![]() |
|
Plagegeister aller Art und deren Bekämpfung: Zip-Datei (Paypal-Rechnung) in eMail-Anhang angeklicktWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
![]() | #1 |
| ![]() Zip-Datei (Paypal-Rechnung) in eMail-Anhang angeklickt Hallo und guten Abend, meine Mutter hat eine SPAM-eMail (Rechnung Paypal) erhalten und leider den Anhang, eine Zip-Datei, angeklickt oder geöffnet. Auf ihrem PC läuft Kaspersky und ich habe einen Scan mit Kaspersky, SpyBot und anderen Scannern gemacht und es wurde nichts gefunden. Leider kenne ich mich nicht sehr gut mit Trojanern etc. aus und möchte euch daher bitten, ob Ihr die Files nach Schädlingen durchsehen könntet oder was ich noch machen kann? Vielen Dank für Eure Hilfe Ben Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2014-08-15 15:47:23 Windows 6.0.6001 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\00000054 Hitachi_ rev.GM4O 465,76GB Running: Gmer-19357.exe; Driver: C:\Users\xxxx\AppData\Local\Temp\kwldrpow.sys ---- System - GMER 2.1 ---- SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwAdjustPrivilegesToken [0x95A76990] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwAlpcConnectPort [0x95A271CE] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwAlpcSendWaitReceivePort [0x95A27400] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwConnectPort [0x95A26FC8] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwCreateSection [0x95A7955C] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwCreateThread [0x95A7898C] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwDebugActiveProcess [0x95A7851E] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwDeviceIoControlFile [0x95A17640] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwDuplicateObject [0x95A76AD2] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwLoadDriver [0x95A765FE] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwMapViewOfSection [0x95A79312] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwOpenProcess [0x95A78052] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwOpenSection [0x95A7978C] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwOpenThread [0x95A7867E] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwQueueApcThread [0x95A791C6] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwReplaceKey [0x95A25680] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwRequestWaitReplyPort [0x95A272D4] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwRestoreKey [0x95A25890] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwResumeThread [0x95A78EE2] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSaveKey [0x95A251A6] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSaveKeyEx [0x95A25340] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSaveMergedKeys [0x95A254E0] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSecureConnectPort [0x95A270C8] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSetContextThread [0x95A79048] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSetInformationToken [0x95A17A5A] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSetSystemInformation [0x95A76936] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSuspendProcess [0x95A7825A] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSuspendThread [0x95A78D82] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSystemDebugControl [0x95A17A6C] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwTerminateProcess [0x95A783C0] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwTerminateThread [0x95A78882] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwUnmapViewOfSection [0x95A79894] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwWriteVirtualMemory [0x95A7961E] SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwCreateThreadEx [0x95A78BD8] ---- Kernel code sections - GMER 2.1 ---- .text ntkrnlpa.exe!KeSetTimerEx + 34C 88701970 4 Bytes [90, 69, A7, 95] .text ntkrnlpa.exe!KeSetTimerEx + 370 88701994 4 Bytes [CE, 71, A2, 95] {INTO ; JNO 0xffffffa5; XCHG EBP, EAX} .text ntkrnlpa.exe!KeSetTimerEx + 3B4 887019D8 4 Bytes [00, 74, A2, 95] {ADD [EDX-0x6b], DH} .text ntkrnlpa.exe!KeSetTimerEx + 3F4 88701A18 4 Bytes [C8, 6F, A2, 95] {ENTER 0xa26f, 0x95} .text ntkrnlpa.exe!KeSetTimerEx + 448 88701A6C 4 Bytes [5C, 95, A7, 95] {POP ESP; XCHG EBP, EAX; CMPSD ; XCHG EBP, EAX} .text ... .text C:\Windows\system32\DRIVERS\atikmdag.sys section is writeable [0x95002000, 0x1F5F94, 0xE8000020] ---- User code sections - GMER 2.1 ---- .text C:\Windows\Explorer.EXE[512] SHELL32.dll!SHFormatDrive + 4EB 75B05764 8 Bytes [80, 11, AA, 61, C0, 11, AA, ...] {ADC BYTE [ECX], 0xaa; POPA ; RCL BYTE [ECX], 0xaa; POPA } ---- Devices - GMER 2.1 ---- AttachedDevice \Driver\tdx \Device\Tcp kltdi.sys AttachedDevice \Driver\tdx \Device\Udp kltdi.sys AttachedDevice \Driver\tdx \Device\RawIp kltdi.sys ---- Processes - GMER 2.1 ---- Process (*** hidden *** ) [4] 8B5628B8 ---- Disk sectors - GMER 2.1 ---- Disk \Device\Harddisk0\DR0 unknown MBR code ---- EOF - GMER 2.1 ---- Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:15-08-2014 Ran by xxxx (administrator) on xxxx-PC on 15-08-2014 15:09:28 Running from C:\Users\xxxx\Downloads Platform: Microsoft® Windows Vista™ Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 7 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe (Microsoft Corporation) C:\Windows\System32\SLsvc.exe (ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe (Realtek Semiconductor) C:\Windows\RtHDVCpl.exe (Hewlett-Packard Company) C:\hp\support\hpsysdrv.exe (OsdMaestro) C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe (Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuSchd2.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (Nuance Communications, Inc.) C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe (Microsoft Corporation) C:\Windows\ehome\ehtray.exe (Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe () C:\Program Files\NETGEAR\WG111v3\WG111v3.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe (Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe () C:\Program Files\Canon\IJPLM\ijplmsvc.exe (TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe (Safer Networking Ltd.) C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Microsoft Corporation) C:\Windows\ehome\ehmsas.exe (Microsoft Corporation) C:\Windows\System32\mobsync.exe (ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe (Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe (TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer.exe (TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\tv_w32.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe (Microsoft Corporation) C:\Windows\System32\wuauclt.exe (TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Desktop.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (Microsoft Corporation) C:\Windows\System32\conime.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe (Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe (Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe (Microsoft Corporation) C:\Windows\System32\conime.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\S-1-5-21-2019164252-3643957268-3047170671-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation) HKU\S-1-5-21-2019164252-3643957268-3047170671-1000\...\Run: [SpybotSD TeaTimer] => C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.) HKU\S-1-5-21-2019164252-3643957268-3047170671-1000\...\RunOnce: [FlashPlayerUpdate] => C:\Windows\system32\Macromed\Flash\FlashUtil32_14_0_0_145_Plugin.exe [851632 2014-07-13] (Adobe Systems Incorporated) HKU\S-1-5-21-2019164252-3643957268-3047170671-1000\...\MountPoints2: {5c9834c4-3bae-11de-9bed-001fc6398558} - F:\rbj9jn1n.bat Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\hpoddt01.exe.lnk ShortcutTarget: hpoddt01.exe.lnk -> C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WG111v3 Smart Wizard.lnk ShortcutTarget: NETGEAR WG111v3 Smart Wizard.lnk -> C:\Program Files\NETGEAR\WG111v3\WG111v3.exe () Startup: C:\Users\inge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=81&bd=Presario&pf=desktop HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=81&bd=Presario&pf=desktop HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=81&bd=Presario&pf=desktop HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=81&bd=Presario&pf=desktop SearchScopes: HKLM - {0F8BC245-2AC7-4F19-8BC0-925B9C49F695} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de SearchScopes: HKLM - {948D8B2B-C96E-4B62-AB42-35F7FFC91A81} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933 SearchScopes: HKCU - {0F8BC245-2AC7-4F19-8BC0-925B9C49F695} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de SearchScopes: HKCU - {948D8B2B-C96E-4B62-AB42-35F7FFC91A81} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933 BHO: Adobe PDF Reader -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) BHO: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.) BHO: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO) BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) BHO: AOL Toolbar Launcher -> {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} -> C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC) BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO) Toolbar: HKLM - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File Toolbar: HKLM - AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC) Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.) Toolbar: HKCU - AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC) DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 FireFox: ======== FF ProfilePath: C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\lhgg7xdv.default FF Homepage: www.gmx.de FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll () FF Plugin: @canon.com/EPPEX -> C:\Program Files\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.) FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.0.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Microsoft .NET Framework Assistant - C:\Users\inge\AppData\Roaming\Mozilla\Firefox\Profiles\lhgg7xdv.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011-07-12] FF Extension: Anti-Banner - C:\Program Files\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak [2014-08-10] FF Extension: Modul zur Link-Untersuchung - C:\Program Files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak [2014-08-10] FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-23] FF HKLM\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\virtualKeyboard@kaspersky.ru FF HKLM\...\Firefox\Extensions: [KavAntiBanner@Kaspersky.ru] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\KavAntiBanner@kaspersky.ru FF HKLM\...\Firefox\Extensions: [linkfilter@kaspersky.ru] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\linkfilter@kaspersky.ru FF HKLM\...\Firefox\Extensions: - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com FF Extension: 卡巴斯基網址顧問 - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-04-18] FF HKLM\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com FF Extension: 虛擬鍵盤 - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-04-18] FF HKLM\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com FF Extension: 惡意網站攔截器 - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-04-18] FF HKLM\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com FF Extension: Chặn quảng cáo - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-04-18] FF HKLM\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com FF Extension: Safe Money - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-04-18] Chrome: ======= CHR HKLM\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - https://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa [] CHR HKLM\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2013-10-17] CHR HKLM\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2013-10-17] CHR HKLM\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2013-10-17] CHR HKLM\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2013-10-17] CHR HKLM\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2013-10-17] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AVP; C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2013-10-17] (Kaspersky Lab ZAO) S3 FirebirdServerMAGIXInstance; C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe [1527900 2005-11-17] (MAGIX®) [File not signed] R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [65536 2007-09-19] (Hewlett-Packard) [File not signed] R2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [140936 2013-05-14] () R2 SBSDWSCService; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R0 AFS; C:\Windows\system32\Drivers\AFS.sys [77004 2010-03-29] (Oak Technology Inc.) [File not signed] R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [135776 2014-04-29] (Kaspersky Lab ZAO) R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [576608 2014-04-29] (Kaspersky Lab ZAO) R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [25696 2013-10-17] (Kaspersky Lab ZAO) R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [25184 2014-04-29] (Kaspersky Lab ZAO) R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [25696 2013-10-17] (Kaspersky Lab ZAO) R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [14432 2013-04-12] (Kaspersky Lab ZAO) R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [45024 2013-05-14] (Kaspersky Lab ZAO) R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [144992 2014-04-29] (Kaspersky Lab ZAO) R3 RTL8187B; C:\Windows\System32\DRIVERS\wg111v3.sys [227328 2007-04-23] (NETGEAR Inc. ) S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X] S3 IpInIp; system32\DRIVERS\ipinip.sys [X] U5 klflt; C:\Windows\System32\Drivers\klflt.sys [94304 2014-04-29] (Kaspersky Lab ZAO) S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] S3 SymIMMP; system32\DRIVERS\SymIM.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-15 15:09 - 2014-08-15 15:10 - 00018227 _____ () C:\Users\xxxx\Downloads\FRST.txt 2014-08-15 15:09 - 2014-08-15 15:09 - 00000000 ____D () C:\FRST 2014-08-15 15:08 - 2014-08-15 15:08 - 01092096 _____ (Farbar) C:\Users\xxxx\Downloads\FRST.exe 2014-08-14 21:43 - 2014-08-14 21:43 - 00001022 _____ () C:\Windows\PFRO.log 2014-08-14 21:36 - 2014-08-14 21:41 - 00000000 ____D () C:\AdwCleaner 2014-08-14 21:14 - 2014-08-14 21:25 - 04813544 _____ (Piriform Ltd) C:\Users\xxxx\Downloads\ccsetup416(1).exe 2014-08-14 21:13 - 2014-08-14 21:14 - 01356107 _____ () C:\Users\xxxx\Downloads\AdwCleaner.exe 2014-08-14 18:54 - 2014-08-14 18:54 - 04813544 _____ (Piriform Ltd) C:\Users\xxxx\Downloads\ccsetup416.exe 2014-08-14 18:45 - 2014-08-14 18:45 - 00118598 _____ () C:\Users\xxxx\Downloads\zbotkiller.zip 2014-08-14 18:38 - 2014-08-14 18:39 - 02347384 _____ (ESET) C:\Users\xxxx\Downloads\esetsmartinstaller_deu.exe 2014-08-14 18:31 - 2014-08-14 18:31 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-08-14 18:29 - 2014-08-14 18:30 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\xxxx\Downloads\mbam-setup-2.0.2.1012.exe 2014-08-14 18:23 - 2014-08-14 18:23 - 00000973 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk 2014-08-14 18:23 - 2014-08-14 18:23 - 00000961 _____ () C:\Users\Public\Desktop\TeamViewer 9.lnk 2014-08-14 18:23 - 2014-08-14 18:23 - 00000000 ____D () C:\Users\xxxx\AppData\Roaming\TeamViewer 2014-08-14 18:22 - 2014-08-14 18:22 - 00000000 ____D () C:\Program Files\TeamViewer 2014-08-14 18:21 - 2014-08-14 18:22 - 06304880 _____ (TeamViewer GmbH) C:\Users\xxxx\Downloads\TeamViewer_Setup_de.exe 2014-08-10 11:44 - 2014-08-10 11:44 - 00000000 ____D () C:\Program Files\Mozilla Firefox ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-15 15:10 - 2014-08-15 15:09 - 00018227 _____ () C:\Users\xxxx\Downloads\FRST.txt 2014-08-15 15:09 - 2014-08-15 15:09 - 00000000 ____D () C:\FRST 2014-08-15 15:08 - 2014-08-15 15:08 - 01092096 _____ (Farbar) C:\Users\xxxx\Downloads\FRST.exe 2014-08-15 15:05 - 2013-09-07 16:36 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-08-15 14:39 - 2006-11-02 14:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2014-08-15 14:39 - 2006-11-02 14:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2014-08-15 14:14 - 2008-03-17 07:29 - 01494328 _____ () C:\Windows\WindowsUpdate.log 2014-08-15 13:59 - 2014-04-18 17:08 - 00000000 ____D () C:\ProgramData\Kaspersky Lab 2014-08-15 12:39 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-08-14 21:43 - 2014-08-14 21:43 - 00001022 _____ () C:\Windows\PFRO.log 2014-08-14 21:43 - 2008-05-11 11:52 - 00122888 _____ () C:\Users\xxxx\AppData\Local\GDIPFONTCACHEV1.DAT 2014-08-14 21:43 - 2006-11-02 14:47 - 00431040 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-08-14 21:41 - 2014-08-14 21:36 - 00000000 ____D () C:\AdwCleaner 2014-08-14 21:41 - 2006-11-02 15:01 - 00032578 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-08-14 21:31 - 2009-03-31 16:58 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy 2014-08-14 21:29 - 2009-08-16 23:15 - 00000000 ____D () C:\Windows\Minidump 2014-08-14 21:29 - 2008-02-27 22:59 - 00000000 ____D () C:\Windows\Panther 2014-08-14 21:25 - 2014-08-14 21:14 - 04813544 _____ (Piriform Ltd) C:\Users\xxxx\Downloads\ccsetup416(1).exe 2014-08-14 21:14 - 2014-08-14 21:13 - 01356107 _____ () C:\Users\xxxx\Downloads\AdwCleaner.exe 2014-08-14 18:54 - 2014-08-14 18:54 - 04813544 _____ (Piriform Ltd) C:\Users\xxxx\Downloads\ccsetup416.exe 2014-08-14 18:45 - 2014-08-14 18:45 - 00118598 _____ () C:\Users\xxxx\Downloads\zbotkiller.zip 2014-08-14 18:39 - 2014-08-14 18:38 - 02347384 _____ (ESET) C:\Users\xxxx\Downloads\esetsmartinstaller_deu.exe 2014-08-14 18:31 - 2014-08-14 18:31 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-08-14 18:30 - 2014-08-14 18:29 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\xxxx\Downloads\mbam-setup-2.0.2.1012.exe 2014-08-14 18:23 - 2014-08-14 18:23 - 00000973 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk 2014-08-14 18:23 - 2014-08-14 18:23 - 00000961 _____ () C:\Users\Public\Desktop\TeamViewer 9.lnk 2014-08-14 18:23 - 2014-08-14 18:23 - 00000000 ____D () C:\Users\xxxx\AppData\Roaming\TeamViewer 2014-08-14 18:22 - 2014-08-14 18:22 - 00000000 ____D () C:\Program Files\TeamViewer 2014-08-14 18:22 - 2014-08-14 18:21 - 06304880 _____ (TeamViewer GmbH) C:\Users\xxxx\Downloads\TeamViewer_Setup_de.exe 2014-08-14 18:19 - 2008-05-11 11:57 - 00000416 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{D907A935-EA0F-484A-BE31-8A648745566F}.job 2014-08-14 03:04 - 2008-05-21 16:00 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-08-14 03:03 - 2013-08-19 10:20 - 00000000 ____D () C:\Windows\system32\MRT 2014-08-14 03:01 - 2006-11-02 12:24 - 96303304 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe 2014-08-13 15:41 - 2012-05-19 19:55 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service 2014-08-10 11:44 - 2014-08-10 11:44 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-08-08 09:11 - 2014-06-19 21:13 - 00000000 ____D () C:\ProgramData\CanonIJPLM 2014-07-31 17:37 - 2008-05-21 16:57 - 00037376 _____ () C:\Users\xxxx\Desktop\xxxx - Golfplätze.xls 2014-07-23 10:52 - 2009-10-18 10:19 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe Files to move or delete: ==================== C:\ProgramData\hpothb07.dat C:\Users\Public\hpothb07.dat Some content of TEMP: ==================== C:\Users\inge\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-08-15 12:45 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version:15-08-2014 Ran by xxxx at 2014-08-15 15:10:38 Running from C:\Users\xxxx\Downloads Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886} AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Update for Microsoft Office 2007 (KB2508958) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version: - Microsoft) 7-Zip 4.57 (HKLM\...\7-Zip) (Version: - ) Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742) (Version: 8.1.2 - Adobe Systems, Inc) Hidden Adobe Flash Player 14 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated) Adobe Flash Player ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 9.0.45.0 - Adobe Systems Incorporated) Adobe Reader 8.1.2 - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-A81200000003}) (Version: 8.1.2 - Adobe Systems Incorporated) Adobe Reader 8.1.2 Security Update 1 (KB403742) (HKLM\...\{AC76BA86-7AD7-1031-7B44-A81200000003}_Adobe Reader 8.1.2 - Deutsch) (Version: - ) AOL Toolbar 5.0 (HKLM\...\AOL Toolbar) (Version: 5.0.67.2 - AOL) ATI Catalyst Install Manager (HKLM\...\{31787FDD-D9FB-C812-4A61-93A1C6B61568}) (Version: 3.0.664.0 - ATI Technologies, Inc.) Brother MFL-Pro Suite DCP-195C (HKLM\...\{6BF66AED-3EA4-4106-B240-5CE96C9B76B0}) (Version: 1.0.0.0 - Brother Industries, Ltd.) Canon Easy-WebPrint EX (HKLM\...\Easy-WebPrint EX) (Version: 1.4.1.0 - Canon Inc.) Canon IJ Scan Utility (HKLM\...\Canon_IJ_Scan_Utility) (Version: - Canon Inc.) Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM\...\CANONIJPLM100) (Version: 4.1.0 - Canon Inc.) Canon MG5500 series Benutzerregistrierung (HKLM\...\Canon MG5500 series Benutzerregistrierung) (Version: - *Canon Inc.) Canon MG5500 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5500_series) (Version: 1.01 - Canon Inc.) Canon My Image Garden (HKLM\...\Canon My Image Garden) (Version: 2.0.1 - Canon Inc.) Canon My Image Garden Design Files (HKLM\...\Canon My Image Garden Design Files) (Version: 2.0.0 - Canon Inc.) Canon My Printer (HKLM\...\CanonMyPrinter) (Version: 3.1.0 - Canon Inc.) Canon Quick Menu (HKLM\...\CanonQuickMenu) (Version: 2.2.1 - Canon Inc.) Cards_Calendar_OrderGift_DoMorePlugout (Version: 1.00.0000 - Hewlett-Packard) Hidden Catalyst Control Center - Branding (HKLM\...\{2E4609A3-F5AF-4408-B0C4-B8B84BC753DF}) (Version: 1.00.0000 - ATI) Catalyst Control Center Core Implementation (Version: 2008.0225.2153.39091 - ATI) Hidden Catalyst Control Center Graphics Full Existing (Version: 2008.0225.2153.39091 - ATI) Hidden Catalyst Control Center Graphics Full New (Version: 2008.0225.2153.39091 - ATI) Hidden Catalyst Control Center Graphics Light (Version: 2008.0225.2153.39091 - ATI) Hidden Catalyst Control Center Graphics Previews Common (Version: 2008.0225.2153.39091 - ATI) Hidden Catalyst Control Center Graphics Previews Vista (Version: 2008.0225.2153.39091 - ATI) Hidden Catalyst Control Center Localization Chinese Standard (Version: 2008.0225.2153.39091 - ATI) Hidden Catalyst Control Center Localization Chinese Traditional (Version: 2008.0225.2153.39091 - ATI) Hidden Catalyst Control Center Localization Czech (Version: 2008.0225.2153.39091 - ATI) Hidden Catalyst Control Center Localization Danish (Version: 2008.0225.2153.39091 - ATI) Hidden Catalyst Control Center Localization Dutch (Version: 2008.0225.2153.39091 - ATI) Hidden Catalyst Control Center Localization Finnish (Version: 2008.0225.2153.39091 - ATI) Hidden Catalyst Control Center Localization French (Version: 2008.0225.2153.39091 - ATI) Hidden Catalyst Control Center Localization German (Version: 2008.0225.2153.39091 - ATI) Hidden Catalyst Control Center Localization Greek (Version: 2008.0225.2153.39091 - ATI) Hidden Catalyst Control Center Localization Hungarian (Version: 2008.0225.2153.39091 - ATI) Hidden Catalyst Control Center Localization Italian (Version: 2008.0225.2153.39091 - ATI) Hidden Catalyst Control Center Localization Japanese (Version: 2008.0225.2153.39091 - ATI) Hidden Catalyst Control Center Localization Korean (Version: 2008.0225.2153.39091 - ATI) Hidden Catalyst Control Center Localization Norwegian (Version: 2008.0225.2153.39091 - ATI) Hidden Catalyst Control Center Localization Polish (Version: 2008.0225.2153.39091 - ATI) Hidden Catalyst Control Center Localization Portuguese (Version: 2008.0225.2153.39091 - ATI) Hidden Catalyst Control Center Localization Russian (Version: 2008.0225.2153.39091 - ATI) Hidden Catalyst Control Center Localization Spanish (Version: 2008.0225.2153.39091 - ATI) Hidden Catalyst Control Center Localization Swedish (Version: 2008.0225.2153.39091 - ATI) Hidden Catalyst Control Center Localization Thai (Version: 2008.0225.2153.39091 - ATI) Hidden Catalyst Control Center Localization Turkish (Version: 2008.0225.2153.39091 - ATI) Hidden CCC Help Chinese Standard (Version: 2008.0225.2152.39091 - ATI) Hidden CCC Help Chinese Traditional (Version: 2008.0225.2152.39091 - ATI) Hidden CCC Help Czech (Version: 2008.0225.2152.39091 - ATI) Hidden CCC Help Danish (Version: 2008.0225.2152.39091 - ATI) Hidden CCC Help Dutch (Version: 2008.0225.2152.39091 - ATI) Hidden CCC Help English (Version: 2008.0225.2152.39091 - ATI) Hidden CCC Help Finnish (Version: 2008.0225.2152.39091 - ATI) Hidden CCC Help French (Version: 2008.0225.2152.39091 - ATI) Hidden CCC Help German (Version: 2008.0225.2152.39091 - ATI) Hidden CCC Help Greek (Version: 2008.0225.2152.39091 - ATI) Hidden CCC Help Hungarian (Version: 2008.0225.2152.39091 - ATI) Hidden CCC Help Italian (Version: 2008.0225.2152.39091 - ATI) Hidden CCC Help Japanese (Version: 2008.0225.2152.39091 - ATI) Hidden CCC Help Korean (Version: 2008.0225.2152.39091 - ATI) Hidden CCC Help Norwegian (Version: 2008.0225.2152.39091 - ATI) Hidden CCC Help Polish (Version: 2008.0225.2152.39091 - ATI) Hidden CCC Help Portuguese (Version: 2008.0225.2152.39091 - ATI) Hidden CCC Help Russian (Version: 2008.0225.2152.39091 - ATI) Hidden CCC Help Spanish (Version: 2008.0225.2152.39091 - ATI) Hidden CCC Help Swedish (Version: 2008.0225.2152.39091 - ATI) Hidden CCC Help Thai (Version: 2008.0225.2152.39091 - ATI) Hidden CCC Help Turkish (Version: 2008.0225.2152.39091 - ATI) Hidden ccc-core-static (Version: 2008.0225.2153.39091 - Ihr Firmenname) Hidden ccc-utility (Version: 2008.0225.2153.39091 - ATI) Hidden Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation) CyberLink DVD Suite Deluxe (HKLM\...\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 5.5.1126 - CyberLink Corp.) Firebird SQL Server - MAGIX Edition (HKLM\...\Firebird SQL Server D) (Version: 2.0.1.8 - MAGIX AG) G3 Manager (HKLM\...\{8D9E93D2-049D-4E9D-B263-13216E20EF1F}) (Version: 1.00.0000 - ) G3 Manager (Version: 1.00.0000 - DECA System) Hidden Hardware Diagnose Tools (HKLM\...\PC-Doctor 5 for Windows) (Version: 5.1.4708.19 - PC-Doctor, Inc.) Hewlett-Packard Active Check (Version: 1.1.11.0 - Hewlett-Packard) Hidden Hewlett-Packard Asset Agent for Health Check (Version: 2.0.62.5 - HP) Hidden High-Definition Video Playback (Version: 11.1.10500.2.65 - Nero AG) Hidden Hoadley Options Strategy Evaluation Tool (HKLM\...\Hoadley Options Strategy Evaluation Tool_is1) (Version: - Peter Hoadley) HP Customer Experience Enhancements (HKLM\...\{C8D47273-7A1A-4614-A3D8-263632D8A5ED}) (Version: 5.6.0.2499 - Hewlett-Packard) HP Customer Feedback (Version: 1.0.0 - Hewlett-Packard) Hidden HP Easy Setup - Frontend (HKLM\...\{1BCE2581-B7CA-4BB4-BDFB-D113506AA38B}) (Version: 5.6.0.2542 - Hewlett-Packard) HP Foto- und Bildbearbeitung 2.0 - All-in-One (Version: 1.10.0000 - Hewlett-Packard Company) Hidden HP Foto- und Bildbearbeitung 2.0 All-in-One Treiber (Version: 1.10.0000 - Hewlett-Packard Company) Hidden HP On-Screen Cap/Num/Scroll Lock Indicator (HKLM\...\OsdMaestro) (Version: - Hewlett-Packard) HP Photosmart Essential 2.5 (HKLM\...\HP Photosmart Essential) (Version: 2.5 - HP) HP Photosmart Essential 2.5 (Version: 1.02.0000 - Hewlett-Packard) Hidden HP Speicher-Disc (HKLM\...\{B376402D-58EA-45EA-BD50-DD924EB67A70}) (Version: 1.0.4.805 - Hewlett-Packard Company) HP Total Care Advisor (HKLM\...\{fef8097e-662d-49b3-aa77-2919db3746d7}) (Version: 1.6.12.2542 - Hewlett-Packard) HP Update (HKLM\...\{11B83AD3-7A46-4C2E-A568-9505981D4C6F}) (Version: 4.000.007.003 - Hewlett-Packard) HPPhotoSmartPhotobookWebPack1 (Version: 1.00.0000 - Hewlett-Packard) Hidden Java(TM) 6 Update 31 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216031FF}) (Version: 6.0.310 - Oracle) Java(TM) SE Runtime Environment 6 Update 1 (HKLM\...\{3248F0A8-6813-11D6-A77B-00B0D0160010}) (Version: 1.6.0.10 - Sun Microsystems, Inc.) Kaspersky Internet Security (HKLM\...\InstallWIX_{6F6873E3-5C92-4049-B511-231A138DD090}) (Version: 14.0.0.4651 - Kaspersky Lab) Kaspersky Internet Security (Version: 14.0.0.4651 - Kaspersky Lab) Hidden MAGIX Fotos auf CD & DVD 7 e-version 7.0.0.22 (D) (HKLM\...\MAGIX Fotos auf CD & DVD 7 e-version D) (Version: 7.0.0.22 - MAGIX AG) MAGIX Online Druck Service 2.3.2.0 (D) (HKLM\...\MAGIX Online Druck Service D) (Version: 2.3.2.0 - MAGIX AG) MAGIX PC Visit (HKLM\...\MAGIX PC Visit D) (Version: 4.3.6.1987 - MAGIX AG) Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version: - Microsoft Corporation) Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation) Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft) Microsoft Office 2007 Service Pack 3 (SP3) (Version: - Microsoft) Hidden Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation) Microsoft Office Groove MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation) Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version: - Microsoft) Hidden Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation) Mozilla Firefox 31.0 (x86 de) (HKLM\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla) Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla) MSXML 4.0 SP2 (KB936181) (HKLM\...\{C04E32E0-0416-434D-AFB9-6969D703A9EF}) (Version: 4.20.9848.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB941833) (HKLM\...\{C523D256-313D-4866-B36A-F3DE528246EF}) (Version: 4.20.9849.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) My HP Games (HKLM\...\WildTangent hp Master Uninstall) (Version: HPCMPQ1902 - WildTangent) Nero 11 Disc Menus Basic (Version: 11.0.11200.12.0 - Nero AG) Hidden Nero Audio Pack 1 (Version: 11.0.11500.110.0 - Nero AG) Hidden Nero ControlCenter 11 (Version: 11.0.12700.0.27 - Nero AG) Hidden Nero Core Components 11 (Version: 11.0.15600.1.17 - Nero AG) Hidden NETGEAR WG111v3 wireless USB 2.0 adapter (HKLM\...\InstallShield_{5396FBD8-8BD7-47F9-92AE-F62F13D5A11D}) (Version: 1.00.0000 - NETGEAR) NETGEAR WG111v3 wireless USB 2.0 adapter (Version: 1.00.0000 - NETGEAR) Hidden Newshosting (HKLM\...\{7E509AFB-E2B5-46A8-B96A-73C40C2782C2}) (Version: 1.3.2 - Newshosting) NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: - ) Opera Stable 18.0.1284.68 (HKLM\...\Opera 18.0.1284.68) (Version: 18.0.1284.68 - Opera Software ASA) PaperPort Image Printer (HKLM\...\{2BC2781A-F7F6-452E-95EB-018A522F1B2C}) (Version: 1.00.0000 - Nuance Communications, Inc.) PL-2303 USB-to-Serial (HKLM\...\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}) (Version: - ) Power2Go (HKLM\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.3610 - CyberLink Corp.) PowerDirector (HKLM\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 6.5.2420 - CyberLink Corp.) PowerDirector (Version: 6.5.2420 - CyberLink Corp.) Hidden PSSWCORE (Version: 2.02.0000 - Hewlett-Packard) Hidden Python 2.5 (HKLM\...\{0A2C5854-557E-48C8-835A-3B9F074BDCAA}) (Version: 2.5.150 - Martin v. Löwis) Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: - ) ScanSoft PaperPort 11 (HKLM\...\{02570AE0-BEE0-4A6C-BE3F-D806E9F2EA17}) (Version: 11.2.0000 - Nuance Communications, Inc.) Silicon Laboratories CP210x USB to UART Bridge (Driver Removal) (HKLM\...\SLABCOMM&10C4&EA60) (Version: - ) Silicon Laboratories CP210x VCP Drivers for Windows 2000/XP/2003 Server/Vista (HKLM\...\{017EB9F9-31B2-4AC0-9171-7791476DC74D}) (Version: 5.40.24 - Silicon Laboratories, Inc.) Skins (Version: 2008.0225.2153.39091 - ATI) Hidden SofTax GR 2012 NP (HKLM\...\SofTax GR 2012 NP) (Version: 1.0.4.3564 - Abraxas Informatik AG) Sonocaddie (HKLM\...\{B79AA6EB-103F-4426-8BD2-2BD18F75F1B0}) (Version: 1.0.2 - Sonostar) Spybot - Search & Destroy (HKLM\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited) TeamViewer 9 (HKLM\...\TeamViewer 9) (Version: 9.0.31064 - TeamViewer) Testversion von Microsoft Office Home and Student 2007 (HKLM\...\OfficeTrial) (Version: - ) Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft) Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version: - Microsoft) Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version: - Microsoft) Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2883097) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{B2260BC9-D561-46EE-B33D-739CF760A2A9}) (Version: - Microsoft) Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft) Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft) Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft) Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft) VideoToolkit01 (Version: 100.0.128.000 - Hewlett-Packard) Hidden VLC media player 2.0.1 (HKLM\...\VLC media player) (Version: 2.0.1 - VideoLAN) WinRAR (HKLM\...\WinRAR archiver) (Version: - ) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) CustomCLSID: HKU\S-1-5-21-2019164252-3643957268-3047170671-1000_Classes\CLSID\{589CEADF-0E01-4892-97F2-AA80B186569C}\InprocServer32 -> C:\Windows\system32\SnCmuicateTask.dll (Sonostar Inc.) CustomCLSID: HKU\S-1-5-21-2019164252-3643957268-3047170671-1000_Classes\CLSID\{EBDE6312-4A82-4504-A568-942234A858A2}\InprocServer32 -> C:\Windows\system32\SnCmuicate.dll (Sonostar Inc.) ==================== Restore Points ========================= 11-04-2014 23:14:41 Windows Update 11-04-2014 23:22:51 Windows Update 17-04-2014 08:28:03 Windows Update 17-04-2014 08:36:38 Windows Update 18-04-2014 13:50:33 Windows Update 18-04-2014 15:09:57 Gerätetreiber-Paketinstallation: Kaspersky Lab Netzwerkdienst 29-04-2014 17:16:54 Windows Update 06-05-2014 14:00:04 Windows Update 07-05-2014 15:38:23 Geplanter Prüfpunkt 14-05-2014 07:05:59 Windows Update 16-05-2014 14:54:05 Windows Update 18-05-2014 06:50:56 Windows Update 29-05-2014 15:19:17 Windows Update 03-06-2014 13:02:49 Windows Update 06-06-2014 20:59:52 Windows Update 19-06-2014 19:14:50 Gerätetreiber-Paketinstallation: Canon Drucker 19-06-2014 19:17:44 Gerätetreiber-Paketinstallation: Canon Bildverarbeitungsgeräte 19-06-2014 19:35:52 Windows Update 19-06-2014 19:45:38 Windows Update 05-07-2014 14:32:33 Windows Update 13-07-2014 12:28:52 Windows Update 18-07-2014 06:01:57 Windows Update 18-07-2014 06:07:51 Windows Update 20-07-2014 09:28:12 Geplanter Prüfpunkt 20-07-2014 10:15:22 Windows Update 01-08-2014 12:31:34 Windows Update 08-08-2014 06:52:59 Windows Update 13-08-2014 18:24:06 Windows Update 14-08-2014 01:00:31 Windows Update 14-08-2014 20:15:57 Geplanter Prüfpunkt 15-08-2014 11:34:48 Geplanter Prüfpunkt 15-08-2014 12:12:04 Windows Update ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2006-11-02 12:23 - 2012-05-19 20:38 - 00442859 ____R C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 localhost 127.0.0.1 www.007guard.com 127.0.0.1 007guard.com 127.0.0.1 008i.com 127.0.0.1 www.008k.com 127.0.0.1 008k.com 127.0.0.1 www.00hq.com 127.0.0.1 00hq.com 127.0.0.1 010402.com 127.0.0.1 www.032439.com 127.0.0.1 032439.com 127.0.0.1 www.0scan.com 127.0.0.1 0scan.com 127.0.0.1 1000gratisproben.com 127.0.0.1 www.1000gratisproben.com 127.0.0.1 1001namen.com 127.0.0.1 www.1001namen.com 127.0.0.1 www.100888290cs.com 127.0.0.1 100888290cs.com 127.0.0.1 100sexlinks.com 127.0.0.1 www.100sexlinks.com 127.0.0.1 www.10sek.com 127.0.0.1 10sek.com 127.0.0.1 1-2005-search.com 127.0.0.1 www.1-2005-search.com 127.0.0.1 www.123fporn.info 127.0.0.1 123fporn.info 127.0.0.1 www.123haustiereundmehr.com 127.0.0.1 123haustiereundmehr.com There are 1000 more lines. ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-19] (Microsoft Corporation) Task: {474F0299-94F4-4E52-8E20-B5380BA89218} - System32\Tasks\JavaUpdatexxxx => C:\Windows\system32\jusched.exe Task: {8A2591F8-6A9F-4F61-864D-83F8E970A08E} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI Task: {9A8D1FB1-5218-4CF7-9D2C-FA9E8E895ADB} - System32\Tasks\JavaUpdateAdministrator => C:\Windows\system32\jusched.exe Task: {A728AE6B-5AB8-4223-AD3E-E6341441A01C} - System32\Tasks\Microsoft\Windows\PLA\System\ConvertLogEntries => Rundll32.exe %windir%\system32\pla.dll,PlaConvertLogEntries Task: {C63691CD-CC8C-4883-B834-0ABF11302D17} - System32\Tasks\PC-Doctor\Scheduled Maintenance => C:\Program Files\PC-Doctor 5 for Windows\RunProfiler.exe [2007-10-04] (PC-Doctor, Inc.) Task: {D00437F4-CCA9-4974-A923-19AC1A3481DF} - System32\Tasks\PC-Doctor\Scheduled Maintenance Swap => C:\Program Files\PC-Doctor 5 for Windows\task_swap.bat [2008-02-27] () Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-05] () Task: {EB93BD1F-4E2C-40BD-A34D-8646CB4A5F85} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-13] (Adobe Systems Incorporated) (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\User_Feed_Synchronization-{D907A935-EA0F-484A-BE31-8A648745566F}.job => C:\Windows\system32\msfeedssync.exe ==================== Loaded Modules (whitelisted) ============= 2008-02-27 23:38 - 2008-02-25 22:10 - 00159744 _____ () C:\Windows\system32\atitmmxx.dll 2006-05-29 20:29 - 2006-05-29 20:29 - 01708032 _____ () C:\Program Files\NETGEAR\WG111v3\WG111v3.exe 2013-06-17 12:35 - 2013-06-17 12:35 - 00478400 _____ () C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\dblite.dll 2013-05-08 14:52 - 2013-05-08 14:52 - 01270464 _____ () C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\kpcengine.2.3.dll 2014-06-19 21:42 - 2013-05-14 11:50 - 00140936 _____ () C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE 2014-08-10 11:44 - 2014-08-10 11:44 - 03800688 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll 2014-07-13 15:05 - 2014-07-13 15:05 - 17029808 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (08/15/2014 00:40:25 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: ) Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei. Error: (08/14/2014 09:44:22 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: ) Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei. Error: (08/14/2014 06:19:00 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: ) Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei. Error: (08/13/2014 08:03:38 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: ) Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei. Error: (08/13/2014 03:42:35 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: ) Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei. Error: (08/13/2014 02:16:29 PM) (Source: LoadPerf) (EventID: 3002) (User: ) Description: :16 Error: (08/13/2014 02:10:50 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: ) Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei. Error: (08/10/2014 00:10:12 PM) (Source: EventSystem) (EventID: 4621) (User: ) Description: 80070005EventSystem.EventSubscription{CEB8B221-89C5-41A8-98CE-79B413BF150B}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000} Error: (08/10/2014 11:03:49 AM) (Source: LoadPerf) (EventID: 3002) (User: ) Description: :16 Error: (08/10/2014 10:58:40 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: ) Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei. System errors: ============= Error: (08/15/2014 00:39:58 PM) (Source: Dhcp) (EventID: 1002) (User: ) Description: Die IP-Adresslease 192.168.0.6 für die Netzwerkkarte mit der Netzwerkadresse 001B2F360DDE wurde durch den DHCP-Server 192.168.0.1 abgelehnt (der DHCP-Server hat eine DHCPNACK-Meldung gesendet). Error: (08/15/2014 00:39:39 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Parallel port driver%%1058 Error: (08/15/2014 00:39:30 PM) (Source: HTTP) (EventID: 15016) (User: ) Description: \Device\Http\ReqQueueKerberos Error: (08/14/2014 09:43:32 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Parallel port driver%%1058 Error: (08/14/2014 09:43:17 PM) (Source: HTTP) (EventID: 15016) (User: ) Description: \Device\Http\ReqQueueKerberos Error: (08/14/2014 06:18:40 PM) (Source: Dhcp) (EventID: 1002) (User: ) Description: Die IP-Adresslease 192.168.0.6 für die Netzwerkkarte mit der Netzwerkadresse 001B2F360DDE wurde durch den DHCP-Server 192.168.0.1 abgelehnt (der DHCP-Server hat eine DHCPNACK-Meldung gesendet). Error: (08/14/2014 06:18:28 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Parallel port driver%%1058 Error: (08/14/2014 06:18:19 PM) (Source: HTTP) (EventID: 15016) (User: ) Description: \Device\Http\ReqQueueKerberos Error: (08/14/2014 06:18:17 PM) (Source: EventLog) (EventID: 6008) (User: ) Description: Das System wurde zuvor am 14.08.2014 um 08:27:35 unerwartet heruntergefahren. Error: (08/14/2014 03:04:05 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Windows Search%%1053 Microsoft Office Sessions: ========================= Error: (08/06/2009 00:17:02 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 18 seconds with 0 seconds of active time. This session ended with a crash. Error: (08/03/2009 11:45:02 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 1 seconds with 0 seconds of active time. This session ended with a crash. CodeIntegrity Errors: =================================== Date: 2014-08-15 15:10:09.185 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-08-15 15:10:08.980 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-08-15 15:10:08.775 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-08-15 15:10:08.561 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-08-15 15:10:08.313 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-08-15 15:10:08.106 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-08-15 15:10:07.896 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-08-15 15:10:07.690 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-08-15 15:09:59.263 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\kneps.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-08-15 15:09:59.061 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\kneps.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. ==================== Memory info =========================== Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 5000+ Percentage of memory in use: 58% Total physical RAM: 3069.77 MB Available physical RAM: 1284.78 MB Total Pagefile: 6355.77 MB Available Pagefile: 4555.95 MB Total Virtual: 2047.88 MB Available Virtual: 1895.13 MB ==================== Drives ================================ Drive c: (COMPAQ) (Fixed) (Total:455.53 GB) (Free:347.8 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Drive d: (FACTORY_IMAGE) (Fixed) (Total:10.23 GB) (Free:1.41 GB) NTFS ==>[System with boot components (obtained from reading drive)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 466 GB) (Disk ID: 1549F232) Partition 1: (Active) - (Size=456 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=10 GB) - (Type=07 NTFS) ==================== End Of Log ============================ |
Themen zu Zip-Datei (Paypal-Rechnung) in eMail-Anhang angeklickt |
adware, branding, browser, canon, ccsetup, ebanking, excel, feedback, firefox, flash player, home, homepage, installation, kaspersky, mozilla, netgear, port, realtek, registry, rundll, safer networking, scan, security, services.exe, software, svchost.exe, system, tcp, trojaner, udp, usb |