| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Virus auf externer Festplatte?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
11.09.2014, 09:26
| #1 |
| |  Virus auf externer Festplatte? Hallo :-) Ich kenne mich nicht besonders gut aus mit Computer und Co, also bitte so einfach wie möglich erklären, danke. Vor ein paar Monaten habe ich mir eine externe Festplatte gekauft, Chili Green 2T, ich brauche sie eigentlich nur um alle meine Fotos darauf zu speichern, das habe ich auch gleich nach dem Kauf gemacht. Jetzt würde ich Fotos von der Festplatte bauchen, leider arbeit sie nicht richtig, nach dem anstecken am PC zeigt sei bei dem Ordner den man als erstes öffnet die ersten paar Bilder und dann gibt sie zwar vor weiter zuladen, aber es können keine weiteren Bilder angesehen oder runtergespeichert werden, auch nicht aus einen anderen Ordner. Meine Frage ist, befindet sich ein Virus auf der Festplatte? kann ich diesen irgendwie entfernen ohne das ich meine Bilder verliere? Vielen Danke schon mal im voraus. |
|
11.09.2014, 09:26
| #2 |
| /// the machine /// TB-Ausbilder    |  Virus auf externer Festplatte? hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
11.09.2014, 10:00
| #3 |
| | Virus auf externer Festplatte? FRST Logfile:
__________________FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-09-2014
Ran by Birgit (administrator) on BIRGIT-PC on 11-09-2014 10:39:02
Running from C:\Users\Birgit\Downloads
Platform: Microsoft Windows 7 Ultimate Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool
Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
() C:\Program Files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [974432 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [nwiz] => nwiz.exe /install
HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [248040 2010-02-18] (Sun Microsystems, Inc.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKU\S-1-5-21-3893443614-215775362-1324763491-1000\...\MountPoints2: {cff065e6-6d6f-11e2-b2a2-806e6f6e6963} - D:\CDMenu\CDMenu.exe
IFEO\bitguard.exe: [Debugger] tasklist.exe
IFEO\bprotect.exe: [Debugger] tasklist.exe
IFEO\bpsvc.exe: [Debugger] tasklist.exe
IFEO\browsemngr.exe: [Debugger] tasklist.exe
IFEO\browserdefender.exe: [Debugger] tasklist.exe
IFEO\browsermngr.exe: [Debugger] tasklist.exe
IFEO\browserprotect.exe: [Debugger] tasklist.exe
IFEO\browsersafeguard.exe: [Debugger] tasklist.exe
IFEO\bundlesweetimsetup.exe: [Debugger] tasklist.exe
IFEO\cltmngsvc.exe: [Debugger] tasklist.exe
IFEO\delta babylon.exe: [Debugger] tasklist.exe
IFEO\delta tb.exe: [Debugger] tasklist.exe
IFEO\delta2.exe: [Debugger] tasklist.exe
IFEO\deltainstaller.exe: [Debugger] tasklist.exe
IFEO\deltasetup.exe: [Debugger] tasklist.exe
IFEO\deltatb.exe: [Debugger] tasklist.exe
IFEO\deltatb_2501-c733154b.exe: [Debugger] tasklist.exe
IFEO\dprotectsvc.exe: [Debugger] tasklist.exe
IFEO\iminentsetup.exe: [Debugger] tasklist.exe
IFEO\jumpflip: [Debugger] tasklist.exe
IFEO\protectedsearch.exe: [Debugger] tasklist.exe
IFEO\rjatydimofu.exe: [Debugger] tasklist.exe
IFEO\searchinstaller.exe: [Debugger] tasklist.exe
IFEO\searchprotection.exe: [Debugger] tasklist.exe
IFEO\searchprotector.exe: [Debugger] tasklist.exe
IFEO\searchsettings.exe: [Debugger] tasklist.exe
IFEO\searchsettings64.exe: [Debugger] tasklist.exe
IFEO\snapdo.exe: [Debugger] tasklist.exe
IFEO\stinst32.exe: [Debugger] tasklist.exe
IFEO\stinst64.exe: [Debugger] tasklist.exe
IFEO\sweetimsetup.exe: [Debugger] tasklist.exe
IFEO\tbdelta.exetoolbar783881609.exe: [Debugger] tasklist.exe
IFEO\umbrella.exe: [Debugger] tasklist.exe
IFEO\utiljumpflip.exe: [Debugger] tasklist.exe
IFEO\volaro: [Debugger] tasklist.exe
IFEO\vonteera: [Debugger] tasklist.exe
IFEO\websteroids.exe: [Debugger] tasklist.exe
IFEO\websteroidsservice.exe: [Debugger] tasklist.exe
HKLM\...\AppCertDlls: [x64] -> c:\program files\movies toolbar\datamngr\x64\apcrtldr.dll <===== ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?publisher=SnapdoSoftonicYB&dpid=SnapdoSoftonicYB&co=AT&userid=b037680f-8610-d497-5567-0dfb2701cbeb&searchtype=ds&q={searchTerms}&installDate=12/10/2013
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN AT: Hotmail, Outlook, Messenger, Skype, Unterhaltung, Nachrichten & Lifestyle
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x929EAD054A09CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-AT
HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = Google
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snapdo.com/?publisher=SnapdoSoftonicYB&dpid=SnapdoSoftonicYB&co=AT&userid=b037680f-8610-d497-5567-0dfb2701cbeb&searchtype=ds&q={searchTerms}&installDate=12/10/2013
SearchScopes: HKLM - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=SnapdoSoftonicYB&dpid=SnapdoSoftonicYB&co=AT&userid=b037680f-8610-d497-5567-0dfb2701cbeb&searchtype=ds&q={searchTerms}&installDate=12/10/2013
SearchScopes: HKLM - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=SnapdoSoftonicYB&dpid=SnapdoSoftonicYB&co=AT&userid=b037680f-8610-d497-5567-0dfb2701cbeb&searchtype=ds&q={searchTerms}&installDate=12/10/2013
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=575&systemid=406&v=a12712-133&apn_uid=1534263558414535&apn_dtid=BND406&o=APN10645&apn_ptnrs=AG6&q={searchTerms}
SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=SnapdoSoftonicYB&dpid=SnapdoSoftonicYB&co=AT&userid=b037680f-8610-d497-5567-0dfb2701cbeb&searchtype=ds&q={searchTerms}&installDate=12/10/2013
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - 87672C6E7593455B9961E273F4ADB59C URL = hxxp://feed.snapdo.com/?publisher=SnapdoSoftonicYB&dpid=SnapdoSoftonicYB&co=AT&userid=b037680f-8610-d497-5567-0dfb2701cbeb&searchtype=ds&q={searchTerms}&installDate=12/10/2013
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=SnapdoSoftonicYB&dpid=SnapdoSoftonicYB&co=AT&userid=b037680f-8610-d497-5567-0dfb2701cbeb&searchtype=ds&q={searchTerms}&installDate=12/10/2013
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.max-start.com/?q={searchTerms}&babsrc=SP_ss_mib2&mntrId=180C00215C45E99D&affID=124439&tsp=5033
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=575&systemid=406&v=a12712-133&apn_uid=1534263558414535&apn_dtid=BND406&o=APN10645&apn_ptnrs=AG6&q={searchTerms}
BHO: No Name -> {2EECD738-5844-4a99-B4B6-146BF802613B} -> No File
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - No Name - {98889811-442D-49dd-99D7-DC866BE87DBC} - No File
Toolbar: HKLM - No Name - {3d86a75b-cb6b-4764-885d-ca6336f04ba2} - No File
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
DPF: {5852F5ED-8BF4-11D4-A245-0080C6F74284} hxxp://javadl-esd.oracle.com/update/1.6.0/jinstall-6u20-windows-i586.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.43.1
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
Chrome:
=======
CHR HomePage: Default -> hxxp://www.search.ask.com/?o=APN10645A&gct=hp&d=406-575&v=a12712-133&t=4
CHR StartupUrls: Default -> "hxxp://www.search.ask.com/?o=APN10645A&gct=hp&d=406-575&v=a12712-133&t=4"
CHR DefaultSearchKeyword: Default -> F8BF6CD753FBE73F45575B3A21460AA6FB6D5C095E34839ADB643D41D22E6513
CHR DefaultSearchURL: Default -> DA510C58A32ACA388F8D4EF84E583223768AE38D5B79BEA084253BDED53EB52B
CHR CustomProfile: C:\Users\Birgit\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (New Tab Page) - C:\Users\Birgit\AppData\Local\Google\Chrome\User Data\Default\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl [2013-11-14]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Birgit\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-10]
CHR Extension: (YouTube) - C:\Users\Birgit\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-05-21]
CHR Extension: (Google-Suche) - C:\Users\Birgit\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-05-21]
CHR Extension: (AdBlock) - C:\Users\Birgit\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-02-25]
CHR Extension: (Google Wallet) - C:\Users\Birgit\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-25]
CHR Extension: (Google Mail) - C:\Users\Birgit\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-05-21]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22192 2014-08-22] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [288120 2014-08-22] (Microsoft Corporation)
R2 NVIDIA Performance Driver Service; C:\Program Files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe [4446752 2009-07-20] ()
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [231800 2014-07-17] (Microsoft Corporation)
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-11 10:39 - 2014-09-11 10:40 - 00012702 _____ () C:\Users\Birgit\Downloads\FRST.txt
2014-09-11 10:38 - 2014-09-11 10:39 - 00000000 ____D () C:\FRST
2014-09-11 10:37 - 2014-09-11 10:37 - 02105856 _____ (Farbar) C:\Users\Birgit\Downloads\FRST64.exe
2014-09-11 10:36 - 2014-09-11 10:36 - 01097728 _____ (Farbar) C:\Users\Birgit\Downloads\FRST.exe
2014-09-10 22:47 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-10 22:47 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-10 22:47 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-10 22:47 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-10 22:47 - 2014-08-18 23:57 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-10 22:47 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-10 22:47 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-10 22:47 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-10 22:47 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-10 22:47 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-10 22:47 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-10 22:47 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-10 22:47 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-10 22:47 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-10 22:47 - 2014-08-18 23:36 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-10 22:47 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-10 22:47 - 2014-08-18 23:30 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-10 22:47 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-10 22:47 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-10 22:47 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-10 22:47 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-10 22:47 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-10 22:47 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-10 22:47 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-10 22:47 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-10 22:47 - 2014-08-18 23:08 - 00673792 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-10 22:47 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-10 22:47 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-10 22:47 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-10 22:47 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-10 22:46 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-10 15:55 - 2014-07-07 03:40 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-10 15:55 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-10 15:51 - 2014-09-05 03:52 - 00445952 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-10 15:51 - 2014-09-05 03:47 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-10 15:51 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-10 15:51 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-02 15:22 - 2014-09-02 15:22 - 00001808 _____ () C:\Users\Birgit\Desktop\eingefügt1.emf
2014-09-02 12:34 - 2014-09-10 21:16 - 00000000 ____D () C:\Users\Birgit\Documents\Meisterarbeit
2014-09-02 12:03 - 2014-09-03 15:51 - 00054259 _____ () C:\Users\Birgit\Desktop\Arbeit_Birgit.lyx.emergency
2014-09-01 19:20 - 2014-08-23 03:46 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-09-01 19:20 - 2014-08-23 02:42 - 02352640 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-09-01 19:07 - 2014-05-14 18:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-09-01 19:07 - 2014-05-14 18:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-09-01 19:07 - 2014-05-14 18:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-09-01 19:07 - 2014-05-14 18:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-09-01 19:06 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-09-01 19:06 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-09-01 19:06 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-09-01 19:06 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-09-01 19:06 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-24 15:37 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-24 15:37 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-24 15:37 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-24 15:36 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-24 10:16 - 2014-07-14 03:42 - 00654336 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-24 10:16 - 2014-06-16 03:44 - 00730048 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-24 10:16 - 2014-06-16 03:44 - 00219072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2014-08-24 10:16 - 2014-06-16 03:40 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2014-08-24 10:15 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-24 10:15 - 2014-06-03 11:30 - 00101824 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-24 10:15 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-24 10:15 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-24 10:15 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-24 10:14 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-11 10:40 - 2014-09-11 10:39 - 00012702 _____ () C:\Users\Birgit\Downloads\FRST.txt
2014-09-11 10:39 - 2014-09-11 10:38 - 00000000 ____D () C:\FRST
2014-09-11 10:37 - 2014-09-11 10:37 - 02105856 _____ (Farbar) C:\Users\Birgit\Downloads\FRST64.exe
2014-09-11 10:36 - 2014-09-11 10:36 - 01097728 _____ (Farbar) C:\Users\Birgit\Downloads\FRST.exe
2014-09-11 10:07 - 2013-09-25 15:08 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-11 10:01 - 2013-05-21 22:37 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-11 09:38 - 2013-02-02 21:39 - 01327496 _____ () C:\Windows\WindowsUpdate.log
2014-09-11 09:29 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-09-11 09:28 - 2009-07-14 06:34 - 00015136 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-11 09:28 - 2009-07-14 06:34 - 00015136 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-11 09:23 - 2014-07-03 19:29 - 00004469 _____ () C:\Windows\setupact.log
2014-09-11 09:23 - 2013-09-25 22:33 - 00000374 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-09-11 09:23 - 2013-05-21 22:37 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-11 09:23 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-10 22:46 - 2013-09-05 00:01 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-10 22:40 - 2013-02-03 14:18 - 98758480 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-10 22:40 - 2013-02-02 22:03 - 00002117 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2014-09-10 22:40 - 2013-02-02 22:03 - 00001912 _____ () C:\Windows\epplauncher.mif
2014-09-10 22:40 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-09-10 22:39 - 2014-05-12 17:38 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-10 22:39 - 2013-02-02 22:03 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-09-10 22:35 - 2013-02-02 21:49 - 01593564 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-10 22:28 - 2014-07-27 15:37 - 00060970 _____ () C:\Users\Birgit\Desktop\Arbeit_Birgit.lyx
2014-09-10 21:50 - 2014-07-27 15:37 - 00060921 _____ () C:\Users\Birgit\Desktop\Arbeit_Birgit.lyx~
2014-09-10 21:16 - 2014-09-02 12:34 - 00000000 ____D () C:\Users\Birgit\Documents\Meisterarbeit
2014-09-05 03:52 - 2014-09-10 15:51 - 00445952 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-05 03:47 - 2014-09-10 15:51 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-03 15:51 - 2014-09-02 12:03 - 00054259 _____ () C:\Users\Birgit\Desktop\Arbeit_Birgit.lyx.emergency
2014-09-02 15:22 - 2014-09-02 15:22 - 00001808 _____ () C:\Users\Birgit\Desktop\eingefügt1.emf
2014-09-02 11:07 - 2009-07-14 06:33 - 00357336 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-24 12:38 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-08-24 10:07 - 2013-05-21 22:36 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-08-24 10:07 - 2013-05-21 22:36 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-08-23 03:46 - 2014-09-01 19:20 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 02:42 - 2014-09-01 19:20 - 02352640 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-19 19:39 - 2014-09-10 22:47 - 00327872 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-19 00:26 - 2014-09-10 22:47 - 17455104 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-19 00:08 - 2014-09-10 22:47 - 04232704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-18 23:57 - 2014-09-10 22:47 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-18 23:57 - 2014-09-10 22:47 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-18 23:46 - 2014-09-10 22:47 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-18 23:45 - 2014-09-10 22:47 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-18 23:44 - 2014-09-10 22:47 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-18 23:44 - 2014-09-10 22:47 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-18 23:42 - 2014-09-10 22:47 - 02185728 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-18 23:39 - 2014-09-10 22:47 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-18 23:39 - 2014-09-10 22:47 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-18 23:37 - 2014-09-10 22:47 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-18 23:36 - 2014-09-10 22:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-18 23:36 - 2014-09-10 22:47 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-18 23:35 - 2014-09-10 22:47 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-18 23:30 - 2014-09-10 22:47 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-18 23:27 - 2014-09-10 22:47 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-18 23:22 - 2014-09-10 22:47 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-18 23:19 - 2014-09-10 22:47 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-18 23:17 - 2014-09-10 22:47 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-18 23:17 - 2014-09-10 22:47 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-18 23:15 - 2014-09-10 22:47 - 11769856 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-18 23:09 - 2014-09-10 22:47 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-18 23:08 - 2014-09-10 22:47 - 02014208 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-18 23:08 - 2014-09-10 22:47 - 00673792 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-18 23:07 - 2014-09-10 22:47 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-18 22:46 - 2014-09-10 22:47 - 01812992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-18 22:38 - 2014-09-10 22:47 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-18 22:36 - 2014-09-10 22:47 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
Files to move or delete:
====================
C:\Users\Public\AlexaNSISPlugin.4040.dll
Some content of TEMP:
====================
C:\Users\Birgit\AppData\Local\Temp\uninst1.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-08-24 12:28
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- FRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 11-09-2014
Ran by Birgit at 2014-09-11 10:40:50
Running from C:\Users\Birgit\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 14 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
AGRIS-Buchhaltung 2012 (HKLM\...\AGRIS-Buchhaltung_is1) (Version: - Agris)
CCleaner (HKLM\...\CCleaner) (Version: 4.15 - Piriform)
FileZilla Client 3.8.0 (HKLM\...\FileZilla Client) (Version: 3.8.0 - Tim Kosse)
Google Chrome (HKLM\...\Google Chrome) (Version: 37.0.2062.120 - Google Inc.)
Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden
HappyFoto-Designer 4.5 (HKLM\...\HappyFoto-Designer_is1) (Version: - )
Java Auto Updater (Version: 2.0.2.1 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 20 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216020FF}) (Version: 6.0.200 - Sun Microsystems, Inc.)
Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.66.00.22 - )
LyX 2.1.0 (HKLM\...\LyX210) (Version: 2.1.0 - LyX Team)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Security Client (Version: 4.6.0305.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MiKTeX 2.9 (HKLM\...\MiKTeX 2.9) (Version: 2.9 - MiKTeX.org)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10 - NVIDIA Corporation)
NVIDIA nView Desktop Manager (HKLM\...\NVIDIA nView Desktop Manager) (Version: 121.20 - NVIDIA Corporation)
NVIDIA Performance Drivers (HKLM\...\{4C0A8D65-4286-4B58-87FE-18AD24289285}) (Version: 2.0.0.19 - NVIDIA Corporation)
PVSonyDll (Version: 1.00.0001 - NVIDIA Corporation) Hidden
supra IPCam (HKLM\...\{AB3B76E1-12D0-4DEE-8897-ED12AF47821E}) (Version: 1.4.0.0 - SUPRA Foto-Elektronik-Vertriebs-GmbH)
TeamViewer 9 (HKLM\...\TeamViewer 9) (Version: 9.0.24951 - TeamViewer)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
03-07-2014 17:11:13 Windows Update
30-07-2014 17:21:37 Windows Update
30-07-2014 20:36:51 Windows Update
24-08-2014 08:08:11 Windows Update
24-08-2014 13:30:43 Windows Update
01-09-2014 17:05:50 Windows Update
01-09-2014 17:06:14 Windows Update
01-09-2014 17:57:00 Windows Update
09-09-2014 08:00:33 Windows Update
10-09-2014 20:33:56 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {0725B738-2161-4CCD-AE55-0BA66AF01400} - System32\Tasks\4790 => Wscript.exe C:\Users\Birgit\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
Task: {09B73DF7-C6C5-4101-961B-1E73730E83BF} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-06-24] (Piriform Ltd)
Task: {404DE80B-EA11-4A08-BCCC-F52070E9AC67} - System32\Tasks\DSite => C:\Users\Birgit\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {7B815BB5-039F-4DB8-8F40-B6822D308096} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-05-21] (Google Inc.)
Task: {C109CF28-0103-446D-838B-730DE37325D4} - System32\Tasks\0 => Iexplore.exe <==== ATTENTION
Task: {CF4218E3-FAD8-41F2-94EE-ED768BA4CC93} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-05-21] (Google Inc.)
Task: {E809DBCB-91A6-4ED2-A2E0-3FD27894B989} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-08-24] (Adobe Systems Incorporated)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2009-07-20 00:55 - 2009-07-20 00:55 - 04446752 _____ () C:\Program Files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe
2014-09-09 11:40 - 2014-08-30 04:49 - 01098056 _____ () C:\Program Files\Google\Chrome\Application\37.0.2062.103\libglesv2.dll
2014-09-09 11:40 - 2014-08-30 04:49 - 00174408 _____ () C:\Program Files\Google\Chrome\Application\37.0.2062.103\libegl.dll
2014-09-09 11:40 - 2014-08-30 04:49 - 08577864 _____ () C:\Program Files\Google\Chrome\Application\37.0.2062.103\pdf.dll
2014-09-09 11:40 - 2014-08-30 04:49 - 00331592 _____ () C:\Program Files\Google\Chrome\Application\37.0.2062.103\ppGoogleNaClPluginChrome.dll
2014-09-09 11:40 - 2014-08-30 04:49 - 01660232 _____ () C:\Program Files\Google\Chrome\Application\37.0.2062.103\ffmpegsumo.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\TEMP:373E1720
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
==================== Faulty Device Manager Devices =============
Name: Basissystemgerät
Description: Basissystemgerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Basissystemgerät
Description: Basissystemgerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (09/10/2014 10:00:45 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm DllHost.exe, Version 6.1.7600.16385 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 860
Startzeit: 01cfcd31dc24fd7d
Endzeit: 33
Anwendungspfad: C:\Windows\system32\DllHost.exe
Berichts-ID: 1f4bcde0-3925-11e4-8ecc-001fe2122fab
Error: (09/10/2014 09:51:47 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Explorer.EXE, Version 6.1.7601.17567 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 700
Startzeit: 01cfcc00af1a7b74
Endzeit: 60000
Anwendungspfad: C:\Windows\Explorer.EXE
Berichts-ID: a17c2d2d-3923-11e4-8ecc-001fe2122fab
Error: (09/10/2014 04:47:42 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe_upnphost, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc100
Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b96f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0013ad65
ID des fehlerhaften Prozesses: 0xed0
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe_upnphost0
Pfad der fehlerhaften Anwendung: svchost.exe_upnphost1
Pfad des fehlerhaften Moduls: svchost.exe_upnphost2
Berichtskennung: svchost.exe_upnphost3
Error: (09/09/2014 03:51:27 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe_upnphost, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc100
Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b96f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0013ad65
ID des fehlerhaften Prozesses: 0x5e0
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe_upnphost0
Pfad der fehlerhaften Anwendung: svchost.exe_upnphost1
Pfad des fehlerhaften Moduls: svchost.exe_upnphost2
Berichtskennung: svchost.exe_upnphost3
Error: (09/01/2014 07:07:21 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: pdflatex.exe, Version: 0.0.0.0, Zeitstempel: 0x51c4b8b9
Name des fehlerhaften Moduls: MiKTeX209-packagemanager.dll, Version: 2.9.4919.0, Zeitstempel: 0x51c4b5aa
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00065a62
ID des fehlerhaften Prozesses: 0xe14
Startzeit der fehlerhaften Anwendung: 0xpdflatex.exe0
Pfad der fehlerhaften Anwendung: pdflatex.exe1
Pfad des fehlerhaften Moduls: pdflatex.exe2
Berichtskennung: pdflatex.exe3
Error: (08/27/2014 04:36:36 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Explorer.EXE, Version 6.1.7601.17567 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 720
Startzeit: 01cfc202670a3a71
Endzeit: 60000
Anwendungspfad: C:\Windows\Explorer.EXE
Berichts-ID: 55ce6a1c-2df7-11e4-8fea-00215c45e99d
Error: (08/24/2014 01:47:09 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm DllHost.exe, Version 6.1.7600.16385 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: b5c
Startzeit: 01cfbf9097e62d8b
Endzeit: 3681
Anwendungspfad: C:\Windows\system32\DllHost.exe
Berichts-ID: 559558c9-2b84-11e4-817e-001fe2122fab
Error: (08/24/2014 10:59:52 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Explorer.EXE, Version 6.1.7601.17567 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 6c0
Startzeit: 01cfbf711fe74061
Endzeit: 327
Anwendungspfad: C:\Windows\Explorer.EXE
Berichts-ID: b50a9ea2-2b6c-11e4-adee-001fe2122fab
Error: (08/24/2014 10:03:50 AM) (Source: MsiInstaller) (EventID: 1024) (User: Birgit-PC)
Description: Produkt: Adobe Reader XI (11.0.07) - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011008}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: How to enable Windows Installer logging
Error: (08/21/2014 08:20:25 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: pdflatex.exe, Version: 0.0.0.0, Zeitstempel: 0x51c4b8b9
Name des fehlerhaften Moduls: MiKTeX209-packagemanager.dll, Version: 2.9.4919.0, Zeitstempel: 0x51c4b5aa
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00065a62
ID des fehlerhaften Prozesses: 0x9c
Startzeit der fehlerhaften Anwendung: 0xpdflatex.exe0
Pfad der fehlerhaften Anwendung: pdflatex.exe1
Pfad des fehlerhaften Moduls: pdflatex.exe2
Berichtskennung: pdflatex.exe3
System errors:
=============
Error: (09/11/2014 10:40:44 AM) (Source: Disk) (EventID: 7) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.
Error: (09/10/2014 09:50:48 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
Error: (09/10/2014 07:18:18 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0
Error: (09/10/2014 07:17:28 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SSDP-Suche" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (09/10/2014 07:17:28 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst SSDPSRV erreicht.
Error: (09/10/2014 07:16:58 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SSDP-Suche" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (09/10/2014 07:16:58 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst SSDPSRV erreicht.
Error: (09/10/2014 07:16:28 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst upnphost erreicht.
Error: (09/10/2014 07:15:58 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SSDP-Suche" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (09/10/2014 07:15:58 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst SSDPSRV erreicht.
Microsoft Office Sessions:
=========================
Error: (09/10/2014 10:00:45 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: DllHost.exe6.1.7600.1638586001cfcd31dc24fd7d33C:\Windows\system32\DllHost.exe1f4bcde0-3925-11e4-8ecc-001fe2122fab
Error: (09/10/2014 09:51:47 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Explorer.EXE6.1.7601.1756770001cfcc00af1a7b7460000C:\Windows\Explorer.EXEa17c2d2d-3923-11e4-8ecc-001fe2122fab
Error: (09/10/2014 04:47:42 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: svchost.exe_upnphost6.1.7600.163854a5bc100ole32.dll6.1.7601.175144ce7b96fc00000050013ad65ed001cfcc3529195b7eC:\Windows\system32\svchost.exeC:\Windows\system32\ole32.dll6aae18d2-38f9-11e4-8ecc-001fe2122fab
Error: (09/09/2014 03:51:27 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: svchost.exe_upnphost6.1.7600.163854a5bc100ole32.dll6.1.7601.175144ce7b96fc00000050013ad655e001cfcc00addb8310C:\Windows\system32\svchost.exeC:\Windows\system32\ole32.dll64a64261-3828-11e4-8ecc-001fe2122fab
Error: (09/01/2014 07:07:21 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: pdflatex.exe0.0.0.051c4b8b9MiKTeX209-packagemanager.dll2.9.4919.051c4b5aac000000500065a62e1401cfc606e9aa9d9aC:\Program Files\MiKTeX 2.9\miktex\bin\pdflatex.exeC:\Program Files\MiKTeX 2.9\miktex\bin\MiKTeX209-packagemanager.dll6f422584-31fa-11e4-8da9-001fe2122fab
Error: (08/27/2014 04:36:36 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Explorer.EXE6.1.7601.1756772001cfc202670a3a7160000C:\Windows\Explorer.EXE55ce6a1c-2df7-11e4-8fea-00215c45e99d
Error: (08/24/2014 01:47:09 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: DllHost.exe6.1.7600.16385b5c01cfbf9097e62d8b3681C:\Windows\system32\DllHost.exe559558c9-2b84-11e4-817e-001fe2122fab
Error: (08/24/2014 10:59:52 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Explorer.EXE6.1.7601.175676c001cfbf711fe74061327C:\Windows\Explorer.EXEb50a9ea2-2b6c-11e4-adee-001fe2122fab
Error: (08/24/2014 10:03:50 AM) (Source: MsiInstaller) (EventID: 1024) (User: Birgit-PC)
Description: Adobe Reader XI (11.0.07) - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011008}1625(NULL)(NULL)(NULL)
Error: (08/21/2014 08:20:25 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: pdflatex.exe0.0.0.051c4b8b9MiKTeX209-packagemanager.dll2.9.4919.051c4b5aac000000500065a629c01cfbd6c921056f4C:\Program Files\MiKTeX 2.9\miktex\bin\pdflatex.exeC:\Program Files\MiKTeX 2.9\miktex\bin\MiKTeX209-packagemanager.dlld1a0386f-295f-11e4-836c-00215c45e99d
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 Duo CPU T7700 @ 2.40GHz
Percentage of memory in use: 63%
Total physical RAM: 2030.3 MB
Available physical RAM: 747.05 MB
Total Pagefile: 4060.59 MB
Available Pagefile: 2098.6 MB
Total Virtual: 2047.88 MB
Available Virtual: 1915.86 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:93.16 GB) (Free:47.3 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive f: (chiligreen) (Fixed) (Total:1863.01 GB) (Free:1804.55 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 93.2 GB) (Disk ID: 049B0C55)
Partition 1: (Active) - (Size=93.2 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 97A970EB)
Partition 1: (Not Active) - (Size=1863 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
12.09.2014, 07:03
| #4 |
| /// the machine /// TB-Ausbilder | Virus auf externer Festplatte? hi, Scan mit Combofix
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
12.09.2014, 09:36
| #5 |
| | Virus auf externer Festplatte?Code:
ATTFilter ComboFix 14-09-12.01 - Birgit 12.09.2014 10:21:38.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.43.1031.18.2030.998 [GMT 2:00]
ausgeführt von:: c:\users\Birgit\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
SP: Microsoft Security Essentials *Disabled/Updated* {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Public\AlexaNSISPlugin.4040.dll
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-08-12 bis 2014-09-12 ))))))))))))))))))))))))))))))
.
.
2014-09-12 08:31 . 2014-09-12 08:31 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-09-12 08:17 . 2014-08-20 17:44 8581864 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5B36091A-AF85-432D-B9FC-12B38B3F217E}\mpengine.dll
2014-09-11 08:38 . 2014-09-11 09:04 -------- d-----w- C:\FRST
2014-09-10 20:46 . 2014-06-27 01:45 2285056 ----a-w- c:\windows\system32\msmpeg2vdec.dll
2014-09-10 13:55 . 2014-07-07 01:40 550912 ----a-w- c:\windows\system32\kerberos.dll
2014-09-10 13:55 . 2014-07-07 01:40 1059840 ----a-w- c:\windows\system32\lsasrv.dll
2014-09-10 13:52 . 2014-08-20 17:44 8581864 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-09-10 13:51 . 2014-06-24 02:59 1987584 ----a-w- c:\windows\system32\d3d10warp.dll
2014-09-10 13:51 . 2014-08-01 11:35 793600 ----a-w- c:\windows\system32\TSWorkspace.dll
2014-09-10 13:51 . 2014-09-05 01:52 445952 ----a-w- c:\windows\system32\aepdu.dll
2014-09-10 13:51 . 2014-09-05 01:47 302592 ----a-w- c:\windows\system32\aeinv.dll
2014-09-01 17:20 . 2014-08-23 00:42 2352640 ----a-w- c:\windows\system32\win32k.sys
2014-09-01 17:20 . 2014-08-23 01:46 305152 ----a-w- c:\windows\system32\gdi32.dll
2014-09-01 17:09 . 2014-08-24 08:09 893248 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{EC2C98B8-A967-4036-87BD-5D8B63174C99}\gapaengine.dll
2014-09-01 17:07 . 2014-05-14 16:23 45536 ----a-w- c:\windows\system32\wups2.dll
2014-09-01 17:07 . 2014-05-14 16:23 54240 ----a-w- c:\windows\system32\wuauclt.exe
2014-09-01 17:07 . 2014-05-14 16:23 1973728 ----a-w- c:\windows\system32\wuaueng.dll
2014-09-01 17:07 . 2014-05-14 16:17 2425856 ----a-w- c:\windows\system32\wucltux.dll
2014-09-01 17:06 . 2014-05-14 16:23 36320 ----a-w- c:\windows\system32\wups.dll
2014-09-01 17:06 . 2014-05-14 16:23 581600 ----a-w- c:\windows\system32\wuapi.dll
2014-09-01 17:06 . 2014-05-14 16:17 92672 ----a-w- c:\windows\system32\wudriver.dll
2014-09-01 17:06 . 2014-05-14 07:23 179656 ----a-w- c:\windows\system32\wuwebv.dll
2014-09-01 17:06 . 2014-05-14 07:17 33792 ----a-w- c:\windows\system32\wuapp.exe
2014-08-24 13:37 . 2014-03-09 21:47 99480 ----a-w- c:\windows\system32\infocardapi.dll
2014-08-24 13:37 . 2014-06-30 22:14 8856 ----a-w- c:\windows\system32\icardres.dll
2014-08-24 13:37 . 2014-03-09 21:47 619672 ----a-w- c:\windows\system32\icardagt.exe
2014-08-24 13:36 . 2014-06-06 06:16 35480 ----a-w- c:\windows\system32\TsWpfWrp.exe
2014-08-24 08:16 . 2014-07-14 01:42 654336 ----a-w- c:\windows\system32\rpcrt4.dll
2014-08-24 08:16 . 2014-06-16 01:44 730048 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2014-08-24 08:16 . 2014-06-16 01:44 219072 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2014-08-24 08:16 . 2014-06-16 01:40 107520 ----a-w- c:\windows\system32\cdd.dll
2014-08-24 08:15 . 2014-07-16 02:46 2048 ----a-w- c:\windows\system32\tzres.dll
2014-08-24 08:15 . 2014-06-03 09:29 2363392 ----a-w- c:\windows\system32\msi.dll
2014-08-24 08:15 . 2014-06-03 09:29 1805824 ----a-w- c:\windows\system32\authui.dll
2014-08-24 08:15 . 2014-06-03 09:30 101824 ----a-w- c:\windows\system32\consent.exe
2014-08-24 08:15 . 2014-06-03 09:29 337408 ----a-w- c:\windows\system32\msihnd.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-08-24 08:09 . 2013-03-13 05:33 893248 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2014-08-24 08:07 . 2013-05-21 20:36 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-08-24 08:07 . 2013-05-21 20:36 699056 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-07-25 00:35 . 2014-07-25 00:35 875688 ----a-w- c:\windows\system32\msvcr120_clr0400.dll
2014-07-17 16:05 . 2014-07-17 16:05 231800 ----a-w- c:\windows\system32\drivers\MpFilter.sys
2014-07-17 16:05 . 2012-08-30 21:03 95920 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys
2014-06-18 01:51 . 2014-07-30 17:22 646144 ----a-w- c:\windows\system32\osk.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2014-08-22 974432]
"nwiz"="nwiz.exe" [2009-08-26 1657376]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-09-05 13797992]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-12-21 959904]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-08-18 108032]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2014-07-17 95920]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe [2014-08-22 288120]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2013-02-03 1343400]
S2 NVIDIA Performance Driver Service;NVIDIA Performance Driver Service;c:\program files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe [2009-07-19 4446752]
S2 TeamViewer9;TeamViewer 9;c:\program files\TeamViewer\Version9\TeamViewer_Service.exe [2013-12-17 5341536]
S3 netw5v32;Intel(R) Wireless WiFi Link 5000-Serie - Adaptertreiber für Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - NISDRV
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-09-11 07:57 1096520 ----a-w- c:\program files\Google\Chrome\Application\37.0.2062.120\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-09-12 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-05-21 08:07]
.
2014-09-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-05-21 20:37]
.
2014-09-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-05-21 20:37]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.at/
uSearchAssistant = hxxp://feed.snapdo.com/?publisher=SnapdoSoftonicYB&dpid=SnapdoSoftonicYB&co=AT&userid=b037680f-8610-d497-5567-0dfb2701cbeb&searchtype=ds&q={searchTerms}&installDate=12/10/2013
IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.43.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-10 - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3893443614-215775362-1324763491-1000\Software\Microsoft\Internet Explorer\Approved Extensions]
@DACL=(02 0000)
"{4D2D3B0F-69BE-477A-90F5-FDDB05357975}"=hex:51,66,7a,6c,4c,1d,3b,1b,1f,26,37,
5d,8a,3e,11,09,8a,ff,bb,9b,07,77,39,6e
"{5018CFD2-804D-4C99-9F81-25EAEA2769DE}"=hex:51,66,7a,6c,4c,1d,3b,1b,c2,d2,02,
40,79,d7,f2,02,85,8b,63,aa,e8,65,29,c5
"{E87806B5-E908-45FD-AF5E-957D83E58E68}"=hex:51,66,7a,6c,4c,1d,3b,1b,a5,1b,62,
f8,3c,be,96,0b,b5,54,d3,3d,81,a7,ce,73
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-09-12 10:34:39
ComboFix-quarantined-files.txt 2014-09-12 08:34
.
Vor Suchlauf: 16 Verzeichnis(se), 50.615.701.504 Bytes frei
Nach Suchlauf: 23 Verzeichnis(se), 50.416.304.128 Bytes frei
.
- - End Of File - - AA9A4567CC3095C418B8B63170FBD2FF
A36C5E4F47E84449FF07ED3517B43A31
|
|
13.09.2014, 07:30
| #6 |
| /// the machine /// TB-Ausbilder | Virus auf externer Festplatte? Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ --> Virus auf externer Festplatte? |
|
| Themen zu Virus auf externer Festplatte? |
| andere, anderen, arbeit, befindet, bilder, brauche, computer, einfach, entfernen, erklären, externe, externe festplatte, externer, festplatte, fotos, frage, gekauft, ordner, platte, richtig, speicher, speichern, virus, würde, öffnet |
WARNUNG an die MITLESER: 
Linear-Darstellung
