| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Zip-Datei (Paypal-Rechnung) in eMail-Anhang angeklicktWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
25.08.2014, 20:06
| #1 |
| |  Zip-Datei (Paypal-Rechnung) in eMail-Anhang angeklickt Hallo und guten Abend, meine Mutter hat eine SPAM-eMail (Rechnung Paypal) erhalten und leider den Anhang, eine Zip-Datei, angeklickt oder geöffnet. Auf ihrem PC läuft Kaspersky und ich habe einen Scan mit Kaspersky, SpyBot und anderen Scannern gemacht und es wurde nichts gefunden. Leider kenne ich mich nicht sehr gut mit Trojanern etc. aus und möchte euch daher bitten, ob Ihr die Files nach Schädlingen durchsehen könntet oder was ich noch machen kann? Vielen Dank für Eure Hilfe Ben Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-08-15 15:47:23
Windows 6.0.6001 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\00000054 Hitachi_ rev.GM4O 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\xxxx\AppData\Local\Temp\kwldrpow.sys
---- System - GMER 2.1 ----
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwAdjustPrivilegesToken [0x95A76990]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwAlpcConnectPort [0x95A271CE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwAlpcSendWaitReceivePort [0x95A27400]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwConnectPort [0x95A26FC8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwCreateSection [0x95A7955C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwCreateThread [0x95A7898C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwDebugActiveProcess [0x95A7851E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwDeviceIoControlFile [0x95A17640]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwDuplicateObject [0x95A76AD2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwLoadDriver [0x95A765FE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwMapViewOfSection [0x95A79312]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwOpenProcess [0x95A78052]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwOpenSection [0x95A7978C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwOpenThread [0x95A7867E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwQueueApcThread [0x95A791C6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwReplaceKey [0x95A25680]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwRequestWaitReplyPort [0x95A272D4]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwRestoreKey [0x95A25890]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwResumeThread [0x95A78EE2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSaveKey [0x95A251A6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSaveKeyEx [0x95A25340]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSaveMergedKeys [0x95A254E0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSecureConnectPort [0x95A270C8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSetContextThread [0x95A79048]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSetInformationToken [0x95A17A5A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSetSystemInformation [0x95A76936]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSuspendProcess [0x95A7825A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSuspendThread [0x95A78D82]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSystemDebugControl [0x95A17A6C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwTerminateProcess [0x95A783C0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwTerminateThread [0x95A78882]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwUnmapViewOfSection [0x95A79894]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwWriteVirtualMemory [0x95A7961E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwCreateThreadEx [0x95A78BD8]
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!KeSetTimerEx + 34C 88701970 4 Bytes [90, 69, A7, 95]
.text ntkrnlpa.exe!KeSetTimerEx + 370 88701994 4 Bytes [CE, 71, A2, 95] {INTO ; JNO 0xffffffa5; XCHG EBP, EAX}
.text ntkrnlpa.exe!KeSetTimerEx + 3B4 887019D8 4 Bytes [00, 74, A2, 95] {ADD [EDX-0x6b], DH}
.text ntkrnlpa.exe!KeSetTimerEx + 3F4 88701A18 4 Bytes [C8, 6F, A2, 95] {ENTER 0xa26f, 0x95}
.text ntkrnlpa.exe!KeSetTimerEx + 448 88701A6C 4 Bytes [5C, 95, A7, 95] {POP ESP; XCHG EBP, EAX; CMPSD ; XCHG EBP, EAX}
.text ...
.text C:\Windows\system32\DRIVERS\atikmdag.sys section is writeable [0x95002000, 0x1F5F94, 0xE8000020]
---- User code sections - GMER 2.1 ----
.text C:\Windows\Explorer.EXE[512] SHELL32.dll!SHFormatDrive + 4EB 75B05764 8 Bytes [80, 11, AA, 61, C0, 11, AA, ...] {ADC BYTE [ECX], 0xaa; POPA ; RCL BYTE [ECX], 0xaa; POPA }
---- Devices - GMER 2.1 ----
AttachedDevice \Driver\tdx \Device\Tcp kltdi.sys
AttachedDevice \Driver\tdx \Device\Udp kltdi.sys
AttachedDevice \Driver\tdx \Device\RawIp kltdi.sys
---- Processes - GMER 2.1 ----
Process (*** hidden *** ) [4] 8B5628B8
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:15-08-2014
Ran by xxxx (administrator) on xxxx-PC on 15-08-2014 15:09:28
Running from C:\Users\xxxx\Downloads
Platform: Microsoft® Windows Vista™ Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 7
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(Hewlett-Packard Company) C:\hp\support\hpsysdrv.exe
(OsdMaestro) C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(Nuance Communications, Inc.) C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
() C:\Program Files\NETGEAR\WG111v3\WG111v3.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
() C:\Program Files\Canon\IJPLM\ijplmsvc.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(Safer Networking Ltd.) C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\tv_w32.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Desktop.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-2019164252-3643957268-3047170671-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-2019164252-3643957268-3047170671-1000\...\Run: [SpybotSD TeaTimer] => C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
HKU\S-1-5-21-2019164252-3643957268-3047170671-1000\...\RunOnce: [FlashPlayerUpdate] => C:\Windows\system32\Macromed\Flash\FlashUtil32_14_0_0_145_Plugin.exe [851632 2014-07-13] (Adobe Systems Incorporated)
HKU\S-1-5-21-2019164252-3643957268-3047170671-1000\...\MountPoints2: {5c9834c4-3bae-11de-9bed-001fc6398558} - F:\rbj9jn1n.bat
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\hpoddt01.exe.lnk
ShortcutTarget: hpoddt01.exe.lnk -> C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WG111v3 Smart Wizard.lnk
ShortcutTarget: NETGEAR WG111v3 Smart Wizard.lnk -> C:\Program Files\NETGEAR\WG111v3\WG111v3.exe ()
Startup: C:\Users\inge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=81&bd=Presario&pf=desktop
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=81&bd=Presario&pf=desktop
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=81&bd=Presario&pf=desktop
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=81&bd=Presario&pf=desktop
SearchScopes: HKLM - {0F8BC245-2AC7-4F19-8BC0-925B9C49F695} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de
SearchScopes: HKLM - {948D8B2B-C96E-4B62-AB42-35F7FFC91A81} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
SearchScopes: HKCU - {0F8BC245-2AC7-4F19-8BC0-925B9C49F695} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de
SearchScopes: HKCU - {948D8B2B-C96E-4B62-AB42-35F7FFC91A81} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
BHO: Adobe PDF Reader -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: AOL Toolbar Launcher -> {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} -> C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Toolbar: HKLM - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKLM - AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKCU - AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\lhgg7xdv.default
FF Homepage: www.gmx.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin: @canon.com/EPPEX -> C:\Program Files\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.)
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Microsoft .NET Framework Assistant - C:\Users\inge\AppData\Roaming\Mozilla\Firefox\Profiles\lhgg7xdv.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011-07-12]
FF Extension: Anti-Banner - C:\Program Files\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak [2014-08-10]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak [2014-08-10]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-23]
FF HKLM\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\virtualKeyboard@kaspersky.ru
FF HKLM\...\Firefox\Extensions: [KavAntiBanner@Kaspersky.ru] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\KavAntiBanner@kaspersky.ru
FF HKLM\...\Firefox\Extensions: [linkfilter@kaspersky.ru] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\linkfilter@kaspersky.ru
FF HKLM\...\Firefox\Extensions: - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: 卡巴斯基網址顧問 - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-04-18]
FF HKLM\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: 虛擬鍵盤 - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-04-18]
FF HKLM\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: 惡意網站攔截器 - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-04-18]
FF HKLM\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Chặn quảng cáo - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-04-18]
FF HKLM\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-04-18]
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - https://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa []
CHR HKLM\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2013-10-17]
CHR HKLM\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2013-10-17]
CHR HKLM\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2013-10-17]
CHR HKLM\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2013-10-17]
CHR HKLM\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2013-10-17]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AVP; C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2013-10-17] (Kaspersky Lab ZAO)
S3 FirebirdServerMAGIXInstance; C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe [1527900 2005-11-17] (MAGIX®) [File not signed]
R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [65536 2007-09-19] (Hewlett-Packard) [File not signed]
R2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [140936 2013-05-14] ()
R2 SBSDWSCService; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R0 AFS; C:\Windows\system32\Drivers\AFS.sys [77004 2010-03-29] (Oak Technology Inc.) [File not signed]
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [135776 2014-04-29] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [576608 2014-04-29] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [25696 2013-10-17] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [25184 2014-04-29] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [25696 2013-10-17] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [14432 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [45024 2013-05-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [144992 2014-04-29] (Kaspersky Lab ZAO)
R3 RTL8187B; C:\Windows\System32\DRIVERS\wg111v3.sys [227328 2007-04-23] (NETGEAR Inc. )
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
U5 klflt; C:\Windows\System32\Drivers\klflt.sys [94304 2014-04-29] (Kaspersky Lab ZAO)
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 SymIMMP; system32\DRIVERS\SymIM.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-15 15:09 - 2014-08-15 15:10 - 00018227 _____ () C:\Users\xxxx\Downloads\FRST.txt
2014-08-15 15:09 - 2014-08-15 15:09 - 00000000 ____D () C:\FRST
2014-08-15 15:08 - 2014-08-15 15:08 - 01092096 _____ (Farbar) C:\Users\xxxx\Downloads\FRST.exe
2014-08-14 21:43 - 2014-08-14 21:43 - 00001022 _____ () C:\Windows\PFRO.log
2014-08-14 21:36 - 2014-08-14 21:41 - 00000000 ____D () C:\AdwCleaner
2014-08-14 21:14 - 2014-08-14 21:25 - 04813544 _____ (Piriform Ltd) C:\Users\xxxx\Downloads\ccsetup416(1).exe
2014-08-14 21:13 - 2014-08-14 21:14 - 01356107 _____ () C:\Users\xxxx\Downloads\AdwCleaner.exe
2014-08-14 18:54 - 2014-08-14 18:54 - 04813544 _____ (Piriform Ltd) C:\Users\xxxx\Downloads\ccsetup416.exe
2014-08-14 18:45 - 2014-08-14 18:45 - 00118598 _____ () C:\Users\xxxx\Downloads\zbotkiller.zip
2014-08-14 18:38 - 2014-08-14 18:39 - 02347384 _____ (ESET) C:\Users\xxxx\Downloads\esetsmartinstaller_deu.exe
2014-08-14 18:31 - 2014-08-14 18:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-14 18:29 - 2014-08-14 18:30 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\xxxx\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-14 18:23 - 2014-08-14 18:23 - 00000973 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk
2014-08-14 18:23 - 2014-08-14 18:23 - 00000961 _____ () C:\Users\Public\Desktop\TeamViewer 9.lnk
2014-08-14 18:23 - 2014-08-14 18:23 - 00000000 ____D () C:\Users\xxxx\AppData\Roaming\TeamViewer
2014-08-14 18:22 - 2014-08-14 18:22 - 00000000 ____D () C:\Program Files\TeamViewer
2014-08-14 18:21 - 2014-08-14 18:22 - 06304880 _____ (TeamViewer GmbH) C:\Users\xxxx\Downloads\TeamViewer_Setup_de.exe
2014-08-10 11:44 - 2014-08-10 11:44 - 00000000 ____D () C:\Program Files\Mozilla Firefox
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-15 15:10 - 2014-08-15 15:09 - 00018227 _____ () C:\Users\xxxx\Downloads\FRST.txt
2014-08-15 15:09 - 2014-08-15 15:09 - 00000000 ____D () C:\FRST
2014-08-15 15:08 - 2014-08-15 15:08 - 01092096 _____ (Farbar) C:\Users\xxxx\Downloads\FRST.exe
2014-08-15 15:05 - 2013-09-07 16:36 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-15 14:39 - 2006-11-02 14:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-15 14:39 - 2006-11-02 14:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-15 14:14 - 2008-03-17 07:29 - 01494328 _____ () C:\Windows\WindowsUpdate.log
2014-08-15 13:59 - 2014-04-18 17:08 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-08-15 12:39 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-14 21:43 - 2014-08-14 21:43 - 00001022 _____ () C:\Windows\PFRO.log
2014-08-14 21:43 - 2008-05-11 11:52 - 00122888 _____ () C:\Users\xxxx\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-14 21:43 - 2006-11-02 14:47 - 00431040 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-14 21:41 - 2014-08-14 21:36 - 00000000 ____D () C:\AdwCleaner
2014-08-14 21:41 - 2006-11-02 15:01 - 00032578 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-08-14 21:31 - 2009-03-31 16:58 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-08-14 21:29 - 2009-08-16 23:15 - 00000000 ____D () C:\Windows\Minidump
2014-08-14 21:29 - 2008-02-27 22:59 - 00000000 ____D () C:\Windows\Panther
2014-08-14 21:25 - 2014-08-14 21:14 - 04813544 _____ (Piriform Ltd) C:\Users\xxxx\Downloads\ccsetup416(1).exe
2014-08-14 21:14 - 2014-08-14 21:13 - 01356107 _____ () C:\Users\xxxx\Downloads\AdwCleaner.exe
2014-08-14 18:54 - 2014-08-14 18:54 - 04813544 _____ (Piriform Ltd) C:\Users\xxxx\Downloads\ccsetup416.exe
2014-08-14 18:45 - 2014-08-14 18:45 - 00118598 _____ () C:\Users\xxxx\Downloads\zbotkiller.zip
2014-08-14 18:39 - 2014-08-14 18:38 - 02347384 _____ (ESET) C:\Users\xxxx\Downloads\esetsmartinstaller_deu.exe
2014-08-14 18:31 - 2014-08-14 18:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-14 18:30 - 2014-08-14 18:29 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\xxxx\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-14 18:23 - 2014-08-14 18:23 - 00000973 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk
2014-08-14 18:23 - 2014-08-14 18:23 - 00000961 _____ () C:\Users\Public\Desktop\TeamViewer 9.lnk
2014-08-14 18:23 - 2014-08-14 18:23 - 00000000 ____D () C:\Users\xxxx\AppData\Roaming\TeamViewer
2014-08-14 18:22 - 2014-08-14 18:22 - 00000000 ____D () C:\Program Files\TeamViewer
2014-08-14 18:22 - 2014-08-14 18:21 - 06304880 _____ (TeamViewer GmbH) C:\Users\xxxx\Downloads\TeamViewer_Setup_de.exe
2014-08-14 18:19 - 2008-05-11 11:57 - 00000416 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{D907A935-EA0F-484A-BE31-8A648745566F}.job
2014-08-14 03:04 - 2008-05-21 16:00 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-08-14 03:03 - 2013-08-19 10:20 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-14 03:01 - 2006-11-02 12:24 - 96303304 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-08-13 15:41 - 2012-05-19 19:55 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-08-10 11:44 - 2014-08-10 11:44 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-08-08 09:11 - 2014-06-19 21:13 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-07-31 17:37 - 2008-05-21 16:57 - 00037376 _____ () C:\Users\xxxx\Desktop\xxxx - Golfplätze.xls
2014-07-23 10:52 - 2009-10-18 10:19 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
Files to move or delete:
====================
C:\ProgramData\hpothb07.dat
C:\Users\Public\hpothb07.dat
Some content of TEMP:
====================
C:\Users\inge\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-08-15 12:45
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version:15-08-2014
Ran by xxxx at 2014-08-15 15:10:38
Running from C:\Users\xxxx\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Update for Microsoft Office 2007 (KB2508958) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version: - Microsoft)
7-Zip 4.57 (HKLM\...\7-Zip) (Version: - )
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742) (Version: 8.1.2 - Adobe Systems, Inc) Hidden
Adobe Flash Player 14 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 9.0.45.0 - Adobe Systems Incorporated)
Adobe Reader 8.1.2 - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-A81200000003}) (Version: 8.1.2 - Adobe Systems Incorporated)
Adobe Reader 8.1.2 Security Update 1 (KB403742) (HKLM\...\{AC76BA86-7AD7-1031-7B44-A81200000003}_Adobe Reader 8.1.2 - Deutsch) (Version: - )
AOL Toolbar 5.0 (HKLM\...\AOL Toolbar) (Version: 5.0.67.2 - AOL)
ATI Catalyst Install Manager (HKLM\...\{31787FDD-D9FB-C812-4A61-93A1C6B61568}) (Version: 3.0.664.0 - ATI Technologies, Inc.)
Brother MFL-Pro Suite DCP-195C (HKLM\...\{6BF66AED-3EA4-4106-B240-5CE96C9B76B0}) (Version: 1.0.0.0 - Brother Industries, Ltd.)
Canon Easy-WebPrint EX (HKLM\...\Easy-WebPrint EX) (Version: 1.4.1.0 - Canon Inc.)
Canon IJ Scan Utility (HKLM\...\Canon_IJ_Scan_Utility) (Version: - Canon Inc.)
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM\...\CANONIJPLM100) (Version: 4.1.0 - Canon Inc.)
Canon MG5500 series Benutzerregistrierung (HKLM\...\Canon MG5500 series Benutzerregistrierung) (Version: - *Canon Inc.)
Canon MG5500 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5500_series) (Version: 1.01 - Canon Inc.)
Canon My Image Garden (HKLM\...\Canon My Image Garden) (Version: 2.0.1 - Canon Inc.)
Canon My Image Garden Design Files (HKLM\...\Canon My Image Garden Design Files) (Version: 2.0.0 - Canon Inc.)
Canon My Printer (HKLM\...\CanonMyPrinter) (Version: 3.1.0 - Canon Inc.)
Canon Quick Menu (HKLM\...\CanonQuickMenu) (Version: 2.2.1 - Canon Inc.)
Cards_Calendar_OrderGift_DoMorePlugout (Version: 1.00.0000 - Hewlett-Packard) Hidden
Catalyst Control Center - Branding (HKLM\...\{2E4609A3-F5AF-4408-B0C4-B8B84BC753DF}) (Version: 1.00.0000 - ATI)
Catalyst Control Center Core Implementation (Version: 2008.0225.2153.39091 - ATI) Hidden
Catalyst Control Center Graphics Full Existing (Version: 2008.0225.2153.39091 - ATI) Hidden
Catalyst Control Center Graphics Full New (Version: 2008.0225.2153.39091 - ATI) Hidden
Catalyst Control Center Graphics Light (Version: 2008.0225.2153.39091 - ATI) Hidden
Catalyst Control Center Graphics Previews Common (Version: 2008.0225.2153.39091 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (Version: 2008.0225.2153.39091 - ATI) Hidden
Catalyst Control Center Localization Chinese Standard (Version: 2008.0225.2153.39091 - ATI) Hidden
Catalyst Control Center Localization Chinese Traditional (Version: 2008.0225.2153.39091 - ATI) Hidden
Catalyst Control Center Localization Czech (Version: 2008.0225.2153.39091 - ATI) Hidden
Catalyst Control Center Localization Danish (Version: 2008.0225.2153.39091 - ATI) Hidden
Catalyst Control Center Localization Dutch (Version: 2008.0225.2153.39091 - ATI) Hidden
Catalyst Control Center Localization Finnish (Version: 2008.0225.2153.39091 - ATI) Hidden
Catalyst Control Center Localization French (Version: 2008.0225.2153.39091 - ATI) Hidden
Catalyst Control Center Localization German (Version: 2008.0225.2153.39091 - ATI) Hidden
Catalyst Control Center Localization Greek (Version: 2008.0225.2153.39091 - ATI) Hidden
Catalyst Control Center Localization Hungarian (Version: 2008.0225.2153.39091 - ATI) Hidden
Catalyst Control Center Localization Italian (Version: 2008.0225.2153.39091 - ATI) Hidden
Catalyst Control Center Localization Japanese (Version: 2008.0225.2153.39091 - ATI) Hidden
Catalyst Control Center Localization Korean (Version: 2008.0225.2153.39091 - ATI) Hidden
Catalyst Control Center Localization Norwegian (Version: 2008.0225.2153.39091 - ATI) Hidden
Catalyst Control Center Localization Polish (Version: 2008.0225.2153.39091 - ATI) Hidden
Catalyst Control Center Localization Portuguese (Version: 2008.0225.2153.39091 - ATI) Hidden
Catalyst Control Center Localization Russian (Version: 2008.0225.2153.39091 - ATI) Hidden
Catalyst Control Center Localization Spanish (Version: 2008.0225.2153.39091 - ATI) Hidden
Catalyst Control Center Localization Swedish (Version: 2008.0225.2153.39091 - ATI) Hidden
Catalyst Control Center Localization Thai (Version: 2008.0225.2153.39091 - ATI) Hidden
Catalyst Control Center Localization Turkish (Version: 2008.0225.2153.39091 - ATI) Hidden
CCC Help Chinese Standard (Version: 2008.0225.2152.39091 - ATI) Hidden
CCC Help Chinese Traditional (Version: 2008.0225.2152.39091 - ATI) Hidden
CCC Help Czech (Version: 2008.0225.2152.39091 - ATI) Hidden
CCC Help Danish (Version: 2008.0225.2152.39091 - ATI) Hidden
CCC Help Dutch (Version: 2008.0225.2152.39091 - ATI) Hidden
CCC Help English (Version: 2008.0225.2152.39091 - ATI) Hidden
CCC Help Finnish (Version: 2008.0225.2152.39091 - ATI) Hidden
CCC Help French (Version: 2008.0225.2152.39091 - ATI) Hidden
CCC Help German (Version: 2008.0225.2152.39091 - ATI) Hidden
CCC Help Greek (Version: 2008.0225.2152.39091 - ATI) Hidden
CCC Help Hungarian (Version: 2008.0225.2152.39091 - ATI) Hidden
CCC Help Italian (Version: 2008.0225.2152.39091 - ATI) Hidden
CCC Help Japanese (Version: 2008.0225.2152.39091 - ATI) Hidden
CCC Help Korean (Version: 2008.0225.2152.39091 - ATI) Hidden
CCC Help Norwegian (Version: 2008.0225.2152.39091 - ATI) Hidden
CCC Help Polish (Version: 2008.0225.2152.39091 - ATI) Hidden
CCC Help Portuguese (Version: 2008.0225.2152.39091 - ATI) Hidden
CCC Help Russian (Version: 2008.0225.2152.39091 - ATI) Hidden
CCC Help Spanish (Version: 2008.0225.2152.39091 - ATI) Hidden
CCC Help Swedish (Version: 2008.0225.2152.39091 - ATI) Hidden
CCC Help Thai (Version: 2008.0225.2152.39091 - ATI) Hidden
CCC Help Turkish (Version: 2008.0225.2152.39091 - ATI) Hidden
ccc-core-static (Version: 2008.0225.2153.39091 - Ihr Firmenname) Hidden
ccc-utility (Version: 2008.0225.2153.39091 - ATI) Hidden
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
CyberLink DVD Suite Deluxe (HKLM\...\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 5.5.1126 - CyberLink Corp.)
Firebird SQL Server - MAGIX Edition (HKLM\...\Firebird SQL Server D) (Version: 2.0.1.8 - MAGIX AG)
G3 Manager (HKLM\...\{8D9E93D2-049D-4E9D-B263-13216E20EF1F}) (Version: 1.00.0000 - )
G3 Manager (Version: 1.00.0000 - DECA System) Hidden
Hardware Diagnose Tools (HKLM\...\PC-Doctor 5 for Windows) (Version: 5.1.4708.19 - PC-Doctor, Inc.)
Hewlett-Packard Active Check (Version: 1.1.11.0 - Hewlett-Packard) Hidden
Hewlett-Packard Asset Agent for Health Check (Version: 2.0.62.5 - HP) Hidden
High-Definition Video Playback (Version: 11.1.10500.2.65 - Nero AG) Hidden
Hoadley Options Strategy Evaluation Tool (HKLM\...\Hoadley Options Strategy Evaluation Tool_is1) (Version: - Peter Hoadley)
HP Customer Experience Enhancements (HKLM\...\{C8D47273-7A1A-4614-A3D8-263632D8A5ED}) (Version: 5.6.0.2499 - Hewlett-Packard)
HP Customer Feedback (Version: 1.0.0 - Hewlett-Packard) Hidden
HP Easy Setup - Frontend (HKLM\...\{1BCE2581-B7CA-4BB4-BDFB-D113506AA38B}) (Version: 5.6.0.2542 - Hewlett-Packard)
HP Foto- und Bildbearbeitung 2.0 - All-in-One (Version: 1.10.0000 - Hewlett-Packard Company) Hidden
HP Foto- und Bildbearbeitung 2.0 All-in-One Treiber (Version: 1.10.0000 - Hewlett-Packard Company) Hidden
HP On-Screen Cap/Num/Scroll Lock Indicator (HKLM\...\OsdMaestro) (Version: - Hewlett-Packard)
HP Photosmart Essential 2.5 (HKLM\...\HP Photosmart Essential) (Version: 2.5 - HP)
HP Photosmart Essential 2.5 (Version: 1.02.0000 - Hewlett-Packard) Hidden
HP Speicher-Disc (HKLM\...\{B376402D-58EA-45EA-BD50-DD924EB67A70}) (Version: 1.0.4.805 - Hewlett-Packard Company)
HP Total Care Advisor (HKLM\...\{fef8097e-662d-49b3-aa77-2919db3746d7}) (Version: 1.6.12.2542 - Hewlett-Packard)
HP Update (HKLM\...\{11B83AD3-7A46-4C2E-A568-9505981D4C6F}) (Version: 4.000.007.003 - Hewlett-Packard)
HPPhotoSmartPhotobookWebPack1 (Version: 1.00.0000 - Hewlett-Packard) Hidden
Java(TM) 6 Update 31 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216031FF}) (Version: 6.0.310 - Oracle)
Java(TM) SE Runtime Environment 6 Update 1 (HKLM\...\{3248F0A8-6813-11D6-A77B-00B0D0160010}) (Version: 1.6.0.10 - Sun Microsystems, Inc.)
Kaspersky Internet Security (HKLM\...\InstallWIX_{6F6873E3-5C92-4049-B511-231A138DD090}) (Version: 14.0.0.4651 - Kaspersky Lab)
Kaspersky Internet Security (Version: 14.0.0.4651 - Kaspersky Lab) Hidden
MAGIX Fotos auf CD & DVD 7 e-version 7.0.0.22 (D) (HKLM\...\MAGIX Fotos auf CD & DVD 7 e-version D) (Version: 7.0.0.22 - MAGIX AG)
MAGIX Online Druck Service 2.3.2.0 (D) (HKLM\...\MAGIX Online Druck Service D) (Version: 2.3.2.0 - MAGIX AG)
MAGIX PC Visit (HKLM\...\MAGIX PC Visit D) (Version: 4.3.6.1987 - MAGIX AG)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (Version: - Microsoft) Hidden
Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version: - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Mozilla Firefox 31.0 (x86 de) (HKLM\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB936181) (HKLM\...\{C04E32E0-0416-434D-AFB9-6969D703A9EF}) (Version: 4.20.9848.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB941833) (HKLM\...\{C523D256-313D-4866-B36A-F3DE528246EF}) (Version: 4.20.9849.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
My HP Games (HKLM\...\WildTangent hp Master Uninstall) (Version: HPCMPQ1902 - WildTangent)
Nero 11 Disc Menus Basic (Version: 11.0.11200.12.0 - Nero AG) Hidden
Nero Audio Pack 1 (Version: 11.0.11500.110.0 - Nero AG) Hidden
Nero ControlCenter 11 (Version: 11.0.12700.0.27 - Nero AG) Hidden
Nero Core Components 11 (Version: 11.0.15600.1.17 - Nero AG) Hidden
NETGEAR WG111v3 wireless USB 2.0 adapter (HKLM\...\InstallShield_{5396FBD8-8BD7-47F9-92AE-F62F13D5A11D}) (Version: 1.00.0000 - NETGEAR)
NETGEAR WG111v3 wireless USB 2.0 adapter (Version: 1.00.0000 - NETGEAR) Hidden
Newshosting (HKLM\...\{7E509AFB-E2B5-46A8-B96A-73C40C2782C2}) (Version: 1.3.2 - Newshosting)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: - )
Opera Stable 18.0.1284.68 (HKLM\...\Opera 18.0.1284.68) (Version: 18.0.1284.68 - Opera Software ASA)
PaperPort Image Printer (HKLM\...\{2BC2781A-F7F6-452E-95EB-018A522F1B2C}) (Version: 1.00.0000 - Nuance Communications, Inc.)
PL-2303 USB-to-Serial (HKLM\...\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}) (Version: - )
Power2Go (HKLM\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.3610 - CyberLink Corp.)
PowerDirector (HKLM\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 6.5.2420 - CyberLink Corp.)
PowerDirector (Version: 6.5.2420 - CyberLink Corp.) Hidden
PSSWCORE (Version: 2.02.0000 - Hewlett-Packard) Hidden
Python 2.5 (HKLM\...\{0A2C5854-557E-48C8-835A-3B9F074BDCAA}) (Version: 2.5.150 - Martin v. Löwis)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: - )
ScanSoft PaperPort 11 (HKLM\...\{02570AE0-BEE0-4A6C-BE3F-D806E9F2EA17}) (Version: 11.2.0000 - Nuance Communications, Inc.)
Silicon Laboratories CP210x USB to UART Bridge (Driver Removal) (HKLM\...\SLABCOMM&10C4&EA60) (Version: - )
Silicon Laboratories CP210x VCP Drivers for Windows 2000/XP/2003 Server/Vista (HKLM\...\{017EB9F9-31B2-4AC0-9171-7791476DC74D}) (Version: 5.40.24 - Silicon Laboratories, Inc.)
Skins (Version: 2008.0225.2153.39091 - ATI) Hidden
SofTax GR 2012 NP (HKLM\...\SofTax GR 2012 NP) (Version: 1.0.4.3564 - Abraxas Informatik AG)
Sonocaddie (HKLM\...\{B79AA6EB-103F-4426-8BD2-2BD18F75F1B0}) (Version: 1.0.2 - Sonostar)
Spybot - Search & Destroy (HKLM\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)
TeamViewer 9 (HKLM\...\TeamViewer 9) (Version: 9.0.31064 - TeamViewer)
Testversion von Microsoft Office Home and Student 2007 (HKLM\...\OfficeTrial) (Version: - )
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2883097) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{B2260BC9-D561-46EE-B33D-739CF760A2A9}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
VideoToolkit01 (Version: 100.0.128.000 - Hewlett-Packard) Hidden
VLC media player 2.0.1 (HKLM\...\VLC media player) (Version: 2.0.1 - VideoLAN)
WinRAR (HKLM\...\WinRAR archiver) (Version: - )
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-2019164252-3643957268-3047170671-1000_Classes\CLSID\{589CEADF-0E01-4892-97F2-AA80B186569C}\InprocServer32 -> C:\Windows\system32\SnCmuicateTask.dll (Sonostar Inc.)
CustomCLSID: HKU\S-1-5-21-2019164252-3643957268-3047170671-1000_Classes\CLSID\{EBDE6312-4A82-4504-A568-942234A858A2}\InprocServer32 -> C:\Windows\system32\SnCmuicate.dll (Sonostar Inc.)
==================== Restore Points =========================
11-04-2014 23:14:41 Windows Update
11-04-2014 23:22:51 Windows Update
17-04-2014 08:28:03 Windows Update
17-04-2014 08:36:38 Windows Update
18-04-2014 13:50:33 Windows Update
18-04-2014 15:09:57 Gerätetreiber-Paketinstallation: Kaspersky Lab Netzwerkdienst
29-04-2014 17:16:54 Windows Update
06-05-2014 14:00:04 Windows Update
07-05-2014 15:38:23 Geplanter Prüfpunkt
14-05-2014 07:05:59 Windows Update
16-05-2014 14:54:05 Windows Update
18-05-2014 06:50:56 Windows Update
29-05-2014 15:19:17 Windows Update
03-06-2014 13:02:49 Windows Update
06-06-2014 20:59:52 Windows Update
19-06-2014 19:14:50 Gerätetreiber-Paketinstallation: Canon Drucker
19-06-2014 19:17:44 Gerätetreiber-Paketinstallation: Canon Bildverarbeitungsgeräte
19-06-2014 19:35:52 Windows Update
19-06-2014 19:45:38 Windows Update
05-07-2014 14:32:33 Windows Update
13-07-2014 12:28:52 Windows Update
18-07-2014 06:01:57 Windows Update
18-07-2014 06:07:51 Windows Update
20-07-2014 09:28:12 Geplanter Prüfpunkt
20-07-2014 10:15:22 Windows Update
01-08-2014 12:31:34 Windows Update
08-08-2014 06:52:59 Windows Update
13-08-2014 18:24:06 Windows Update
14-08-2014 01:00:31 Windows Update
14-08-2014 20:15:57 Geplanter Prüfpunkt
15-08-2014 11:34:48 Geplanter Prüfpunkt
15-08-2014 12:12:04 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2006-11-02 12:23 - 2012-05-19 20:38 - 00442859 ____R C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 www.100888290cs.com
127.0.0.1 100888290cs.com
127.0.0.1 100sexlinks.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 www.10sek.com
127.0.0.1 10sek.com
127.0.0.1 1-2005-search.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 www.123fporn.info
127.0.0.1 123fporn.info
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123haustiereundmehr.com
There are 1000 more lines.
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-19] (Microsoft Corporation)
Task: {474F0299-94F4-4E52-8E20-B5380BA89218} - System32\Tasks\JavaUpdatexxxx => C:\Windows\system32\jusched.exe
Task: {8A2591F8-6A9F-4F61-864D-83F8E970A08E} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {9A8D1FB1-5218-4CF7-9D2C-FA9E8E895ADB} - System32\Tasks\JavaUpdateAdministrator => C:\Windows\system32\jusched.exe
Task: {A728AE6B-5AB8-4223-AD3E-E6341441A01C} - System32\Tasks\Microsoft\Windows\PLA\System\ConvertLogEntries => Rundll32.exe %windir%\system32\pla.dll,PlaConvertLogEntries
Task: {C63691CD-CC8C-4883-B834-0ABF11302D17} - System32\Tasks\PC-Doctor\Scheduled Maintenance => C:\Program Files\PC-Doctor 5 for Windows\RunProfiler.exe [2007-10-04] (PC-Doctor, Inc.)
Task: {D00437F4-CCA9-4974-A923-19AC1A3481DF} - System32\Tasks\PC-Doctor\Scheduled Maintenance Swap => C:\Program Files\PC-Doctor 5 for Windows\task_swap.bat [2008-02-27] ()
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-05] ()
Task: {EB93BD1F-4E2C-40BD-A34D-8646CB4A5F85} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-13] (Adobe Systems Incorporated)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{D907A935-EA0F-484A-BE31-8A648745566F}.job => C:\Windows\system32\msfeedssync.exe
==================== Loaded Modules (whitelisted) =============
2008-02-27 23:38 - 2008-02-25 22:10 - 00159744 _____ () C:\Windows\system32\atitmmxx.dll
2006-05-29 20:29 - 2006-05-29 20:29 - 01708032 _____ () C:\Program Files\NETGEAR\WG111v3\WG111v3.exe
2013-06-17 12:35 - 2013-06-17 12:35 - 00478400 _____ () C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\dblite.dll
2013-05-08 14:52 - 2013-05-08 14:52 - 01270464 _____ () C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\kpcengine.2.3.dll
2014-06-19 21:42 - 2013-05-14 11:50 - 00140936 _____ () C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
2014-08-10 11:44 - 2014-08-10 11:44 - 03800688 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-07-13 15:05 - 2014-07-13 15:05 - 17029808 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (08/15/2014 00:40:25 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
Error: (08/14/2014 09:44:22 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
Error: (08/14/2014 06:19:00 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
Error: (08/13/2014 08:03:38 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
Error: (08/13/2014 03:42:35 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
Error: (08/13/2014 02:16:29 PM) (Source: LoadPerf) (EventID: 3002) (User: )
Description: :16
Error: (08/13/2014 02:10:50 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
Error: (08/10/2014 00:10:12 PM) (Source: EventSystem) (EventID: 4621) (User: )
Description: 80070005EventSystem.EventSubscription{CEB8B221-89C5-41A8-98CE-79B413BF150B}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}
Error: (08/10/2014 11:03:49 AM) (Source: LoadPerf) (EventID: 3002) (User: )
Description: :16
Error: (08/10/2014 10:58:40 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
System errors:
=============
Error: (08/15/2014 00:39:58 PM) (Source: Dhcp) (EventID: 1002) (User: )
Description: Die IP-Adresslease 192.168.0.6 für die Netzwerkkarte mit der Netzwerkadresse 001B2F360DDE wurde durch den DHCP-Server 192.168.0.1 abgelehnt (der DHCP-Server hat eine DHCPNACK-Meldung gesendet).
Error: (08/15/2014 00:39:39 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058
Error: (08/15/2014 00:39:30 PM) (Source: HTTP) (EventID: 15016) (User: )
Description: \Device\Http\ReqQueueKerberos
Error: (08/14/2014 09:43:32 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058
Error: (08/14/2014 09:43:17 PM) (Source: HTTP) (EventID: 15016) (User: )
Description: \Device\Http\ReqQueueKerberos
Error: (08/14/2014 06:18:40 PM) (Source: Dhcp) (EventID: 1002) (User: )
Description: Die IP-Adresslease 192.168.0.6 für die Netzwerkkarte mit der Netzwerkadresse 001B2F360DDE wurde durch den DHCP-Server 192.168.0.1 abgelehnt (der DHCP-Server hat eine DHCPNACK-Meldung gesendet).
Error: (08/14/2014 06:18:28 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058
Error: (08/14/2014 06:18:19 PM) (Source: HTTP) (EventID: 15016) (User: )
Description: \Device\Http\ReqQueueKerberos
Error: (08/14/2014 06:18:17 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 14.08.2014 um 08:27:35 unerwartet heruntergefahren.
Error: (08/14/2014 03:04:05 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Windows Search%%1053
Microsoft Office Sessions:
=========================
Error: (08/06/2009 00:17:02 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 18 seconds with 0 seconds of active time. This session ended with a crash.
Error: (08/03/2009 11:45:02 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 1 seconds with 0 seconds of active time. This session ended with a crash.
CodeIntegrity Errors:
===================================
Date: 2014-08-15 15:10:09.185
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-08-15 15:10:08.980
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-08-15 15:10:08.775
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-08-15 15:10:08.561
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-08-15 15:10:08.313
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-08-15 15:10:08.106
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-08-15 15:10:07.896
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-08-15 15:10:07.690
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-08-15 15:09:59.263
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\kneps.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-08-15 15:09:59.061
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\kneps.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 5000+
Percentage of memory in use: 58%
Total physical RAM: 3069.77 MB
Available physical RAM: 1284.78 MB
Total Pagefile: 6355.77 MB
Available Pagefile: 4555.95 MB
Total Virtual: 2047.88 MB
Available Virtual: 1895.13 MB
==================== Drives ================================
Drive c: (COMPAQ) (Fixed) (Total:455.53 GB) (Free:347.8 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (FACTORY_IMAGE) (Fixed) (Total:10.23 GB) (Free:1.41 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 466 GB) (Disk ID: 1549F232)
Partition 1: (Active) - (Size=456 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=10 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
| Themen zu Zip-Datei (Paypal-Rechnung) in eMail-Anhang angeklickt |
| adware, branding, browser, canon, ccsetup, ebanking, excel, feedback, firefox, flash player, home, homepage, installation, kaspersky, mozilla, netgear, port, realtek, registry, rundll, safer networking, scan, security, services.exe, software, svchost.exe, system, tcp, trojaner, udp, usb |
Baum-Darstellung