| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: PC extrem lahm - braucht ewig fürs hochfahren...Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
20.08.2014, 22:43
| #1 |
 |  PC extrem lahm - braucht ewig fürs hochfahren... Mir wurde hier schon so gut mit meinem PC und mein Netbook geholfen, nun ist der PC von Junior dran  Wie im Titel schon erwähnt, braucht dieser PC ewig, bis der hochgefahren ist und auch nur einigermassen reagiert - dazu muss ich erwähnen, das "reagieren" lässt da auch schon einiges zu wünschen übrig  Ob das mit meinem Problem überhaupt zutun hat, aber möchte es hierfür trotzdem kurz am rande erwähnen, DVD Laufwerk/Brenner reagiert nur selten, bis gar nicht - die Mouse (egal ob über USB oder die andere Steckmöglichkeit) funzt auch nicht wirklich... Wenn ihr mehr Infos braucht, fragt einfach - weiss sonst leider nicht was ich noch zum Problem schreiben kann, ausser das alles extrem langsam geht... Hier aber erstmal die ersten Logs: defogger: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 21:55 on 20/08/2014 (Freya)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:19-08-2014
Ran by Freya (administrator) on FREYA-PC on 20-08-2014 21:58:02
Running from C:\Users\Freya\Desktop
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(WiseCleaner.com) C:\Program Files\Wise\Wise Care 365\WiseTray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(PixArt Imaging Incorporation) C:\Windows\PixArt\PAC207\Monitor.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
() C:\Program Files\Rainlendar2\Rainlendar2.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10996368 2000-01-01] (Realtek Semiconductor)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-20] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [PAC207_Monitor] => C:\Windows\PixArt\PAC207\Monitor.exe [319488 2006-11-03] (PixArt Imaging Incorporation)
HKLM\...\Run: [Monitor] => C:\Windows\PixArt\PAC207\Monitor.exe [319488 2006-11-03] (PixArt Imaging Incorporation)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2014-05-08] (Adobe Systems Incorporated)
HKU\S-1-5-21-1859236571-841277905-2564189232-1000\...\Run: [Rainlendar2] => C:\Program Files\Rainlendar2\Rainlendar2.exe [2498048 2012-07-02] ()
HKU\S-1-5-21-1859236571-841277905-2564189232-1000\...\Run: [Google Update] => C:\Users\Freya\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-04-21] (Google Inc.)
HKU\S-1-5-21-1859236571-841277905-2564189232-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-1859236571-841277905-2564189232-1000\...\MountPoints2: {37bfa420-3d25-11e1-bd75-001bb95b5021} - E:\setup_vmb_lite.exe /checkApplicationPresence
HKU\S-1-5-21-1859236571-841277905-2564189232-1000\...\MountPoints2: {37bfa42a-3d25-11e1-bd75-001bb95b5021} - J:\setup_vmb_lite.exe /checkApplicationPresence
HKU\S-1-5-21-1859236571-841277905-2564189232-1000\...\MountPoints2: {9a211630-ea67-11e1-9b17-001bb95b5021} - E:\setup_vmb_lite.exe /checkApplicationPresence
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/?affID=116779&tt=4512_3&babsrc=HP_ss&mntrId=9427003d000000000000001bb95b5021
HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://search.babylon.com/?affID=116779&tt=4512_3&babsrc=HP_ss&mntrId=9427003d000000000000001bb95b5021
SearchScopes: HKCU - DefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.claro-search.com/?q={searchTerms}&affID=114508&tt=4312_5&babsrc=SP_clro&mntrId=9427003d000000000000001bb95b5021
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.claro-search.com/?q={searchTerms}&affID=114508&tt=4312_5&babsrc=SP_clro&mntrId=9427003d000000000000001bb95b5021
SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =
BHO: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - No Name - {9E131A93-EED7-4BEB-B015-A0ADB30B5646} - No File
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_65-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0065-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_65-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_65-windows-i586.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Freya\AppData\Roaming\Mozilla\Firefox\Profiles\2xnoprgf.default-1361555679772
FF Homepage: hxxp://paladine.repage.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.5.1 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll No File
FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Freya\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\Freya\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\Freya\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF user.js: detected! => C:\Users\Freya\AppData\Roaming\Mozilla\Firefox\Profiles\2xnoprgf.default-1361555679772\user.js
FF SearchPlugin: C:\Users\Freya\AppData\Roaming\Mozilla\Firefox\Profiles\2xnoprgf.default-1361555679772\searchplugins\babylon.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Greasefire - C:\Users\Freya\AppData\Roaming\Mozilla\Firefox\Profiles\2xnoprgf.default-1361555679772\Extensions\greasefire@skrul.com [2013-02-24]
FF Extension: Greasefire - C:\Users\Freya\AppData\Roaming\Mozilla\Firefox\Profiles\2xnoprgf.default-1361555679772\Extensions\greasefire@skrul.com.xpi [2013-02-24]
FF Extension: Adblock Plus - C:\Users\Freya\AppData\Roaming\Mozilla\Firefox\Profiles\2xnoprgf.default-1361555679772\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-10-10]
FF Extension: Greasemonkey - C:\Users\Freya\AppData\Roaming\Mozilla\Firefox\Profiles\2xnoprgf.default-1361555679772\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2013-08-04]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-01-14]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
Chrome:
=======
CHR StartupUrls: "hxxp://paladine.repage.de/"
CHR DefaultSuggestURL: {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&xssi=t&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Users\Freya\AppData\Local\Google\Chrome\Application\32.0.1700.107\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Freya\AppData\Local\Google\Chrome\Application\32.0.1700.107\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Freya\AppData\Local\Google\Chrome\Application\32.0.1700.107\pdf.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U17) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (McAfee Security Scanner +) - C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll No File
CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Zylom Plugin) - C:\ProgramData\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll No File
CHR Plugin: (Unity Player) - C:\Users\Freya\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
CHR Plugin: (Google Update) - C:\Users\Freya\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Mail.Ru GameCenter Detector) - C:\Users\Freya\AppData\Local\Mail.Ru\GameCenter\NPDetector.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.170.2) - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Extension: (Google Docs) - C:\Users\Freya\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-04-21]
CHR Extension: (Google Drive) - C:\Users\Freya\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-04-21]
CHR Extension: (YouTube) - C:\Users\Freya\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-04-21]
CHR Extension: (Google-Suche) - C:\Users\Freya\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-04-21]
CHR Extension: (AdBlock) - C:\Users\Freya\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-04-21]
CHR Extension: (Wajam) - C:\Users\Freya\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp [2012-10-28]
CHR Extension: (Google Wallet) - C:\Users\Freya\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-17]
CHR Extension: (Google Mail) - C:\Users\Freya\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-04-21]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc.exe [802384 2014-08-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-08-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1021008 2014-08-20] (Avira Operations GmbH & Co. KG)
R2 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [248832 2009-05-21] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-05-21] (Hewlett-Packard Co.) [File not signed]
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]
S2 LiveUpdateSvc; C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe [2152736 2014-05-04] (IObit)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]
S3 WiseBootAssistant; C:\Program Files\Wise\Wise Care 365\BootTime.exe [580648 2012-07-17] (WiseCleaner.com) [File not signed]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-16] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-06-11] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-07] (Avira Operations GmbH & Co. KG)
S3 PAC207; C:\Windows\System32\DRIVERS\PFC027.SYS [616064 2007-10-25] (PixArt Imaging Inc.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [13464 2013-05-31] ()
R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x86.sys [315392 2009-09-28] ()
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-20 21:58 - 2014-08-20 21:59 - 00015362 _____ () C:\Users\Freya\Desktop\FRST.txt
2014-08-20 21:57 - 2014-08-20 21:58 - 00000000 ____D () C:\FRST
2014-08-20 21:55 - 2014-08-20 21:55 - 00000472 _____ () C:\Users\Freya\Desktop\defogger_disable.log
2014-08-20 21:53 - 2014-08-20 21:53 - 01093632 _____ (Farbar) C:\Users\Freya\Desktop\FRST.exe
2014-08-20 21:53 - 2014-08-20 21:53 - 00380416 _____ () C:\Users\Freya\Desktop\Gmer-19357.exe
2014-08-20 21:51 - 2014-08-20 21:51 - 00050477 _____ () C:\Users\Freya\Desktop\Defogger.exe
2014-08-20 21:42 - 2014-08-20 21:45 - 00002564 _____ () C:\DelFix.txt
2014-08-20 21:42 - 2014-08-20 21:42 - 00000000 ____D () C:\Windows\ERUNT
2014-07-29 14:42 - 2012-05-04 19:29 - 00772504 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2014-07-29 14:42 - 2012-05-04 19:29 - 00687504 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2014-07-29 13:52 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-07-29 13:51 - 2014-07-11 03:02 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-07-29 13:51 - 2014-07-11 02:56 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-07-29 13:51 - 2014-07-11 02:55 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-07-29 12:58 - 2014-07-29 12:58 - 00001182 _____ () C:\Users\Freya\Desktop\Revo Uninstaller.lnk
2014-07-29 12:58 - 2014-07-29 12:58 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-07-29 12:51 - 2014-07-29 12:51 - 00000000 _____ () C:\Users\Freya\defogger_reenable
2014-07-29 12:47 - 2014-07-29 12:47 - 00000000 ____D () C:\Users\Freya\Desktop\revouninstaller-portable
2014-07-29 11:48 - 2014-08-20 21:16 - 00000314 _____ () C:\Windows\setupact.log
2014-07-29 11:48 - 2014-07-29 13:38 - 00003530 _____ () C:\Windows\PFRO.log
2014-07-29 11:48 - 2014-07-29 11:48 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-24 11:38 - 2014-07-24 11:39 - 00144896 ___SH () C:\Users\Freya\Desktop\Thumbs.db
2014-07-24 11:33 - 2014-08-20 21:24 - 00251452 _____ () C:\Windows\WindowsUpdate.log
2014-07-24 07:22 - 2014-07-24 07:22 - 00000000 ____D () C:\Users\Freya\AppData\Local\Adobe
2014-07-24 07:20 - 2014-08-20 21:03 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-24 01:21 - 2014-07-24 01:21 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-07-24 01:21 - 2014-07-24 01:21 - 00001949 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-07-23 23:12 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-23 23:12 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-23 23:12 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-23 23:12 - 2014-06-19 01:56 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-23 23:12 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-23 23:12 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-23 23:12 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-23 23:12 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-23 23:12 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-23 23:12 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-23 23:12 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-23 23:12 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-23 23:12 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-23 23:12 - 2014-06-19 01:23 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-23 23:12 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-23 23:12 - 2014-06-19 01:16 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-23 23:12 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-23 23:12 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-23 23:12 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-23 23:12 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-23 23:12 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-23 23:12 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-23 23:12 - 2014-06-19 00:52 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-23 23:12 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-23 23:12 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-23 23:12 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-23 23:12 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-23 23:12 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-23 23:12 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-23 23:12 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-23 23:08 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-23 23:08 - 2014-06-18 02:52 - 02350080 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-23 23:08 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-23 23:08 - 2014-05-30 08:36 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-23 23:07 - 2014-06-30 03:40 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-07-23 23:07 - 2014-06-30 03:36 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-07-23 23:07 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-23 23:07 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-23 23:07 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-23 23:07 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-23 23:07 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-23 23:07 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-23 23:07 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-23 23:02 - 2014-06-05 16:26 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-23 22:52 - 2014-07-23 22:52 - 00000000 ____D () C:\Windows\Tasks\ImCleanDisabled
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-20 21:59 - 2014-08-20 21:58 - 00015362 _____ () C:\Users\Freya\Desktop\FRST.txt
2014-08-20 21:58 - 2014-08-20 21:57 - 00000000 ____D () C:\FRST
2014-08-20 21:57 - 2009-07-14 06:34 - 00020272 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-20 21:57 - 2009-07-14 06:34 - 00020272 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-20 21:55 - 2014-08-20 21:55 - 00000472 _____ () C:\Users\Freya\Desktop\defogger_disable.log
2014-08-20 21:53 - 2014-08-20 21:53 - 01093632 _____ (Farbar) C:\Users\Freya\Desktop\FRST.exe
2014-08-20 21:53 - 2014-08-20 21:53 - 00380416 _____ () C:\Users\Freya\Desktop\Gmer-19357.exe
2014-08-20 21:51 - 2014-08-20 21:51 - 00050477 _____ () C:\Users\Freya\Desktop\Defogger.exe
2014-08-20 21:46 - 2013-04-25 14:31 - 00000000 ____D () C:\Users\Freya\Desktop\TurboRisk_2_0
2014-08-20 21:45 - 2014-08-20 21:42 - 00002564 _____ () C:\DelFix.txt
2014-08-20 21:42 - 2014-08-20 21:42 - 00000000 ____D () C:\Windows\ERUNT
2014-08-20 21:32 - 2013-04-21 11:58 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1859236571-841277905-2564189232-1000UA.job
2014-08-20 21:24 - 2014-07-24 11:33 - 00251452 _____ () C:\Windows\WindowsUpdate.log
2014-08-20 21:16 - 2014-07-29 11:48 - 00000314 _____ () C:\Windows\setupact.log
2014-08-20 21:16 - 2013-02-16 18:57 - 00000000 ____D () C:\Users\Freya\.rainlendar2
2014-08-20 21:16 - 2012-10-23 05:05 - 00000398 _____ () C:\Windows\Tasks\Wise Care 365.job
2014-08-20 21:16 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-20 21:03 - 2014-07-24 07:20 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-20 21:03 - 2013-02-16 18:59 - 00000362 _____ () C:\Windows\Tasks\WpsUpdateTask_Freya.job
2014-08-20 20:58 - 2013-04-21 12:02 - 00002356 _____ () C:\Users\Freya\Desktop\Google Chrome.lnk
2014-08-20 20:12 - 2014-06-10 22:51 - 00000000 ____D () C:\ProgramData\ProductData
2014-08-05 09:20 - 2011-11-29 03:20 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-07-29 18:32 - 2013-12-16 23:31 - 00001068 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1859236571-841277905-2564189232-1000Core1cefaa63e165850.job
2014-07-29 14:52 - 2011-11-29 08:24 - 00000000 ____D () C:\Program Files\Java
2014-07-29 14:38 - 2014-05-13 21:33 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-07-29 14:38 - 2011-11-29 08:24 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-07-29 14:18 - 2014-02-09 10:51 - 00000000 ____D () C:\GamesMailRu
2014-07-29 14:16 - 2013-10-22 12:16 - 00000000 ____D () C:\ProgramData\Oracle
2014-07-29 13:38 - 2014-07-29 11:48 - 00003530 _____ () C:\Windows\PFRO.log
2014-07-29 13:38 - 2014-06-10 22:50 - 00000000 ____D () C:\Program Files\IObit
2014-07-29 13:32 - 2012-10-23 02:45 - 00000000 ____D () C:\Program Files\Wise
2014-07-29 13:30 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-07-29 13:27 - 2013-04-27 18:19 - 00000000 ____D () C:\Users\Freya\AppData\Local\Thunderbird
2014-07-29 13:07 - 2013-04-27 16:51 - 00000000 ____D () C:\Program Files\gs
2014-07-29 13:05 - 2013-02-11 07:24 - 00000000 ____D () C:\Users\Freya\AppData\Local\Mail.Ru
2014-07-29 12:58 - 2014-07-29 12:58 - 00001182 _____ () C:\Users\Freya\Desktop\Revo Uninstaller.lnk
2014-07-29 12:58 - 2014-07-29 12:58 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-07-29 12:51 - 2014-07-29 12:51 - 00000000 _____ () C:\Users\Freya\defogger_reenable
2014-07-29 12:51 - 2011-11-29 03:03 - 00000000 ____D () C:\Users\Freya
2014-07-29 12:47 - 2014-07-29 12:47 - 00000000 ____D () C:\Users\Freya\Desktop\revouninstaller-portable
2014-07-29 11:48 - 2014-07-29 11:48 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-24 14:43 - 2013-05-07 16:36 - 00035848 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-07-24 11:43 - 2012-01-13 09:43 - 00000000 ____D () C:\Program Files\OXXOGames
2014-07-24 11:39 - 2014-07-24 11:38 - 00144896 ___SH () C:\Users\Freya\Desktop\Thumbs.db
2014-07-24 11:34 - 2012-10-23 05:05 - 00000000 ____D () C:\Users\Freya\AppData\Roaming\Wise Care 365
2014-07-24 07:24 - 2012-05-05 02:09 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-07-24 07:22 - 2014-07-24 07:22 - 00000000 ____D () C:\Users\Freya\AppData\Local\Adobe
2014-07-24 07:20 - 2014-02-09 14:38 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-07-24 07:20 - 2014-02-09 14:38 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-07-24 03:24 - 2009-07-14 06:33 - 00303704 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-24 03:23 - 2012-04-19 01:49 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-24 03:21 - 2014-06-10 22:33 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-07-24 03:21 - 2011-04-12 03:38 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-24 03:21 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-07-24 03:03 - 2012-04-19 01:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-07-24 01:21 - 2014-07-24 01:21 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-07-24 01:21 - 2014-07-24 01:21 - 00001949 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-07-24 01:20 - 2011-12-10 19:11 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-07-24 01:20 - 2011-12-10 19:09 - 00000000 ____D () C:\ProgramData\Adobe
2014-07-24 01:19 - 2011-12-10 19:11 - 00000000 ____D () C:\Program Files\Adobe
2014-07-24 00:46 - 2014-06-10 23:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Booster
2014-07-24 00:39 - 2014-06-10 22:44 - 00000000 ____D () C:\Users\Freya\AppData\Roaming\IObit
2014-07-24 00:18 - 2013-08-18 21:38 - 00000000 ____D () C:\Users\Freya\Documents\Haushaltsbuch
2014-07-24 00:11 - 2012-01-13 09:43 - 00000000 ____D () C:\Program Files\DEUTSCHLAND SPIELT
2014-07-23 22:52 - 2014-07-23 22:52 - 00000000 ____D () C:\Windows\Tasks\ImCleanDisabled
2014-07-23 22:48 - 2014-06-10 22:51 - 00000000 ____D () C:\ProgramData\IObit
Some content of TEMP:
====================
C:\Users\Freya\AppData\Local\Temp\avgnt.exe
C:\Users\Freya\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-07-29 16:28
==================== End Of Log ============================
Addition Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version:19-08-2014
Ran by Freya at 2014-08-20 22:00:02
Running from C:\Users\Freya\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
32 Bit HP CIO Components Installer (Version: 7.1.8 - Hewlett-Packard) Hidden
Adobe Flash Player 14 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Antivirus Pro (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.6.552 - Avira)
BufferChm (Version: 130.0.331.000 - Hewlett-Packard) Hidden
Copy (Version: 130.0.366.000 - Hewlett-Packard) Hidden
Destinations (Version: 130.0.0.0 - Hewlett-Packard) Hidden
DeviceDiscovery (Version: 130.0.372.000 - Hewlett-Packard) Hidden
DJ_AIO_06_F2400_SW_Min (Version: 130.0.373.000 - Hewlett-Packard) Hidden
F2400 (Version: 130.0.373.000 - Hewlett-Packard) Hidden
Free-Jahreskalender 2013 (HKLM\...\{7FF30785-278C-4D1C-858B-349F7373A991}) (Version: 9.00.2013 - OW-SOFT)
FreePDF (Remove only) (HKLM\...\FreePDF_XP) (Version: - )
Google Chrome (HKCU\...\Google Chrome) (Version: 36.0.1985.143 - Google Inc.)
GPBaseService2 (Version: 130.0.371.000 - Hewlett-Packard) Hidden
Hewlett-Packard ACLM.NET v1.1.0.0 (Version: 1.00.0000 - Hewlett-Packard) Hidden
HP Customer Participation Program 13.0 (HKLM\...\HPExtendedCapabilities) (Version: 13.0 - HP)
HP Deskjet F2400 All-In-One Driver Software 13.0 Rel .6 (HKLM\...\{CDBF8C2D-04B0-4F9B-9AE1-7422F7F0EC94}) (Version: 13.0 - HP)
HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)
HP Print Projects 1.0 (HKLM\...\HP Print Projects) (Version: 1.0 - HP)
HP Smart Web Printing 4.5 (HKLM\...\HP Smart Web Printing) (Version: 4.5 - HP)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Update (HKLM\...\{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}) (Version: 5.003.001.001 - Hewlett-Packard)
HPDiagnosticAlert (Version: 1.00.0000 - Microsoft) Hidden
HPPhotoGadget (Version: 130.0.282.000 - Hewlett-Packard) Hidden
hpPrintProjects (Version: 130.0.303.000 - Hewlett-Packard) Hidden
HPProductAssistant (Version: 130.0.371.000 - Hewlett-Packard) Hidden
HPSSupply (Version: 130.0.371.000 - Hewlett-Packard) Hidden
hpWLPGInstaller (Version: 130.0.303.000 - Hewlett-Packard) Hidden
IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.36 - Irfan Skiljan)
Java 7 Update 65 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.650 - Oracle)
Java Auto Updater (Version: 2.1.65.20 - Oracle, Inc.) Hidden
Kingsoft Office 2012 (8.1.0.3333) (HKLM\...\Kingsoft Office) (Version: 8.1.0.3333 - Kingsoft Corp.)
MarketResearch (Version: 130.0.374.000 - Hewlett-Packard) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office Access 2003 Runtime (HKLM\...\{901C0407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 30.0 (x86 de) (HKLM\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
MSVCRT (Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.12.5896 - NVIDIA Corporation)
OpenOffice 4.0.1 (HKLM\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
PC Camera (HKLM\...\InstallShield_{C679F9B9-C65D-4C65-BD6C-BF90B859E281}) (Version: 1.0.412 - Ihr Firmenname)
PC Camera (Version: 1.0.412 - Ihr Firmenname) Hidden
PDF24 Creator 5.7.0 (HKLM\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
PVSonyDll (Version: 1.00.0001 - NVIDIA Corporation) Hidden
Rainlendar2 (remove only) (HKLM\...\Rainlendar2) (Version: - )
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7183 - Realtek Semiconductor Corp.)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version: - )
Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Scan (Version: 13.0.0.0 - Hewlett-Packard) Hidden
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 13.0 - HP)
Skype™ 6.11 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
SmartWebPrinting (Version: 130.0.373.000 - Hewlett-Packard) Hidden
SolutionCenter (Version: 130.0.373.000 - Hewlett-Packard) Hidden
Status (Version: 130.0.373.000 - Hewlett-Packard) Hidden
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.13.1 - TeamSpeak Systems GmbH)
Toolbox (Version: 130.0.648.000 - Hewlett-Packard) Hidden
TrayApp (Version: 130.0.376.000 - Hewlett-Packard) Hidden
Unity Web Player (HKLM\...\UnityWebPlayer) (Version: 2.6.1f3_31223 - Unity Technologies ApS)
WebReg (Version: 130.0.132.017 - Hewlett-Packard) Hidden
Windows Live Anmelde-Assistent (HKLM\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Communications Platform (Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8117.0416 - Microsoft Corporation)
Windows Live Essentials (Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM\...\{586509F0-350D-48B5-B763-9CC2F8D96C4C}) (Version: 14.0.8117.416 - Microsoft Corporation)
Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WinRAR 4.20 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
Wise Care 365 version 2.05 (HKLM\...\{E864A1C8-EEE1-47D0-A7F8-00CC86D26D5E}_is1) (Version: 2.05 - WiseCleaner.com, Inc.)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-1859236571-841277905-2564189232-1000_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Users\Freya\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1859236571-841277905-2564189232-1000_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> C:\Users\Freya\AppData\Local\Google\Update\1.3.24.15\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1859236571-841277905-2564189232-1000_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> C:\Users\Freya\AppData\Local\Google\Update\1.3.24.15\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1859236571-841277905-2564189232-1000_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> C:\Users\Freya\AppData\Local\Google\Update\1.3.24.15\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1859236571-841277905-2564189232-1000_Classes\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\localserver32 -> C:\Users\Freya\AppData\Local\Google\Chrome\Application\36.0.1985.143\delegate_execute.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1859236571-841277905-2564189232-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Freya\AppData\Local\Google\Update\1.3.24.15\psuser.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1859236571-841277905-2564189232-1000_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Users\Freya\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1859236571-841277905-2564189232-1000_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Users\Freya\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1859236571-841277905-2564189232-1000_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> C:\Users\Freya\AppData\Local\Google\Update\1.3.24.15\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1859236571-841277905-2564189232-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Freya\AppData\Local\Google\Update\1.3.24.15\psuser.dll (Google Inc.)
==================== Restore Points =========================
20-08-2014 19:44:14 Ende der Bereinigung
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {04E970D5-820A-4B57-90CE-758EF30EE6B1} - System32\Tasks\AdobeFlashPlayerUpdate => C:\Windows\system32\FlashPlayerUpdateService.exe
Task: {1FA2850E-23BD-40D5-9C9D-D1EAD17CFFE3} - System32\Tasks\HP-Online-Aktualisierungsprogramm => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2011-05-10] (Hewlett-Packard)
Task: {2F1BDF3B-9EF4-4920-84D2-2459EEEAF962} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-24] (Adobe Systems Incorporated)
Task: {4C066A25-D3EA-4E01-8118-F0407491AC4A} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {64C692AA-ABE0-4B18-B31A-F632D548C126} - System32\Tasks\YourFile Update => C:\Program Files\YourFileDownloader\YourFileUpdater.exe <==== ATTENTION
Task: {818B2240-3753-4334-B799-073F708645A5} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1859236571-841277905-2564189232-1000Core1cefaa63e165850 => C:\Users\Freya\AppData\Local\Google\Update\GoogleUpdate.exe [2013-04-21] (Google Inc.)
Task: {84FC6916-4E01-467D-8C87-DFC8B60E57BF} - System32\Tasks\WpsUpdateTask_Freya => C:\Program Files\Kingsoft\Kingsoft Office\office6\wpsupdate.exe [2012-09-03] (Zhuhai Kingsoft Office-software Co.,Ltd)
Task: {9A9B1607-178D-4944-B73F-EB83D36721FF} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2014-07-11] (Oracle Corporation)
Task: {AD5CFCCB-9781-4AD8-BFA5-5D2812E42339} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1859236571-841277905-2564189232-1000UA => C:\Users\Freya\AppData\Local\Google\Update\GoogleUpdate.exe [2013-04-21] (Google Inc.)
Task: {D1A60D51-8C3E-44E8-93D4-BBCA42D5EE00} - System32\Tasks\Wise Memory Optimizer Task => C:\Program Files\Wise\Wise Care 365\WiseMemoryOptimzer.exe [2012-10-10] (WiseCleaner.com)
Task: {E8B150B4-72AD-4334-8C46-BADE6174225B} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1859236571-841277905-2564189232-1000Core => C:\Users\Freya\AppData\Local\Google\Update\GoogleUpdate.exe [2013-04-21] (Google Inc.)
Task: {F4CA83B1-B3A5-4D78-A4B0-12D1934B51A1} - System32\Tasks\AdobeFlashPlayerUpdate 2 => C:\Windows\system32\FlashPlayerUpdateService.exe
Task: {FA426ACB-693A-4CA3-9FBD-47632FE508E0} - System32\Tasks\Wise Care 365 => C:\Program Files\Wise\Wise Care 365\WiseTray.exe [2012-09-24] (WiseCleaner.com)
Task: {FB94CD0A-A550-41CF-87B2-A4FDFAF9296F} - System32\Tasks\{9D18C69F-D9AE-4D7C-915A-FC329658E78E} => Firefox.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&ver=4.2.0.169&LastError=404
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Driver Booster Scan.job => C:\Program Files\IObit\Driver Booster\Scheduler.exe
Task: C:\Windows\Tasks\Driver Booster SkipUAC (Freya).job => C:\Program Files\IObit\Driver Booster\DriverBooster.exe
Task: C:\Windows\Tasks\Driver Booster Update.job => C:\Program Files\IObit\Driver Booster\AutoUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1859236571-841277905-2564189232-1000Core1cefaa63e165850.job => C:\Users\Freya\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1859236571-841277905-2564189232-1000UA.job => C:\Users\Freya\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Wise Care 365.job => C:\Program Files\Wise\Wise Care 365\WiseTray.exe
Task: C:\Windows\Tasks\Wise Memory Optimizer Task.job => C:\Program Files\Wise\Wise Care 365\WiseMemoryOptimzer.exe
Task: C:\Windows\Tasks\WpsUpdateTask_Freya.job => C:\Program Files\Kingsoft\Kingsoft Office\office6\wpsupdate.exe
==================== Loaded Modules (whitelisted) =============
2013-04-27 16:51 - 2012-08-18 11:31 - 00116224 _____ () C:\Windows\System32\redmonnt.dll
2012-07-02 09:11 - 2012-07-02 09:11 - 02498048 _____ () C:\Program Files\Rainlendar2\Rainlendar2.exe
2012-05-16 21:01 - 2012-05-16 21:01 - 00140800 _____ () C:\Program Files\Rainlendar2\lua52.dll
2012-07-02 09:11 - 2012-07-02 09:11 - 00198144 _____ () C:\Program Files\Rainlendar2\plugins\iCalendarPlugin.dll
2012-06-17 15:22 - 2012-06-17 15:22 - 00012800 _____ () C:\Program Files\Rainlendar2\lfs.dll
2014-05-13 21:33 - 2014-06-06 06:38 - 03852912 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\TEMP:C0BCE04B
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice => ""="Service"
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (08/20/2014 09:44:11 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {3db8aa63-04a5-485b-b846-c96253930ec2}
Error: (08/20/2014 09:18:04 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/20/2014 08:13:29 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/29/2014 04:00:34 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/29/2014 03:10:43 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Gmer-19357.exe, Version: 2.1.19357.0, Zeitstempel: 0x52e7ea83
Name des fehlerhaften Moduls: Gmer-19357.exe, Version: 2.1.19357.0, Zeitstempel: 0x52e7ea83
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00012298
ID des fehlerhaften Prozesses: 0x850
Startzeit der fehlerhaften Anwendung: 0xGmer-19357.exe0
Pfad der fehlerhaften Anwendung: Gmer-19357.exe1
Pfad des fehlerhaften Moduls: Gmer-19357.exe2
Berichtskennung: Gmer-19357.exe3
Error: (07/29/2014 01:42:26 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {2ad7208e-8fdf-40c3-b7a0-bce128aee85f}
Error: (07/29/2014 01:40:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/29/2014 11:50:28 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/24/2014 11:30:17 AM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {9f67875e-9e46-4cf9-83a9-c054b0b523fe}
Error: (07/24/2014 07:26:38 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (07/23/2014 10:52:41 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Advanced SystemCare Service 7" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (07/23/2014 10:45:51 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Windows Defender" wurde nicht richtig gestartet.
Error: (07/23/2014 10:39:40 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 20.07.2014 um 22:57:44 unerwartet heruntergefahren.
Error: (07/23/2014 10:38:45 PM) (Source: volmgr) (EventID: 46) (User: )
Description: Die Initialisierung des Speicherabbildes ist fehlgeschlagen.
Error: (07/20/2014 10:57:26 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070308 fehlgeschlagen: Sicherheitsupdate für Windows 7 (KB2971850)
Error: (07/20/2014 10:57:20 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070308 fehlgeschlagen: Kumulatives Sicherheitsupdate für Internet Explorer 11 unter Windows 7 (KB2962872)
Error: (07/20/2014 10:56:50 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070308 fehlgeschlagen: Update für Windows 7 (KB2800095)
Error: (07/20/2014 10:56:25 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070308 fehlgeschlagen: Sicherheitsupdate für Windows 7 (KB2973201)
Error: (07/20/2014 10:55:18 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070308 fehlgeschlagen: Update für Windows 7 (KB2966583)
Error: (07/20/2014 10:54:27 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070308 fehlgeschlagen: Sicherheitsupdate für Windows 7 (KB2972280)
Microsoft Office Sessions:
=========================
Error: (08/20/2014 09:44:11 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Zugriff verweigert
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {3db8aa63-04a5-485b-b846-c96253930ec2}
Error: (08/20/2014 09:18:04 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/20/2014 08:13:29 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/29/2014 04:00:34 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/29/2014 03:10:43 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Gmer-19357.exe2.1.19357.052e7ea83Gmer-19357.exe2.1.19357.052e7ea83c00000050001229885001cfab2e31817230C:\Users\Freya\Desktop\Gmer-19357.exeC:\Users\Freya\Desktop\Gmer-19357.exebe9b1e50-1721-11e4-a456-001bb95b5021
Error: (07/29/2014 01:42:26 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Zugriff verweigert
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {2ad7208e-8fdf-40c3-b7a0-bce128aee85f}
Error: (07/29/2014 01:40:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/29/2014 11:50:28 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/24/2014 11:30:17 AM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Zugriff verweigert
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {9f67875e-9e46-4cf9-83a9-c054b0b523fe}
Error: (07/24/2014 07:26:38 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
==================== Memory info ===========================
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 3600+
Percentage of memory in use: 89%
Total physical RAM: 766.49 MB
Available physical RAM: 79.36 MB
Total Pagefile: 1790.49 MB
Available Pagefile: 585.92 MB
Total Virtual: 2047.88 MB
Available Virtual: 1904.52 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:232.88 GB) (Free:126.99 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 8596CDBB)
Partition 1: (Active) - (Size=232.9 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-08-20 23:15:43
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\00000059 ST325082 rev.3.AA 232,89GB
Running: Gmer-19357.exe; Driver: C:\Users\Freya\AppData\Local\Temp\ugloypob.sys
---- System - GMER 2.1 ----
SSDT 88A9922E ZwCreateSection
SSDT 88A99206 ZwCreateSymbolicLinkObject
SSDT 88A9920B ZwLoadDriver
SSDT 88A99201 ZwOpenSection
SSDT 88A99238 ZwRequestWaitReplyPort
SSDT 88A99233 ZwSetContextThread
SSDT 88A9923D ZwSetSecurityObject
SSDT 88A99210 ZwSetSystemInformation
SSDT 88A99242 ZwSystemDebugControl
SSDT 88A991CF ZwTerminateProcess
SSDT 88A991CA ZwWriteVirtualMemory
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!ZwRollbackEnlistment + 142D 82C50A15 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82C8A212 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!KeRemoveQueueEx + 11F7 82C9158C 4 Bytes [2E, 92, A9, 88]
.text ntkrnlpa.exe!KeRemoveQueueEx + 11FF 82C91594 4 Bytes [06, 92, A9, 88]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1313 82C916A8 4 Bytes [0B, 92, A9, 88]
.text ntkrnlpa.exe!KeRemoveQueueEx + 13AF 82C91744 4 Bytes [01, 92, A9, 88]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1553 82C918E8 4 Bytes [38, 92, A9, 88]
.text ...
---- Registry - GMER 2.1 ----
Reg HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@SIGN.MEDIA=8974F30A DiDi 360\xb0\Setup.exe 1
---- EOF - GMER 2.1 ----
 |
| Themen zu PC extrem lahm - braucht ewig fürs hochfahren... |
| adware, antivir, avira, browser, error, fehler, firefox, flash player, google, home, homepage, langsam, mozilla, problem, realtek, registry, rundll, scan, security, services.exe, software, svchost.exe, system, usb, windows |
Baum-Darstellung