|
Log-Analyse und Auswertung: Malware/Windowsupdates zeigen Konfigurationsfehler an und installieren sich nicht mehrWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
10.07.2014, 01:06 | #1 |
| Malware/Windowsupdates zeigen Konfigurationsfehler an und installieren sich nicht mehr Hey, Ich hoffe zunächst das ich hier richtig bin, da ich nicht genau bestimmen kann ob das eine mit dem anderen zusammenhängt oder es ein reines Windowsproblem ist, sollte das der Fall sein, dann bitte ich darum mich an jemand zu leiten der mir da helfen kann (: In letzer Zeit das Gefühl unerwünschte Malware auf meinen Rechner zu haben, zudem habe ich noch ein weiteres Problem und zwar installieren sich meine Windowsupdates nicht mehr obwohl ich die automatische Aktualisierung aktiviert habe, beim runterfahren des Computers werden sie an sich schon installiert doch beim Neustart wird Windows wieder zurückgesetzt, mittlerweile beläuft sich das schon auf 30 Updates. ich würde mich über Hilfe freuen Geändert von Zayanu (10.07.2014 um 01:41 Uhr) |
10.07.2014, 07:10 | #2 |
/// the machine /// TB-Ausbilder | Malware/Windowsupdates zeigen Konfigurationsfehler an und installieren sich nicht mehr hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
10.07.2014, 09:13 | #3 |
| Malware/Windowsupdates zeigen Konfigurationsfehler an und installieren sich nicht mehr FRST:
__________________FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-07-2014 Ran by User (administrator) on NICKY on 10-07-2014 10:06:55 Running from C:\Users\User\Downloads Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG) C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKWCtlx64.exe (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG) C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKService.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKBap64.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (G Data Software AG) C:\Program Files (x86)\G Data\AntiVirus\AVKTray\AVKTray.exe (TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GdBgInx64.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GDKBFltExe32.exe () C:\Users\User\AppData\Roaming\BrowserCompanion\tcbhn.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (TeamSpeak Systems GmbH) C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe (TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\Integrator.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11786344 2011-03-28] (Realtek Semiconductor) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-02-05] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\nvspcap64.dll [1179576 2014-02-05] (NVIDIA Corporation) HKLM-x32\...\Run: [LogitechCommunicationsManager] => C:\Program Files (x86)\Common Files\LogiShrd\LComMgr\Communications_Helper.exe [488984 2007-02-08] (Logitech Inc.) HKLM-x32\...\Run: [LogitechQuickCamRibbon] => C:\Program Files (x86)\Logitech\QuickCam10\QuickCam10.exe [774168 2007-02-08] () HKLM-x32\...\Run: [G Data ASM] => C:\Program Files (x86)\G Data\AntiVirus\DelayLoader\AutorunDelayLoader.exe [431224 2013-12-19] (G Data Software AG) HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files (x86)\G Data\AntiVirus\AVKTray\AVKTray.exe HKU\S-1-5-21-480108453-1788057580-3342198939-1001\...\MountPoints2: {ce2f0baa-24e0-11e2-b2b2-d027886e2e06} - J:\Startme.exe IFEO\pccompanion.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe" IFEO\quickcam10.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe" IFEO\setup.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe" IFEO\skype.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe" IFEO\teamviewer.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe" Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip () Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tcbhn.lnk ShortcutTarget: tcbhn.lnk -> C:\Users\User\AppData\Roaming\BrowserCompanion\tcbhn.exe () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1387301489&from=tugs&uid=ST500DM002-1BD142_Z2A93KJ6XXXXZ2A93KJ6 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387301489&from=tugs&uid=ST500DM002-1BD142_Z2A93KJ6XXXXZ2A93KJ6&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1387301489&from=tugs&uid=ST500DM002-1BD142_Z2A93KJ6XXXXZ2A93KJ6 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1387301489&from=tugs&uid=ST500DM002-1BD142_Z2A93KJ6XXXXZ2A93KJ6 HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1387301489&from=tugs&uid=ST500DM002-1BD142_Z2A93KJ6XXXXZ2A93KJ6&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387301489&from=tugs&uid=ST500DM002-1BD142_Z2A93KJ6XXXXZ2A93KJ6&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1387301489&from=tugs&uid=ST500DM002-1BD142_Z2A93KJ6XXXXZ2A93KJ6 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1387301489&from=tugs&uid=ST500DM002-1BD142_Z2A93KJ6XXXXZ2A93KJ6 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1387301489&from=tugs&uid=ST500DM002-1BD142_Z2A93KJ6XXXXZ2A93KJ6&q={searchTerms} StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.nationzoom.com/?type=sc&ts=1387301489&from=tugs&uid=ST500DM002-1BD142_Z2A93KJ6XXXXZ2A93KJ6 SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387301489&from=tugs&uid=ST500DM002-1BD142_Z2A93KJ6XXXXZ2A93KJ6&q={searchTerms} SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387301489&from=tugs&uid=ST500DM002-1BD142_Z2A93KJ6XXXXZ2A93KJ6&q={searchTerms} SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387301489&from=tugs&uid=ST500DM002-1BD142_Z2A93KJ6XXXXZ2A93KJ6&q={searchTerms} SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387301489&from=tugs&uid=ST500DM002-1BD142_Z2A93KJ6XXXXZ2A93KJ6&q={searchTerms} SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=115284&tt=3512_3&babsrc=SP_ss&mntrId=a295bd15000000000000d027886e2e06 SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387301489&from=tugs&uid=ST500DM002-1BD142_Z2A93KJ6XXXXZ2A93KJ6&q={searchTerms} SearchScopes: HKCU - {506726F0-3180-4815-95A1-DDC96828C0AD} URL = hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p23_serp_ie_de_display?ie=UTF8&tagbase=bds-p23&tbrId=v1_abb-channel-23_96a905ff6b534e98b2b4e31973ba1b36_39_1006_20130323_DE_ie_ds_&tag=bds-p23-serp-de-ie-21&query={searchTerms} SearchScopes: HKCU - {80D19614-39C8-4F5C-B5B1-2A7B20D3F0B3} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^U3&apn_dtid=^OSJ000^YY^DE&apn_uid=3BBD24F9-DB79-480B-85DB-906518028002&apn_sauid=A15E5CCD-DE14-4863-831D-5F385537A112 BHO: Plus-HD-1.3 - {11111111-1111-1111-1111-110311121157} - C:\Program Files (x86)\Plus-HD-1.3\Plus-HD-1.3-bho64.dll (Plus HD) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Plus-HD-1.3 - {11111111-1111-1111-1111-110311121157} - C:\Program Files (x86)\Plus-HD-1.3\Plus-HD-1.3-bho.dll No File BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKCU - No Name - {7E111A5C-3D11-4F56-9463-5310C3C69025} - No File Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll () FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml Chrome: ======= CHR Extension: (Google Docs) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-07-02] CHR Extension: (Google Drive) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-07-02] CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-07-02] CHR Extension: (Google-Suche) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-07-02] CHR Extension: (Google Wallet) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-07-02] CHR Extension: (Google Mail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-07-02] CHR HKLM-x32\...\Chrome\Extension: [bodddioamolcibagionmmobehnbhiakf] - C:\Program Files (x86)\BrowserCompanion\blabbers-ch.crx [2014-07-02] CHR HKLM-x32\...\Chrome\Extension: [ifohbjbgfchkkfhphahclmkpgejiplfo] - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtab.crx [2014-07-02] CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Services (Whitelisted) ================= R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2250360 2014-05-27] (G Data Software AG) R2 AVKService; C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG) R2 AVKWCtl; C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKWCtlx64.exe [2683760 2014-05-20] (G Data Software AG) R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700536 2014-05-20] (G Data Software AG) S4 LVSrvLauncher; C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe [173344 2007-02-06] (Logitech Inc.) U2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-02-05] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16941856 2014-02-05] (NVIDIA Corporation) R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2145080 2014-06-16] (TuneUp Software) ==================== Drivers (Whitelisted) ==================== S3 asmthub3; C:\Windows\System32\DRIVERS\asmthub3.sys [122856 2010-12-08] () [File not signed] S3 asmtxhci; C:\Windows\System32\DRIVERS\asmtxhci.sys [369640 2010-12-08] (ASMedia Technology Inc) [File not signed] R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [55808 2014-07-02] (G Data Software AG) R1 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt64.sys [20992 2014-07-02] (G Data Software AG) R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [142336 2014-07-02] (G Data Software AG) R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [64000 2014-07-02] (G Data Software AG) R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64000 2014-07-02] (G Data Software AG) R1 GRD; C:\Windows\system32\drivers\GRD.sys [106272 2014-05-22] (G Data Software) R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [61440 2014-07-02] (G Data Software AG) S3 LVcKap64; C:\Windows\System32\DRIVERS\LVcKap64.sys [1013024 2007-02-06] (Logitech Inc.) S3 LVMVDrv; C:\Windows\System32\DRIVERS\LVMVDrv.sys [2346016 2007-02-06] (Logitech Inc.) S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2Mon.sys [31520 2007-02-06] () R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation) R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2014-05-27] (TuneUp Software) S3 FXDrv32; \??\D:\FXDrv64.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-07-10 10:06 - 2014-07-10 10:07 - 00016654 _____ () C:\Users\User\Downloads\FRST.txt 2014-07-10 10:06 - 2014-07-10 10:06 - 02084352 _____ (Farbar) C:\Users\User\Downloads\FRST64.exe 2014-07-10 10:06 - 2014-07-10 10:06 - 00000000 ____D () C:\FRST 2014-07-10 01:27 - 2014-07-10 01:29 - 00002260 _____ () C:\Windows\logboot_09.07.2014.tureg.log 2014-07-02 20:29 - 2014-07-10 09:42 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-07-02 20:29 - 2014-07-10 09:30 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-07-02 20:29 - 2014-07-02 20:37 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-07-02 20:29 - 2014-07-02 20:37 - 00003850 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-07-02 20:29 - 2014-07-02 20:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-07-02 20:29 - 2014-07-02 20:29 - 00000000 ____D () C:\Program Files (x86)\Google 2014-07-02 20:26 - 2014-06-16 13:13 - 00043320 _____ (TuneUp Software) C:\Windows\system32\uxtuneup.dll 2014-07-02 20:26 - 2014-06-16 13:13 - 00036152 _____ (TuneUp Software) C:\Windows\SysWOW64\uxtuneup.dll 2014-07-02 19:32 - 2014-07-02 19:32 - 00003704 _____ () C:\Windows\System32\Tasks\Java Update Scheduler 2014-07-02 19:32 - 2014-07-02 19:32 - 00003694 _____ () C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm 2014-07-02 19:18 - 2014-07-02 19:18 - 00002207 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014.lnk 2014-07-02 19:18 - 2014-07-02 19:18 - 00000000 ____D () C:\Users\User\AppData\Roaming\TuneUp Software 2014-07-02 19:18 - 2014-07-02 19:18 - 00000000 ____D () C:\Users\User\AppData\Local\TuneUp Software 2014-07-02 19:18 - 2014-07-02 19:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014 2014-07-02 19:18 - 2014-06-16 13:13 - 00040760 _____ (TuneUp Software) C:\Windows\system32\TURegOpt.exe 2014-07-02 19:18 - 2014-06-16 13:13 - 00029496 _____ (TuneUp Software) C:\Windows\system32\authuitu.dll 2014-07-02 19:18 - 2014-06-16 13:13 - 00025400 _____ (TuneUp Software) C:\Windows\SysWOW64\authuitu.dll 2014-07-02 19:17 - 2014-07-02 19:18 - 00000000 ____D () C:\Program Files (x86)\TuneUp Utilities 2014 2014-07-02 19:15 - 2014-07-02 19:26 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2014-07-02 19:15 - 2014-07-02 19:18 - 00000000 ____D () C:\ProgramData\TuneUp Software 2014-07-02 13:14 - 2014-07-02 13:14 - 03589024 _____ (Blizzard Entertainment) C:\Users\User\Downloads\Diablo-III-Setup-deDE.exe 2014-07-02 12:34 - 2014-07-02 12:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data AntiVirus 2014-07-01 21:08 - 2014-07-01 21:08 - 00000000 ____D () C:\Users\User\Documents\Diablo III 2014-07-01 18:22 - 2014-07-01 18:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III 2014-06-27 15:49 - 2014-06-27 15:49 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-06-13 10:28 - 2014-06-08 11:13 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-06-13 10:28 - 2014-06-08 11:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-06-13 10:24 - 2014-05-24 04:48 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-06-13 10:24 - 2014-05-24 04:47 - 02239488 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-06-13 10:24 - 2014-05-24 04:47 - 01366016 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-06-13 10:24 - 2014-05-24 04:46 - 19290112 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-06-13 10:24 - 2014-05-24 04:46 - 15368704 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-06-13 10:24 - 2014-05-24 04:46 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-06-13 10:24 - 2014-05-24 04:46 - 02650112 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-06-13 10:24 - 2014-05-24 04:46 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2014-06-13 10:24 - 2014-05-24 04:46 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-06-13 10:24 - 2014-05-24 04:46 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-06-13 10:24 - 2014-05-24 04:46 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-06-13 10:24 - 2014-05-24 04:46 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2014-06-13 10:24 - 2014-05-24 04:46 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-06-13 10:24 - 2014-05-24 04:46 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-06-13 10:24 - 2014-05-24 04:46 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-06-13 10:24 - 2014-05-24 04:46 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-06-13 10:24 - 2014-05-24 04:45 - 01508864 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-06-13 10:24 - 2014-05-24 04:45 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-06-13 10:24 - 2014-05-24 04:45 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-06-13 10:24 - 2014-05-24 03:26 - 14365696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-06-13 10:24 - 2014-05-24 03:26 - 01766400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-06-13 10:24 - 2014-05-24 03:26 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-06-13 10:24 - 2014-05-24 03:26 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-06-13 10:24 - 2014-05-24 03:26 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-06-13 10:24 - 2014-05-24 03:26 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-06-13 10:24 - 2014-05-24 03:25 - 13731328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-06-13 10:24 - 2014-05-24 03:25 - 02862080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-06-13 10:24 - 2014-05-24 03:25 - 02050560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-06-13 10:24 - 2014-05-24 03:25 - 01440768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-06-13 10:24 - 2014-05-24 03:25 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2014-06-13 10:24 - 2014-05-24 03:25 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-06-13 10:24 - 2014-05-24 03:25 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-06-13 10:24 - 2014-05-24 03:25 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-06-13 10:24 - 2014-05-24 03:25 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2014-06-13 10:24 - 2014-05-24 03:25 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-06-13 10:24 - 2014-05-24 03:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-06-13 10:24 - 2014-05-24 03:25 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-06-13 10:24 - 2014-05-24 03:09 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-06-13 10:24 - 2014-05-24 03:03 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-06-13 10:24 - 2014-05-24 02:13 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2014-06-13 10:24 - 2014-05-24 02:06 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe ==================== One Month Modified Files and Folders ======= 2014-07-10 10:07 - 2014-07-10 10:06 - 00016654 _____ () C:\Users\User\Downloads\FRST.txt 2014-07-10 10:06 - 2014-07-10 10:06 - 02084352 _____ (Farbar) C:\Users\User\Downloads\FRST64.exe 2014-07-10 10:06 - 2014-07-10 10:06 - 00000000 ____D () C:\FRST 2014-07-10 10:05 - 2011-04-26 11:46 - 01580162 _____ () C:\Windows\WindowsUpdate.log 2014-07-10 10:01 - 2009-07-14 06:45 - 00021856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-07-10 10:01 - 2009-07-14 06:45 - 00021856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-07-10 09:52 - 2012-04-11 19:33 - 00000000 ____D () C:\Users\User\AppData\Roaming\TS3Client 2014-07-10 09:42 - 2014-07-02 20:29 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-07-10 09:32 - 2012-04-11 21:08 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-07-10 09:30 - 2014-07-02 20:29 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-07-10 09:30 - 2012-09-01 16:09 - 00000000 ____D () C:\Users\User\AppData\Roaming\BrowserCompanion 2014-07-10 09:29 - 2011-04-26 15:12 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-07-10 09:29 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-07-10 09:29 - 2009-07-14 06:51 - 00152676 _____ () C:\Windows\setupact.log 2014-07-10 03:04 - 2013-08-14 02:10 - 00000000 ____D () C:\Windows\system32\MRT 2014-07-10 03:03 - 2011-04-27 14:12 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-07-10 01:29 - 2014-07-10 01:27 - 00002260 _____ () C:\Windows\logboot_09.07.2014.tureg.log 2014-07-10 01:29 - 2009-07-14 04:34 - 62652416 _____ () C:\Windows\system32\config\SOFTWARE_tureg_old 2014-07-10 01:29 - 2009-07-14 04:34 - 38273024 _____ () C:\Windows\system32\config\SYSTEM_tureg_old 2014-07-10 01:29 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\SECURITY_tureg_old 2014-07-10 01:26 - 2009-07-14 04:34 - 01048576 _____ () C:\Windows\system32\config\DEFAULT_tureg_old 2014-07-10 01:26 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\SAM_tureg_old 2014-07-10 01:25 - 2014-01-27 17:31 - 00000000 ____D () C:\Users\User\AppData\Local\Battle.net 2014-07-10 00:09 - 2014-01-27 17:31 - 00000000 ____D () C:\Program Files (x86)\Battle.net 2014-07-09 03:09 - 2013-11-12 16:07 - 00925967 _____ () C:\Windows\IE11_main.log 2014-07-08 22:32 - 2012-04-11 21:08 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-07-08 22:32 - 2012-04-11 21:08 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-07-08 22:32 - 2012-04-11 21:08 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-07-08 03:25 - 2010-11-21 05:47 - 00347720 _____ () C:\Windows\PFRO.log 2014-07-03 22:41 - 2011-09-06 16:57 - 00000000 ____D () C:\Users\User\AppData\Local\VirtualStore 2014-07-02 20:37 - 2014-07-02 20:29 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-07-02 20:37 - 2014-07-02 20:29 - 00003850 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-07-02 20:34 - 2013-03-23 23:13 - 00000000 ____D () C:\Users\User\Desktop\Zeugs 2014-07-02 20:29 - 2014-07-02 20:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-07-02 20:29 - 2014-07-02 20:29 - 00000000 ____D () C:\Program Files (x86)\Google 2014-07-02 20:29 - 2012-09-09 04:27 - 00000000 ____D () C:\Users\User\AppData\Local\Google 2014-07-02 19:32 - 2014-07-02 19:32 - 00003704 _____ () C:\Windows\System32\Tasks\Java Update Scheduler 2014-07-02 19:32 - 2014-07-02 19:32 - 00003694 _____ () C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm 2014-07-02 19:26 - 2014-07-02 19:15 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2014-07-02 19:23 - 2011-04-26 14:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XnView 2014-07-02 19:18 - 2014-07-02 19:18 - 00002207 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014.lnk 2014-07-02 19:18 - 2014-07-02 19:18 - 00000000 ____D () C:\Users\User\AppData\Roaming\TuneUp Software 2014-07-02 19:18 - 2014-07-02 19:18 - 00000000 ____D () C:\Users\User\AppData\Local\TuneUp Software 2014-07-02 19:18 - 2014-07-02 19:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014 2014-07-02 19:18 - 2014-07-02 19:17 - 00000000 ____D () C:\Program Files (x86)\TuneUp Utilities 2014 2014-07-02 19:18 - 2014-07-02 19:15 - 00000000 ____D () C:\ProgramData\TuneUp Software 2014-07-02 19:05 - 2013-03-14 04:00 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-07-02 13:14 - 2014-07-02 13:14 - 03589024 _____ (Blizzard Entertainment) C:\Users\User\Downloads\Diablo-III-Setup-deDE.exe 2014-07-02 13:13 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF 2014-07-02 12:40 - 2012-04-12 09:24 - 00000000 ____D () C:\Users\User\AppData\Local\Deployment 2014-07-02 12:34 - 2014-07-02 12:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data AntiVirus 2014-07-02 12:34 - 2014-04-10 12:25 - 00020992 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBFlt64.sys 2014-07-02 12:34 - 2014-03-10 12:28 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys 2014-07-02 12:34 - 2014-03-10 12:26 - 00061440 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys 2014-07-02 12:33 - 2014-03-10 12:26 - 00142336 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys 2014-07-02 12:33 - 2014-03-10 12:26 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys 2014-07-02 12:33 - 2014-03-10 12:25 - 00055808 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys 2014-07-02 12:32 - 2011-05-05 16:41 - 00322272 _____ () C:\Windows\DPINST.LOG 2014-07-01 21:08 - 2014-07-01 21:08 - 00000000 ____D () C:\Users\User\Documents\Diablo III 2014-07-01 18:22 - 2014-07-01 18:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III 2014-07-01 18:15 - 2014-01-27 17:34 - 00000000 ____D () C:\Program Files (x86)\Hearthstone 2014-06-27 15:49 - 2014-06-27 15:49 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-06-25 10:26 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-06-24 21:00 - 2012-04-11 19:08 - 00000000 ____D () C:\Program Files (x86)\TeamSpeak 3 Client 2014-06-18 09:58 - 2012-04-11 19:37 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft 2014-06-16 13:13 - 2014-07-02 20:26 - 00043320 _____ (TuneUp Software) C:\Windows\system32\uxtuneup.dll 2014-06-16 13:13 - 2014-07-02 20:26 - 00036152 _____ (TuneUp Software) C:\Windows\SysWOW64\uxtuneup.dll 2014-06-16 13:13 - 2014-07-02 19:18 - 00040760 _____ (TuneUp Software) C:\Windows\system32\TURegOpt.exe 2014-06-16 13:13 - 2014-07-02 19:18 - 00029496 _____ (TuneUp Software) C:\Windows\system32\authuitu.dll 2014-06-16 13:13 - 2014-07-02 19:18 - 00025400 _____ (TuneUp Software) C:\Windows\SysWOW64\authuitu.dll 2014-06-11 23:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-06-11 23:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared 2014-06-11 23:21 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration Files to move or delete: ==================== C:\Users\Public\AlexaNSISPlugin.4424.dll Some content of TEMP: ==================== C:\Users\User\AppData\Local\Temp\avgnt.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-07-10 04:06 ==================== End Of Log ============================ Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 09-07-2014 Ran by User at 2014-07-10 10:07:52 Running from C:\Users\User\Downloads Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: G Data AntiVirus (Enabled - Up to date) {545C8713-0744-B079-87F8-349A6D5C8CF0} AS: G Data AntiVirus (Enabled - Up to date) {EF3D66F7-217E-BFF7-BD48-0FE816DBC64D} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== 7-Zip 9.22 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0922-000001000000}) (Version: 9.22.00.0 - Igor Pavlov) Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated) Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated) Adobe Reader X (10.1.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.10 - Adobe Systems Incorporated) AMD APP SDK Runtime (Version: 2.4.595.9 - Advanced Micro Devices Inc.) Hidden AMD Drag and Drop Transcoding (Version: 2.00.0000 - ATI Technologies Inc.) Hidden ATI Catalyst Install Manager (HKLM\...\{47B188E2-2447-5C40-15B6-9D49DC90BF5B}) (Version: 3.0.816.0 - ATI Technologies, Inc.) Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment) Catalyst Control Center InstallProxy (x32 Version: 2011.0308.2325.42017 - ATI Technologies, Inc.) Hidden CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.3.8.2523 - CDBurnerXP) Curse Client (HKCU\...\101a9f93b8f0bb6f) (Version: 5.1.1.810 - Curse) D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden Diablo III (HKLM-x32\...\Diablo III) (Version: - Blizzard Entertainment) G Data AntiVirus (HKLM-x32\...\{B9FC0A7D-FA1D-4347-ABED-AD8AD5305633}) (Version: 25.0.1.4 - G Data Software AG) GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden Google Chrome (HKLM-x32\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.) Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment) Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.550 - Oracle) Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation) Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Logitech Audio Echo Cancellation Component for 64-bit Windows (Version: 10.51.2027 - Logitech Inc.) Hidden Logitech QuickCam (HKLM\...\{192E85C6-2B8A-4217-AD30-ECA5CE19DB23}) (Version: 10.51.2029 - Logitech Inc.) Logitech Video Enumerator (x32 Version: 10.51.2027 - Logitech Inc.) Hidden Logitech® Camera-Treiber (HKLM-x32\...\QcDrv) (Version: - ) Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation) Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation) Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) MVisn64 (Version: 10.51.2027 - Logitech Inc.) Hidden NVIDIA 3D Vision Controller Driver (x32 Version: 270.61 - NVIDIA Corporation) Hidden NVIDIA 3D Vision Controller-Treiber 335.21 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 335.21 - NVIDIA Corporation) NVIDIA 3D Vision Treiber 335.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 335.23 - NVIDIA Corporation) NVIDIA GeForce Experience 1.8.2.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.2.1 - NVIDIA Corporation) NVIDIA Grafiktreiber 335.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 335.23 - NVIDIA Corporation) NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation) NVIDIA Install Application (Version: 2.1002.147.1067 - NVIDIA Corporation) Hidden NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden NVIDIA PhysX (x32 Version: 9.13.1220 - NVIDIA Corporation) Hidden NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation) NVIDIA ShadowPlay 11.10.13 (Version: 11.10.13 - NVIDIA Corporation) Hidden NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3523 - NVIDIA Corporation) Hidden NVIDIA Systemsteuerung 335.23 (Version: 335.23 - NVIDIA Corporation) Hidden NVIDIA Update 11.10.13 (Version: 11.10.13 - NVIDIA Corporation) Hidden NVIDIA Update Core (Version: 11.10.13 - NVIDIA Corporation) Hidden NVIDIA Virtual Audio 1.2.20 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.20 - NVIDIA Corporation) Ravensburger tiptoi (HKLM-x32\...\Ravensburger tiptoi) (Version: - ) Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.43.321.2011 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6343 - Realtek Semiconductor Corp.) SHIELD Streaming (Version: 1.7.321 - NVIDIA Corporation) Hidden Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.) Sony Mobile Update Engine (HKLM-x32\...\Update Engine) (Version: 2.14.7.201405202226 - Sony Mobile Communications AB) Sony PC Companion 2.10.197 (HKLM-x32\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.197 - Sony) TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.15 - TeamSpeak Systems GmbH) TeamViewer 7 (HKLM-x32\...\TeamViewer 7) (Version: 7.0.13852 - TeamViewer) TuneUp Utilities 2014 (de-DE) (x32 Version: 14.0.1000.324 - TuneUp Software) Hidden TuneUp Utilities 2014 (HKLM-x32\...\TuneUp Utilities) (Version: 14.0.1000.324 - TuneUp Software) TuneUp Utilities 2014 (x32 Version: 14.0.1000.324 - TuneUp Software) Hidden WildStar (HKLM-x32\...\WildStar) (Version: - NCSOFT) Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation) Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Family Safety (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Language Selector (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation) Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Messenger Companion Core (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live PIMT Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live UX Platform Language Pack (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden WinRAR 4.11 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.11.0 - win.rar GmbH) WMV9/VC-1 Video Playback (Version: 1.00.0000 - ATI Technologies Inc.) Hidden World of Warcraft (HKLM-x32\...\World of Warcraft) (Version: - Blizzard Entertainment) XnView 1.97.8 (HKLM-x32\...\XnView_is1) (Version: 1.97.8 - Gougelet Pierre-e) ==================== Restore Points ========================= ==================== Hosts content: ========================== 2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {3D2820F4-988D-4B92-811B-07F93F503DBE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-07-02] (Google Inc.) Task: {4E613C76-4501-4ADD-ACFE-8FBC9D105BA7} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation) Task: {5F983C22-7A2C-4E59-ABF0-B090185308B6} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup Task: {B53A4B8A-BCED-41D0-ABEB-80281E0421FB} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-07-02] (Google Inc.) Task: {BC306E47-F23A-4BF1-93D4-64DB25E13A7B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-08] (Adobe Systems Incorporated) Task: {D8B80CD2-F900-455C-ADC8-B514EEE2A02C} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21] (Adobe Systems Incorporated) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2011-04-07 23:19 - 2014-03-04 15:05 - 00116056 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll 2014-06-16 13:14 - 2014-06-16 13:14 - 00699704 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\avgrepliba.dll 2014-05-20 03:38 - 2014-05-20 03:38 - 00340088 ____N () C:\Program Files (x86)\Common Files\G Data\AVKProxy\PktIcpt2x64.dll 2012-06-28 14:50 - 2012-06-28 14:50 - 00695448 _____ () C:\Users\User\AppData\Roaming\BrowserCompanion\tcbhn.exe 2014-03-14 14:32 - 2014-03-14 14:32 - 00148480 _____ () C:\Program Files (x86)\TeamSpeak 3 Client\quazip.dll 2014-03-14 14:32 - 2014-03-14 14:32 - 00864768 _____ () C:\Program Files (x86)\TeamSpeak 3 Client\platforms\qwindows.dll 2014-03-14 14:32 - 2014-03-14 14:32 - 00677376 _____ () C:\Program Files (x86)\TeamSpeak 3 Client\sqldrivers\qsqlite.dll 2012-02-15 12:33 - 2014-06-24 21:00 - 00092104 _____ () C:\Program Files (x86)\TeamSpeak 3 Client\soundbackends\directsound_win32.dll 2012-02-15 12:33 - 2014-06-24 21:00 - 00105416 _____ () C:\Program Files (x86)\TeamSpeak 3 Client\soundbackends\windowsaudiosession_win32.dll 2014-03-14 14:32 - 2014-03-14 14:32 - 00025600 _____ () C:\Program Files (x86)\TeamSpeak 3 Client\imageformats\qgif.dll 2014-03-14 14:32 - 2014-03-14 14:32 - 00242688 _____ () C:\Program Files (x86)\TeamSpeak 3 Client\imageformats\qjpeg.dll 2012-02-15 12:33 - 2014-06-24 21:00 - 00477128 _____ () C:\Program Files (x86)\TeamSpeak 3 Client\plugins\clientquery_plugin.dll 2013-09-09 22:28 - 2014-06-24 21:00 - 00483784 _____ () C:\Program Files (x86)\TeamSpeak 3 Client\plugins\teamspeak_control_plugin.dll 2014-03-14 14:32 - 2014-03-14 14:32 - 00123904 _____ () C:\Program Files (x86)\TeamSpeak 3 Client\accessible\qtaccessiblewidgets.dll 2014-06-16 13:09 - 2014-06-16 13:09 - 00611128 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\TUKernel.bpl 2014-06-16 13:09 - 2014-06-16 13:09 - 00152888 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\TUBasic.bpl 2014-06-16 13:10 - 2014-06-16 13:10 - 00820024 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\MainControls.bpl 2014-06-16 13:09 - 2014-06-16 13:09 - 00119096 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\TUTransl.bpl 2014-06-16 13:09 - 2014-06-16 13:09 - 00161080 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\PerlRegEx.bpl 2014-06-16 13:09 - 2014-06-16 13:09 - 00210744 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\XMLComponents.bpl 2014-06-16 13:09 - 2014-06-16 13:09 - 00449848 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\GR32_D6.bpl 2014-06-16 13:09 - 2014-06-16 13:09 - 00129336 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\SchedAgent_2007.bpl 2014-06-16 13:09 - 2014-06-16 13:09 - 00335672 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\TUCompression.bpl 2014-06-16 13:09 - 2014-06-16 13:09 - 00307000 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\DEC.bpl 2014-06-16 13:10 - 2014-06-16 13:10 - 00493368 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\Html.bpl 2014-06-16 13:09 - 2014-06-16 13:09 - 00307000 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\ntrtl60.bpl 2014-06-16 13:10 - 2014-06-16 13:10 - 00278840 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\AppInitialization.bpl 2014-06-16 13:09 - 2014-06-16 13:09 - 00033080 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\TUBase.bpl 2014-06-16 13:10 - 2014-06-16 13:10 - 00215864 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\ProgramRating.bpl 2014-06-16 13:10 - 2014-06-16 13:10 - 00423224 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\VisControls.bpl 2014-06-16 13:10 - 2014-06-16 13:10 - 01145144 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\dxBarD12.bpl 2014-06-16 13:10 - 2014-06-16 13:10 - 00044856 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\dxCoreD12.bpl 2014-06-16 13:10 - 2014-06-16 13:10 - 00016184 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\dxComnD12.bpl 2014-06-16 13:10 - 2014-06-16 13:10 - 00055608 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\dxThemeD12.bpl 2014-06-16 13:10 - 2014-06-16 13:10 - 00852280 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\cxLibraryD12.bpl 2014-06-16 13:10 - 2014-06-16 13:10 - 00069944 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\dxGDIPlusD12.bpl 2014-06-16 13:10 - 2014-06-16 13:10 - 00068408 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\SysControls.bpl 2014-06-16 13:10 - 2014-06-16 13:10 - 00144184 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\TUIcoEngineerDirTree.bpl 2014-06-16 13:09 - 2014-06-16 13:09 - 00076600 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\TUShell.bpl 2014-06-16 13:10 - 2014-06-16 13:10 - 00154424 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\cefcomponent.bpl 2014-06-16 13:10 - 2014-06-16 13:10 - 00107320 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\TUShredder.bpl 2014-06-16 13:10 - 2014-06-16 13:10 - 00470328 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\SysInfo.bpl 2014-06-16 13:10 - 2014-06-16 13:10 - 00656184 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\MSI_D6.bpl 2014-06-16 13:11 - 2014-06-16 13:11 - 00458040 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\PowerManager.bpl 2014-06-16 13:11 - 2014-06-16 13:11 - 00632632 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\TUDiskCleanerClass.bpl 2014-06-16 13:10 - 2014-06-16 13:10 - 00092984 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\TUApps.bpl 2014-06-16 13:09 - 2014-06-16 13:09 - 00042808 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\TURar.bpl 2014-06-16 13:10 - 2014-06-16 13:10 - 00489272 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\Traces.bpl 2014-06-16 13:10 - 2014-06-16 13:10 - 00083256 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\TUOperaClass.bpl 2014-06-16 13:10 - 2014-06-16 13:10 - 00047928 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\TUApplications.bpl 2014-06-16 13:10 - 2014-06-16 13:10 - 00042808 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\TUSafariClass.bpl 2014-06-16 13:11 - 2014-06-16 13:11 - 00140088 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\CommonForms.bpl 2014-06-16 13:10 - 2014-06-16 13:10 - 00609080 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\VirtualTreesR.bpl 2014-06-16 13:10 - 2014-06-16 13:10 - 00065848 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\TUIECacheClass.bpl 2014-06-16 13:11 - 2014-06-16 13:11 - 00962872 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\TuningWizard.bpl 2014-06-16 13:10 - 2014-06-16 13:10 - 00107320 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\Internet.bpl 2014-06-16 13:10 - 2014-06-16 13:10 - 00207672 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\dxBarExtItemsD12.bpl 2014-06-16 13:10 - 2014-06-16 13:10 - 00809272 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\dxSkinsCoreD12.bpl 2014-06-16 13:10 - 2014-06-16 13:10 - 00329016 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\dxDockingD12.bpl 2014-06-16 13:10 - 2014-06-16 13:10 - 00928056 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\dxRibbonD12.bpl 2014-05-27 14:03 - 2014-05-27 14:03 - 13417496 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\libcef.dll 2014-07-02 20:29 - 2014-06-05 15:58 - 00716616 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\libglesv2.dll 2014-07-02 20:29 - 2014-06-05 15:58 - 00126280 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\libegl.dll 2014-07-02 20:29 - 2014-06-05 15:58 - 04217672 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\pdf.dll 2014-07-02 20:29 - 2014-06-05 15:58 - 00414536 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll 2014-07-02 20:29 - 2014-06-05 15:58 - 01732424 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ffmpegsumo.dll 2014-07-02 20:29 - 2014-06-05 15:58 - 14612296 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\PepperFlash\pepflashplayer.dll ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== ==================== EXE Association (whitelisted) ============= ==================== MSCONFIG/TASK MANAGER disabled items ========= ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (07/10/2014 10:07:53 AM) (Source: VSS) (EventID: 12292) (User: ) Description: Volumeschattenkopie-Dienstfehler: Beim Erstellen der Schattenkopieanbieter-COM-Klasse mit CLSID {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} [0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden. ] ist ein Fehler aufgetreten. Vorgang: Für diesen Anbieter eine aufrufbare Schnittstelle abrufen Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen Schattenkopien abfragen Kontext: Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5} Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} Snapshotkontext: 13 Snapshotkontext: 13 Ausführungskontext: Coordinator Error: (07/10/2014 10:07:53 AM) (Source: VSS) (EventID: 13) (User: ) Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} und dem Namen "SW_PROV" kann nicht gestartet werden. [0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden. ] Vorgang: Für diesen Anbieter eine aufrufbare Schnittstelle abrufen Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen Schattenkopien abfragen Kontext: Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5} Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} Snapshotkontext: 13 Snapshotkontext: 13 Ausführungskontext: Coordinator Error: (07/10/2014 10:05:23 AM) (Source: VSS) (EventID: 12292) (User: ) Description: Volumeschattenkopie-Dienstfehler: Beim Erstellen der Schattenkopieanbieter-COM-Klasse mit CLSID {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} [0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden. ] ist ein Fehler aufgetreten. Vorgang: Für diesen Anbieter eine aufrufbare Schnittstelle abrufen Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen Schattenkopien abfragen Kontext: Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5} Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} Snapshotkontext: 13 Snapshotkontext: 13 Ausführungskontext: Coordinator Error: (07/10/2014 10:05:23 AM) (Source: VSS) (EventID: 13) (User: ) Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} und dem Namen "SW_PROV" kann nicht gestartet werden. [0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden. ] Vorgang: Für diesen Anbieter eine aufrufbare Schnittstelle abrufen Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen Schattenkopien abfragen Kontext: Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5} Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} Snapshotkontext: 13 Snapshotkontext: 13 Ausführungskontext: Coordinator Error: (07/10/2014 10:03:41 AM) (Source: VSS) (EventID: 12292) (User: ) Description: Volumeschattenkopie-Dienstfehler: Beim Erstellen der Schattenkopieanbieter-COM-Klasse mit CLSID {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} [0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden. ] ist ein Fehler aufgetreten. Vorgang: Für diesen Anbieter eine aufrufbare Schnittstelle abrufen Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen Schattenkopien abfragen Kontext: Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5} Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} Snapshotkontext: 13 Snapshotkontext: 13 Ausführungskontext: Coordinator Error: (07/10/2014 10:03:41 AM) (Source: VSS) (EventID: 13) (User: ) Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} und dem Namen "SW_PROV" kann nicht gestartet werden. [0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden. ] Vorgang: Für diesen Anbieter eine aufrufbare Schnittstelle abrufen Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen Schattenkopien abfragen Kontext: Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5} Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} Snapshotkontext: 13 Snapshotkontext: 13 Ausführungskontext: Coordinator Error: (07/10/2014 10:01:22 AM) (Source: VSS) (EventID: 12292) (User: ) Description: Volumeschattenkopie-Dienstfehler: Beim Erstellen der Schattenkopieanbieter-COM-Klasse mit CLSID {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} [0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden. ] ist ein Fehler aufgetreten. Vorgang: Für diesen Anbieter eine aufrufbare Schnittstelle abrufen Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen Schattenkopien abfragen Kontext: Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5} Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} Snapshotkontext: 13 Snapshotkontext: 13 Ausführungskontext: Coordinator Error: (07/10/2014 10:01:22 AM) (Source: VSS) (EventID: 13) (User: ) Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} und dem Namen "SW_PROV" kann nicht gestartet werden. [0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden. ] Vorgang: Für diesen Anbieter eine aufrufbare Schnittstelle abrufen Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen Schattenkopien abfragen Kontext: Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5} Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} Snapshotkontext: 13 Snapshotkontext: 13 Ausführungskontext: Coordinator Error: (07/10/2014 09:57:34 AM) (Source: VSS) (EventID: 12292) (User: ) Description: Volumeschattenkopie-Dienstfehler: Beim Erstellen der Schattenkopieanbieter-COM-Klasse mit CLSID {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} [0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden. ] ist ein Fehler aufgetreten. Vorgang: Für diesen Anbieter eine aufrufbare Schnittstelle abrufen Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen Schattenkopien abfragen Kontext: Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5} Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} Snapshotkontext: 13 Snapshotkontext: 13 Ausführungskontext: Coordinator Error: (07/10/2014 09:57:34 AM) (Source: VSS) (EventID: 13) (User: ) Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} und dem Namen "SW_PROV" kann nicht gestartet werden. [0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden. ] Vorgang: Für diesen Anbieter eine aufrufbare Schnittstelle abrufen Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen Schattenkopien abfragen Kontext: Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5} Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} Snapshotkontext: 13 Snapshotkontext: 13 Ausführungskontext: Coordinator System errors: ============= Error: (07/10/2014 09:31:25 AM) (Source: WMPNetworkSvc) (EventID: 14332) (User: ) Description: WMPNetworkSvc0x80070422 Error: (07/10/2014 09:31:23 AM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuchanbieter-Host" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1058 Error: (07/10/2014 09:29:44 AM) (Source: EventLog) (EventID: 6008) (User: ) Description: Das System wurde zuvor am 10.07.2014 um 06:43:52 unerwartet heruntergefahren. Error: (07/10/2014 03:42:08 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT) Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070002 fehlgeschlagen: Sicherheitsupdate für Windows 7 für x64-basierte Systeme (KB2973351) Error: (07/10/2014 03:42:08 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT) Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070002 fehlgeschlagen: Update für Windows 7 für x64-basierte Systeme (KB2973337) Error: (07/10/2014 03:42:08 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT) Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070002 fehlgeschlagen: Sicherheitsupdate für Windows 7 für x64-basierte Systeme (KB2871997) Error: (07/10/2014 03:42:08 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT) Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070002 fehlgeschlagen: Kumulatives Sicherheitsupdate für Internet Explorer 10 unter Windows 7 Service Pack 1 für x64-basierte Systeme (KB2962872) Error: (07/10/2014 03:42:08 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT) Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070002 fehlgeschlagen: Sicherheitsupdate für Windows 7 für x64-basierte Systeme (KB2961072) Error: (07/10/2014 03:42:08 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT) Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070002 fehlgeschlagen: Sicherheitsupdate für Windows 7 für x64-basierte Systeme (KB2972280) Error: (07/10/2014 03:42:08 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT) Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070002 fehlgeschlagen: Sicherheitsupdate für Windows 7 für x64-basierte Systeme (KB2862330) Microsoft Office Sessions: ========================= Error: (07/10/2014 10:07:53 AM) (Source: VSS) (EventID: 12292) (User: ) Description: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden. Vorgang: Für diesen Anbieter eine aufrufbare Schnittstelle abrufen Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen Schattenkopien abfragen Kontext: Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5} Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} Snapshotkontext: 13 Snapshotkontext: 13 Ausführungskontext: Coordinator Error: (07/10/2014 10:07:53 AM) (Source: VSS) (EventID: 13) (User: ) Description: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}SW_PROV0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden. Vorgang: Für diesen Anbieter eine aufrufbare Schnittstelle abrufen Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen Schattenkopien abfragen Kontext: Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5} Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} Snapshotkontext: 13 Snapshotkontext: 13 Ausführungskontext: Coordinator Error: (07/10/2014 10:05:23 AM) (Source: VSS) (EventID: 12292) (User: ) Description: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden. Vorgang: Für diesen Anbieter eine aufrufbare Schnittstelle abrufen Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen Schattenkopien abfragen Kontext: Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5} Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} Snapshotkontext: 13 Snapshotkontext: 13 Ausführungskontext: Coordinator Error: (07/10/2014 10:05:23 AM) (Source: VSS) (EventID: 13) (User: ) Description: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}SW_PROV0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden. Vorgang: Für diesen Anbieter eine aufrufbare Schnittstelle abrufen Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen Schattenkopien abfragen Kontext: Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5} Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} Snapshotkontext: 13 Snapshotkontext: 13 Ausführungskontext: Coordinator Error: (07/10/2014 10:03:41 AM) (Source: VSS) (EventID: 12292) (User: ) Description: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden. Vorgang: Für diesen Anbieter eine aufrufbare Schnittstelle abrufen Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen Schattenkopien abfragen Kontext: Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5} Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} Snapshotkontext: 13 Snapshotkontext: 13 Ausführungskontext: Coordinator Error: (07/10/2014 10:03:41 AM) (Source: VSS) (EventID: 13) (User: ) Description: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}SW_PROV0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden. Vorgang: Für diesen Anbieter eine aufrufbare Schnittstelle abrufen Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen Schattenkopien abfragen Kontext: Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5} Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} Snapshotkontext: 13 Snapshotkontext: 13 Ausführungskontext: Coordinator Error: (07/10/2014 10:01:22 AM) (Source: VSS) (EventID: 12292) (User: ) Description: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden. Vorgang: Für diesen Anbieter eine aufrufbare Schnittstelle abrufen Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen Schattenkopien abfragen Kontext: Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5} Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} Snapshotkontext: 13 Snapshotkontext: 13 Ausführungskontext: Coordinator Error: (07/10/2014 10:01:22 AM) (Source: VSS) (EventID: 13) (User: ) Description: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}SW_PROV0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden. Vorgang: Für diesen Anbieter eine aufrufbare Schnittstelle abrufen Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen Schattenkopien abfragen Kontext: Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5} Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} Snapshotkontext: 13 Snapshotkontext: 13 Ausführungskontext: Coordinator Error: (07/10/2014 09:57:34 AM) (Source: VSS) (EventID: 12292) (User: ) Description: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden. Vorgang: Für diesen Anbieter eine aufrufbare Schnittstelle abrufen Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen Schattenkopien abfragen Kontext: Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5} Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} Snapshotkontext: 13 Snapshotkontext: 13 Ausführungskontext: Coordinator Error: (07/10/2014 09:57:34 AM) (Source: VSS) (EventID: 13) (User: ) Description: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}SW_PROV0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden. Vorgang: Für diesen Anbieter eine aufrufbare Schnittstelle abrufen Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen Schattenkopien abfragen Kontext: Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5} Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} Snapshotkontext: 13 Snapshotkontext: 13 Ausführungskontext: Coordinator ==================== Memory info =========================== Percentage of memory in use: 43% Total physical RAM: 6107.79 MB Available physical RAM: 3463.04 MB Total Pagefile: 12213.77 MB Available Pagefile: 9225.86 MB Total Virtual: 8192 MB Available Virtual: 8191.81 MB ==================== Drives ================================ Drive c: (System) (Fixed) (Total:100.01 GB) (Free:13.91 GB) NTFS Drive e: (Daten) (Fixed) (Total:365.65 GB) (Free:100.64 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: EE29F579) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=100 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=366 GB) - (Type=07 NTFS) ==================== End Of Log ============================ |
11.07.2014, 08:22 | #4 |
/// the machine /// TB-Ausbilder | Malware/Windowsupdates zeigen Konfigurationsfehler an und installieren sich nicht mehr Downloade Dir bitte Malwarebytes Anti-Malware
Downloade Dir bitte AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
22.07.2014, 20:30 | #5 |
| Malware/Windowsupdates zeigen Konfigurationsfehler an und installieren sich nicht mehr Nachdem ich lange Zeit verhindert war nun die gewünschten Angaben (; Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 22.07.2014 Suchlauf-Zeit: 09:00:14 Logdatei: mbam.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.07.22.01 Rootkit Datenbank: v2014.07.17.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: User Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 283990 Verstrichene Zeit: 15 Min, 31 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 0 (No malicious items detected) Physische Sektoren: 0 (No malicious items detected) (end) Code:
ATTFilter Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\bodddioamolcibagionmmobehnbhiakf Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\biclient_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\biclient_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_installer_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_installer_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B3B3A6AC-74EC-BD56-BCDB-EFA4799FB9DF} Schlüssel Gelöscht : HKCU\Software\Alexa Internet Schlüssel Gelöscht : HKCU\Software\BrowserCompanion Schlüssel Gelöscht : HKCU\Software\distromatic Schlüssel Gelöscht : HKCU\Software\IM Schlüssel Gelöscht : HKCU\Software\ImInstaller Schlüssel Gelöscht : HKCU\Software\OCS Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F} Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Re_Markit Schlüssel Gelöscht : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0} Schlüssel Gelöscht : HKLM\Software\{6791A2F3-FC80-475C-A002-C014AF797E9C} Schlüssel Gelöscht : HKLM\Software\Babylon Schlüssel Gelöscht : HKLM\Software\Conduit Schlüssel Gelöscht : HKLM\Software\supWPM Schlüssel Gelöscht : HKLM\Software\systweak Schlüssel Gelöscht : HKLM\Software\Uniblue ***** [ Browser ] ***** -\\ Internet Explorer v10.0.9200.16921 -\\ Google Chrome v36.0.1985.125 [ Datei : C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\preferences ] ************************* AdwCleaner[R0].txt - [5943 octets] - [22/07/2014 09:22:39] AdwCleaner[R1].txt - [6003 octets] - [22/07/2014 20:28:44] AdwCleaner[S0].txt - [5181 octets] - [22/07/2014 21:00:15] ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5241 octets] ########## Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.1.4 (04.06.2014:1) OS: Windows 7 Home Premium x64 Ran by User on 22.07.2014 at 21:13:36,47 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{80D19614-39C8-4F5C-B5B1-2A7B20D3F0B3} ~~~ Files ~~~ Folders Failed to delete: [Folder] "C:\ai_recyclebin" Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin" ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 22.07.2014 at 21:24:11,24 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-07-2014 Ran by User (administrator) on NICKY on 22-07-2014 21:25:21 Running from C:\Users\User\Downloads Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG) C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKWCtlx64.exe (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG) C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKService.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (G Data Software AG) C:\Program Files (x86)\G Data\AntiVirus\AVKTray\AVKTray.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GdBgInx64.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GDKBFltExe32.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKBap64.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GDKBFltSur64.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11786344 2011-03-28] (Realtek Semiconductor) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-02-05] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM-x32\...\Run: [LogitechCommunicationsManager] => C:\Program Files (x86)\Common Files\LogiShrd\LComMgr\Communications_Helper.exe [488984 2007-02-08] (Logitech Inc.) HKLM-x32\...\Run: [LogitechQuickCamRibbon] => C:\Program Files (x86)\Logitech\QuickCam10\QuickCam10.exe [774168 2007-02-08] () HKLM-x32\...\Run: [G Data ASM] => C:\Program Files (x86)\G Data\AntiVirus\DelayLoader\AutorunDelayLoader.exe [431224 2013-12-19] (G Data Software AG) HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files (x86)\G Data\AntiVirus\AVKTray\AVKTray.exe, HKU\S-1-5-19\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation) HKU\S-1-5-20\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation) HKU\S-1-5-21-480108453-1788057580-3342198939-1001\...\MountPoints2: {ce2f0baa-24e0-11e2-b2b2-d027886e2e06} - J:\Startme.exe IFEO\pccompanion.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe" IFEO\quickcam10.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe" IFEO\setup.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe" IFEO\skype.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe" IFEO\teamviewer.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe" Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com StartMenuInternet: IEXPLORE.EXE - iexplore.exe SearchScopes: HKLM-x32 - DefaultScope value is missing. SearchScopes: HKCU - {506726F0-3180-4815-95A1-DDC96828C0AD} URL = hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p23_serp_ie_de_display?ie=UTF8&tagbase=bds-p23&tbrId=v1_abb-channel-23_96a905ff6b534e98b2b4e31973ba1b36_39_1006_20130323_DE_ie_ds_&tag=bds-p23-serp-de-ie-21&query={searchTerms} BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKCU - No Name - {7E111A5C-3D11-4F56-9463-5310C3C69025} - No File DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll () FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) Chrome: ======= CHR HomePage: CHR Extension: (Google Docs) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-07-02] CHR Extension: (Google Drive) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-07-02] CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-07-02] CHR Extension: (Google-Suche) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-07-02] CHR Extension: (Google Wallet) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-07-02] CHR Extension: (Google Mail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-07-02] CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Services (Whitelisted) ================= R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2250360 2014-05-27] (G Data Software AG) R2 AVKService; C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG) R2 AVKWCtl; C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKWCtlx64.exe [2683760 2014-05-20] (G Data Software AG) R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700536 2014-05-20] (G Data Software AG) S4 LVSrvLauncher; C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe [173344 2007-02-06] (Logitech Inc.) U2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-02-05] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16941856 2014-02-05] (NVIDIA Corporation) R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2145080 2014-07-16] (TuneUp Software) ==================== Drivers (Whitelisted) ==================== S3 asmthub3; C:\Windows\System32\DRIVERS\asmthub3.sys [122856 2010-12-08] () [File not signed] S3 asmtxhci; C:\Windows\System32\DRIVERS\asmtxhci.sys [369640 2010-12-08] (ASMedia Technology Inc) [File not signed] R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [55808 2014-07-02] (G Data Software AG) R1 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt64.sys [20992 2014-07-02] (G Data Software AG) R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [142336 2014-07-02] (G Data Software AG) R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [64000 2014-07-02] (G Data Software AG) R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64000 2014-07-02] (G Data Software AG) R1 GRD; C:\Windows\system32\drivers\GRD.sys [106272 2014-05-22] (G Data Software) R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [61440 2014-07-02] (G Data Software AG) S3 LVcKap64; C:\Windows\System32\DRIVERS\LVcKap64.sys [1013024 2007-02-06] (Logitech Inc.) S3 LVMVDrv; C:\Windows\System32\DRIVERS\LVMVDrv.sys [2346016 2007-02-06] (Logitech Inc.) S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2Mon.sys [31520 2007-02-06] () R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation) R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2014-05-27] (TuneUp Software) S3 FXDrv32; \??\D:\FXDrv64.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-07-22 21:25 - 2014-07-22 21:25 - 00000000 ____D () C:\Users\User\Downloads\FRST-OlderVersion 2014-07-22 21:24 - 2014-07-22 21:24 - 00000888 _____ () C:\Users\User\Desktop\JRT.txt 2014-07-22 21:05 - 2014-07-22 21:05 - 01016261 _____ (Thisisu) C:\Users\User\Downloads\JRT (1).exe 2014-07-22 20:38 - 2014-07-22 20:38 - 00000000 ____D () C:\Windows\ERUNT 2014-07-22 20:37 - 2014-07-22 20:37 - 01016261 _____ (Thisisu) C:\Users\User\Downloads\JRT.exe 2014-07-22 09:33 - 2014-07-22 09:33 - 00002770 _____ () C:\Windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 2014-07-22 09:23 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll 2014-07-22 09:22 - 2014-07-22 09:22 - 01354223 _____ () C:\Users\User\Downloads\adwcleaner_3.216.exe 2014-07-22 09:17 - 2014-07-22 09:17 - 00001158 _____ () C:\Users\User\Desktop\mbam.txt 2014-07-21 17:17 - 2014-07-16 10:24 - 00043320 _____ (TuneUp Software) C:\Windows\system32\uxtuneup.dll 2014-07-21 17:17 - 2014-07-16 10:24 - 00036152 _____ (TuneUp Software) C:\Windows\SysWOW64\uxtuneup.dll 2014-07-21 17:17 - 2014-07-16 10:24 - 00029496 _____ (TuneUp Software) C:\Windows\system32\authuitu.dll 2014-07-21 17:17 - 2014-07-16 10:24 - 00025400 _____ (TuneUp Software) C:\Windows\SysWOW64\authuitu.dll 2014-07-11 09:42 - 2014-07-22 09:00 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-07-11 09:41 - 2014-07-11 09:41 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-07-11 09:41 - 2014-07-11 09:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-07-11 09:41 - 2014-07-11 09:41 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-07-11 09:41 - 2014-07-11 09:41 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-07-11 09:41 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-07-11 09:41 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-07-11 09:41 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-07-11 09:40 - 2014-07-11 09:41 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\User\Downloads\mbam-setup-2.0.2.1012.exe 2014-07-10 10:07 - 2014-07-10 10:08 - 00040617 _____ () C:\Users\User\Downloads\Addition.txt 2014-07-10 10:06 - 2014-07-22 21:25 - 02090496 _____ (Farbar) C:\Users\User\Downloads\FRST64.exe 2014-07-10 10:06 - 2014-07-22 21:25 - 00012912 _____ () C:\Users\User\Downloads\FRST.txt 2014-07-10 10:06 - 2014-07-22 21:25 - 00000000 ____D () C:\FRST 2014-07-10 01:27 - 2014-07-10 01:29 - 00002260 _____ () C:\Windows\logboot_09.07.2014.tureg.log 2014-07-02 20:29 - 2014-07-22 21:01 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-07-02 20:29 - 2014-07-22 20:42 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-07-02 20:29 - 2014-07-02 20:37 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-07-02 20:29 - 2014-07-02 20:37 - 00003850 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-07-02 20:29 - 2014-07-02 20:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-07-02 20:29 - 2014-07-02 20:29 - 00000000 ____D () C:\Program Files (x86)\Google 2014-07-02 19:32 - 2014-07-02 19:32 - 00003704 _____ () C:\Windows\System32\Tasks\Java Update Scheduler 2014-07-02 19:32 - 2014-07-02 19:32 - 00003694 _____ () C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm 2014-07-02 19:18 - 2014-07-16 10:24 - 00040760 _____ (TuneUp Software) C:\Windows\system32\TURegOpt.exe 2014-07-02 19:18 - 2014-07-02 19:18 - 00002207 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014.lnk 2014-07-02 19:18 - 2014-07-02 19:18 - 00000000 ____D () C:\Users\User\AppData\Roaming\TuneUp Software 2014-07-02 19:18 - 2014-07-02 19:18 - 00000000 ____D () C:\Users\User\AppData\Local\TuneUp Software 2014-07-02 19:18 - 2014-07-02 19:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014 2014-07-02 19:17 - 2014-07-21 17:20 - 00000000 ____D () C:\Program Files (x86)\TuneUp Utilities 2014 2014-07-02 19:15 - 2014-07-02 19:26 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2014-07-02 19:15 - 2014-07-02 19:18 - 00000000 ____D () C:\ProgramData\TuneUp Software 2014-07-02 13:14 - 2014-07-02 13:14 - 03589024 _____ (Blizzard Entertainment) C:\Users\User\Downloads\Diablo-III-Setup-deDE.exe 2014-07-02 12:34 - 2014-07-02 12:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data AntiVirus 2014-07-01 21:08 - 2014-07-01 21:08 - 00000000 ____D () C:\Users\User\Documents\Diablo III 2014-07-01 18:22 - 2014-07-01 18:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III 2014-06-27 15:49 - 2014-06-27 15:49 - 00000000 ___SD () C:\Windows\system32\CompatTel ==================== One Month Modified Files and Folders ======= 2014-07-22 21:26 - 2014-07-10 10:06 - 00012912 _____ () C:\Users\User\Downloads\FRST.txt 2014-07-22 21:25 - 2014-07-22 21:25 - 00000000 ____D () C:\Users\User\Downloads\FRST-OlderVersion 2014-07-22 21:25 - 2014-07-10 10:06 - 02090496 _____ (Farbar) C:\Users\User\Downloads\FRST64.exe 2014-07-22 21:25 - 2014-07-10 10:06 - 00000000 ____D () C:\FRST 2014-07-22 21:24 - 2014-07-22 21:24 - 00000888 _____ () C:\Users\User\Desktop\JRT.txt 2014-07-22 21:12 - 2011-04-26 11:46 - 01049934 _____ () C:\Windows\WindowsUpdate.log 2014-07-22 21:10 - 2009-07-14 06:45 - 00021856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-07-22 21:10 - 2009-07-14 06:45 - 00021856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-07-22 21:05 - 2014-07-22 21:05 - 01016261 _____ (Thisisu) C:\Users\User\Downloads\JRT (1).exe 2014-07-22 21:01 - 2014-07-02 20:29 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-07-22 21:01 - 2011-04-26 15:12 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-07-22 21:01 - 2010-11-21 05:47 - 00361070 _____ () C:\Windows\PFRO.log 2014-07-22 21:01 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-07-22 21:01 - 2009-07-14 06:51 - 00154188 _____ () C:\Windows\setupact.log 2014-07-22 21:00 - 2014-02-27 02:21 - 00000000 ____D () C:\AdwCleaner 2014-07-22 21:00 - 2011-09-06 16:57 - 00000999 _____ () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-07-22 20:42 - 2014-07-02 20:29 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-07-22 20:38 - 2014-07-22 20:38 - 00000000 ____D () C:\Windows\ERUNT 2014-07-22 20:37 - 2014-07-22 20:37 - 01016261 _____ (Thisisu) C:\Users\User\Downloads\JRT.exe 2014-07-22 20:32 - 2012-04-11 21:08 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-07-22 09:33 - 2014-07-22 09:33 - 00002770 _____ () C:\Windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 2014-07-22 09:22 - 2014-07-22 09:22 - 01354223 _____ () C:\Users\User\Downloads\adwcleaner_3.216.exe 2014-07-22 09:17 - 2014-07-22 09:17 - 00001158 _____ () C:\Users\User\Desktop\mbam.txt 2014-07-22 09:10 - 2013-11-12 16:07 - 00941255 _____ () C:\Windows\IE11_main.log 2014-07-22 09:00 - 2014-07-11 09:42 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-07-22 00:56 - 2014-01-27 17:31 - 00000000 ____D () C:\Users\User\AppData\Local\Battle.net 2014-07-22 00:09 - 2012-04-11 19:33 - 00000000 ____D () C:\Users\User\AppData\Roaming\TS3Client 2014-07-21 17:20 - 2014-07-02 19:17 - 00000000 ____D () C:\Program Files (x86)\TuneUp Utilities 2014 2014-07-21 17:19 - 2012-04-11 19:08 - 00000000 ____D () C:\Program Files (x86)\TeamSpeak 3 Client 2014-07-16 10:24 - 2014-07-21 17:17 - 00043320 _____ (TuneUp Software) C:\Windows\system32\uxtuneup.dll 2014-07-16 10:24 - 2014-07-21 17:17 - 00036152 _____ (TuneUp Software) C:\Windows\SysWOW64\uxtuneup.dll 2014-07-16 10:24 - 2014-07-21 17:17 - 00029496 _____ (TuneUp Software) C:\Windows\system32\authuitu.dll 2014-07-16 10:24 - 2014-07-21 17:17 - 00025400 _____ (TuneUp Software) C:\Windows\SysWOW64\authuitu.dll 2014-07-16 10:24 - 2014-07-02 19:18 - 00040760 _____ (TuneUp Software) C:\Windows\system32\TURegOpt.exe 2014-07-11 09:41 - 2014-07-11 09:41 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-07-11 09:41 - 2014-07-11 09:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-07-11 09:41 - 2014-07-11 09:41 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-07-11 09:41 - 2014-07-11 09:41 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-07-11 09:41 - 2014-07-11 09:40 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\User\Downloads\mbam-setup-2.0.2.1012.exe 2014-07-10 12:39 - 2012-04-12 09:24 - 00000000 ____D () C:\Users\User\AppData\Local\Deployment 2014-07-10 10:32 - 2014-01-27 17:31 - 00000000 ____D () C:\Program Files (x86)\Battle.net 2014-07-10 10:08 - 2014-07-10 10:07 - 00040617 _____ () C:\Users\User\Downloads\Addition.txt 2014-07-10 03:04 - 2013-08-14 02:10 - 00000000 ____D () C:\Windows\system32\MRT 2014-07-10 03:03 - 2011-04-27 14:12 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-07-10 01:29 - 2014-07-10 01:27 - 00002260 _____ () C:\Windows\logboot_09.07.2014.tureg.log 2014-07-10 01:29 - 2009-07-14 04:34 - 62652416 _____ () C:\Windows\system32\config\SOFTWARE_tureg_old 2014-07-10 01:29 - 2009-07-14 04:34 - 38273024 _____ () C:\Windows\system32\config\SYSTEM_tureg_old 2014-07-10 01:29 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\SECURITY_tureg_old 2014-07-10 01:26 - 2009-07-14 04:34 - 01048576 _____ () C:\Windows\system32\config\DEFAULT_tureg_old 2014-07-10 01:26 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\SAM_tureg_old 2014-07-08 22:32 - 2012-04-11 21:08 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-07-08 22:32 - 2012-04-11 21:08 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-07-08 22:32 - 2012-04-11 21:08 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-07-03 22:41 - 2011-09-06 16:57 - 00000000 ____D () C:\Users\User\AppData\Local\VirtualStore 2014-07-02 20:37 - 2014-07-02 20:29 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-07-02 20:37 - 2014-07-02 20:29 - 00003850 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-07-02 20:34 - 2013-03-23 23:13 - 00000000 ____D () C:\Users\User\Desktop\Zeugs 2014-07-02 20:29 - 2014-07-02 20:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-07-02 20:29 - 2014-07-02 20:29 - 00000000 ____D () C:\Program Files (x86)\Google 2014-07-02 20:29 - 2012-09-09 04:27 - 00000000 ____D () C:\Users\User\AppData\Local\Google 2014-07-02 19:32 - 2014-07-02 19:32 - 00003704 _____ () C:\Windows\System32\Tasks\Java Update Scheduler 2014-07-02 19:32 - 2014-07-02 19:32 - 00003694 _____ () C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm 2014-07-02 19:26 - 2014-07-02 19:15 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2014-07-02 19:23 - 2011-04-26 14:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XnView 2014-07-02 19:18 - 2014-07-02 19:18 - 00002207 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014.lnk 2014-07-02 19:18 - 2014-07-02 19:18 - 00000000 ____D () C:\Users\User\AppData\Roaming\TuneUp Software 2014-07-02 19:18 - 2014-07-02 19:18 - 00000000 ____D () C:\Users\User\AppData\Local\TuneUp Software 2014-07-02 19:18 - 2014-07-02 19:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014 2014-07-02 19:18 - 2014-07-02 19:15 - 00000000 ____D () C:\ProgramData\TuneUp Software 2014-07-02 19:05 - 2013-03-14 04:00 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-07-02 13:14 - 2014-07-02 13:14 - 03589024 _____ (Blizzard Entertainment) C:\Users\User\Downloads\Diablo-III-Setup-deDE.exe 2014-07-02 13:13 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF 2014-07-02 12:34 - 2014-07-02 12:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data AntiVirus 2014-07-02 12:34 - 2014-04-10 12:25 - 00020992 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBFlt64.sys 2014-07-02 12:34 - 2014-03-10 12:28 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys 2014-07-02 12:34 - 2014-03-10 12:26 - 00061440 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys 2014-07-02 12:33 - 2014-03-10 12:26 - 00142336 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys 2014-07-02 12:33 - 2014-03-10 12:26 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys 2014-07-02 12:33 - 2014-03-10 12:25 - 00055808 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys 2014-07-02 12:32 - 2011-05-05 16:41 - 00322272 _____ () C:\Windows\DPINST.LOG 2014-07-01 21:08 - 2014-07-01 21:08 - 00000000 ____D () C:\Users\User\Documents\Diablo III 2014-07-01 18:22 - 2014-07-01 18:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III 2014-07-01 18:15 - 2014-01-27 17:34 - 00000000 ____D () C:\Program Files (x86)\Hearthstone 2014-06-27 15:49 - 2014-06-27 15:49 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-06-25 10:26 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT Files to move or delete: ==================== C:\Users\Public\AlexaNSISPlugin.4424.dll Some content of TEMP: ==================== C:\Users\User\AppData\Local\Temp\avgnt.exe C:\Users\User\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-07-22 10:08 ==================== End Of Log ============================ Für die Verspätung noch mal eine Entschuldigung und zwischendurch auch mal ein Danke an dich für deine Hilfe (; |
23.07.2014, 11:23 | #6 |
/// the machine /// TB-Ausbilder | Malware/Windowsupdates zeigen Konfigurationsfehler an und installieren sich nicht mehrESET Online Scanner
Downloade Dir bitte SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ --> Malware/Windowsupdates zeigen Konfigurationsfehler an und installieren sich nicht mehr |
23.07.2014, 19:22 | #7 |
| Malware/Windowsupdates zeigen Konfigurationsfehler an und installieren sich nicht mehr Eset Code:
ATTFilter ESETSmartInstaller@High as downloader log: all ok # product=EOS # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.7623 # api_version=3.0.2 # EOSSerial=97628852e7c73e4dad02ad1bf5ae3843 # engine=19307 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2014-07-23 03:33:02 # local_time=2014-07-23 05:33:02 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1031 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode_1='' # compatibility_mode=5893 16776573 100 94 69625 157759432 0 0 # scanned=313893 # found=53 # cleaned=0 # scan_time=17572 sh=97BCCD25561F44E9B13F05F6EEF083C9CE9BA529 ft=1 fh=641f1fb3d2e699c4 vn="Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Conduit\Community Alerts\Alert.dll.vir" sh=E33473A547B46503C4F7D8D6095F084570496E0F ft=1 fh=3cc725458bf86889 vn="Win32/BrowserCompanion evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\User\AppData\Roaming\BrowserCompanion\tcbhn.exe.vir" sh=40D44156458F674C3887933151991767FC8DA071 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2012-04-29 191142\Backup Files 2012-04-29 191142\Backup files 1.zip" sh=D15F9E4F27A813C55B11052F65A6F80AFED5828B ft=0 fh=0000000000000000 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2012-05-06 200016\Backup Files 2012-05-06 200016\Backup files 1.zip" sh=CE6D8EDF38DC3C2941FD3E22F9B998ED8D3F5E23 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2012-05-13 190001\Backup Files 2012-05-13 190001\Backup files 1.zip" sh=04BDFC4BF46B4C94B986AB142E3F99496DAA745A ft=0 fh=0000000000000000 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2012-05-16 015225\Backup Files 2012-05-16 015225\Backup files 1.zip" sh=FB778046DA95FA8217E55693D575957001C81365 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2012-05-28 110749\Backup Files 2012-05-28 110749\Backup files 1.zip" sh=5FB38FEC9BFF09D800EB8F8DE29F7BE67447BBD7 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2012-06-10 221820\Backup Files 2012-06-10 221820\Backup files 1.zip" sh=21783752F3AA5ABFF7DBB449BE29FE2CEB74B906 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2012-06-24 212844\Backup Files 2012-06-24 212844\Backup files 1.zip" sh=270085E223F1173644B0A5567B60B3EDC978607C ft=0 fh=0000000000000000 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2012-07-15 210002\Backup Files 2012-07-15 210002\Backup files 1.zip" sh=5FD399720DB423DD9E1CFB31FFC96B185DFA3DBB ft=0 fh=0000000000000000 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2012-07-22 190001\Backup Files 2012-07-22 190001\Backup files 1.zip" sh=07D6A61CCCF3A8A695E0A0000D1748F0DA03547B ft=0 fh=0000000000000000 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2012-07-29 190001\Backup Files 2012-07-29 190001\Backup files 1.zip" sh=985DB0ACBDD1C90B988B2DD2FEEB39E37B13D4F0 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2012-08-12 220559\Backup Files 2012-08-12 220559\Backup files 1.zip" sh=F19324A0D45AEB1E9A78D2A2CF78A6E8F9378410 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2012-08-27 093105\Backup Files 2012-08-27 093105\Backup files 1.zip" sh=0A6301667AE22F0DE64C150AAEF8D748533C481E ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Babylon.Q evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2012-09-02 190001\Backup Files 2012-09-02 190001\Backup files 1.zip" sh=E263E84A52D427210D85548331747E9340193F3C ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion.G evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2012-09-02 190001\Backup Files 2012-09-09 190001\Backup files 2.zip" sh=10C27FB8F35E70AB15CF395C4E87C57AF59174D1 ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2012-09-23 190001\Backup Files 2012-09-23 190001\Backup files 1.zip" sh=A2802B05DFC2D54D4CE8AB439C119F64BAFBD928 ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion.G evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2012-09-23 190001\Backup Files 2012-09-23 190001\Backup files 2.zip" sh=7DE7EA419DD2137780C519DA09F036515043A7DA ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2012-10-21 190001\Backup Files 2012-10-21 190001\Backup files 1.zip" sh=1DB684057C0434EC2DDD2A8360D1B89F1F788028 ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2012-10-28 190001\Backup Files 2012-10-28 190001\Backup files 1.zip" sh=388AD750DF245CE7D7544556AA63E319B647D3F2 ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2012-11-25 190002\Backup Files 2012-11-25 190002\Backup files 1.zip" sh=AD801E44092454F5DA8AB2E867D3418FCD0762EE ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2013-01-13 195747\Backup Files 2013-01-13 195747\Backup files 1.zip" sh=11BC3A18778664A9432A0D4CAF85C6791BA451D9 ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2013-02-03 190003\Backup Files 2013-02-03 190003\Backup files 1.zip" sh=9D1FC165388D4D3217F91722AD6371D616967196 ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2013-02-24 190001\Backup Files 2013-02-24 190001\Backup files 1.zip" sh=79A179232227837593A0ABBF7B3E25F366A1A5B1 ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2013-03-10 190002\Backup Files 2013-03-10 190002\Backup files 1.zip" sh=86E51A56059ACA7E6BA8741FB47DB0CCB2525209 ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2013-03-17 190001\Backup Files 2013-03-17 190001\Backup files 1.zip" sh=0CE1F9103AB283B25F9865CFEF7F01884E6F53FE ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2013-03-31 190001\Backup Files 2013-03-31 190001\Backup files 1.zip" sh=37978E2328E07DC36FC47715B493BB9EBAA42553 ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2013-04-28 192304\Backup Files 2013-04-28 192304\Backup files 1.zip" sh=A606FA5D0CE0371FFC11D835A13D501F109F9A1A ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2013-06-02 193439\Backup Files 2013-06-02 193439\Backup files 1.zip" sh=4311B05AA33F6F3E8A5E66DB5DF61E912F32EA75 ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2013-07-15 182318\Backup Files 2013-07-15 182318\Backup files 1.zip" sh=4808EC807B46A29905028C10CDA92190152FD6C7 ft=0 fh=0000000000000000 vn="Variante von Win32/BrowserCompanion.A evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2013-07-15 182318\Backup Files 2013-07-15 182318\Backup files 3.zip" sh=8EB36E0932B06865C42C70981BE007425237CC1E ft=0 fh=0000000000000000 vn="Win32/Toolbar.SearchSuite evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2013-07-15 182318\Backup Files 2013-07-22 212705\Backup files 1.zip" sh=443B8F346354A3F7AF43A9A3FC72CB0295B82C1C ft=0 fh=0000000000000000 vn="Win32/Toolbar.SearchSuite evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2013-07-15 182318\Backup Files 2013-07-22 212705\Backup files 2.zip" sh=54E7F1886026E34ADE60128B0281E7AA8538CDE1 ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2013-09-09 230239\Backup Files 2013-09-09 230239\Backup files 1.zip" sh=93F63C12BD3430DCC856756C5F986AC552E002CC ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2013-11-11 184412\Backup Files 2013-11-11 184412\Backup files 1.zip" sh=28CB3092112955EA160E41364819D3B2DCDF72CE ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2013-12-02 183417\Backup Files 2013-12-02 183417\Backup files 1.zip" sh=FF53E76E659FA540EDC26593EDC9C7BCBA037E06 ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2013-12-16 131153\Backup Files 2013-12-16 131153\Backup files 1.zip" sh=4D5EC281CB59BAAF21D377302DEEF3B41403E330 ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2013-12-16 165412\Backup Files 2013-12-16 165412\Backup files 1.zip" sh=6E9DB8E7738FE944B3B82C11AB2E29779AD67892 ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2014-01-05 190001\Backup Files 2014-01-05 190001\Backup files 1.zip" sh=C4AB3F9924C50899296709DF79F688F416F3BF29 ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2014-01-14 184613\Backup Files 2014-01-14 184613\Backup files 1.zip" sh=3CD32DFCB11B6432DE539E4A09B80ED68F1902C5 ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2014-01-20 185419\Backup Files 2014-01-20 185419\Backup files 1.zip" sh=CC1A66A2B695385F91BE1D01429C6F53BB08E563 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2014-01-20 185419\Backup Files 2014-01-20 224918\Backup files 1.zip" sh=53234EECD3AD6086E76EE80EDB7D50B63FE24E6C ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2014-01-26 191434\Backup Files 2014-01-26 191434\Backup files 1.zip" sh=6E35E8B24AD315615BB7CAA9BFE7256C04FC0BB6 ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2014-02-10 102116\Backup Files 2014-02-10 102116\Backup files 1.zip" sh=2BC11058F9F1E756205B4D499F3793589B665B89 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2014-02-10 102116\Backup Files 2014-02-17 123358\Backup files 1.zip" sh=32A3219B8E6C6167AB1E53033E802198F18247BF ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2014-02-24 201748\Backup Files 2014-02-24 201748\Backup files 1.zip" sh=308456E2C352BDE3D6A16F9DE8D7492347B557E5 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2014-02-24 201748\Backup Files 2014-02-24 201748\Backup files 2.zip" sh=6D9698F8EED02BDB84B5DFD9163F0C205F5BA832 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2014-02-24 201748\Backup Files 2014-03-10 104647\Backup files 1.zip" sh=8BDD40B635885FC092EAE3C0A93A9E41363259CA ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2014-02-24 201748\Backup Files 2014-03-10 145150\Backup files 1.zip" sh=B08E59980A5D5FE414F4C5D510F465D973B69F82 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2014-02-24 201748\Backup Files 2014-03-24 121732\Backup files 1.zip" sh=20C31401EE4328BA0ACA3A9D30170252AF275E23 ft=0 fh=0000000000000000 vn="Win32/BrowserCompanion evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2014-06-24 184915\Backup Files 2014-06-24 184915\Backup files 1.zip" sh=20668E5F1705B20F593E9D94BDCC7434E7CA0D21 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2014-06-24 184915\Backup Files 2014-06-24 184915\Backup files 2.zip" sh=C6505DE0DF06896A5016D67C074066DF74AAF151 ft=0 fh=0000000000000000 vn="Win32/Toolbar.SearchSuite evtl. unerwünschte Anwendung" ac=I fn="E:\NICKY\Backup Set 2014-06-24 184915\Backup Files 2014-06-24 184915\Backup files 4.zip" Security Check Code:
ATTFilter Results of screen317's Security Check version 0.99.85 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 10 Out of date! ``````````````Antivirus/Firewall Check:`````````````` G Data AntiVirus Antivirus out of date! `````````Anti-malware/Other Utilities Check:````````` TuneUp Utilities 2014 TuneUp Utilities 2014 (de-DE) TuneUp Utilities 2014 JavaFX 2.1.1 Java 7 Update 55 Java version out of Date! Adobe Flash Player 14.0.0.145 Adobe Reader 10.1.10 Adobe Reader out of Date! Google Chrome 35.0.1916.153 Google Chrome 36.0.1985.125 ````````Process Check: objlist.exe by Laurent```````` G Data AntiVirus AVK AVKWCtlx64.exe G Data AntiVirus AVK AVKService.exe G Data AntiVirus AVKTray AVKTray.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-07-2014 01 Ran by User (administrator) on NICKY on 23-07-2014 19:40:56 Running from C:\Users\User\Desktop\Trojanerhilfe Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG) C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKWCtlx64.exe (AMD) C:\Windows\System32\atiesrxx.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG) C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKService.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKBap64.exe (AMD) C:\Windows\System32\atieclxx.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe (G Data Software AG) C:\Program Files (x86)\G Data\AntiVirus\AVKTray\AVKTray.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GdBgInx64.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GDKBFltExe32.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11786344 2011-03-28] (Realtek Semiconductor) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-02-05] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM-x32\...\Run: [LogitechCommunicationsManager] => C:\Program Files (x86)\Common Files\LogiShrd\LComMgr\Communications_Helper.exe [488984 2007-02-08] (Logitech Inc.) HKLM-x32\...\Run: [LogitechQuickCamRibbon] => C:\Program Files (x86)\Logitech\QuickCam10\QuickCam10.exe [774168 2007-02-08] () HKLM-x32\...\Run: [G Data ASM] => C:\Program Files (x86)\G Data\AntiVirus\DelayLoader\AutorunDelayLoader.exe [431224 2013-12-19] (G Data Software AG) HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files (x86)\G Data\AntiVirus\AVKTray\AVKTray.exe, HKU\S-1-5-19\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation) HKU\S-1-5-20\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation) HKU\S-1-5-21-480108453-1788057580-3342198939-1001\...\MountPoints2: {ce2f0baa-24e0-11e2-b2b2-d027886e2e06} - J:\Startme.exe IFEO\pccompanion.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe" IFEO\quickcam10.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe" IFEO\setup.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe" IFEO\skype.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe" IFEO\teamviewer.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe" Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com StartMenuInternet: IEXPLORE.EXE - iexplore.exe SearchScopes: HKLM-x32 - DefaultScope value is missing. SearchScopes: HKCU - {506726F0-3180-4815-95A1-DDC96828C0AD} URL = hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p23_serp_ie_de_display?ie=UTF8&tagbase=bds-p23&tbrId=v1_abb-channel-23_96a905ff6b534e98b2b4e31973ba1b36_39_1006_20130323_DE_ie_ds_&tag=bds-p23-serp-de-ie-21&query={searchTerms} BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKCU - No Name - {7E111A5C-3D11-4F56-9463-5310C3C69025} - No File DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll () FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) Chrome: ======= CHR HomePage: CHR Extension: (Google Docs) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-07-02] CHR Extension: (Google Drive) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-07-02] CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-07-02] CHR Extension: (Google-Suche) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-07-02] CHR Extension: (Google Wallet) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-07-02] CHR Extension: (Google Mail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-07-02] CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Services (Whitelisted) ================= R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2250360 2014-05-27] (G Data Software AG) R2 AVKService; C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG) R2 AVKWCtl; C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKWCtlx64.exe [2683760 2014-05-20] (G Data Software AG) R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700536 2014-05-20] (G Data Software AG) S4 LVSrvLauncher; C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe [173344 2007-02-06] (Logitech Inc.) U2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-02-05] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16941856 2014-02-05] (NVIDIA Corporation) R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2145080 2014-07-16] (TuneUp Software) ==================== Drivers (Whitelisted) ==================== S3 asmthub3; C:\Windows\System32\DRIVERS\asmthub3.sys [122856 2010-12-08] () [File not signed] S3 asmtxhci; C:\Windows\System32\DRIVERS\asmtxhci.sys [369640 2010-12-08] (ASMedia Technology Inc) [File not signed] R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [55808 2014-07-02] (G Data Software AG) R1 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt64.sys [20992 2014-07-02] (G Data Software AG) R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [142336 2014-07-02] (G Data Software AG) R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [64000 2014-07-02] (G Data Software AG) R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64000 2014-07-02] (G Data Software AG) R1 GRD; C:\Windows\system32\drivers\GRD.sys [106272 2014-05-22] (G Data Software) R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [61440 2014-07-02] (G Data Software AG) S3 LVcKap64; C:\Windows\System32\DRIVERS\LVcKap64.sys [1013024 2007-02-06] (Logitech Inc.) S3 LVMVDrv; C:\Windows\System32\DRIVERS\LVMVDrv.sys [2346016 2007-02-06] (Logitech Inc.) S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2Mon.sys [31520 2007-02-06] () R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation) R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2014-05-27] (TuneUp Software) S3 FXDrv32; \??\D:\FXDrv64.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-07-23 19:38 - 2014-07-23 19:38 - 00854390 _____ () C:\Users\User\Downloads\SecurityCheck (2).exe 2014-07-23 12:37 - 2014-07-23 12:37 - 02347384 _____ (ESET) C:\Users\User\Downloads\esetsmartinstaller_deu.exe 2014-07-23 12:37 - 2014-07-23 12:37 - 00000000 ____D () C:\Program Files (x86)\ESET 2014-07-23 12:36 - 2014-07-23 12:36 - 00854390 _____ () C:\Users\User\Downloads\SecurityCheck (1).exe 2014-07-23 12:35 - 2014-07-23 12:35 - 00854390 _____ () C:\Users\User\Downloads\SecurityCheck.exe 2014-07-23 10:44 - 2014-07-23 10:44 - 00985600 _____ () C:\Users\User\Downloads\MicrosoftFixit50123.msi 2014-07-22 21:59 - 2014-07-23 19:40 - 00000000 ____D () C:\Users\User\Desktop\Trojanerhilfe 2014-07-22 21:25 - 2014-07-22 21:25 - 00000000 ____D () C:\Users\User\Downloads\FRST-OlderVersion 2014-07-22 20:38 - 2014-07-22 20:38 - 00000000 ____D () C:\Windows\ERUNT 2014-07-22 09:33 - 2014-07-22 09:33 - 00002770 _____ () C:\Windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 2014-07-22 09:23 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll 2014-07-21 17:17 - 2014-07-16 10:24 - 00043320 _____ (TuneUp Software) C:\Windows\system32\uxtuneup.dll 2014-07-21 17:17 - 2014-07-16 10:24 - 00036152 _____ (TuneUp Software) C:\Windows\SysWOW64\uxtuneup.dll 2014-07-21 17:17 - 2014-07-16 10:24 - 00029496 _____ (TuneUp Software) C:\Windows\system32\authuitu.dll 2014-07-21 17:17 - 2014-07-16 10:24 - 00025400 _____ (TuneUp Software) C:\Windows\SysWOW64\authuitu.dll 2014-07-11 09:42 - 2014-07-22 09:00 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-07-11 09:41 - 2014-07-11 09:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-07-11 09:41 - 2014-07-11 09:41 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-07-11 09:41 - 2014-07-11 09:41 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-07-11 09:41 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-07-11 09:41 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-07-11 09:41 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-07-11 09:40 - 2014-07-11 09:41 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\User\Downloads\mbam-setup-2.0.2.1012.exe 2014-07-10 10:06 - 2014-07-23 19:40 - 00000000 ____D () C:\FRST 2014-07-10 01:27 - 2014-07-10 01:29 - 00002260 _____ () C:\Windows\logboot_09.07.2014.tureg.log 2014-07-02 20:29 - 2014-07-23 18:42 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-07-02 20:29 - 2014-07-23 11:07 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-07-02 20:29 - 2014-07-02 20:37 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-07-02 20:29 - 2014-07-02 20:37 - 00003850 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-07-02 20:29 - 2014-07-02 20:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-07-02 20:29 - 2014-07-02 20:29 - 00000000 ____D () C:\Program Files (x86)\Google 2014-07-02 19:32 - 2014-07-02 19:32 - 00003704 _____ () C:\Windows\System32\Tasks\Java Update Scheduler 2014-07-02 19:32 - 2014-07-02 19:32 - 00003694 _____ () C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm 2014-07-02 19:18 - 2014-07-16 10:24 - 00040760 _____ (TuneUp Software) C:\Windows\system32\TURegOpt.exe 2014-07-02 19:18 - 2014-07-02 19:18 - 00002207 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014.lnk 2014-07-02 19:18 - 2014-07-02 19:18 - 00000000 ____D () C:\Users\User\AppData\Roaming\TuneUp Software 2014-07-02 19:18 - 2014-07-02 19:18 - 00000000 ____D () C:\Users\User\AppData\Local\TuneUp Software 2014-07-02 19:18 - 2014-07-02 19:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014 2014-07-02 19:17 - 2014-07-21 17:20 - 00000000 ____D () C:\Program Files (x86)\TuneUp Utilities 2014 2014-07-02 19:15 - 2014-07-02 19:26 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2014-07-02 19:15 - 2014-07-02 19:18 - 00000000 ____D () C:\ProgramData\TuneUp Software 2014-07-02 13:14 - 2014-07-02 13:14 - 03589024 _____ (Blizzard Entertainment) C:\Users\User\Downloads\Diablo-III-Setup-deDE.exe 2014-07-02 12:34 - 2014-07-02 12:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data AntiVirus 2014-07-01 21:08 - 2014-07-01 21:08 - 00000000 ____D () C:\Users\User\Documents\Diablo III 2014-07-01 18:22 - 2014-07-01 18:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III 2014-06-27 15:49 - 2014-06-27 15:49 - 00000000 ___SD () C:\Windows\system32\CompatTel ==================== One Month Modified Files and Folders ======= 2014-07-23 19:40 - 2014-07-22 21:59 - 00000000 ____D () C:\Users\User\Desktop\Trojanerhilfe 2014-07-23 19:40 - 2014-07-10 10:06 - 00000000 ____D () C:\FRST 2014-07-23 19:38 - 2014-07-23 19:38 - 00854390 _____ () C:\Users\User\Downloads\SecurityCheck (2).exe 2014-07-23 19:32 - 2012-04-11 21:08 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-07-23 19:32 - 2011-04-26 11:46 - 01718366 _____ () C:\Windows\WindowsUpdate.log 2014-07-23 18:42 - 2014-07-02 20:29 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-07-23 12:37 - 2014-07-23 12:37 - 02347384 _____ (ESET) C:\Users\User\Downloads\esetsmartinstaller_deu.exe 2014-07-23 12:37 - 2014-07-23 12:37 - 00000000 ____D () C:\Program Files (x86)\ESET 2014-07-23 12:36 - 2014-07-23 12:36 - 00854390 _____ () C:\Users\User\Downloads\SecurityCheck (1).exe 2014-07-23 12:35 - 2014-07-23 12:35 - 00854390 _____ () C:\Users\User\Downloads\SecurityCheck.exe 2014-07-23 11:13 - 2009-07-14 06:45 - 00021856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-07-23 11:13 - 2009-07-14 06:45 - 00021856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-07-23 11:07 - 2014-07-02 20:29 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-07-23 11:05 - 2011-04-26 15:12 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-07-23 11:05 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-07-23 11:05 - 2009-07-14 06:51 - 00155196 _____ () C:\Windows\setupact.log 2014-07-23 10:57 - 2013-11-12 16:07 - 00971486 _____ () C:\Windows\IE11_main.log 2014-07-23 10:44 - 2014-07-23 10:44 - 00985600 _____ () C:\Users\User\Downloads\MicrosoftFixit50123.msi 2014-07-23 00:11 - 2014-01-27 17:31 - 00000000 ____D () C:\Users\User\AppData\Local\Battle.net 2014-07-22 23:19 - 2012-04-11 19:33 - 00000000 ____D () C:\Users\User\AppData\Roaming\TS3Client 2014-07-22 22:21 - 2014-01-27 17:34 - 00000000 ____D () C:\Program Files (x86)\Hearthstone 2014-07-22 21:25 - 2014-07-22 21:25 - 00000000 ____D () C:\Users\User\Downloads\FRST-OlderVersion 2014-07-22 21:01 - 2010-11-21 05:47 - 00361070 _____ () C:\Windows\PFRO.log 2014-07-22 21:00 - 2014-02-27 02:21 - 00000000 ____D () C:\AdwCleaner 2014-07-22 21:00 - 2011-09-06 16:57 - 00000999 _____ () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-07-22 20:38 - 2014-07-22 20:38 - 00000000 ____D () C:\Windows\ERUNT 2014-07-22 09:33 - 2014-07-22 09:33 - 00002770 _____ () C:\Windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 2014-07-22 09:00 - 2014-07-11 09:42 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-07-21 17:20 - 2014-07-02 19:17 - 00000000 ____D () C:\Program Files (x86)\TuneUp Utilities 2014 2014-07-21 17:19 - 2012-04-11 19:08 - 00000000 ____D () C:\Program Files (x86)\TeamSpeak 3 Client 2014-07-16 10:24 - 2014-07-21 17:17 - 00043320 _____ (TuneUp Software) C:\Windows\system32\uxtuneup.dll 2014-07-16 10:24 - 2014-07-21 17:17 - 00036152 _____ (TuneUp Software) C:\Windows\SysWOW64\uxtuneup.dll 2014-07-16 10:24 - 2014-07-21 17:17 - 00029496 _____ (TuneUp Software) C:\Windows\system32\authuitu.dll 2014-07-16 10:24 - 2014-07-21 17:17 - 00025400 _____ (TuneUp Software) C:\Windows\SysWOW64\authuitu.dll 2014-07-16 10:24 - 2014-07-02 19:18 - 00040760 _____ (TuneUp Software) C:\Windows\system32\TURegOpt.exe 2014-07-11 09:41 - 2014-07-11 09:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-07-11 09:41 - 2014-07-11 09:41 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-07-11 09:41 - 2014-07-11 09:41 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-07-11 09:41 - 2014-07-11 09:40 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\User\Downloads\mbam-setup-2.0.2.1012.exe 2014-07-10 12:39 - 2012-04-12 09:24 - 00000000 ____D () C:\Users\User\AppData\Local\Deployment 2014-07-10 10:32 - 2014-01-27 17:31 - 00000000 ____D () C:\Program Files (x86)\Battle.net 2014-07-10 03:04 - 2013-08-14 02:10 - 00000000 ____D () C:\Windows\system32\MRT 2014-07-10 03:03 - 2011-04-27 14:12 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-07-10 01:29 - 2014-07-10 01:27 - 00002260 _____ () C:\Windows\logboot_09.07.2014.tureg.log 2014-07-10 01:29 - 2009-07-14 04:34 - 62652416 _____ () C:\Windows\system32\config\SOFTWARE_tureg_old 2014-07-10 01:29 - 2009-07-14 04:34 - 38273024 _____ () C:\Windows\system32\config\SYSTEM_tureg_old 2014-07-10 01:29 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\SECURITY_tureg_old 2014-07-10 01:26 - 2009-07-14 04:34 - 01048576 _____ () C:\Windows\system32\config\DEFAULT_tureg_old 2014-07-10 01:26 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\SAM_tureg_old 2014-07-08 22:32 - 2012-04-11 21:08 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-07-08 22:32 - 2012-04-11 21:08 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-07-08 22:32 - 2012-04-11 21:08 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-07-03 22:41 - 2011-09-06 16:57 - 00000000 ____D () C:\Users\User\AppData\Local\VirtualStore 2014-07-02 20:37 - 2014-07-02 20:29 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-07-02 20:37 - 2014-07-02 20:29 - 00003850 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-07-02 20:34 - 2013-03-23 23:13 - 00000000 ____D () C:\Users\User\Desktop\Zeugs 2014-07-02 20:29 - 2014-07-02 20:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-07-02 20:29 - 2014-07-02 20:29 - 00000000 ____D () C:\Program Files (x86)\Google 2014-07-02 20:29 - 2012-09-09 04:27 - 00000000 ____D () C:\Users\User\AppData\Local\Google 2014-07-02 19:32 - 2014-07-02 19:32 - 00003704 _____ () C:\Windows\System32\Tasks\Java Update Scheduler 2014-07-02 19:32 - 2014-07-02 19:32 - 00003694 _____ () C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm 2014-07-02 19:26 - 2014-07-02 19:15 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2014-07-02 19:23 - 2011-04-26 14:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XnView 2014-07-02 19:18 - 2014-07-02 19:18 - 00002207 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014.lnk 2014-07-02 19:18 - 2014-07-02 19:18 - 00000000 ____D () C:\Users\User\AppData\Roaming\TuneUp Software 2014-07-02 19:18 - 2014-07-02 19:18 - 00000000 ____D () C:\Users\User\AppData\Local\TuneUp Software 2014-07-02 19:18 - 2014-07-02 19:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014 2014-07-02 19:18 - 2014-07-02 19:15 - 00000000 ____D () C:\ProgramData\TuneUp Software 2014-07-02 19:05 - 2013-03-14 04:00 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-07-02 13:14 - 2014-07-02 13:14 - 03589024 _____ (Blizzard Entertainment) C:\Users\User\Downloads\Diablo-III-Setup-deDE.exe 2014-07-02 13:13 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF 2014-07-02 12:34 - 2014-07-02 12:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data AntiVirus 2014-07-02 12:34 - 2014-04-10 12:25 - 00020992 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBFlt64.sys 2014-07-02 12:34 - 2014-03-10 12:28 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys 2014-07-02 12:34 - 2014-03-10 12:26 - 00061440 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys 2014-07-02 12:33 - 2014-03-10 12:26 - 00142336 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys 2014-07-02 12:33 - 2014-03-10 12:26 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys 2014-07-02 12:33 - 2014-03-10 12:25 - 00055808 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys 2014-07-02 12:32 - 2011-05-05 16:41 - 00322272 _____ () C:\Windows\DPINST.LOG 2014-07-01 21:08 - 2014-07-01 21:08 - 00000000 ____D () C:\Users\User\Documents\Diablo III 2014-07-01 18:22 - 2014-07-01 18:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III 2014-06-27 15:49 - 2014-06-27 15:49 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-06-25 10:26 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT Files to move or delete: ==================== C:\Users\Public\AlexaNSISPlugin.4424.dll Some content of TEMP: ==================== C:\Users\User\AppData\Local\Temp\avgnt.exe C:\Users\User\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-07-22 10:08 ==================== End Of Log ============================ --- --- --- Ich werde nun schauen ob es bei den Windowsupdates immer noch einen Konfigurationsfehler gibt, bevor ich das alles hier grad ausgeführt habe, hat sich Windows wieder "zurückgesetzt" und die 29 Updats sind immer noch nicht auf dem Rechner drauf, sie installieren sich zwar aber ich werd mal jetz schauen. Danke dir auf jeden fall Wie schon befürchtet gibt es immer noch einen Fehler beim Konfigurieren der Windows-Updates und die Änderungen wurden wieder Rückgängig gemacht. Die ganzen Programme haben ja doch eine ganze Menge gefunden und doch mag es nicht so wie es soll |
24.07.2014, 18:20 | #8 |
/// the machine /// TB-Ausbilder | Malware/Windowsupdates zeigen Konfigurationsfehler an und installieren sich nicht mehr Java und adobe updaten. Backup auf E komplett löschen. Downloade dir bitte Farbar Service Scanner
Poste bitte den Inhalt hier.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
24.07.2014, 19:08 | #9 |
| Malware/Windowsupdates zeigen Konfigurationsfehler an und installieren sich nicht mehr Den Backupordner vom Windows? Bzw das Backup vom 24.06 quasi? Code:
ATTFilter Farbar Service Scanner Version: 21-07-2014 Ran by User (administrator) on 24-07-2014 at 20:07:40 Running from "C:\Users\User\Downloads" Microsoft Windows 7 Home Premium Service Pack 1 (X64) Boot Mode: Normal **************************************************************** Internet Services: ============ Connection Status: ============== Localhost is accessible. LAN connected. Google IP is accessible. Google.com is accessible. Yahoo.com is accessible. Windows Firewall: ============= Firewall Disabled Policy: ================== System Restore: ============ System Restore Disabled Policy: ======================== Action Center: ============ Windows Update: ============ Windows Autoupdate Disabled Policy: ============================ Windows Defender: ============== Other Services: ============== File Check: ======== C:\Windows\System32\nsisvc.dll => File is digitally signed C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed C:\Windows\System32\dhcpcore.dll => File is digitally signed C:\Windows\System32\drivers\afd.sys => File is digitally signed C:\Windows\System32\drivers\tdx.sys => File is digitally signed C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed C:\Windows\System32\dnsrslvr.dll => File is digitally signed C:\Windows\System32\mpssvc.dll => File is digitally signed C:\Windows\System32\bfe.dll => File is digitally signed C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed C:\Windows\System32\SDRSVC.dll => File is digitally signed C:\Windows\System32\vssvc.exe => File is digitally signed C:\Windows\System32\wscsvc.dll => File is digitally signed C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed C:\Windows\System32\wuaueng.dll => File is digitally signed C:\Windows\System32\qmgr.dll => File is digitally signed C:\Windows\System32\es.dll => File is digitally signed C:\Windows\System32\cryptsvc.dll => File is digitally signed C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed C:\Windows\System32\ipnathlp.dll => File is digitally signed C:\Windows\System32\iphlpsvc.dll => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed **** End of log **** |
25.07.2014, 17:31 | #10 |
/// the machine /// TB-Ausbilder | Malware/Windowsupdates zeigen Konfigurationsfehler an und installieren sich nicht mehr
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
29.07.2014, 10:47 | #11 |
| Malware/Windowsupdates zeigen Konfigurationsfehler an und installieren sich nicht mehr Hey Schrauber, Ich habe nun das Programm wie auf den Bildern durchlaufen lassen. Was soll ich nun tun? Liebe Grüße Zaya |
29.07.2014, 11:50 | #12 |
/// the machine /// TB-Ausbilder | Malware/Windowsupdates zeigen Konfigurationsfehler an und installieren sich nicht mehr Alle backup-Sets auf E löschen, die laut dem Log von ESET befallen sind. Bitte ein frisches Log mit FRST und FSS machen und beide Logs posten. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
29.07.2014, 12:14 | #13 |
| Malware/Windowsupdates zeigen Konfigurationsfehler an und installieren sich nicht mehr Auf E dürften sich keine Backup´s mehr befinden..die hatte ich ja schon gelöscht FRST FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-07-2014 Ran by User (administrator) on NICKY on 29-07-2014 13:07:43 Running from C:\Users\User\Desktop\Hilfe bei Trojanern Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG) C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKWCtlx64.exe (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG) C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKService.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe (G Data Software AG) C:\Program Files (x86)\G Data\AntiVirus\AVKTray\AVKTray.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GdBgInx64.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GDKBFltExe32.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKBap64.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11786344 2011-03-28] (Realtek Semiconductor) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-02-05] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM-x32\...\Run: [LogitechCommunicationsManager] => C:\Program Files (x86)\Common Files\LogiShrd\LComMgr\Communications_Helper.exe [488984 2007-02-08] (Logitech Inc.) HKLM-x32\...\Run: [LogitechQuickCamRibbon] => C:\Program Files (x86)\Logitech\QuickCam10\QuickCam10.exe [774168 2007-02-08] () HKLM-x32\...\Run: [G Data ASM] => C:\Program Files (x86)\G Data\AntiVirus\DelayLoader\AutorunDelayLoader.exe [431224 2013-12-19] (G Data Software AG) HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files (x86)\G Data\AntiVirus\AVKTray\AVKTray.exe, HKU\S-1-5-19\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation) HKU\S-1-5-20\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation) HKU\S-1-5-21-480108453-1788057580-3342198939-1001\...\MountPoints2: {ce2f0baa-24e0-11e2-b2b2-d027886e2e06} - J:\Startme.exe IFEO\pccompanion.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe" IFEO\quickcam10.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe" IFEO\setup.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe" IFEO\skype.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe" IFEO\teamviewer.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe" Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip () ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com StartMenuInternet: IEXPLORE.EXE - iexplore.exe SearchScopes: HKLM-x32 - DefaultScope value is missing. SearchScopes: HKCU - {506726F0-3180-4815-95A1-DDC96828C0AD} URL = hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p23_serp_ie_de_display?ie=UTF8&tagbase=bds-p23&tbrId=v1_abb-channel-23_96a905ff6b534e98b2b4e31973ba1b36_39_1006_20130323_DE_ie_ds_&tag=bds-p23-serp-de-ie-21&query={searchTerms} BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKCU - No Name - {7E111A5C-3D11-4F56-9463-5310C3C69025} - No File DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll () FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) Chrome: ======= CHR HomePage: CHR Extension: (Google Docs) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-07-02] CHR Extension: (Google Drive) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-07-02] CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-07-02] CHR Extension: (Google-Suche) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-07-02] CHR Extension: (Google Wallet) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-07-02] CHR Extension: (Google Mail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-07-02] CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2250360 2014-05-27] (G Data Software AG) R2 AVKService; C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG) R2 AVKWCtl; C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKWCtlx64.exe [2683760 2014-05-20] (G Data Software AG) R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700536 2014-05-20] (G Data Software AG) S4 LVSrvLauncher; C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe [173344 2007-02-06] (Logitech Inc.) U2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-02-05] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16941856 2014-02-05] (NVIDIA Corporation) R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2145080 2014-07-16] (TuneUp Software) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 asmthub3; C:\Windows\System32\DRIVERS\asmthub3.sys [122856 2010-12-08] () [File not signed] S3 asmtxhci; C:\Windows\System32\DRIVERS\asmtxhci.sys [369640 2010-12-08] (ASMedia Technology Inc) [File not signed] R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [55808 2014-07-02] (G Data Software AG) R1 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt64.sys [20992 2014-07-02] (G Data Software AG) R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [142336 2014-07-02] (G Data Software AG) R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [64000 2014-07-02] (G Data Software AG) R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64000 2014-07-02] (G Data Software AG) R1 GRD; C:\Windows\system32\drivers\GRD.sys [106272 2014-05-22] (G Data Software) R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [61440 2014-07-02] (G Data Software AG) S3 LVcKap64; C:\Windows\System32\DRIVERS\LVcKap64.sys [1013024 2007-02-06] (Logitech Inc.) S3 LVMVDrv; C:\Windows\System32\DRIVERS\LVMVDrv.sys [2346016 2007-02-06] (Logitech Inc.) S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2Mon.sys [31520 2007-02-06] () R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation) R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2014-05-27] (TuneUp Software) S3 FXDrv32; \??\D:\FXDrv64.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-07-29 10:58 - 2014-07-29 10:58 - 00003288 ____N () C:\bootsqm.dat 2014-07-28 21:52 - 2014-07-28 21:52 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-NICKY-Microsoft-Windows-7-Home-Premium-(64-bit).dat 2014-07-28 21:52 - 2014-07-28 21:52 - 00000000 ____D () C:\RegBackup 2014-07-28 21:03 - 2014-07-28 21:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com 2014-07-28 21:03 - 2014-07-28 21:03 - 00000000 ____D () C:\Program Files (x86)\Tweaking.com 2014-07-24 20:07 - 2014-07-24 20:09 - 00002358 _____ () C:\Users\User\Downloads\FSS.txt 2014-07-24 20:07 - 2014-07-24 20:07 - 00415232 _____ () C:\Users\User\Downloads\FSS.exe 2014-07-24 20:03 - 2014-07-24 20:03 - 00000000 ____D () C:\Users\User\AppData\Local\Adobe 2014-07-24 20:01 - 2014-07-24 20:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-07-24 20:01 - 2014-07-11 03:02 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-07-24 20:01 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-07-24 20:01 - 2014-07-11 02:56 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-07-24 20:01 - 2014-07-11 02:55 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-07-24 20:00 - 2014-07-24 20:01 - 00004698 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log 2014-07-24 12:37 - 2014-07-24 12:37 - 00985600 _____ () C:\Users\User\Downloads\MicrosoftFixit50123 (1).msi 2014-07-23 12:37 - 2014-07-23 12:37 - 02347384 _____ (ESET) C:\Users\User\Downloads\esetsmartinstaller_deu.exe 2014-07-23 10:44 - 2014-07-23 10:44 - 00985600 _____ () C:\Users\User\Downloads\MicrosoftFixit50123.msi 2014-07-22 21:59 - 2014-07-29 13:07 - 00000000 ____D () C:\Users\User\Desktop\Hilfe bei Trojanern 2014-07-22 21:25 - 2014-07-22 21:25 - 00000000 ____D () C:\Users\User\Downloads\FRST-OlderVersion 2014-07-22 20:38 - 2014-07-22 20:38 - 00000000 ____D () C:\Windows\ERUNT 2014-07-22 09:33 - 2014-07-22 09:33 - 00002770 _____ () C:\Windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 2014-07-22 09:23 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll 2014-07-21 17:17 - 2014-07-16 10:24 - 00043320 _____ (TuneUp Software) C:\Windows\system32\uxtuneup.dll 2014-07-21 17:17 - 2014-07-16 10:24 - 00036152 _____ (TuneUp Software) C:\Windows\SysWOW64\uxtuneup.dll 2014-07-21 17:17 - 2014-07-16 10:24 - 00029496 _____ (TuneUp Software) C:\Windows\system32\authuitu.dll 2014-07-21 17:17 - 2014-07-16 10:24 - 00025400 _____ (TuneUp Software) C:\Windows\SysWOW64\authuitu.dll 2014-07-11 09:42 - 2014-07-22 09:00 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-07-11 09:41 - 2014-07-11 09:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-07-11 09:41 - 2014-07-11 09:41 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-07-11 09:41 - 2014-07-11 09:41 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-07-11 09:41 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-07-11 09:41 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-07-11 09:41 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-07-11 09:40 - 2014-07-11 09:41 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\User\Downloads\mbam-setup-2.0.2.1012.exe 2014-07-10 10:06 - 2014-07-29 13:07 - 00000000 ____D () C:\FRST 2014-07-10 01:27 - 2014-07-10 01:29 - 00002260 _____ () C:\Windows\logboot_09.07.2014.tureg.log 2014-07-02 20:29 - 2014-07-29 12:42 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-07-02 20:29 - 2014-07-29 11:44 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-07-02 20:29 - 2014-07-02 20:37 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-07-02 20:29 - 2014-07-02 20:37 - 00003850 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-07-02 20:29 - 2014-07-02 20:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-07-02 20:29 - 2014-07-02 20:29 - 00000000 ____D () C:\Program Files (x86)\Google 2014-07-02 19:32 - 2014-07-28 21:51 - 00003704 _____ () C:\Windows\System32\Tasks\Java Update Scheduler 2014-07-02 19:32 - 2014-07-02 19:32 - 00003694 _____ () C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm 2014-07-02 19:18 - 2014-07-16 10:24 - 00040760 _____ (TuneUp Software) C:\Windows\system32\TURegOpt.exe 2014-07-02 19:18 - 2014-07-02 19:18 - 00002207 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014.lnk 2014-07-02 19:18 - 2014-07-02 19:18 - 00000000 ____D () C:\Users\User\AppData\Roaming\TuneUp Software 2014-07-02 19:18 - 2014-07-02 19:18 - 00000000 ____D () C:\Users\User\AppData\Local\TuneUp Software 2014-07-02 19:18 - 2014-07-02 19:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014 2014-07-02 19:17 - 2014-07-21 17:20 - 00000000 ____D () C:\Program Files (x86)\TuneUp Utilities 2014 2014-07-02 19:15 - 2014-07-02 19:26 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2014-07-02 19:15 - 2014-07-02 19:18 - 00000000 ____D () C:\ProgramData\TuneUp Software 2014-07-02 13:14 - 2014-07-02 13:14 - 03589024 _____ (Blizzard Entertainment) C:\Users\User\Downloads\Diablo-III-Setup-deDE.exe 2014-07-02 12:34 - 2014-07-02 12:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data AntiVirus 2014-07-01 21:08 - 2014-07-01 21:08 - 00000000 ____D () C:\Users\User\Documents\Diablo III 2014-07-01 18:22 - 2014-07-01 18:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-07-29 13:07 - 2014-07-22 21:59 - 00000000 ____D () C:\Users\User\Desktop\Hilfe bei Trojanern 2014-07-29 13:07 - 2014-07-10 10:06 - 00000000 ____D () C:\FRST 2014-07-29 12:42 - 2014-07-02 20:29 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-07-29 12:32 - 2012-04-11 21:08 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-07-29 12:25 - 2012-04-12 03:29 - 00058016 _____ () C:\Users\User\AppData\Local\GDIPFONTCACHEV1.DAT 2014-07-29 11:51 - 2009-07-14 06:45 - 00021856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-07-29 11:51 - 2009-07-14 06:45 - 00021856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-07-29 11:47 - 2011-04-26 11:46 - 02036862 _____ () C:\Windows\WindowsUpdate.log 2014-07-29 11:47 - 2010-11-21 08:50 - 00686022 _____ () C:\Windows\system32\perfh007.dat 2014-07-29 11:47 - 2010-11-21 08:50 - 00145596 _____ () C:\Windows\system32\perfc007.dat 2014-07-29 11:47 - 2009-07-14 07:13 - 01622236 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-07-29 11:44 - 2014-07-02 20:29 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-07-29 11:43 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-07-29 11:43 - 2009-07-14 06:51 - 00158388 _____ () C:\Windows\setupact.log 2014-07-29 11:42 - 2011-04-26 15:12 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-07-29 11:42 - 2010-11-21 05:47 - 00362676 _____ () C:\Windows\PFRO.log 2014-07-29 11:42 - 2009-07-14 06:45 - 00275856 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-07-29 11:36 - 2009-07-14 04:34 - 00000439 _____ () C:\Windows\win.ini 2014-07-29 10:58 - 2014-07-29 10:58 - 00003288 ____N () C:\bootsqm.dat 2014-07-29 02:05 - 2013-11-12 16:07 - 01035908 _____ () C:\Windows\IE11_main.log 2014-07-28 22:24 - 2009-07-14 04:34 - 00000855 _____ () C:\Windows\system32\Drivers\etc\hosts_bak_407 2014-07-28 21:52 - 2014-07-28 21:52 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-NICKY-Microsoft-Windows-7-Home-Premium-(64-bit).dat 2014-07-28 21:52 - 2014-07-28 21:52 - 00000000 ____D () C:\RegBackup 2014-07-28 21:51 - 2014-07-02 19:32 - 00003704 _____ () C:\Windows\System32\Tasks\Java Update Scheduler 2014-07-28 21:03 - 2014-07-28 21:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com 2014-07-28 21:03 - 2014-07-28 21:03 - 00000000 ____D () C:\Program Files (x86)\Tweaking.com 2014-07-24 22:33 - 2012-04-11 19:33 - 00000000 ____D () C:\Users\User\AppData\Roaming\TS3Client 2014-07-24 22:31 - 2014-01-27 17:31 - 00000000 ____D () C:\Users\User\AppData\Local\Battle.net 2014-07-24 20:09 - 2014-07-24 20:07 - 00002358 _____ () C:\Users\User\Downloads\FSS.txt 2014-07-24 20:07 - 2014-07-24 20:07 - 00415232 _____ () C:\Users\User\Downloads\FSS.exe 2014-07-24 20:03 - 2014-07-24 20:03 - 00000000 ____D () C:\Users\User\AppData\Local\Adobe 2014-07-24 20:01 - 2014-07-24 20:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-07-24 20:01 - 2014-07-24 20:00 - 00004698 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log 2014-07-24 20:01 - 2013-10-22 17:49 - 00000000 ____D () C:\ProgramData\Oracle 2014-07-24 20:01 - 2013-06-27 12:15 - 00000000 ____D () C:\Program Files (x86)\Java 2014-07-24 19:27 - 2014-01-27 17:31 - 00000000 ____D () C:\Program Files (x86)\Battle.net 2014-07-24 12:37 - 2014-07-24 12:37 - 00985600 _____ () C:\Users\User\Downloads\MicrosoftFixit50123 (1).msi 2014-07-23 12:37 - 2014-07-23 12:37 - 02347384 _____ (ESET) C:\Users\User\Downloads\esetsmartinstaller_deu.exe 2014-07-23 10:44 - 2014-07-23 10:44 - 00985600 _____ () C:\Users\User\Downloads\MicrosoftFixit50123.msi 2014-07-22 22:21 - 2014-01-27 17:34 - 00000000 ____D () C:\Program Files (x86)\Hearthstone 2014-07-22 21:25 - 2014-07-22 21:25 - 00000000 ____D () C:\Users\User\Downloads\FRST-OlderVersion 2014-07-22 21:00 - 2014-02-27 02:21 - 00000000 ____D () C:\AdwCleaner 2014-07-22 21:00 - 2011-09-06 16:57 - 00000999 _____ () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-07-22 20:38 - 2014-07-22 20:38 - 00000000 ____D () C:\Windows\ERUNT 2014-07-22 09:33 - 2014-07-22 09:33 - 00002770 _____ () C:\Windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 2014-07-22 09:00 - 2014-07-11 09:42 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-07-21 17:20 - 2014-07-02 19:17 - 00000000 ____D () C:\Program Files (x86)\TuneUp Utilities 2014 2014-07-21 17:19 - 2012-04-11 19:08 - 00000000 ____D () C:\Program Files (x86)\TeamSpeak 3 Client 2014-07-16 10:24 - 2014-07-21 17:17 - 00043320 _____ (TuneUp Software) C:\Windows\system32\uxtuneup.dll 2014-07-16 10:24 - 2014-07-21 17:17 - 00036152 _____ (TuneUp Software) C:\Windows\SysWOW64\uxtuneup.dll 2014-07-16 10:24 - 2014-07-21 17:17 - 00029496 _____ (TuneUp Software) C:\Windows\system32\authuitu.dll 2014-07-16 10:24 - 2014-07-21 17:17 - 00025400 _____ (TuneUp Software) C:\Windows\SysWOW64\authuitu.dll 2014-07-16 10:24 - 2014-07-02 19:18 - 00040760 _____ (TuneUp Software) C:\Windows\system32\TURegOpt.exe 2014-07-11 09:41 - 2014-07-11 09:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-07-11 09:41 - 2014-07-11 09:41 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-07-11 09:41 - 2014-07-11 09:41 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-07-11 09:41 - 2014-07-11 09:40 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\User\Downloads\mbam-setup-2.0.2.1012.exe 2014-07-11 03:02 - 2014-07-24 20:01 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-07-11 02:56 - 2014-07-24 20:01 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-07-11 02:56 - 2014-07-24 20:01 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-07-11 02:55 - 2014-07-24 20:01 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-07-10 12:39 - 2012-04-12 09:24 - 00000000 ____D () C:\Users\User\AppData\Local\Deployment 2014-07-10 03:04 - 2013-08-14 02:10 - 00000000 ____D () C:\Windows\system32\MRT 2014-07-10 03:03 - 2011-04-27 14:12 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-07-10 01:29 - 2014-07-10 01:27 - 00002260 _____ () C:\Windows\logboot_09.07.2014.tureg.log 2014-07-10 01:29 - 2009-07-14 04:34 - 62652416 _____ () C:\Windows\system32\config\SOFTWARE_tureg_old 2014-07-10 01:29 - 2009-07-14 04:34 - 38273024 _____ () C:\Windows\system32\config\SYSTEM_tureg_old 2014-07-10 01:29 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\SECURITY_tureg_old 2014-07-10 01:26 - 2009-07-14 04:34 - 01048576 _____ () C:\Windows\system32\config\DEFAULT_tureg_old 2014-07-10 01:26 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\SAM_tureg_old 2014-07-08 22:32 - 2012-04-11 21:08 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-07-08 22:32 - 2012-04-11 21:08 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-07-08 22:32 - 2012-04-11 21:08 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-07-03 22:41 - 2011-09-06 16:57 - 00000000 ____D () C:\Users\User\AppData\Local\VirtualStore 2014-07-02 20:37 - 2014-07-02 20:29 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-07-02 20:37 - 2014-07-02 20:29 - 00003850 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-07-02 20:34 - 2013-03-23 23:13 - 00000000 ____D () C:\Users\User\Desktop\Zeugs 2014-07-02 20:29 - 2014-07-02 20:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-07-02 20:29 - 2014-07-02 20:29 - 00000000 ____D () C:\Program Files (x86)\Google 2014-07-02 20:29 - 2012-09-09 04:27 - 00000000 ____D () C:\Users\User\AppData\Local\Google 2014-07-02 19:32 - 2014-07-02 19:32 - 00003694 _____ () C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm 2014-07-02 19:26 - 2014-07-02 19:15 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2014-07-02 19:23 - 2011-04-26 14:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XnView 2014-07-02 19:18 - 2014-07-02 19:18 - 00002207 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014.lnk 2014-07-02 19:18 - 2014-07-02 19:18 - 00000000 ____D () C:\Users\User\AppData\Roaming\TuneUp Software 2014-07-02 19:18 - 2014-07-02 19:18 - 00000000 ____D () C:\Users\User\AppData\Local\TuneUp Software 2014-07-02 19:18 - 2014-07-02 19:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014 2014-07-02 19:18 - 2014-07-02 19:15 - 00000000 ____D () C:\ProgramData\TuneUp Software 2014-07-02 19:05 - 2013-03-14 04:00 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-07-02 13:14 - 2014-07-02 13:14 - 03589024 _____ (Blizzard Entertainment) C:\Users\User\Downloads\Diablo-III-Setup-deDE.exe 2014-07-02 13:13 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF 2014-07-02 12:34 - 2014-07-02 12:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data AntiVirus 2014-07-02 12:34 - 2014-04-10 12:25 - 00020992 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBFlt64.sys 2014-07-02 12:34 - 2014-03-10 12:28 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys 2014-07-02 12:34 - 2014-03-10 12:26 - 00061440 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys 2014-07-02 12:33 - 2014-03-10 12:26 - 00142336 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys 2014-07-02 12:33 - 2014-03-10 12:26 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys 2014-07-02 12:33 - 2014-03-10 12:25 - 00055808 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys 2014-07-02 12:32 - 2011-05-05 16:41 - 00322272 _____ () C:\Windows\DPINST.LOG 2014-07-01 21:08 - 2014-07-01 21:08 - 00000000 ____D () C:\Users\User\Documents\Diablo III 2014-07-01 18:22 - 2014-07-01 18:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III Files to move or delete: ==================== C:\Users\Public\AlexaNSISPlugin.4424.dll Some content of TEMP: ==================== C:\Users\User\AppData\Local\Temp\avgnt.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-07-28 23:42 ==================== End Of Log ============================ --- --- --- FSS Code:
ATTFilter Farbar Service Scanner Version: 21-07-2014 Ran by User (administrator) on 29-07-2014 at 13:13:50 Running from "C:\Users\User\Downloads" Microsoft Windows 7 Home Premium Service Pack 1 (X64) Boot Mode: Normal **************************************************************** Internet Services: ============ Connection Status: ============== Localhost is accessible. LAN connected. Google IP is accessible. Google.com is accessible. Yahoo.com is accessible. Windows Firewall: ============= Firewall Disabled Policy: ================== System Restore: ============ System Restore Disabled Policy: ======================== Action Center: ============ Windows Update: ============ Windows Autoupdate Disabled Policy: ============================ Windows Defender: ============== Other Services: ============== File Check: ======== C:\Windows\System32\nsisvc.dll => File is digitally signed C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed C:\Windows\System32\dhcpcore.dll => File is digitally signed C:\Windows\System32\drivers\afd.sys => File is digitally signed C:\Windows\System32\drivers\tdx.sys => File is digitally signed C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed C:\Windows\System32\dnsrslvr.dll => File is digitally signed C:\Windows\System32\mpssvc.dll => File is digitally signed C:\Windows\System32\bfe.dll => File is digitally signed C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed C:\Windows\System32\SDRSVC.dll => File is digitally signed C:\Windows\System32\vssvc.exe => File is digitally signed C:\Windows\System32\wscsvc.dll => File is digitally signed C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed C:\Windows\System32\wuaueng.dll => File is digitally signed C:\Windows\System32\qmgr.dll => File is digitally signed C:\Windows\System32\es.dll => File is digitally signed C:\Windows\System32\cryptsvc.dll => File is digitally signed C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed C:\Windows\System32\ipnathlp.dll => File is digitally signed C:\Windows\System32\iphlpsvc.dll => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed **** End of log **** |
29.07.2014, 16:20 | #14 |
/// the machine /// TB-Ausbilder | Malware/Windowsupdates zeigen Konfigurationsfehler an und installieren sich nicht mehr Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
30.07.2014, 11:18 | #15 |
| Malware/Windowsupdates zeigen Konfigurationsfehler an und installieren sich nicht mehr Ich habe Probleme beim ersten er findet keine Fixlist...ich hab sie so gespeichert wie angegeben, ok..habs gefunden woran es lag einfach ins Verzeichnis anstatt auf dem Desktop FRST Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 26-07-2014 Ran by User at 2014-07-30 11:37:28 Run:1 Running from C:\Users\User\Desktop\Hilfe bei Trojanern Boot Mode: Normal ============================================== Content of fixlist: ***************** CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ***************** "HKLM\SOFTWARE\Policies\Google" => Key deleted successfully. ==== End of Fixlog ==== Das danach versteh ich nicht wirklich, da ich ja laut Suche keins der Programme drauf habe... "Es gab ein Fehler beim Konfigurieren der Windows-Updates, die Änderungen werden rückgängig gemacht" Stand nun wieder da. Die Einstellung das sie sich automatisch installieren ist schon immer eingestellt, daran habe ich nichts gemacht |
Themen zu Malware/Windowsupdates zeigen Konfigurationsfehler an und installieren sich nicht mehr |
automatische, installieren, installiert, js/toolbar.crossrider.b, nationzoom, nationzoom entfernen, neustart, nicht mehr, rechner, runterfahren, unerwünschte, weiteres, win32/browsercompanion.a, win32/browsercompanion.g, win32/toolbar.babylon.q, win32/toolbar.conduit.q, win32/toolbar.conduit.y, win32/toolbar.searchsuite, windowsupdates, zunächst, zurückgesetzt |