| |
| |||||||
Log-Analyse und Auswertung: Trojan.Kazy!WvUyTGribrg (trojan) in AdobeARM.exeWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
26.08.2014, 01:27
| #1 |
 |  Trojan.Kazy!WvUyTGribrg (trojan) in AdobeARM.exe Lieber Helfer, liebe Helferin, Outpost Security Suite meldet mir beim Starten von firefox den Trojaner Trojan.Kazy!WvUyTGribrg Additiv meldet mir avast folgende Viren: izlg8f37.vbt in C:\windows\system32\Filt\TMP Upx.bezukwke in C:\Unsers\AlX\AppData\Local\Temp Upx.mdvwsaqs in C:\Unsers\AlX\AppData\Local\Temp Upx.yaxqpvla in C:\Unsers\AlX\AppData\Local\Temp Ich weiß nicht, ob das eine etwas mit dem anderen zu tun hat. Ich habe leider alles falsch gemacht und es - anders als Regel 1 vorschreibt - auf eigene Faust probiert. Ich habe mit der outpost security suite den virus entfernt, danach mit malwarebytes, spybot search and destroy und avast gescannt. Als die Programme nichts gefunden haben, habe ich trojan hunter runtergeladen und mit der shareware-version gescannt, die aber auch nichts gefunden hat. Wenn ich den Rechner neu starte, ist der trojaner wieder da. Sorry, wenn ich es damit komplizierter gemacht habe. Jetzt weiß ich nicht mehr weiter. Ich habe der Anleitung entsprechend die Scans durchgeführt: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-08-2014 01
Ran by AlX (administrator) on ALX-PC on 26-08-2014 01:24:34
Running from C:\Users\AlX\Downloads
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Agnitum Ltd.) C:\Program Files\Agnitum\Outpost Security Suite Free\op_mon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Agnitum Ltd.) C:\Program Files\Agnitum\Outpost Security Suite Free\acs.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Mischel Internet Security) C:\Program Files (x86)\TrojanHunter 5.6\THGuard.exe
() C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
() C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6100\Bin\HPNetworkCommunicator.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2723624 2011-03-28] (Synaptics Incorporated)
HKLM\...\Run: [Power Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1831528 2011-05-10] (Acer Incorporated)
HKLM\...\Run: [OutpostMonitor] => C:\Program Files\Agnitum\Outpost Security Suite Free\op_mon.exe [4510072 2011-04-04] (Agnitum Ltd.)
HKLM\...\Run: [OutpostFeedBack] => C:\Program Files\Agnitum\Outpost Security Suite Free\feedback.exe [808064 2011-03-30] (Agnitum Ltd.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12921488 2000-01-01] (Realtek Semiconductor)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1103440 2011-07-01] (Dritek System Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-28] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-08-10] (AVAST Software)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-03-24] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [191528 2014-06-04] (Geek Software GmbH)
HKLM-x32\...\Run: [THGuard] => C:\Program Files (x86)\TrojanHunter 5.6\THGuard.exe [1081808 2014-07-30] (Mischel Internet Security)
HKU\.DEFAULT\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-3429764466-1293764708-2967138861-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
AppInit_DLLs: c:\progra~1\agnitum\outpos~1\wl_hoo~1.dll => c:\Program Files\Agnitum\Outpost Security Suite Free\wl_hook64.dll [983664 2011-03-30] (Agnitum Ltd.)
AppInit_DLLs-x32: c:\progra~1\agnitum\outpos~1\wl_hook.dll => c:\Program Files\Agnitum\Outpost Security Suite Free\wl_hook.dll [701456 2011-03-30] (Agnitum Ltd.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (No File)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\p6_19_erinnerung.lnk
ShortcutTarget: p6_19_erinnerung.lnk -> C:\Program Files (x86)\phase6\phase6_19\WinStart\WinStart.exe (phase6)
Startup: C:\Users\AlX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 6100 (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 6100 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet 6100\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: Outpost -> {33C9E362-3EDA-4930-8AFE-5DA39A8BB77A} => C:\Program Files\Agnitum\Outpost Security Suite Free\op_shell.dll (Agnitum Ltd.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyServer: 127.0.0.1:9666
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: No Name -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> No File
BHO-x32: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre8\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre8\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKLM-x32 - No Name - {ba696155-d96e-4281-b467-0367a0456474} - No File
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default
FF Homepage: https://startpage.com/do/search
FF NetworkProxy: "socks_version", 4
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=11.5.2 -> C:\Program Files (x86)\Java\jre8\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.5.2 -> C:\Program Files (x86)\Java\jre8\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @protectdisc.com/NPPDLicenseHelper -> C:\Program Files (x86)\ProtectDisc\License Helper\NPPDLicenseHelper.dll ()
FF Plugin-x32: @real.com/nppl3260;version=15.0.6.14 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprjplug;version=15.0.6.14 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.6.14 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.6.14 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=15.0.6.14 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\searchplugins\ixquick-https---deutsch.xml
FF SearchPlugin: C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\searchplugins\nation-secure-search.xml
FF SearchPlugin: C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\searchplugins\startpage-https---deutsch.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ProxTube - Unblock YouTube - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\ich@maltegoetz.de [2014-01-26]
FF Extension: YouTube Unblocker - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\youtubeunblocker@unblocker.yt [2014-06-06]
FF Extension: WOT - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-26]
FF Extension: Adblock Plus Pop-up Addon - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\adblockpopups@jessehakanen.net.xpi [2014-01-04]
FF Extension: Proxy-Listen.de - Proxyswitcher - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\admin@proxy-listen.de.xpi [2014-07-17]
FF Extension: Add-on Compatibility Reporter - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\compatibility@addons.mozilla.org.xpi [2013-07-12]
FF Extension: Hide My Ass Proxy Extension - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\extension@hidemyass.com.xpi [2014-01-04]
FF Extension: Ghostery - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\firefox@ghostery.com.xpi [2013-10-18]
FF Extension: One Click Proxy - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\jid0-zXo3XFGyiDalgkeEO4UYJTUwo2I@jetpack.xpi [2014-02-22]
FF Extension: Lightbeam - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\jid1-F9UJ2thwoAm5gQ@jetpack.xpi [2013-11-27]
FF Extension: Proxy Selector - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\proxyselector@mozilla.org.xpi [2014-07-17]
FF Extension: Proxy Tool - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\proxytool@proxylist.co.xpi [2014-07-17]
FF Extension: Speed DNS - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\speeddns@gmail.com.xpi [2014-01-18]
FF Extension: ProxTube - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{2541D29A-DB9E-4c1e-949A-31EFB4AEF4E7}.xpi [2014-08-10]
FF Extension: Cookie Cutter - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{4d14a68e-9a97-4358-8603-ed67b332cef1}.xpi [2014-07-17]
FF Extension: UltraSurf Firefox Tool - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{5B52016C-D097-4aec-BE61-9F129D8FDDBA}.xpi [2014-07-17]
FF Extension: NoScript - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-02-21]
FF Extension: HideMyAss - Free Web Proxy - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{9aba569a-d0cc-427d-bd2a-27bfd7ce544c}.xpi [2014-07-17]
FF Extension: BetterPrivacy - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2014-07-17]
FF Extension: Torbutton - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}.xpi [2014-07-17]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-08-10]
FF HKLM-x32\...\Firefox\Extensions: [{0153E448-190B-4987-BDE1-F256CADA672F}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012-09-15]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-12-16]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-07-17]
CHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2012-09-15]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 acssrv; C:\Program Files\Agnitum\Outpost Security Suite Free\acs.exe [3501696 2011-04-04] (Agnitum Ltd.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2013-03-28] (Advanced Micro Devices, Inc.) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-07-17] (AVAST Software)
S3 CGVPNCliSrvc; C:\Program Files\CyberGhost VPN\CGVPNCliService.exe [2438696 2012-04-26] (mobile concepts GmbH)
R2 DirMngr; C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe [218112 2013-07-16] () [File not signed]
R2 GREGService; C:\Program Files (x86)\Acer\Registration\GREGsvc.exe [29696 2011-05-26] (Acer Incorporated) [File not signed]
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [116104 2010-04-05] ()
S2 libusbd; C:\Windows\SysWOW64\libusbd-nt.exe [18944 2005-03-09] (hxxp://libusb-win32.sourceforge.net) [File not signed]
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256832 2011-04-24] (NTI Corporation)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S2 McAfee SiteAdvisor Service; No ImagePath
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 afw; C:\Windows\System32\DRIVERS\afw.sys [39528 2010-04-20] (Agnitum Ltd.)
R3 afwcore; C:\Windows\System32\drivers\afwcore.sys [424040 2010-09-27] (Agnitum Ltd.)
R3 ASWFilt; C:\Windows\system32\Filt\ASWFilt64.dll [49168 2011-03-21] (Agnitum Ltd.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-07-17] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-07-17] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-07-17] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-07-17] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-07-17] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-07-17] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-07-17] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-07-17] ()
R3 L1C; C:\Windows\System32\DRIVERS\L1C60x64.sys [120520 2013-04-26] (Qualcomm Atheros Co., Ltd.)
S3 libusb0; C:\Windows\SysWOW64\drivers\libusb0.sys [33792 2005-03-09] () [File not signed]
R1 SandBox; C:\Windows\system32\drivers\SandBox64.sys [1097672 2011-03-21] (Agnitum Ltd.)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2013-06-15] ()
R3 VBEngNT; C:\Windows\system32\drivers\VBEngNT.sys [293048 2011-02-02] (VirusBuster Kft.)
R3 VBFilt; C:\Windows\system32\Filt\VBFilt64.dll [42976 2011-03-21] (Agnitum Ltd.)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-26 01:24 - 2014-08-26 01:25 - 00021007 _____ () C:\Users\AlX\Downloads\FRST.txt
2014-08-26 01:24 - 2014-08-26 01:24 - 00000000 ____D () C:\FRST
2014-08-26 01:23 - 2014-08-26 01:23 - 02103296 _____ (Farbar) C:\Users\AlX\Downloads\FRST64.exe
2014-08-26 01:22 - 2014-08-26 01:22 - 00000468 _____ () C:\Users\AlX\Downloads\defogger_disable.log
2014-08-26 01:22 - 2014-08-26 01:22 - 00000000 _____ () C:\Users\AlX\defogger_reenable
2014-08-26 01:21 - 2014-08-26 01:21 - 00050477 _____ () C:\Users\AlX\Downloads\Defogger.exe
2014-08-26 01:14 - 2014-08-26 01:14 - 00000021 _____ () C:\Windows\S.dirmngr
2014-08-26 00:20 - 2014-08-26 00:20 - 00000344 _____ () C:\Windows\PFRO.log
2014-08-26 00:18 - 2014-08-26 00:18 - 00000000 ____D () C:\Users\AlX\AppData\Roaming\TrojanHunter
2014-08-25 20:44 - 2014-08-26 01:14 - 00000224 _____ () C:\Windows\setupact.log
2014-08-25 20:44 - 2014-08-25 20:44 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-25 20:20 - 2014-08-25 20:20 - 00078984 _____ () C:\Users\AlX\Documents\25.08.2014registry.reg
2014-08-25 20:10 - 2014-08-25 20:10 - 00000000 ____D () C:\Users\AlX\Downloads\tor
2014-08-25 17:06 - 2014-08-25 17:06 - 00000000 ____D () C:\Users\AlX\AppData\Roaming\KeePass
2014-08-25 15:57 - 2014-08-25 15:57 - 04334200 _____ (Bytelayer AB ) C:\Users\AlX\Downloads\TrojanHunterSetup.exe
2014-08-25 15:54 - 2014-08-25 15:54 - 00001071 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeePass.lnk
2014-08-25 15:54 - 2014-08-25 15:54 - 00000000 ____D () C:\Program Files (x86)\KeePass Password Safe
2014-08-25 15:52 - 2014-08-25 15:59 - 00000000 ____D () C:\Program Files (x86)\TrojanHunter 5.6
2014-08-25 15:52 - 2014-08-25 15:58 - 00000000 ____D () C:\ProgramData\TrojanHunter
2014-08-25 15:52 - 2014-08-25 15:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TrojanHunter
2014-08-25 15:52 - 2014-08-25 15:52 - 00059392 ____R () C:\Windows\SysWOW64\streamhlp.dll
2014-08-25 15:51 - 2014-08-25 15:51 - 01101648 _____ () C:\Users\AlX\Downloads\TrojanHunter - CHIP-Installer.exe
2014-08-25 15:48 - 2014-08-26 01:17 - 00017701 _____ () C:\Windows\WindowsUpdate.log
2014-08-21 09:48 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-21 09:48 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-21 09:48 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-21 09:48 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-21 09:47 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-21 09:47 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-08-21 09:47 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-21 09:47 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-08-21 09:47 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-21 09:47 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-08-21 09:47 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-21 09:47 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-08-21 09:47 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-21 09:47 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-08-13 20:15 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-13 20:15 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-13 20:15 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-13 20:15 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-13 20:15 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-13 20:15 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-13 20:14 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-13 20:14 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-13 16:45 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-13 16:45 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-13 16:45 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-13 16:45 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-13 16:45 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-13 16:45 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-13 16:45 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-13 16:45 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-13 16:45 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-13 16:45 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-13 16:45 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-13 16:45 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-13 16:45 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-13 16:45 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-13 16:45 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-13 16:45 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-13 16:45 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-13 16:45 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-13 16:45 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-13 16:45 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-13 16:45 - 2014-07-16 05:25 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-13 16:45 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-13 16:45 - 2014-07-16 04:46 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-13 16:45 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-13 16:45 - 2014-07-16 04:12 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-13 16:45 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-08-13 16:45 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-08-13 16:45 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-08-13 16:45 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-08-13 16:45 - 2014-07-09 04:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-08-13 16:45 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-08-13 16:45 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-08-13 16:45 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-08-13 16:45 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-08-13 16:45 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-08-13 16:45 - 2014-07-09 00:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-08-13 16:45 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-08-13 16:45 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-13 16:45 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-08-13 16:45 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-13 16:45 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-13 16:45 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-13 16:45 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-13 16:45 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-13 16:45 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-13 16:45 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-13 16:45 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-13 16:44 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-13 16:44 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-13 16:44 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-13 16:44 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-13 16:44 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-13 16:44 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-13 16:44 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-13 16:44 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-13 16:44 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-13 16:44 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-13 16:44 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-13 16:44 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-13 16:44 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-13 16:44 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-13 16:44 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-13 16:44 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-13 16:44 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-13 16:44 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-13 16:44 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-13 16:44 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-13 16:44 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-13 16:44 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-13 16:44 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-13 16:44 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-13 16:44 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-13 16:44 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-13 16:44 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-13 16:44 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-13 16:44 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-13 16:44 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-13 16:44 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-13 16:44 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-13 16:44 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-13 16:44 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-13 16:44 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-13 16:44 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-13 16:43 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-13 16:43 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-13 16:43 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-13 16:43 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-10 16:35 - 2014-08-10 16:35 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-26 01:25 - 2014-08-26 01:24 - 00021007 _____ () C:\Users\AlX\Downloads\FRST.txt
2014-08-26 01:24 - 2014-08-26 01:24 - 00000000 ____D () C:\FRST
2014-08-26 01:24 - 2012-01-08 17:23 - 00156378 _____ () C:\Windows\system32\config\rules.rdb
2014-08-26 01:23 - 2014-08-26 01:23 - 02103296 _____ (Farbar) C:\Users\AlX\Downloads\FRST64.exe
2014-08-26 01:22 - 2014-08-26 01:22 - 00000468 _____ () C:\Users\AlX\Downloads\defogger_disable.log
2014-08-26 01:22 - 2014-08-26 01:22 - 00000000 _____ () C:\Users\AlX\defogger_reenable
2014-08-26 01:22 - 2011-12-10 00:48 - 00000000 ____D () C:\Users\AlX
2014-08-26 01:22 - 2009-07-14 06:45 - 00024400 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-26 01:22 - 2009-07-14 06:45 - 00024400 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-26 01:21 - 2014-08-26 01:21 - 00050477 _____ () C:\Users\AlX\Downloads\Defogger.exe
2014-08-26 01:17 - 2014-08-25 15:48 - 00017701 _____ () C:\Windows\WindowsUpdate.log
2014-08-26 01:17 - 2013-10-17 22:56 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-26 01:14 - 2014-08-26 01:14 - 00000021 _____ () C:\Windows\S.dirmngr
2014-08-26 01:14 - 2014-08-25 20:44 - 00000224 _____ () C:\Windows\setupact.log
2014-08-26 01:14 - 2014-07-14 13:42 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-26 01:14 - 2013-09-05 13:35 - 00000000 ____D () C:\Users\Public\Documents\phase6_19_Daten
2014-08-26 01:14 - 2013-07-13 14:37 - 00000322 _____ () C:\Windows\Tasks\GlaryInitialize.job
2014-08-26 01:14 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-26 01:12 - 2014-07-14 13:42 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-26 01:12 - 2011-12-10 03:09 - 00523928 _____ () C:\Windows\system32\config\afw_db.conf
2014-08-26 01:12 - 2011-12-10 03:09 - 00073924 _____ () C:\Windows\system32\config\afw_hm.conf
2014-08-26 00:20 - 2014-08-26 00:20 - 00000344 _____ () C:\Windows\PFRO.log
2014-08-26 00:20 - 2012-05-10 13:58 - 00068744 _____ () C:\Users\AlX\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-26 00:20 - 2009-07-14 06:45 - 00315656 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-26 00:18 - 2014-08-26 00:18 - 00000000 ____D () C:\Users\AlX\AppData\Roaming\TrojanHunter
2014-08-26 00:18 - 2012-05-26 01:56 - 00007767 _____ () C:\ProgramData\hpzinstall.log
2014-08-26 00:15 - 2014-07-08 15:26 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-25 20:44 - 2014-08-25 20:44 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-25 20:30 - 2012-05-26 01:58 - 00000000 ____D () C:\Program Files (x86)\HP
2014-08-25 20:26 - 2012-02-13 19:25 - 00000000 ____D () C:\Program Files (x86)\Google
2014-08-25 20:23 - 2012-02-13 19:25 - 00000000 ____D () C:\Users\AlX\AppData\Local\Google
2014-08-25 20:20 - 2014-08-25 20:20 - 00078984 _____ () C:\Users\AlX\Documents\25.08.2014registry.reg
2014-08-25 20:18 - 2011-12-09 21:21 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-08-25 20:10 - 2014-08-25 20:10 - 00000000 ____D () C:\Users\AlX\Downloads\tor
2014-08-25 17:06 - 2014-08-25 17:06 - 00000000 ____D () C:\Users\AlX\AppData\Roaming\KeePass
2014-08-25 15:59 - 2014-08-25 15:52 - 00000000 ____D () C:\Program Files (x86)\TrojanHunter 5.6
2014-08-25 15:58 - 2014-08-25 15:52 - 00000000 ____D () C:\ProgramData\TrojanHunter
2014-08-25 15:57 - 2014-08-25 15:57 - 04334200 _____ (Bytelayer AB ) C:\Users\AlX\Downloads\TrojanHunterSetup.exe
2014-08-25 15:57 - 2014-08-25 15:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TrojanHunter
2014-08-25 15:54 - 2014-08-25 15:54 - 00001071 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeePass.lnk
2014-08-25 15:54 - 2014-08-25 15:54 - 00000000 ____D () C:\Program Files (x86)\KeePass Password Safe
2014-08-25 15:52 - 2014-08-25 15:52 - 00059392 ____R () C:\Windows\SysWOW64\streamhlp.dll
2014-08-25 15:51 - 2014-08-25 15:51 - 01101648 _____ () C:\Users\AlX\Downloads\TrojanHunter - CHIP-Installer.exe
2014-08-25 15:48 - 2012-01-16 17:27 - 00000000 ____D () C:\Users\AlX\AppData\Roaming\uTorrent
2014-08-25 15:11 - 2012-04-18 22:24 - 00000000 ____D () C:\Program Files (x86)\Klett
2014-08-25 15:11 - 2012-01-29 03:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Klett
2014-08-25 13:11 - 2011-12-10 01:51 - 00000000 ____D () C:\Windows\system32\Filt
2014-08-24 14:02 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-08-24 13:05 - 2013-12-16 11:56 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-08-24 01:27 - 2011-09-26 10:53 - 00699666 _____ () C:\Windows\system32\perfh007.dat
2014-08-24 01:27 - 2011-09-26 10:53 - 00149774 _____ () C:\Windows\system32\perfc007.dat
2014-08-24 01:27 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-20 14:56 - 2012-02-03 17:13 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-08-19 00:54 - 2012-04-27 15:41 - 00000000 ____D () C:\Users\AlX\AppData\Local\Paint.NET
2014-08-16 14:59 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-13 23:42 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-13 20:26 - 2013-07-14 13:17 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-13 20:22 - 2011-12-09 22:31 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-13 20:13 - 2014-05-07 11:35 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-08-12 17:49 - 2012-05-15 18:12 - 00000000 ____D () C:\Users\AlX\AppData\Roaming\Audacity
2014-08-11 00:47 - 2012-05-05 17:36 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-08-10 16:35 - 2014-08-10 16:35 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-08-07 04:06 - 2014-08-13 16:43 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-07 04:01 - 2014-08-13 16:43 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-01 01:41 - 2014-08-13 16:44 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-01 01:16 - 2014-08-13 16:45 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-08-17 19:18
==================== End Of Log ============================
FRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-08-2014 01
Ran by AlX at 2014-08-26 01:26:33
Running from C:\Users\AlX\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AV: Outpost Security Suite (Enabled - Up to date) {ECEA6BCD-A007-0BC7-D5A5-0254DCBD816E}
AS: Outpost Security Suite (Enabled - Up to date) {578B8A29-863D-0449-EF15-3926A73ACBD3}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: Outpost Security Suite (Enabled) {D4D1EAE8-EA68-0A9F-FEFA-AB61226EC615}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
µTorrent (HKLM-x32\...\uTorrent) (Version: 3.1.3 - )
64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
Acer Backup Manager (HKLM-x32\...\InstallShield_{0B61BBD5-DA3C-409A-8730-0C3DC3B0F270}) (Version: 3.0.0.99 - NTI Corporation)
Acer ePower Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 6.00.3007 - Acer Incorporated)
Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 5.00.3502 - Acer Incorporated)
Acer Registration (HKLM-x32\...\Acer Registration) (Version: 1.04.3502 - Acer Incorporated)
Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 1.1.0530.2011 - Acer Incorporated)
Acer Updater (HKLM-x32\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.02.3502 - Acer Incorporated)
Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
AFPL Ghostscript 8.54 (HKLM-x32\...\AFPL Ghostscript 8.54) (Version: - )
AFPL Ghostscript Fonts (HKLM-x32\...\AFPL Ghostscript Fonts) (Version: - )
AMD Accelerated Video Transcoding (Version: 12.10.100.30328 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.1084.4 - Advanced Micro Devices Inc.) Hidden
AMD AVIVO64 Codecs (Version: 12.5.100.20704 - Advanced Micro Devices, Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{9AB0D5B6-4779-8C4F-CA91-A1FEDB56D7EC}) (Version: 8.0.911.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Fuel (Version: 2013.0328.2218.38225 - Ihr Firmenname) Hidden
AMD Media Foundation Decoders (Version: 1.0.80328.2204 - Advanced Micro Devices, Inc.) Hidden
AMD Steady Video Plug-In (Version: 2.06.0000 - AMD) Hidden
AMD VISION Engine Control Center (x32 Version: 2013.0328.2218.38225 - Ihr Firmenname) Hidden
A-PDF Restrictions Remover 1.6 (HKLM-x32\...\A-PDF Restrictions Remover_is1) (Version: - A-PDF Solution)
A-PDF Text Extractor 1.4 (HKLM-x32\...\A-PDF Text Extractor_is1) (Version: - A-PDF.com)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.2.43 - Atheros Communications Inc.)
Audacity 2.0 (HKLM-x32\...\Audacity_is1) (Version: - Audacity Team)
avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2021 - AVAST Software)
Backup Manager V3 (x32 Version: 3.0.0.99 - NTI Corporation) Hidden
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM-x32\...\CANONIJPLM100) (Version: - )
Canon MP Navigator EX 4.0 (HKLM-x32\...\MP Navigator EX 4.0) (Version: - )
CanoScan LiDE 110 Scanner Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ2414) (Version: - )
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 3.15 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4214 - CDBurnerXP)
CheckDrive (HKLM-x32\...\{B83513EC-2E4D-4621-816D-4CCF397BE702}_is1) (Version: 4.0 - Abelssoft)
CyberGhost VPN (HKLM\...\CyberGhost VPN_is1) (Version: - CyberGhost S.R.L.)
DriverEasy 4.5.2 (HKLM\...\DriverEasy_is1) (Version: 4.5.2.0 - Easeware)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 15.2.20140326 - Landesfinanzdirektion Thüringen)
EVEREST Home Edition v2.20 (HKLM-x32\...\EVEREST Home Edition_is1) (Version: 2.20 - Lavalys Inc)
Foxit Reader 5.1 (HKLM-x32\...\Foxit Reader_is1) (Version: 5.1.4.104 - Foxit Corporation)
Free WMA to MP3 Converter 1.16 (HKLM-x32\...\Free WMA to MP3 Converter_is1) (Version: - Jodix Technologies Ltd.)
Free YouTube Download version 3.2.31.325 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.31.325 - DVDVideoSoft Ltd.)
Glary Utilities 2.56.0.1822 (HKLM-x32\...\Glary Utilities_is1) (Version: 2.56.0.1822 - Glarysoft Ltd)
Gpg4win (2.2.0-beta34) (HKLM-x32\...\GPG4Win) (Version: 2.2.0-beta34 - The Gpg4win Project)
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.04) (Version: 9.04 - Artifex Software Inc.)
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.06) (Version: 9.06 - Artifex Software Inc.)
Green Line 3 Sprachtrainer (HKLM-x32\...\{EE6F9172-D644-4C45-9892-2F22AF49F88C}) (Version: 1.00.000 - Klett)
GSview 5.0 (HKLM\...\GSview 5.0) (Version: 5.0 - Ghostgum Software Pty Ltd)
HP Officejet 6100 - Grundlegende Software für das Gerät (HKLM\...\{E30BC112-507C-4980-A00B-13C5CC9EDB03}) (Version: 25.0.617.0 - Hewlett-Packard Co.)
HP Officejet 6100 Hilfe (HKLM-x32\...\{2033DC31-6C96-4E5B-BF51-6BFFDB3E6564}) (Version: 140.0.2.2 - Hewlett Packard)
HP Update (HKLM-x32\...\{85DF2EED-08BC-46FB-90DA-28B0D0A8E8A8}) (Version: 5.003.000.004 - Hewlett-Packard)
ISO Workshop 3.4 (HKLM-x32\...\ISO Workshop_is1) (Version: - Glorylogic)
Java 7 Update 65 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417065FF}) (Version: 7.0.650 - Oracle)
Java 7 Update 65 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217065FF}) (Version: 7.0.650 - Oracle)
Java 8 Update 5 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218005FF}) (Version: 8.0.50 - Oracle Corporation)
Java Auto Updater (x32 Version: 2.8.05.13 - Oracle, Inc.) Hidden
Kastor - Stream Recorder V 1.0 (HKLM-x32\...\{CB84FEF6-C573-4328-B9A4-B29568A4E10E}_is1) (Version: 1.0.0.0 - KastorSoft)
KeePass Password Safe 1.27 (HKLM-x32\...\KeePass Password Safe_is1) (Version: 1.27 - Dominik Reichl)
Klett Lehrersoftware Green Line (Band 3) (HKLM-x32\...\Klett Lehrersoftware Green Line (Band 3)) (Version: - )
K-Lite Codec Pack 6.0.4 (Basic) (HKLM-x32\...\KLiteCodecPack_is1) (Version: 6.0.4 - )
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version: - )
Launch Manager (HKLM-x32\...\LManager) (Version: 5.1.7 - Acer Inc.)
LibUSB-Win32-0.1.10.1 (HKLM-x32\...\LibUSB-Win32_is1) (Version: 0.1.10.1 - LibUSB-Win32)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (HKLM-x32\...\{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}) (Version: 9.0.30411 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 31.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 31.0 - Mozilla)
Mozilla Thunderbird 31.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.0 (x86 de)) (Version: 31.0 - Mozilla)
NTI Media Maker 9 (HKLM-x32\...\InstallShield_{D3D5C4E8-040F-4C6F-8105-41D43CF94F44}) (Version: 9.0.2.8942 - NTI Corporation)
NTI Media Maker 9 (x32 Version: 9.0.2.8942 - NTI Corporation) Hidden
OpenOffice 4.0.0 (HKLM-x32\...\{B28DBCBA-60F8-40ED-B35B-F510C327946C}) (Version: 4.00.9702 - Apache Software Foundation)
Outpost Security Suite 7.1.1 (HKLM\...\Agnitum Outpost Security Suite Free_is1) (Version: 7.1.1 - Agnitum, Ltd.)
Paint.NET v3.5.10 (HKLM\...\{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}) (Version: 3.60.0 - dotPDN LLC)
PDF Blender (HKLM-x32\...\PDF Blender) (Version: - )
PDF24 Creator 6.5.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
phase6_19 (HKLM-x32\...\{65D70656-D248-4C83-B594-E3029C43B37A}) (Version: 1.90.0000 - phase6)
PKR (HKLM-x32\...\PKR) (Version: - PKR Ltd)
Protect Disc License Helper 1.0.118 (HKLM-x32\...\Protect Disc License Helper) (Version: 1.0.118 - Protect Disc)
ProtectDisc Driver, Version 11 (HKLM-x32\...\ProtectDisc Driver 11) (Version: 11.0.0.11 - ProtectDisc Software GmbH)
RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden
RealPlayer (HKLM-x32\...\RealPlayer 15.0) (Version: 15.0.6 - RealNetworks)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6680 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30127 - Realtek Semiconductor Corp.)
RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
SlimDrivers (HKLM-x32\...\{7E052F74-10A7-42E7-84EB-01C172F5AB5D}) (Version: 2.2.28413 - SlimWare Utilities, Inc.)
Sprachtrainer Fonts (HKLM-x32\...\{FBCF2ED3-AFB5-475E-BF9A-30BEAD366FBC}) (Version: 1.00.01 - Ernst Klett Verlag GmbH)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.2.17.5 - Synaptics Incorporated)
TopOCR 3.1 (HKLM-x32\...\TopOCR) (Version: 3.1 - TopSoft, Ltd)
TrojanHunter 5.6 (HKLM-x32\...\TrojanHunter_is1) (Version: 5.6 - Bytelayer AB)
USB Flachbettscanner (HKLM-x32\...\{D341C705-A763-4DC0-A3B6-EA13E34ADE9E}) (Version: - )
Visual Studio 2008 x64 Redistributables (HKLM-x32\...\{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}) (Version: 10.0.0.2 - AVG Technologies)
Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)
Welcome Center (HKLM-x32\...\Acer Welcome Center) (Version: 1.02.3503 - Acer Incorporated)
WinRAR 4.10 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.10.0 - win.rar GmbH)
Wipe 2013.55 (HKLM-x32\...\Wipe 2013) (Version: - )
Wise Registry Cleaner 7.88 (HKLM-x32\...\Wise Registry Cleaner_is1) (Version: 7.88 - WiseCleaner.com, Inc.)
Xleaner v4.06.616 (HKLM-x32\...\{72D84E46-E633-4729-8A77-2347C8CD4096}_is1) (Version: - More Than A Cleaner.de)
YouTube Song Downloader (HKLM-x32\...\{4281435C-AD1D-4C8A-B9C0-3961C11EF142}_is1) (Version: 8.2 - Abelssoft)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-3429764466-1293764708-2967138861-1001_Classes\CLSID\{7F943A42-14C6-0ADB-796B-A6520583F6C6}\InprocServer32 -> C:\Windows\system32\ole32.dll (Microsoft Corporation)
==================== Restore Points =========================
17-07-2014 20:18:30 avast! antivirus system restore point
25-07-2014 04:39:19 Windows Update
11-08-2014 21:40:01 Geplanter Prüfpunkt
13-08-2014 18:12:45 Windows Update
21-08-2014 07:46:21 Windows Update
25-08-2014 13:11:31 Klett Font Phonetik wird entfernt
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2014-03-27 14:03 - 00000698 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {2F633BFB-ED06-4A61-940D-35CB18538E55} - System32\Tasks\{F70D7270-28A2-4FEB-A035-9C4A4C56976F} => C:\Users\AlX\Downloads\sca9693w9xp.exe
Task: {3084DA88-B1B1-4302-9C76-7E0F5DA7BA5F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {4CD62BD1-33E1-4BBC-9640-82B0E2E594DF} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {68702AB2-B9AB-47DD-AD79-CA887C32208A} - System32\Tasks\ROC_REG_JAN_DELETE => C:\ProgramData\AVG January 2013 Campaign\ROC.exe [2013-01-17] ()
Task: {6A20A5C0-1F79-4303-8AF9-3A4F19B3884F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-08] (Adobe Systems Incorporated)
Task: {763044E8-7B71-4C18-941F-73F1A1B32C29} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-3429764466-1293764708-2967138861-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-07-27] (RealNetworks, Inc.)
Task: {816175CE-D199-4ABC-BA6C-71AD8848CB8C} - System32\Tasks\Ad-Aware Update (Weekly) => C:\Program Files (x86)\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe
Task: {8B2A0DB6-A6AD-4DA4-80D4-1D09B2D9ACFE} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-3429764466-1293764708-2967138861-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-07-27] (RealNetworks, Inc.)
Task: {9EB84B48-5049-4C9F-8697-0741CE1C4CF6} - System32\Tasks\Adobe Reader Speed Launcher => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe
Task: {BE0A8B47-02DE-4FFA-BB65-46BE1C22C980} - System32\Tasks\Adobe ARM => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-12-21] (Adobe Systems Incorporated)
Task: {BF47B4DE-CCF9-40DE-9888-AFB491C73EAD} - System32\Tasks\{AB8B422C-24D8-4940-B641-1540DA1CAC31} => C:\Users\AlX\Downloads\SetupPoker_a451c9(2).exe
Task: {CD23F21F-6D8D-4590-AF0F-5791B4FA60EB} - System32\Tasks\{4AF1DABB-5C26-444C-A5BA-D1C93289680E} => C:\Users\AlX\Desktop\Setup.exe
Task: {ECE74594-99A1-4D4A-9EA8-E189618CF648} - System32\Tasks\GlaryInitialize => C:\Program Files (x86)\Glary Utilities\initialize.exe [2013-05-27] (Glarysoft Ltd)
Task: {F0E1F30D-57AB-4FF5-B84E-3E8B66155C22} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-07-17] (AVAST Software)
Task: {F5E77754-9BEB-41DB-92D4-D1D566E0C426} - System32\Tasks\DriverEasy Scheduled Scan => C:\Program Files\Easeware\DriverEasy\DriverEasy.exe [2013-05-29] (Easeware)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\DriverEasy Scheduled Scan.job => C:\Program Files\Easeware\DriverEasy\DriverEasy.exe
Task: C:\Windows\Tasks\GlaryInitialize.job => C:\Program Files (x86)\Glary Utilities\initialize.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\ROC_REG_JAN_DELETE.job => C:\ProgramData\AVG January 2013 Campaign\ROC.exe
==================== Loaded Modules (whitelisted) =============
2011-12-10 01:52 - 2011-03-30 20:02 - 00264200 _____ () C:\Program Files\Agnitum\Outpost Security Suite Free\w7_gui.dll
2011-12-10 01:52 - 2009-12-03 09:28 - 00270336 _____ () C:\Program Files\Agnitum\Outpost Security Suite Free\unrar.dll
2011-12-10 01:52 - 2009-12-03 09:28 - 00243200 _____ () C:\Program Files\Agnitum\Outpost Security Suite Free\zlib.dll
2013-03-28 22:30 - 2013-03-28 22:30 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2013-07-16 15:53 - 2013-07-16 15:53 - 00218112 _____ () C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
2013-03-28 22:30 - 2013-03-28 22:30 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2012-02-03 17:13 - 2010-04-05 21:55 - 00116104 _____ () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
2014-07-17 22:20 - 2014-07-17 22:20 - 00301152 _____ () C:\Program Files\AVAST Software\Avast\aswProperty.dll
2014-08-26 00:21 - 2014-08-26 00:21 - 02801152 _____ () C:\Program Files\AVAST Software\Avast\defs\14082501\algo.dll
2014-07-17 22:20 - 2014-07-17 22:20 - 19329904 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2013-07-16 15:49 - 2013-07-16 15:49 - 00221184 _____ () C:\Program Files (x86)\GNU\GnuPG\libksba-8.dll
2013-07-16 15:48 - 2013-07-16 15:48 - 00037888 _____ () C:\Program Files (x86)\GNU\GnuPG\libgpg-error-0.dll
2013-07-16 15:46 - 2013-07-16 15:46 - 00050176 _____ () C:\Program Files (x86)\GNU\GnuPG\libw32pth-0.dll
2013-07-16 15:49 - 2013-07-16 15:49 - 00069632 _____ () C:\Program Files (x86)\GNU\GnuPG\libassuan-0.dll
2013-07-16 15:50 - 2013-07-16 15:50 - 00627712 _____ () C:\Program Files (x86)\GNU\GnuPG\libgcrypt-11.dll
2014-08-10 16:35 - 2014-08-10 16:35 - 03800688 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2011-04-24 03:29 - 2011-04-24 03:29 - 00465640 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\sqlite3.dll
2011-04-24 03:29 - 2011-04-24 03:29 - 01081664 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\ACE.dll
2011-04-24 03:29 - 2011-04-24 03:29 - 00125760 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\MailConverter32.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\Temp:0B4227B4
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: TkBellExe => "C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe" -osboot
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (08/26/2014 01:14:59 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/26/2014 00:21:23 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/25/2014 03:45:57 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/25/2014 03:20:01 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm chrome.exe, Version 36.0.1985.143 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 151c
Startzeit: 01cfc0672c17da2a
Endzeit: 141
Anwendungspfad: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Berichts-ID: 7ea35240-2c5a-11e4-9103-3860777a9ebe
Error: (08/25/2014 01:05:57 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/25/2014 07:56:50 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/24/2014 04:05:50 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/24/2014 02:19:46 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/24/2014 02:04:07 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/24/2014 01:05:29 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (08/26/2014 01:14:54 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%3
Error: (08/26/2014 01:14:54 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "LibUsb-Win32 - Daemon, Version 0.1.10.1" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (08/26/2014 01:13:57 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\libusb0.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (08/26/2014 00:21:15 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%3
Error: (08/26/2014 00:21:14 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "LibUsb-Win32 - Daemon, Version 0.1.10.1" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (08/26/2014 00:20:09 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\libusb0.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (08/25/2014 03:45:52 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%3
Error: (08/25/2014 03:45:50 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "LibUsb-Win32 - Daemon, Version 0.1.10.1" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (08/25/2014 03:44:49 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\libusb0.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (08/25/2014 01:05:49 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%3
Microsoft Office Sessions:
=========================
Error: (08/26/2014 01:14:59 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/26/2014 00:21:23 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/25/2014 03:45:57 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/25/2014 03:20:01 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: chrome.exe36.0.1985.143151c01cfc0672c17da2a141C:\Program Files (x86)\Google\Chrome\Application\chrome.exe7ea35240-2c5a-11e4-9103-3860777a9ebe
Error: (08/25/2014 01:05:57 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/25/2014 07:56:50 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/24/2014 04:05:50 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/24/2014 02:19:46 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/24/2014 02:04:07 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/24/2014 01:05:29 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
CodeIntegrity Errors:
===================================
Date: 2013-03-22 16:10:42.922
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Users\AlX\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-03-22 16:10:42.795
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Users\AlX\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-03-22 16:10:41.906
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-03-22 16:10:41.774
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Processor: AMD E-450 APU with Radeon(tm) HD Graphics
Percentage of memory in use: 26%
Total physical RAM: 7913.9 MB
Available physical RAM: 5845.23 MB
Total Pagefile: 15825.98 MB
Available Pagefile: 13592.83 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: (Acer) (Fixed) (Total:680.54 GB) (Free:601.82 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 698.6 GB) (Disk ID: 1F732B1D)
Partition 1: (Not Active) - (Size=18 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=680.5 GB) - (Type=07 NTFS)
==================== End Of Log ============================
defogger_disable by jpshortstuff (23.02.10.1) Log created at 01:22 on 26/08/2014 (AlX) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- GMER Logfile: Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-08-26 02:00:58
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000070 ST975042 rev.0001 698,64GB
Running: qwfin87w.exe; Driver: C:\Users\AlX\AppData\Local\Temp\kfldrpow.sys
---- Kernel code sections - GMER 2.1 ----
.text C:\Windows\System32\win32k.sys!EngSetLastError + 152 fffff96000154e88 8 bytes [34, 26, 08, 04, 80, F8, FF, ...]
.text C:\Windows\System32\win32k.sys!EngSetLastError + 628 fffff96000155064 8 bytes [34, 16, 08, 04, 80, F8, FF, ...]
.text C:\Windows\System32\win32k.sys!W32pServiceTable fffff96000184200 7 bytes [00, A2, F3, FF, 01, B6, F0]
.text C:\Windows\System32\win32k.sys!W32pServiceTable + 8 fffff96000184208 3 bytes [C0, 06, 02]
.text ... * 106
.text C:\Windows\System32\win32k.sys!EngGetProcessHandle + 484 fffff960002432fc 6 bytes {JMP QWORD [RIP-0xba97a]}
.text C:\Windows\System32\win32k.sys!EngCTGetCurrentGamma + 32 fffff96000249780 14 bytes {JMP QWORD [RIP+0x0]}
.text C:\Windows\System32\win32k.sys!EngDeleteEvent + 32 fffff9600024d840 14 bytes {JMP QWORD [RIP+0x0]}
.text C:\Windows\System32\win32k.sys!FONTOBJ_pQueryGlyphAttrs + 720 fffff960002a5240 14 bytes {JMP QWORD [RIP+0x0]}
---- User code sections - GMER 2.1 ----
.text C:\Windows\system32\wininit.exe[600] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Windows\system32\wininit.exe[600] C:\Windows\system32\USER32.dll!UnregisterClassW + 212 0000000076ccd538 14 bytes {PUSH RAX; AND [RSI], ECX; ADD BYTE [RCX], 0x0; ADD [RAX], AL; JMP QWORD [RIP-0xe]}
.text C:\Windows\system32\wininit.exe[600] C:\Windows\system32\USER32.dll!SetWindowPos 0000000076cd3c50 6 bytes {JMP QWORD [RIP+0xa0]}
.text C:\Windows\system32\wininit.exe[600] C:\Windows\system32\USER32.dll!SetWindowPos + 166 0000000076cd3cf6 8 bytes [C0, 21, 0E, 80, 01, 00, 00, ...]
.text C:\Windows\system32\wininit.exe[600] C:\Windows\system32\USER32.dll!mouse_event + 212 0000000076ce3968 14 bytes [A0, 22, 0E, 80, 01, 00, 00, ...]
.text C:\Windows\system32\wininit.exe[600] C:\Windows\system32\USER32.dll!VkKeyScanW + 20 0000000076d106f8 14 bytes [10, 23, 0E, 80, 01, 00, 00, ...]
.text C:\Windows\system32\winlogon.exe[656] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Windows\system32\winlogon.exe[656] C:\Windows\system32\USER32.dll!UnregisterClassW + 212 0000000076ccd538 14 bytes {PUSH RAX; AND [RSI], ECX; ADD BYTE [RCX], 0x0; ADD [RAX], AL; JMP QWORD [RIP-0xe]}
.text C:\Windows\system32\winlogon.exe[656] C:\Windows\system32\USER32.dll!SetWindowPos 0000000076cd3c50 6 bytes {JMP QWORD [RIP+0xa0]}
.text C:\Windows\system32\winlogon.exe[656] C:\Windows\system32\USER32.dll!SetWindowPos + 166 0000000076cd3cf6 8 bytes [C0, 21, 0E, 80, 01, 00, 00, ...]
.text C:\Windows\system32\winlogon.exe[656] C:\Windows\system32\USER32.dll!mouse_event + 212 0000000076ce3968 14 bytes [A0, 22, 0E, 80, 01, 00, 00, ...]
.text C:\Windows\system32\winlogon.exe[656] C:\Windows\system32\USER32.dll!VkKeyScanW + 20 0000000076d106f8 14 bytes [10, 23, 0E, 80, 01, 00, 00, ...]
.text C:\Windows\system32\services.exe[680] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Windows\system32\services.exe[680] C:\Windows\system32\USER32.dll!UnregisterClassW + 212 0000000076ccd538 14 bytes {PUSH RAX; AND [RSI], ECX; ADD BYTE [RCX], 0x0; ADD [RAX], AL; JMP QWORD [RIP-0xe]}
.text C:\Windows\system32\services.exe[680] C:\Windows\system32\USER32.dll!SetWindowPos 0000000076cd3c50 6 bytes {JMP QWORD [RIP+0xa0]}
.text C:\Windows\system32\services.exe[680] C:\Windows\system32\USER32.dll!SetWindowPos + 166 0000000076cd3cf6 8 bytes [C0, 21, 0E, 80, 01, 00, 00, ...]
.text C:\Windows\system32\services.exe[680] C:\Windows\system32\USER32.dll!mouse_event + 212 0000000076ce3968 14 bytes [A0, 22, 0E, 80, 01, 00, 00, ...]
.text C:\Windows\system32\services.exe[680] C:\Windows\system32\USER32.dll!VkKeyScanW + 20 0000000076d106f8 14 bytes [10, 23, 0E, 80, 01, 00, 00, ...]
.text C:\Windows\system32\atiesrxx.exe[984] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Windows\System32\svchost.exe[356] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Windows\system32\svchost.exe[804] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
? C:\Windows\system32\tschannel.dll [804] entry point in ".rsrc" section 000007fefae86894
.text C:\Windows\system32\Dwm.exe[1444] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Windows\Explorer.EXE[1452] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1764] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[1784] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Windows\system32\taskhost.exe[1852] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1364] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Windows\system32\RunDll32.exe[1368] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Program Files (x86)\Launch Manager\LManager.exe[2212] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007623a2fd 1 byte [62]
.text C:\Program Files (x86)\Launch Manager\LManager.exe[2212] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000768b8e4e 5 bytes JMP 00000001005955a0
.text C:\Program Files (x86)\Launch Manager\LManager.exe[2212] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000768df170 1 byte JMP 0000000100595574
.text C:\Program Files (x86)\Launch Manager\LManager.exe[2212] C:\Windows\syswow64\USER32.dll!SetForegroundWindow + 2 00000000768df172 3 bytes {JMP QWORD [RBX-0x35]}
.text C:\Program Files (x86)\Launch Manager\LManager.exe[2212] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 00000000769007d7 5 bytes JMP 0000000100595624
.text C:\Program Files (x86)\Launch Manager\LManager.exe[2212] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExA 0000000076916da0 5 bytes JMP 00000001005955f8
.text C:\Program Files (x86)\Launch Manager\LManager.exe[2212] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074a61465 2 bytes [A6, 74]
.text C:\Program Files (x86)\Launch Manager\LManager.exe[2212] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074a614bb 2 bytes [A6, 74]
.text ... * 2
.text C:\Program Files\AVAST Software\Avast\avastui.exe[2244] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000076218791 8 bytes [31, C0, C2, 04, 00, 90, 90, ...]
.text C:\Program Files\AVAST Software\Avast\avastui.exe[2244] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007623a2fd 1 byte [62]
.text C:\Program Files\AVAST Software\Avast\avastui.exe[2244] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000768b8e4e 5 bytes JMP 00000001100a55a0
.text C:\Program Files\AVAST Software\Avast\avastui.exe[2244] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000768df170 1 byte JMP 00000001100a5574
.text C:\Program Files\AVAST Software\Avast\avastui.exe[2244] C:\Windows\syswow64\USER32.dll!SetForegroundWindow + 2 00000000768df172 3 bytes {JMP QWORD [RBX+0x7c]}
.text C:\Program Files\AVAST Software\Avast\avastui.exe[2244] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 00000000769007d7 5 bytes JMP 00000001100a5624
.text C:\Program Files\AVAST Software\Avast\avastui.exe[2244] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExA 0000000076916da0 5 bytes JMP 00000001100a55f8
.text C:\Program Files\AVAST Software\Avast\avastui.exe[2244] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074a61465 2 bytes [A6, 74]
.text C:\Program Files\AVAST Software\Avast\avastui.exe[2244] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074a614bb 2 bytes [A6, 74]
.text ... * 2
.text C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[2276] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007623a2fd 1 byte [62]
.text C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[2276] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000768b8e4e 5 bytes JMP 00000001100a55a0
.text C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[2276] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000768df170 1 byte JMP 00000001100a5574
.text C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[2276] C:\Windows\syswow64\USER32.dll!SetForegroundWindow + 2 00000000768df172 3 bytes {JMP QWORD [RBX+0x7c]}
.text C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[2276] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 00000000769007d7 5 bytes JMP 00000001100a5624
.text C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[2276] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExA 0000000076916da0 5 bytes JMP 00000001100a55f8
.text C:\Program Files (x86)\PDF24\pdf24.exe[2332] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007623a2fd 1 byte [62]
.text C:\Program Files (x86)\PDF24\pdf24.exe[2332] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000768b8e4e 5 bytes JMP 00000001100a55a0
.text C:\Program Files (x86)\PDF24\pdf24.exe[2332] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000768df170 1 byte JMP 00000001100a5574
.text C:\Program Files (x86)\PDF24\pdf24.exe[2332] C:\Windows\syswow64\USER32.dll!SetForegroundWindow + 2 00000000768df172 3 bytes {JMP QWORD [RBX+0x7c]}
.text C:\Program Files (x86)\PDF24\pdf24.exe[2332] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 00000000769007d7 5 bytes JMP 00000001100a5624
.text C:\Program Files (x86)\PDF24\pdf24.exe[2332] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExA 0000000076916da0 5 bytes JMP 00000001100a55f8
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2348] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007623a2fd 1 byte [62]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2348] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000768b8e4e 5 bytes JMP 00000001100a55a0
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2348] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000768df170 1 byte JMP 00000001100a5574
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2348] C:\Windows\syswow64\USER32.dll!SetForegroundWindow + 2 00000000768df172 3 bytes {JMP QWORD [RBX+0x7c]}
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2348] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 00000000769007d7 5 bytes JMP 00000001100a5624
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2348] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExA 0000000076916da0 5 bytes JMP 00000001100a55f8
.text C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe[2572] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007623a2fd 1 byte [62]
.text C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe[2572] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000768b8e4e 5 bytes JMP 00000001100a55a0
.text C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe[2572] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000768df170 1 byte JMP 00000001100a5574
.text C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe[2572] C:\Windows\syswow64\USER32.dll!SetForegroundWindow + 2 00000000768df172 3 bytes {JMP QWORD [RBX+0x7c]}
.text C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe[2572] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 00000000769007d7 5 bytes JMP 00000001100a5624
.text C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe[2572] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExA 0000000076916da0 5 bytes JMP 00000001100a55f8
.text C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[2624] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Program Files (x86)\Launch Manager\dsiwmis.exe[3032] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007623a2fd 1 byte [62]
.text C:\Program Files (x86)\Launch Manager\dsiwmis.exe[3032] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000768b8e4e 5 bytes JMP 00000001100a55a0
.text C:\Program Files (x86)\Launch Manager\dsiwmis.exe[3032] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000768df170 1 byte JMP 00000001100a5574
.text C:\Program Files (x86)\Launch Manager\dsiwmis.exe[3032] C:\Windows\syswow64\USER32.dll!SetForegroundWindow + 2 00000000768df172 3 bytes {JMP QWORD [RBX+0x7c]}
.text C:\Program Files (x86)\Launch Manager\dsiwmis.exe[3032] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 00000000769007d7 5 bytes JMP 00000001100a5624
.text C:\Program Files (x86)\Launch Manager\dsiwmis.exe[3032] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExA 0000000076916da0 5 bytes JMP 00000001100a55f8
.text C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe[2196] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[2148] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007623a2fd 1 byte [62]
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[2148] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000768b8e4e 5 bytes JMP 00000001100a55a0
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[2148] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000768df170 1 byte JMP 00000001100a5574
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[2148] C:\Windows\syswow64\USER32.dll!SetForegroundWindow + 2 00000000768df172 3 bytes {JMP QWORD [RBX+0x7c]}
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[2148] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 00000000769007d7 5 bytes JMP 00000001100a5624
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[2148] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExA 0000000076916da0 5 bytes JMP 00000001100a55f8
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1344] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007623a2fd 1 byte [62]
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1344] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000768b8e4e 5 bytes JMP 00000001100a55a0
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1344] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000768df170 1 byte JMP 00000001100a5574
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1344] C:\Windows\syswow64\USER32.dll!SetForegroundWindow + 2 00000000768df172 3 bytes {JMP QWORD [RBX+0x7c]}
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1344] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 00000000769007d7 5 bytes JMP 00000001100a5624
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1344] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExA 0000000076916da0 5 bytes JMP 00000001100a55f8
.text C:\Program Files (x86)\Acer\Registration\GREGsvc.exe[2644] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007623a2fd 1 byte [62]
.text C:\Program Files (x86)\Acer\Registration\GREGsvc.exe[2644] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000768b8e4e 5 bytes JMP 00000001100a55a0
.text C:\Program Files (x86)\Acer\Registration\GREGsvc.exe[2644] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000768df170 1 byte JMP 00000001100a5574
.text C:\Program Files (x86)\Acer\Registration\GREGsvc.exe[2644] C:\Windows\syswow64\USER32.dll!SetForegroundWindow + 2 00000000768df172 3 bytes {JMP QWORD [RBX+0x7c]}
.text C:\Program Files (x86)\Acer\Registration\GREGsvc.exe[2644] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 00000000769007d7 5 bytes JMP 00000001100a5624
.text C:\Program Files (x86)\Acer\Registration\GREGsvc.exe[2644] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExA 0000000076916da0 5 bytes JMP 00000001100a55f8
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[2240] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007623a2fd 1 byte [62]
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[2240] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000768b8e4e 5 bytes JMP 00000001100a55a0
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[2240] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000768df170 1 byte JMP 00000001100a5574
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[2240] C:\Windows\syswow64\USER32.dll!SetForegroundWindow + 2 00000000768df172 3 bytes {JMP QWORD [RBX+0x7c]}
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[2240] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 00000000769007d7 5 bytes JMP 00000001100a5624
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[2240] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExA 0000000076916da0 5 bytes JMP 00000001100a55f8
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[2240] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074a61465 2 bytes [A6, 74]
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[2240] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074a614bb 2 bytes [A6, 74]
.text ... * 2
.text C:\Program Files\Acer\Acer Updater\UpdaterService.exe[3212] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007623a2fd 1 byte [62]
.text C:\Program Files\Acer\Acer Updater\UpdaterService.exe[3212] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000768b8e4e 5 bytes JMP 00000001100a55a0
.text C:\Program Files\Acer\Acer Updater\UpdaterService.exe[3212] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000768df170 1 byte JMP 00000001100a5574
.text C:\Program Files\Acer\Acer Updater\UpdaterService.exe[3212] C:\Windows\syswow64\USER32.dll!SetForegroundWindow + 2 00000000768df172 3 bytes {JMP QWORD [RBX+0x7c]}
.text C:\Program Files\Acer\Acer Updater\UpdaterService.exe[3212] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 00000000769007d7 5 bytes JMP 00000001100a5624
.text C:\Program Files\Acer\Acer Updater\UpdaterService.exe[3212] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExA 0000000076916da0 5 bytes JMP 00000001100a55f8
.text C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[3292] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007623a2fd 1 byte [62]
.text C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[3292] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000768b8e4e 5 bytes JMP 00000001100a55a0
.text C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[3292] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000768df170 1 byte JMP 00000001100a5574
.text C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[3292] C:\Windows\syswow64\USER32.dll!SetForegroundWindow + 2 00000000768df172 3 bytes {JMP QWORD [RBX+0x7c]}
.text C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[3292] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 00000000769007d7 5 bytes JMP 00000001100a5624
.text C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[3292] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExA 0000000076916da0 5 bytes JMP 00000001100a55f8
.text C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[3292] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074a61465 2 bytes [A6, 74]
.text C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[3292] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074a614bb 2 bytes [A6, 74]
.text ... * 2
.text C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe[3488] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007623a2fd 1 byte [62]
.text C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe[3488] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000768b8e4e 5 bytes JMP 00000001100a55a0
.text C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe[3488] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000768df170 1 byte JMP 00000001100a5574
.text C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe[3488] C:\Windows\syswow64\USER32.dll!SetForegroundWindow + 2 00000000768df172 3 bytes {JMP QWORD [RBX+0x7c]}
.text C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe[3488] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 00000000769007d7 5 bytes JMP 00000001100a5624
.text C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe[3488] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExA 0000000076916da0 5 bytes JMP 00000001100a55f8
.text C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe[3488] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000074a61465 2 bytes [A6, 74]
.text C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe[3488] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 0000000074a614bb 2 bytes [A6, 74]
.text ... * 2
.text C:\Windows\system32\wbem\unsecapp.exe[3752] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe[4148] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Users\AlX\Downloads\qwfin87w.exe[3012] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007623a2fd 1 byte [62]
.text C:\Users\AlX\Downloads\qwfin87w.exe[3012] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000768b8e4e 5 bytes JMP 00000001100a55a0
.text C:\Users\AlX\Downloads\qwfin87w.exe[3012] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000768df170 1 byte JMP 00000001100a5574
.text C:\Users\AlX\Downloads\qwfin87w.exe[3012] C:\Windows\syswow64\USER32.dll!SetForegroundWindow + 2 00000000768df172 3 bytes {JMP QWORD [RBX+0x7c]}
.text C:\Users\AlX\Downloads\qwfin87w.exe[3012] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 00000000769007d7 5 bytes JMP 00000001100a5624
.text C:\Users\AlX\Downloads\qwfin87w.exe[3012] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExA 0000000076916da0 5 bytes JMP 00000001100a55f8
---- EOF - GMER 2.1 ----
Ich hoffe das ist alles soweit richtig. Noch einmal vielen Dank. Toll, dass es euch gibt. Gruß AlX |
| Themen zu Trojan.Kazy!WvUyTGribrg (trojan) in AdobeARM.exe |
| abelssoft, ad-aware, antivirus, branding, canon, converter, cyberghost, desktop, device driver, downloader, dvdvideosoft ltd., feedback, firefox, flash player, home, homepage, launch, mozilla, mp3, msiexec.exe, netzwerk, officejet, realtek, registry, safer networking, schannel.dll, security, siteadvisor, software, starten, svchost.exe, system, trojaner, viren, virus, windows, wma |
Baum-Darstellung