| |
| |||||||
Log-Analyse und Auswertung: WIN7: C:\windows\system32\myosprotect.dll idst nicht löschbarWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
16.11.2014, 15:44
| #1 |
| |  WIN7: C:\windows\system32\myosprotect.dll idst nicht löschbar Guten Tag und schon einmal vielen Dank für das Hilfsangebot.  Ich habe den Verdacht, dass sich die Schadsoftware "MyOSProtect" im System meines Kindes eingenistet hat. Die Datei C:\windows\system32\myosprotect.dll idst nicht löschbar. Auf der Suche nach einer Lösung bemerkte ich, dass ich mit dem Computer nicht mehr ins Internet komme, obwohl die Wlan-Verbindung funktioniert. Ich bitte um Hilfe! Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-11-2014 01 Ran by Fabio Bollwahn (administrator) on FABIOBOLLWAHN on 16-11-2014 15:07:13 Running from C:\Users\Fabio Bollwahn\Desktop Loaded Profile: Fabio Bollwahn (Available profiles: Fabio Bollwahn) Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe (Symantec Corporation) C:\Program Files\Norton 360\Engine\21.6.0.32\n360.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe (Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Symantec Corporation) C:\Program Files\Norton 360\Engine\21.6.0.32\n360.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe () C:\Users\Fabio Bollwahn\Desktop\Defogger.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk ShortcutTarget: phase-6 Reminder.lnk -> C:\Program Files\phase-6\phase-6\reminder\reminder.exe (phase-6) ShellIconOverlayIdentifiers: [OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files\Norton 360\Engine\21.6.0.32\buShell.dll (Symantec Corporation) ShellIconOverlayIdentifiers: [OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files\Norton 360\Engine\21.6.0.32\buShell.dll (Symantec Corporation) ShellIconOverlayIdentifiers: [OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files\Norton 360\Engine\21.6.0.32\buShell.dll (Symantec Corporation) CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=de&pid=N360&pvid=21.6.0.32 HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-380057843-347636753-2285813949-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files\Norton 360\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation) BHO: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files\Norton 360\Engine\21.6.0.32\IPS\IPSBHO.DLL (Symantec Corporation) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation) Winsock: Catalog9 01 C:\Windows\system32\MyOSProtect.dll File Not found () Winsock: Catalog9 02 C:\Windows\system32\MyOSProtect.dll File Not found () Winsock: Catalog9 03 C:\Windows\system32\MyOSProtect.dll File Not found () Winsock: Catalog9 04 C:\Windows\system32\MyOSProtect.dll File Not found () Winsock: Catalog9 15 C:\Windows\system32\MyOSProtect.dll File Not found () Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @nvidia.com/3DVision -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin: @nvidia.com/3DVisionStreaming -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.) FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.3.0.12\coFFPlgn FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.3.0.12\coFFPlgn [2014-11-16] Chrome: ======= CHR HomePage: Default -> hxxp://www.google.com/ CHR StartupUrls: Default -> "hxxp://www.google.de/" CHR DefaultSuggestURL: Default -> hxxp://ss-sym.ask.com/query?q={searchTerms}&sstype=prefix&li=ff CHR Profile: C:\Users\Fabio Bollwahn\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Docs) - C:\Users\Fabio Bollwahn\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-28] CHR Extension: (Google Drive) - C:\Users\Fabio Bollwahn\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-28] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Fabio Bollwahn\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-07] CHR Extension: (YouTube) - C:\Users\Fabio Bollwahn\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-28] CHR Extension: (Google-Suche) - C:\Users\Fabio Bollwahn\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-28] CHR Extension: (Norton Identity Safe) - C:\Users\Fabio Bollwahn\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif [2014-08-28] CHR Extension: (Norton Safe) - C:\Users\Fabio Bollwahn\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmgcfemagnogdodbambjhdcmfcpicngl [2014-08-31] CHR Extension: (Google Wallet) - C:\Users\Fabio Bollwahn\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-28] CHR Extension: (Google Mail) - C:\Users\Fabio Bollwahn\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-28] CHR HKLM\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files\Norton 360\Engine\21.6.0.32\Exts\Chrome.crx [2014-10-04] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation) R2 N360; C:\Program Files\Norton 360\Engine\21.6.0.32\N360.exe [265040 2014-09-21] (Symantec Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R1 BHDrvx86; C:\Program Files\Norton 360\NortonData\21.3.0.12\Definitions\BASHDefs\20141107.001\BHDrvx86.sys [1138392 2014-10-03] (Symantec Corporation) R1 ccSet_N360; C:\Windows\system32\drivers\N360\1506000.020\ccSetx86.sys [127064 2014-02-21] (Symantec Corporation) R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [378672 2014-09-19] (Symantec Corporation) R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [111408 2014-09-12] (Symantec Corporation) R1 IDSVix86; C:\Program Files\Norton 360\NortonData\21.3.0.12\Definitions\IPSDefs\20141114.001\IDSvix86.sys [476888 2014-08-29] (Symantec Corporation) R3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [28944 2008-02-29] (Logitech, Inc.) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-10-01] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2014-11-16] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-10-01] (Malwarebytes Corporation) R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [5810 2004-08-13] () R3 NAVENG; C:\Program Files\Norton 360\NortonData\21.3.0.12\Definitions\VirusDefs\20141115.001\NAVENG.SYS [95704 2014-09-19] (Symantec Corporation) R3 NAVEX15; C:\Program Files\Norton 360\NortonData\21.3.0.12\Definitions\VirusDefs\20141115.001\NAVEX15.SYS [1636696 2014-09-19] (Symantec Corporation) R3 netr28u; C:\Windows\System32\DRIVERS\netr28u.sys [1321568 2012-08-17] (Ralink Technology Corp.) R1 SRTSP; C:\Windows\System32\Drivers\N360\1506000.020\SRTSP.SYS [664792 2014-08-26] (Symantec Corporation) R1 SRTSPX; C:\Windows\system32\drivers\N360\1506000.020\SRTSPX.SYS [32984 2014-08-26] (Symantec Corporation) R0 SymDS; C:\Windows\System32\drivers\N360\1506000.020\SYMDS.SYS [367704 2013-10-30] (Symantec Corporation) R0 SymEFA; C:\Windows\System32\drivers\N360\1506000.020\SYMEFA.SYS [936152 2014-03-04] (Symantec Corporation) R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142936 2014-07-15] (Symantec Corporation) R1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [63576 2013-10-30] (Symantec Corporation) R1 SymIRON; C:\Windows\system32\drivers\N360\1506000.020\Ironx86.SYS [209624 2014-08-06] (Symantec Corporation) R1 SymNetS; C:\Windows\System32\Drivers\N360\1506000.020\SYMNETS.SYS [447704 2014-02-18] (Symantec Corporation) U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation) S3 catchme; \??\C:\Users\FABIOB~1\AppData\Local\Temp\catchme.sys [X] S4 nvvad_WaveExtensible; system32\drivers\nvvad32v.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-11-16 15:04 - 2014-11-16 15:06 - 00000490 _____ () C:\Users\Fabio Bollwahn\Desktop\defogger_disable.log 2014-11-16 15:04 - 2014-11-16 15:04 - 00000000 _____ () C:\Users\Fabio Bollwahn\defogger_reenable 2014-11-16 15:04 - 2014-11-16 14:59 - 00050477 _____ () C:\Users\Fabio Bollwahn\Desktop\Defogger.exe 2014-11-16 14:47 - 2014-11-16 14:51 - 00000000 ____D () C:\Users\Fabio Bollwahn\AppData\Local\NPE 2014-11-16 14:32 - 2014-11-16 14:59 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-11-16 14:32 - 2014-11-16 14:32 - 00001060 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-11-16 14:32 - 2014-11-16 14:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-11-16 14:32 - 2014-11-16 14:32 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-11-16 14:32 - 2014-11-16 14:32 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-11-16 14:32 - 2014-10-01 11:11 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-11-16 14:32 - 2014-10-01 11:11 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-11-16 14:32 - 2014-10-01 11:11 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-11-16 13:56 - 2014-11-16 13:56 - 00010341 _____ () C:\ComboFix.txt 2014-11-16 12:54 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-11-16 12:54 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-11-16 12:54 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-11-16 12:54 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-11-16 12:54 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-11-16 12:54 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe 2014-11-16 12:54 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe 2014-11-16 12:54 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe 2014-11-16 12:52 - 2014-11-16 13:56 - 00000000 ____D () C:\Qoobox 2014-11-16 12:52 - 2014-11-16 13:09 - 00000000 ____D () C:\Windows\erdnt 2014-11-16 12:52 - 2014-11-16 12:43 - 05598504 ____R (Swearware) C:\Users\Fabio Bollwahn\Desktop\ComboFix.exe 2014-11-16 12:50 - 2014-11-16 15:07 - 00011835 _____ () C:\Users\Fabio Bollwahn\Desktop\FRST.txt 2014-11-16 12:50 - 2014-11-16 12:51 - 00019303 _____ () C:\Users\Fabio Bollwahn\Desktop\Addition.txt 2014-11-16 12:49 - 2014-11-16 12:41 - 01108480 _____ (Farbar) C:\Users\Fabio Bollwahn\Desktop\FRST.exe 2014-11-16 12:44 - 2014-11-16 15:07 - 00000000 ____D () C:\FRST 2014-11-16 11:31 - 2014-11-16 11:31 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf 2014-11-16 11:05 - 2014-11-16 14:08 - 00000375 _____ () C:\Windows\system32\Drivers\etc\hosts.ics 2014-11-16 10:40 - 2013-10-30 08:26 - 00063576 ____R (Symantec Corporation) C:\Windows\system32\Drivers\SymIMV.sys 2014-11-16 09:51 - 2014-11-16 09:51 - 00000000 ____D () C:\ProgramData\Ralink Driver 2014-11-16 09:51 - 2014-11-16 09:51 - 00000000 ____D () C:\Program Files\Ralink 2014-11-16 09:51 - 2012-08-17 22:31 - 01321568 _____ (Ralink Technology Corp.) C:\Windows\system32\Drivers\netr28u.sys 2014-11-16 09:51 - 2011-12-26 10:57 - 00238944 _____ (Ralink Technology, Inc.) C:\Windows\system32\RaCoInst.dll 2014-11-16 09:51 - 2011-12-26 10:57 - 00014119 _____ () C:\Windows\system32\RaCoInst.dat 2014-11-16 09:51 - 2011-09-08 05:51 - 00237568 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Windows\system32\ssleay32.dll 2014-11-16 09:51 - 2011-09-08 05:50 - 01100288 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Windows\system32\libeay32.dll 2014-11-16 09:50 - 2014-11-16 09:50 - 00000000 ____D () C:\Users\Fabio Bollwahn\AppData\Roaming\InstallShield 2014-11-15 22:20 - 2014-11-16 14:59 - 00005306 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-11-15 22:20 - 2014-11-16 14:59 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-11-15 22:19 - 2014-11-15 22:19 - 00000000 __SHD () C:\Users\Fabio Bollwahn\AppData\Local\EmieBrowserModeList 2014-11-13 15:51 - 2014-11-13 15:51 - 00002255 _____ () C:\Users\Fabio Bollwahn\AppData\Local\recently-used.xbel 2014-11-13 15:34 - 2014-11-07 20:23 - 00341168 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-11-13 15:34 - 2014-11-06 04:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-11-13 15:34 - 2014-11-06 04:28 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-11-13 15:34 - 2014-11-06 04:13 - 00501248 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-11-13 15:34 - 2014-11-06 04:13 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-11-13 15:34 - 2014-11-06 04:12 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-11-13 15:34 - 2014-11-06 04:10 - 19781632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-11-13 15:34 - 2014-11-06 04:10 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-11-13 15:34 - 2014-11-06 04:05 - 02277376 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-11-13 15:34 - 2014-11-06 04:04 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-11-13 15:34 - 2014-11-06 04:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-11-13 15:34 - 2014-11-06 04:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-11-13 15:34 - 2014-11-06 03:59 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-11-13 15:34 - 2014-11-06 03:59 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-11-13 15:34 - 2014-11-06 03:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-11-13 15:34 - 2014-11-06 03:51 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-11-13 15:34 - 2014-11-06 03:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-11-13 15:34 - 2014-11-06 03:42 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-11-13 15:34 - 2014-11-06 03:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-11-13 15:34 - 2014-11-06 03:36 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-11-13 15:34 - 2014-11-06 03:34 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-11-13 15:34 - 2014-11-06 03:22 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-11-13 15:34 - 2014-11-06 03:22 - 00683008 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-11-13 15:34 - 2014-11-06 03:21 - 04298240 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-11-13 15:34 - 2014-11-06 03:21 - 02051072 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-11-13 15:34 - 2014-11-06 03:20 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-11-13 15:34 - 2014-11-06 03:03 - 12819456 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-11-13 15:34 - 2014-11-06 02:52 - 01892864 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-11-13 15:34 - 2014-11-06 02:48 - 01310208 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-11-13 15:34 - 2014-11-06 02:47 - 00708096 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-11-13 15:24 - 2014-10-25 02:32 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll 2014-11-13 15:24 - 2014-10-18 02:33 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll 2014-11-13 15:24 - 2014-10-14 02:56 - 00136632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2014-11-13 15:24 - 2014-10-14 02:50 - 02363904 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll 2014-11-13 15:24 - 2014-10-14 02:50 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-11-13 15:24 - 2014-10-14 02:50 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll 2014-11-13 15:24 - 2014-10-14 02:47 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2014-11-13 15:24 - 2014-10-14 02:46 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2014-11-13 15:24 - 2014-10-10 01:45 - 02379264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-11-13 15:24 - 2014-10-03 02:44 - 00475136 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll 2014-11-13 15:24 - 2014-10-03 02:44 - 00442880 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll 2014-11-13 15:24 - 2014-10-03 02:44 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll 2014-11-13 15:24 - 2014-10-03 02:44 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll 2014-11-13 15:24 - 2014-10-03 02:44 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll 2014-11-13 15:24 - 2014-09-19 10:23 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-11-13 15:24 - 2014-09-19 10:23 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2014-11-13 15:24 - 2014-09-19 10:23 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2014-11-13 15:24 - 2014-09-19 10:23 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2014-11-13 15:24 - 2014-09-19 10:23 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2014-11-13 15:24 - 2014-09-19 10:23 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2014-11-13 15:24 - 2014-09-19 10:23 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2014-11-13 15:24 - 2014-08-21 07:26 - 01237504 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2014-11-13 15:24 - 2014-08-21 07:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll 2014-11-13 15:24 - 2014-08-12 02:36 - 00701440 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL 2014-11-13 15:23 - 2014-11-05 18:50 - 00254464 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2014-11-13 15:23 - 2014-11-05 18:50 - 00203776 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-11-13 15:23 - 2014-11-05 18:47 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-11-13 15:20 - 2014-11-15 20:59 - 00000000 ___RD () C:\Users\Fabio Bollwahn\Desktop\Schule Fabio 2014-11-05 16:38 - 2014-11-05 16:38 - 02346942 _____ () C:\Users\Fabio Bollwahn\Desktop\TechnicLauncher.exe 2014-11-02 18:24 - 2014-11-13 15:51 - 00000000 ____D () C:\Users\Fabio Bollwahn\AppData\Local\gtk-2.0 2014-11-02 18:24 - 2014-11-02 18:24 - 00000000 ____D () C:\Users\Fabio Bollwahn\.thumbnails 2014-11-02 18:04 - 2014-11-02 18:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip 2014-11-02 18:04 - 2014-11-02 18:04 - 00000000 ____D () C:\Program Files\7-Zip 2014-11-02 17:47 - 2014-11-02 17:47 - 00001047 _____ () C:\Users\Fabio Bollwahn\Desktop\GIMP 2.lnk 2014-11-02 17:43 - 2014-11-13 15:51 - 00000000 ____D () C:\Users\Fabio Bollwahn\.gimp-2.8 2014-11-02 17:43 - 2014-11-02 17:43 - 00000000 ____D () C:\Users\Fabio Bollwahn\AppData\Local\gegl-0.2 2014-11-02 17:43 - 2014-11-02 17:43 - 00000000 ____D () C:\Users\Fabio Bollwahn\AppData\Local\fontconfig 2014-11-02 17:41 - 2014-11-02 17:41 - 00001047 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk 2014-11-02 17:39 - 2014-11-02 17:41 - 00000000 ____D () C:\Program Files\GIMP 2 2014-11-01 20:28 - 2014-11-01 20:28 - 00009127 _____ () C:\Users\Fabio Bollwahn\Downloads\gimp-2.8.14-setup-1.exe.torrent 2014-11-01 20:19 - 2014-11-01 20:19 - 00018797 _____ () C:\Users\Fabio Bollwahn\Downloads\HimGames_Res_Pack_Tut.zip 2014-11-01 12:21 - 2014-11-16 10:08 - 00000000 ____D () C:\Users\Fabio Bollwahn\AppData\Roaming\.minecraft 2014-10-30 16:02 - 2014-10-30 16:02 - 00000355 _____ () C:\Users\Fabio Bollwahn\Desktop\Computer - Verknüpfung.lnk 2014-10-29 20:02 - 2014-10-29 20:03 - 00000000 ____D () C:\Users\Fabio Bollwahn\AppData\Local\Adobe 2014-10-28 17:08 - 2014-10-28 17:07 - 07846188 _____ () C:\Users\Fabio Bollwahn\phase-6-backpack-fabio-bollwahn-2014-10-28.p6b 2014-10-28 16:33 - 2014-10-28 16:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\phase-6 2014-10-17 16:04 - 2014-10-28 16:33 - 00001071 _____ () C:\Users\Public\Desktop\phase-6 desktop.lnk 2014-10-17 16:04 - 2014-10-17 16:09 - 00000000 ____D () C:\Users\Fabio Bollwahn\.phase-6 2014-10-17 16:04 - 2014-10-17 16:09 - 00000000 ____D () C:\ProgramData\Phase6 2014-10-17 16:04 - 2014-10-17 16:04 - 00000000 ____D () C:\Users\Fabio Bollwahn\AppData\Roaming\Phase6 2014-10-17 16:04 - 2014-10-17 16:04 - 00000000 ____D () C:\Users\Fabio Bollwahn\AppData\Roaming\Mozilla 2014-10-17 16:04 - 2014-10-17 16:04 - 00000000 ____D () C:\Users\Fabio Bollwahn\.swt 2014-10-17 16:03 - 2014-10-17 16:03 - 00000000 ____D () C:\Program Files\phase-6 2014-10-17 16:01 - 2014-10-17 16:03 - 85744960 _____ () C:\Users\Fabio Bollwahn\Downloads\phase-6-desktop-2.3.4-windows-installer.exe ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-11-16 15:06 - 2009-07-14 05:34 - 00024000 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-11-16 15:06 - 2009-07-14 05:34 - 00024000 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-11-16 15:04 - 2014-07-09 16:42 - 00000000 ____D () C:\Users\Fabio Bollwahn 2014-11-16 15:01 - 2014-07-09 16:37 - 01214086 _____ () C:\Windows\WindowsUpdate.log 2014-11-16 14:58 - 2014-08-21 14:13 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-11-16 14:58 - 2014-07-11 12:51 - 00043448 _____ () C:\Windows\PFRO.log 2014-11-16 14:58 - 2009-07-14 05:39 - 00034107 _____ () C:\Windows\setupact.log 2014-11-16 14:51 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\NDF 2014-11-16 14:47 - 2014-07-15 09:16 - 00000000 ____D () C:\ProgramData\Norton 2014-11-16 14:28 - 2014-07-09 16:46 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-11-16 13:53 - 2009-07-14 03:04 - 00000215 _____ () C:\Windows\system.ini 2014-11-16 13:11 - 2009-07-14 03:37 - 00000000 ___RD () C:\Users\Public 2014-11-16 13:11 - 2009-07-14 03:37 - 00000000 ___RD () C:\Users\Default 2014-11-16 12:08 - 2014-08-28 14:15 - 00000000 ____D () C:\Program Files\Google 2014-11-16 12:04 - 2014-08-28 14:15 - 00000000 ____D () C:\Users\Fabio Bollwahn\AppData\Local\Google 2014-11-16 10:33 - 2014-07-09 17:13 - 00008856 _____ () C:\Windows\system32\RaCoInst.log 2014-11-16 09:51 - 2014-07-09 17:08 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information 2014-11-15 21:53 - 2014-10-09 14:55 - 00000000 ____D () C:\Users\Fabio Bollwahn\AppData\Roaming\Skype 2014-11-15 21:31 - 2014-09-07 18:57 - 00000000 ____D () C:\Program Files\Web Protect 2014-11-15 20:57 - 2014-08-26 19:02 - 00000000 ____D () C:\Users\Fabio Bollwahn\Desktop\.minecraft 2014-11-15 19:56 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Microsoft.NET 2014-11-14 22:25 - 2009-07-14 05:33 - 00267160 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-11-14 22:22 - 2014-07-10 12:27 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-11-14 22:22 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\de-DE 2014-11-14 21:34 - 2014-07-10 11:20 - 00000000 ____D () C:\Windows\system32\MRT 2014-11-14 21:24 - 2014-07-10 11:20 - 100445232 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-11-04 20:57 - 2014-09-07 18:56 - 00000000 ____D () C:\Users\Fabio Bollwahn\AppData\Local\CrashDumps 2014-11-02 18:27 - 2014-08-24 17:06 - 00000000 ____D () C:\Users\Fabio Bollwahn\AppData\Local\Windows Live 2014-10-17 17:23 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\rescache ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-11-01 16:55 ==================== End Of Log ============================ Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-11-16 15:23:11
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST3500418AS rev.CC38 465,76GB
Running: 8zln08o4.exe; Driver: C:\Users\FABIOB~1\AppData\Local\Temp\kwtiquod.sys
---- System - GMER 2.1 ----
SSDT 85958858 ZwAlertResumeThread
SSDT 859588F0 ZwAlertThread
SSDT 85895328 ZwAllocateVirtualMemory
SSDT 85868958 ZwAlpcConnectPort
SSDT 85956EA0 ZwAssignProcessToJobObject
SSDT 85958680 ZwCreateMutant
SSDT 85956C98 ZwCreateSymbolicLinkObject
SSDT 85971D18 ZwCreateThread
SSDT 85956D40 ZwCreateThreadEx
SSDT 85956F38 ZwDebugActiveProcess
SSDT 85956268 ZwDuplicateObject
SSDT 85895218 ZwFreeVirtualMemory
SSDT 85958728 ZwImpersonateAnonymousToken
SSDT 859587C0 ZwImpersonateThread
SSDT 8587E710 ZwLoadDriver
SSDT 85895180 ZwMapViewOfSection
SSDT 859585E8 ZwOpenEvent
SSDT 8598D4D0 ZwOpenProcess
SSDT 8588B7E8 ZwOpenProcessToken
SSDT 859584B8 ZwOpenSection
SSDT 859562F0 ZwOpenThread
SSDT 85956DF8 ZwProtectVirtualMemory
SSDT 85956BF0 ZwQueueApcThread
SSDT 85956B48 ZwQueueApcThreadEx
SSDT 85958988 ZwResumeThread
SSDT 85958B50 ZwSetContextThread
SSDT 85895080 ZwSetInformationProcess
SSDT 85956FD0 ZwSetSystemInformation
SSDT 85958550 ZwSuspendProcess
SSDT 85958A20 ZwSuspendThread
SSDT 85943EA0 ZwTerminateProcess
SSDT 85958AB8 ZwTerminateThread
SSDT 85895108 ZwUnmapViewOfSection
SSDT 858952A0 ZwWriteVirtualMemory
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!ZwRollbackEnlistment + 142D 82A8DA15 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82AC7212 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!KeRemoveQueueEx + 10DB 82ACE470 8 Bytes [58, 88, 95, 85, F0, 88, 95, ...]
.text ntkrnlpa.exe!KeRemoveQueueEx + 10F3 82ACE488 4 Bytes [28, 53, 89, 85]
.text ntkrnlpa.exe!KeRemoveQueueEx + 10FF 82ACE494 4 Bytes [58, 89, 86, 85]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1153 82ACE4E8 4 Bytes [A0, 6E, 95, 85]
.text ntkrnlpa.exe!KeRemoveQueueEx + 11CF 82ACE564 4 Bytes [80, 86, 95, 85]
.text ...
---- User code sections - GMER 2.1 ----
.text C:\Users\Fabio Bollwahn\Desktop\8zln08o4.exe[3880] ntdll.dll!NtTerminateThread 77086918 5 Bytes JMP 00020050
.text C:\Users\Fabio Bollwahn\Desktop\8zln08o4.exe[3880] USER32.dll!ChangeWindowMessageFilterEx + F 754724D7 7 Bytes JMP 001A0A12
.text C:\Users\Fabio Bollwahn\Desktop\8zln08o4.exe[3880] USER32.dll!RecordShutdownReason + 372 754B06C2 7 Bytes JMP 001A0930
.text C:\Users\Fabio Bollwahn\Desktop\FRST.exe[3936] ntdll.dll!NtTerminateThread 77086918 5 Bytes JMP 00020050
.text C:\Users\Fabio Bollwahn\Desktop\FRST.exe[3936] USER32.dll!ChangeWindowMessageFilterEx + F 754724D7 7 Bytes JMP 000A0A12
.text C:\Users\Fabio Bollwahn\Desktop\FRST.exe[3936] USER32.dll!RecordShutdownReason + 372 754B06C2 7 Bytes JMP 000A0930
---- Devices - GMER 2.1 ----
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys
---- Registry - GMER 2.1 ----
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\System\Active
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\System\Active@EA090801 193
---- EOF - GMER 2.1 ----
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 13-11-2014 01
Ran by Fabio Bollwahn at 2014-11-16 12:50:43
Running from C:\Users\Fabio Bollwahn\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Norton 360 Premier Edition (Enabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}
AS: Norton 360 Premier Edition (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Norton 360 Premier Edition (Enabled) {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (HKLM\...\7-Zip) (Version: - )
Brother MFL-Pro Suite MFC-J4510DW (HKLM\...\{DD98C438-D769-4677-AA87-3481FA32D20C}) (Version: 2.0.0.0 - Brother Industries, Ltd.)
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
Fotogalerie (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Google Chrome (HKLM\...\Google Chrome) (Version: 37.0.2062.103 - Google Inc.)
Google Update Helper (Version: 1.3.25.5 - Google Inc.) Hidden
Java 7 Update 67 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
Klett Lernsoftware Mathematik - Lambacher Schweizer 6 NW (HKLM\...\Klett Lernsoftware Mathematik - Lambacher Schweizer 6 NW_is1) (Version: - )
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Movie Maker (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (Version: 16.4.1108.0727 - Microsoft) Hidden
Norton 360 (HKLM\...\N360) (Version: 21.6.0.32 - Symantec Corporation)
NVIDIA 3D Vision Controller-Treiber 340.50 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 340.50 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 340.52 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.62.40 - NVIDIA Corporation)
NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
phase-6 2.3.4 (HKLM\...\phase-6) (Version: 2.3.4 - phase-6)
Photo Common (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Photo Gallery (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Ralink RT2870 Wireless LAN Card (HKLM\...\{28DA7D8B-F9A4-4F18-8AA0-551B1E084D0D}) (Version: 1.5.24.0 - Ralink)
Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.2.14014_6 - Samsung Electronics Co., Ltd.)
Samsung Kies (Version: 2.6.2.14014_6 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.45.0 - SAMSUNG Electronics Co., Ltd.)
Skype™ 6.21 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.21.104 - Skype Technologies S.A.)
Stronghold 2 (HKLM\...\{16D2C649-CBA8-44EE-B730-12584667D487}) (Version: 1.40.1000 - Firefly Studios)
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
04-10-2014 19:57:38 Windows Update
16-10-2014 14:56:33 Windows Update
23-10-2014 15:22:52 Geplanter Prüfpunkt
01-11-2014 16:03:33 Geplanter Prüfpunkt
14-11-2014 20:19:53 Windows Update
14-11-2014 21:38:26 Windows Update
15-11-2014 21:08:18 Norton 360 Registry Clean
15-11-2014 21:25:30 Entfernt Ralink Wireless LAN
16-11-2014 08:50:44 Installiert Ralink Wireless LAN
16-11-2014 09:22:32 Installiert Ralink Wireless LAN
16-11-2014 09:33:25 Installiert Ralink Wireless LAN
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {1F13B423-CF6F-4B32-9C4D-DF3AE36ED4BE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-08-28] (Google Inc.)
Task: {966A493C-E215-4173-BFC7-55A9A2596D7E} - System32\Tasks\Norton 360\Norton Error Processor => C:\Program Files\Norton 360\Engine\21.6.0.32\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {9BACFC09-E0C9-4749-8F11-423FB9E59B3D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: {B37FB60B-3117-453A-AF98-374FD67BD798} - System32\Tasks\{E855ED70-57C6-4510-966A-31CF0A251A31} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.21.60.104/de/abandoninstall?page=tsMain
Task: {B42E4CC5-64D8-42E0-A605-41E146EB1D72} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-08-28] (Google Inc.)
Task: {BAA8C01E-C9DD-47F9-AA7B-9CC27380C3B8} - System32\Tasks\Norton 360\Norton Error Analyzer => C:\Program Files\Norton 360\Engine\21.6.0.32\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {C76BAABA-6BB2-4AAE-B461-D21C35D59A69} - System32\Tasks\Norton WSC Integration => C:\Program Files\Norton 360\Engine\21.6.0.32\WSCStub.exe [2014-09-21] (Symantec Corporation)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
==================== Loaded Modules (whitelisted) =============
2014-08-21 14:26 - 2014-07-02 20:42 - 00107992 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\pcwatch.sys => ""="Driver" <==== ATTENTION
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MyOSProtect => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\pcwatch.sys => ""="Driver" <==== ATTENTION
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-380057843-347636753-2285813949-500 - Administrator - Disabled)
Fabio Bollwahn (S-1-5-21-380057843-347636753-2285813949-1000 - Administrator - Enabled) => C:\Users\Fabio Bollwahn
Gast (S-1-5-21-380057843-347636753-2285813949-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-380057843-347636753-2285813949-1002 - Limited - Enabled)
==================== Faulty Device Manager Devices =============
Name: NVIDIA nForce 10/100/1000 Mbps Ethernet
Description: NVIDIA nForce Networking Controller
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: NVIDIA
Service: NVNET
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Coprozessor
Description: Coprozessor
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (11/16/2014 00:09:17 PM) (Source: Schedule) (EventID: 0) (User: )
Description: Schedule error: 10106Initialize call failed, bailing out
Error: (11/16/2014 11:57:35 AM) (Source: Schedule) (EventID: 0) (User: )
Description: Schedule error: 10106Initialize call failed, bailing out
Error: (11/16/2014 11:44:11 AM) (Source: Schedule) (EventID: 0) (User: )
Description: Schedule error: 10106Initialize call failed, bailing out
Error: (11/16/2014 11:09:46 AM) (Source: Schedule) (EventID: 0) (User: )
Description: Schedule error: 10106Initialize call failed, bailing out
Error: (11/16/2014 09:50:44 AM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {42e7b90d-f491-4e22-86c9-231e3090dca6}
Error: (11/16/2014 09:49:04 AM) (Source: Schedule) (EventID: 0) (User: )
Description: Schedule error: 10106Initialize call failed, bailing out
Error: (11/15/2014 10:25:30 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {3482a20c-3373-43cc-9f1b-95002e362e7d}
Error: (11/15/2014 10:20:36 PM) (Source: Schedule) (EventID: 0) (User: )
Description: Schedule error: 10106Initialize call failed, bailing out
Error: (11/15/2014 10:03:22 PM) (Source: Schedule) (EventID: 0) (User: )
Description: Schedule error: 10106Initialize call failed, bailing out
Error: (11/15/2014 09:58:09 PM) (Source: Schedule) (EventID: 0) (User: )
Description: Schedule error: 10106Initialize call failed, bailing out
System errors:
=============
Error: (11/16/2014 00:49:43 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "IPsec-Richtlinien-Agent" wurde mit folgendem Fehler beendet:
%%10106
Error: (11/16/2014 00:49:41 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "IPsec-Richtlinien-Agent" wurde mit folgendem Fehler beendet:
%%10106
Error: (11/16/2014 00:49:41 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "IPsec-Richtlinien-Agent" wurde mit folgendem Fehler beendet:
%%10106
Error: (11/16/2014 00:49:40 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "IPsec-Richtlinien-Agent" wurde mit folgendem Fehler beendet:
%%10106
Error: (11/16/2014 00:49:02 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0
Error: (11/16/2014 00:44:15 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0
Error: (11/16/2014 00:43:58 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR2 gefunden.
Error: (11/16/2014 00:43:57 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR2 gefunden.
Error: (11/16/2014 00:43:57 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR2 gefunden.
Error: (11/16/2014 00:43:56 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR2 gefunden.
Microsoft Office Sessions:
=========================
Error: (11/16/2014 00:09:17 PM) (Source: Schedule) (EventID: 0) (User: )
Description: Schedule error: 10106Initialize call failed, bailing out
Error: (11/16/2014 11:57:35 AM) (Source: Schedule) (EventID: 0) (User: )
Description: Schedule error: 10106Initialize call failed, bailing out
Error: (11/16/2014 11:44:11 AM) (Source: Schedule) (EventID: 0) (User: )
Description: Schedule error: 10106Initialize call failed, bailing out
Error: (11/16/2014 11:09:46 AM) (Source: Schedule) (EventID: 0) (User: )
Description: Schedule error: 10106Initialize call failed, bailing out
Error: (11/16/2014 09:50:44 AM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Zugriff verweigert
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {42e7b90d-f491-4e22-86c9-231e3090dca6}
Error: (11/16/2014 09:49:04 AM) (Source: Schedule) (EventID: 0) (User: )
Description: Schedule error: 10106Initialize call failed, bailing out
Error: (11/15/2014 10:25:30 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Zugriff verweigert
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {3482a20c-3373-43cc-9f1b-95002e362e7d}
Error: (11/15/2014 10:20:36 PM) (Source: Schedule) (EventID: 0) (User: )
Description: Schedule error: 10106Initialize call failed, bailing out
Error: (11/15/2014 10:03:22 PM) (Source: Schedule) (EventID: 0) (User: )
Description: Schedule error: 10106Initialize call failed, bailing out
Error: (11/15/2014 09:58:09 PM) (Source: Schedule) (EventID: 0) (User: )
Description: Schedule error: 10106Initialize call failed, bailing out
CodeIntegrity Errors:
===================================
Date: 2014-08-26 16:34:30.252
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Telekom\Kinderschutz-Software\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-08-26 16:19:00.481
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Telekom\Kinderschutz-Software\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-08-25 17:00:10.305
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Telekom\Kinderschutz-Software\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-08-25 16:32:11.148
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Telekom\Kinderschutz-Software\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-08-21 15:21:23.556
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Telekom\Kinderschutz-Software\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-08-21 14:50:42.194
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Telekom\Kinderschutz-Software\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-07-17 20:56:07.137
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Telekom\Kinderschutz-Software\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-07-14 13:06:42.195
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Telekom\Kinderschutz-Software\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-07-12 13:54:31.702
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Telekom\Kinderschutz-Software\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-07-12 13:08:16.891
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Telekom\Kinderschutz-Software\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 5000+
Percentage of memory in use: 49%
Total physical RAM: 1791.18 MB
Available physical RAM: 913.22 MB
Total Pagefile: 3582.35 MB
Available Pagefile: 2521.76 MB
Total Virtual: 2047.88 MB
Available Virtual: 1910.3 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:232.88 GB) (Free:157.31 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:232.88 GB) (Free:232.73 GB) NTFS
Drive e: (Driver) (CDROM) (Total:0.1 GB) (Free:0 GB) CDFS
Drive f: (SharkoonEC2) (Removable) (Total:3.73 GB) (Free:1.42 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 00034AAF)
Partition 1: (Active) - (Size=232.9 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=232.9 GB) - (Type=OF Extended)
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 3.7 GB) (Disk ID: 400D3BAB)
Partition 1: (Active) - (Size=3.7 GB) - (Type=0C)
==================== End Of Log ============================
|
Baum-Darstellung