| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Netbook auf Virenbefall überprüfenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
26.11.2014, 14:42
| #1 |
 |  Netbook auf Virenbefall überprüfen Der PC eines Bekannten hat sich einen Virus eingefangen, wobei u.a. der Mailaccount gehackt wurde, wodurch Spammails versendet wurden und versucht wurde, das Login bei der Sparkasse abzugreifen, was zum Glück noch rechtzeitig bemerkt wurde. Diesen PC hatte ich dann, um auf Nummer sicher zu gehen, komplett neu aufgesetzt. Im gleichen Netzwerk war aber noch ein Netbook, das ebenfalls im Internet genutzt wurde, aber keine Symptome einer Infektion zeigt(e). Da eine komplette Neuinstallation immer sehr zeitaufwendig ist, hätte ich gerne Eure Hilfe, um einmal zu checken, ob das Netbook evtl. auf befallen ist. Ich bitte also um die Aufforderungen zum Posten einiger Logfiles.  |
|
26.11.2014, 14:45
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Netbook auf Virenbefall überprüfen Hallo und
__________________ Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden? Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520 Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten! Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht! Zudem bitte auch ein Log mit Farbars Tool machen: Scan mit Farbar's Recovery Scan Tool (FRST) Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
 Lesestoff:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit. Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
26.11.2014, 15:01
| #3 |
| | Netbook auf Virenbefall überprüfen Noch ein paar Zusatzinfos. Das Netbook hat wie gesagt keinen Virenbefall gezeigt, nur der PC, der aber schon komplett neu installiert wurde und wo keine Logs mehr vorhanden sind, was er denn gehabt hat.
__________________Das Netbook hat zudem sehr veraltete Software. Das habe ich schon gestgestellt (Java, Firefox, Flash etc.) und keinen Virenscanner. Ich habe nun das FRST versucht zu starten, es meldet: AutoIT Error: Error: "EndIf" statement with no matching "If" statement. Das Netbook hat Windows 7 Starter SP1 32bit installiert. Vielleicht ist das damit nicht kompatibel? |
|
26.11.2014, 15:05
| #4 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Netbook auf Virenbefall überprüfen In einem Strang behandeln und bereinigen wir genau einen PC, also bitte nicht mit Logs von verschiedenen Rechnern ankommen, das stiftet nur Verwirrung und endet im Chaos Zitat:
Ja, FRST läuft definitiv auf einem 32 Bit Windows 7. Für ein 64 Bit Windows 7 muss es es FRST64 sein. Stell dicher, dass du die richtige Version hast, außerdem muss FRST auf dem Desktop liegen und von da gestartet werden. Deaktiviere den Virenscanner vor dem Doppelklick auf FRST
__________________ Logfiles bitte immer in CODE-Tags posten |
|
26.11.2014, 15:27
| #5 |
| | Netbook auf Virenbefall überprüfen Ja nur das Netbook, der PC ist wie gesagt schon bereinigt durch komplette Neuinstallation! Ich habe die 32bit Version von FRST gezogen und auf dem Desktop abgelegt. Er startet aber nicht, sondern bringt oben genannten Fehler: AutoIT Error: Error: "EndIf" statement with no matching "If" statement. Vielleicht liegt es doch daran, dass nur ein Windows Starter drauf ist? Der User, der es ausführt, hat Admin-Rechte. |
|
26.11.2014, 15:36
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Netbook auf Virenbefall überprüfen FRST löschen, nochmal neu runterladen
__________________ --> Netbook auf Virenbefall überprüfen |
|
26.11.2014, 15:50
| #7 | |
| | Netbook auf Virenbefall überprüfenZitat:
Geändert von 3kats3 (26.11.2014 um 15:57 Uhr) |
|
26.11.2014, 15:58
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Netbook auf Virenbefall überprüfen Nein...Virenscanner vorher deaktiviert?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
27.11.2014, 10:58
| #9 |
| | Netbook auf Virenbefall überprüfen Ja, den hab ich sogar deinstalliert, nachdem er eh seit 2011 kein Update mehr gezogen hatte. Hab das Netbook noch mal neu gestartet und FRST erneut ausgeführt, aber er bleibt bei der Fehlermeldung. Adminrechte hat der Benutzer auch, ich leg mal einen weiteren Benutzer an und probiere es über den oder ist das eher kontraproduktiv? Leider hat das mit dem anderen Benutzeraccouts auch keine Verbesserung gebracht, er bringt immer den gleichen Fehler. Gibt es vielleicht noch einen anderen Ansatz? |
|
27.11.2014, 13:48
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Netbook auf Virenbefall überprüfen FRST hatte in der gestrigen Versionen offensichtlich nen Bug. Einfach nochmal neu runterladen und erneut ausführen.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
27.11.2014, 14:00
| #11 |
| | Netbook auf Virenbefall überprüfenFRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 26-11-2014 01
Ran by Nils (administrator) on NILS-NETBOOK on 27-11-2014 13:54:38
Running from C:\Users\Nils\Desktop
Loaded Profile: Nils (Available profiles: Nils & Test)
Platform: Microsoft Windows 7 Starter Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
() C:\Windows\System32\AsusService.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\VS7DEBUG\mdm.exe
() C:\Program Files\ASUS\Game Park\GameConsole\OberonGameConsoleService.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files\ASUS\Eee Docking\Eee Docking.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe
(ASUS) C:\Windows\AsScrPro.exe
() C:\Program Files\ASUS\EPC\EeeSplendid\AsAgent.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Boingo Wireless, Inc.) C:\Program Files\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe
(ASUSTeK Computer Inc.) C:\Program Files\EeePC\HotkeyService\HotKeyMon.exe
(ASUSTeK Computer Inc.) C:\Program Files\EeePC\HotkeyService\HotkeyService.exe
(ASUSTeK Computer Inc.) C:\Program Files\EeePC\SHE\SuperHybridEngine.exe
() C:\Program Files\ASUS\LiveUpdate\LiveUpdate.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1545512 2009-07-20] (Synaptics Incorporated)
HKLM\...\Run: [HotkeyMon] => C:\Program Files\EeePC\HotkeyService\HotKeyMon.exe [100328 2009-09-11] (ASUSTeK Computer Inc.)
HKLM\...\Run: [HotkeyService] => C:\Program Files\EeePC\HotkeyService\HotkeyService.exe [1021424 2009-10-17] (ASUSTeK Computer Inc.)
HKLM\...\Run: [SuperHybridEngine] => C:\Program Files\EeePC\SHE\SuperHybridEngine.exe [413688 2009-10-26] (ASUSTeK Computer Inc.)
HKLM\...\Run: [Eee Docking] => C:\Program Files\ASUS\Eee Docking\Eee Docking.exe [414384 2009-11-17] ()
HKLM\...\Run: [LiveUpdate] => C:\Program Files\Asus\LiveUpdate\LiveUpdate.exe [803304 2009-08-28] ()
HKLM\...\Run: [SynAsusAcpi] => C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [83240 2009-07-20] (Synaptics Incorporated)
HKLM\...\Run: [ASUS Screen Saver Protector] => C:\Windows\AsScrPro.exe [3058304 2010-01-06] (ASUS)
HKLM\...\Run: [EeeSplendidAgent] => C:\Program Files\ASUS\EPC\EeeSplendid\AsAgent.exe [104960 2009-12-30] ()
HKLM\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7744032 2009-09-29] (Realtek Semiconductor)
HKLM\...\Run: [Boingo Wi-Fi] => C:\Program Files\Boingo\Boingo Wi-Fi\Boingo.lnk [2429 2010-06-09] ()
HKLM\...\Run: [ASUSPRP] => C:\Program Files\ASUS\APRP\APRP.EXE [2018032 2010-01-06] (ASUSTek Computer Inc.)
HKLM\...\Run: [CanonSolutionMenu] => C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe [644696 2007-05-14] (CANON INC.)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [1603152 2007-04-03] (CANON INC.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKU\S-1-5-21-2771088097-4119805611-136013659-1000\...\Run: [msnmsgr] => "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\tmchlang.lnk
ShortcutTarget: tmchlang.lnk -> C:\Program Files\Trend Micro\Internet Security\TmChLang.exe (No File)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-2771088097-4119805611-136013659-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus.msn.com
HKU\S-1-5-21-2771088097-4119805611-136013659-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com
HKU\S-1-5-21-2771088097-4119805611-136013659-1000\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://eeepc.asus.com
HKU\S-1-5-21-2771088097-4119805611-136013659-1000\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://eeepc.asus.com
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Skype add-on (mastermind) -> {22BF413B-C6D2-4d91-82A9-A0F997BA588C} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
Toolbar: HKU\S-1-5-21-2771088097-4119805611-136013659-1000 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
FireFox:
========
FF ProfilePath: C:\Users\Nils\AppData\Roaming\Mozilla\Firefox\Profiles\gcrmjyv1.default
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF32_15_0_0_189.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
Chrome:
=======
CHR Profile: C:\Users\Nils\AppData\Local\Google\Chrome\User Data\Default
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AsusService; C:\Windows\System32\AsusService.exe [219136 2009-08-19] () [File not signed]
R2 MDM; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed]
S2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2009-05-15] (Hewlett-Packard) [File not signed]
R2 OberonGameConsoleService; C:\Program Files\Asus\Game Park\GameConsole\OberonGameConsoleService.exe [44312 2009-09-15] ()
S2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2009-05-15] (Hewlett-Packard) [File not signed]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 AsUpIO; C:\windows\System32\drivers\AsUpIO.sys [11448 2009-07-06] ()
R3 kbfiltr; C:\windows\System32\DRIVERS\kbfiltr.sys [13880 2009-07-20] ( )
S3 btwaudio; system32\drivers\btwaudio.sys [X]
S3 btwavdt; \SystemRoot\system32\DRIVERS\btwavdt.sys [X]
S3 btwl2cap; system32\DRIVERS\btwl2cap.sys [X]
S3 btwrchid; \SystemRoot\system32\DRIVERS\btwrchid.sys [X]
S3 ncplelhp; system32\DRIVERS\ncplelhp.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-11-27 13:54 - 2014-11-27 13:55 - 00008607 _____ () C:\Users\Nils\Desktop\FRST.txt
2014-11-27 13:54 - 2014-11-27 13:54 - 00000000 ____D () C:\FRST
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 _SHDL () C:\Users\Test\Startmenü
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 _SHDL () C:\Users\Test\Netzwerkumgebung
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 _SHDL () C:\Users\Test\Druckumgebung
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 _SHDL () C:\Users\Test\Documents\Eigene Musik
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 _SHDL () C:\Users\Test\Documents\Eigene Bilder
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 _SHDL () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 _SHDL () C:\Users\Test\AppData\Local\Verlauf
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 ____D () C:\Users\Test\AppData\Local\VirtualStore
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 ____D () C:\Users\Test
2014-11-26 16:10 - 2010-01-07 23:43 - 00000000 ____D () C:\Users\Test\AppData\Roaming\E-Cam
2014-11-26 16:10 - 2010-01-06 23:49 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Game Park
2014-11-26 16:10 - 2010-01-06 23:24 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Adobe
2014-11-26 16:10 - 2010-01-06 23:16 - 00067856 _____ () C:\Users\Test\AppData\Local\GDIPFONTCACHEV1.DAT
2014-11-26 16:10 - 2010-01-06 22:56 - 00000000 ____D () C:\Users\Test\AppData\Local\Microsoft Help
2014-11-26 16:10 - 2010-01-06 22:55 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Macromedia
2014-11-26 16:10 - 2010-01-06 22:55 - 00000000 ____D () C:\Users\Test\AppData\Local\Adobe
2014-11-26 16:10 - 2010-01-06 22:53 - 00000000 ____D () C:\Users\Test\Documents\EBI
2014-11-26 16:10 - 2010-01-06 22:46 - 00000000 ____D () C:\Users\Test\Documents\Bluetooth Exchange Folder
2014-11-26 16:10 - 2010-01-06 22:46 - 00000000 ____D () C:\Users\Test\AppData\Local\Broadcom
2014-11-26 16:10 - 2010-01-06 22:39 - 00000000 ____D () C:\Users\Test\AppData\Roaming\InstallShield
2014-11-26 16:10 - 2009-07-14 05:54 - 00001419 _____ () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-11-26 16:10 - 2009-07-14 05:53 - 00000020 ___SH () C:\Users\Test\ntuser.ini
2014-11-26 16:10 - 2009-07-14 05:42 - 00000000 ___RD () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-11-26 16:10 - 2009-07-14 05:37 - 00000000 ___RD () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-11-26 15:52 - 2014-11-27 13:52 - 01109504 _____ (Farbar) C:\Users\Nils\Desktop\FRST.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-11-27 13:53 - 2012-09-14 10:04 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-11-27 13:53 - 2010-06-10 04:11 - 01870596 _____ () C:\windows\WindowsUpdate.log
2014-11-26 16:13 - 2009-07-14 05:34 - 00016160 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-26 16:13 - 2009-07-14 05:34 - 00016160 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-26 16:06 - 2010-01-06 23:21 - 00109872 _____ () C:\windows\PFRO.log
2014-11-26 16:06 - 2009-07-14 05:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-11-26 16:06 - 2009-07-14 05:39 - 00090678 _____ () C:\windows\setupact.log
2014-11-26 14:55 - 2009-07-25 08:50 - 01750500 _____ () C:\windows\system32\PerfStringBackup.INI
2014-11-26 14:39 - 2010-01-06 22:47 - 00000000 ____D () C:\Program Files\Trend Micro
2014-11-03 22:34 - 2013-06-29 23:10 - 00000328 _____ () C:\windows\TMFilter.log
2014-11-03 17:34 - 2009-07-14 03:37 - 00000000 ____D () C:\windows\Microsoft.NET
2014-11-03 08:20 - 2014-05-20 08:58 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-11-03 07:59 - 2009-07-14 05:33 - 00418496 _____ () C:\windows\system32\FNTCACHE.DAT
Some content of TEMP:
====================
C:\Users\Nils\AppData\Local\Temp\atl80.dll
C:\Users\Nils\AppData\Local\Temp\mfc80.dll
C:\Users\Nils\AppData\Local\Temp\mfc80u.dll
C:\Users\Nils\AppData\Local\Temp\mfcm80.dll
C:\Users\Nils\AppData\Local\Temp\mfcm80u.dll
C:\Users\Nils\AppData\Local\Temp\msvcm80.dll
C:\Users\Nils\AppData\Local\Temp\msvcp80.dll
C:\Users\Nils\AppData\Local\Temp\msvcr80.dll
C:\Users\Nils\AppData\Local\Temp\TmDbg32.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2013-09-13 20:10
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 26-11-2014 01
Ran by Nils at 2014-11-27 13:56:08
Running from C:\Users\Nils\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
32 Bit HP CIO Components Installer (Version: 1.1.0 - Hewlett-Packard) Hidden
Acrobat.com (HKLM\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe AIR (HKLM\...\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)
Adobe Flash Player 10 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 10.0.32.18 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.189 - Adobe Systems Incorporated)
Adobe Reader 9.5.5 MUI (HKLM\...\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.5.5 - Adobe Systems Incorporated)
ASUS VIBE (HKLM\...\ASUS VIBE) (Version: 1.0.187 - Ecareme, Inc.)
ASUSUpdate for Eee PC (HKLM\...\{587178E7-B1DF-494E-9838-FA4DD36E873C}) (Version: 1.03.06 - ASUSTeK Computer Inc.)
Atheros Client Installation Program (HKLM\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 7.0 - Atheros)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.10 - Atheros Communications Inc.)
Boingo Wi-Fi (HKLM\...\{84C2B80B-64A2-4B22-93EC-F30C3D6BF7D8}) (Version: 1.7.0048 - Boingo Wireless, Inc.)
Canon IJ Network Scan Utility (HKLM\...\Canon_IJ_Network_Scan_UTILITY) (Version: - )
Canon IJ Network Tool (HKLM\...\Canon_IJ_Network_UTILITY) (Version: - )
Canon MP Navigator EX 1.0 (HKLM\...\MP Navigator EX 1.0) (Version: - )
Canon MX700 series (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX700_series) (Version: - )
Canon My Printer (HKLM\...\CanonMyPrinter) (Version: - )
Canon Utilities Easy-PhotoPrint EX (HKLM\...\Easy-PhotoPrint EX) (Version: - )
Canon Utilities Solution Menu (HKLM\...\CanonSolutionMenu) (Version: - )
Chicken Invaders 2 (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110209593}) (Version: - Oberon Media)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
ebi.BookReader3J (HKLM\...\{F3D2DEDC-4732-4188-8A3A-1A3FFBD4D6C8}) (Version: 3.75.14 - eBOOK Initiative Japan Co., Ltd.)
E-Cam (HKLM\...\{185AFA7A-F63E-450B-94AA-011CAC18090E}) (Version: 2.0.2.3 - )
Eee Docking 3.6.0 (HKLM\...\Eee Docking_is1) (Version: 3.6.0 - ASUSTek Computer Inc.)
EeeSplendid (HKLM\...\{6333FC29-BFE5-4024-AC78-958A1A7555D1}) (Version: 5.1.2.0008 - ASUS)
EeeSplendid (Version: 5.1.2.0008 - ASUS) Hidden
FontResizer (HKLM\...\InstallShield_{17780F99-A9DF-450B-81B3-6781B20A17A8}) (Version: 1.01.0011 - ASUSTek)
FontResizer (Version: 1.01.0011 - ASUSTek) Hidden
Game Park Console (HKLM\...\{BB5E5F87-E939-4974-A006-2B4A2F60EEA3}_is1) (Version: 5.2.1.4 - Oberon Media, Inc.)
Hotkey Service (HKLM\...\{71C0E38E-09F2-4386-9977-404D4F6640CD}) (Version: 1.15 - AsusTek Computer)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.14.10.2117 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation)
LiveUpdate (HKLM\...\{38E5A3B1-ADF1-47E0-8024-76310A30EB36}) (Version: 1.19 - Asus)
LocaleMe (HKLM\...\{F58C1D44-4AC9-48E8-9049-7A6CDFCB415C}) (Version: 1.3 - ASUS)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0100-040C-0000-0000000FF1CE}_OMUI.fr-fr_{CF3C20A6-47B7-48DA-95C1-6FBB5A439AF8}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0100-0410-0000-0000000FF1CE}_OMUI.it-it_{7F40286D-09A7-4DC0-A2A4-AA18D026D369}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0100-0413-0000-0000000FF1CE}_OMUI.nl-nl_{26257879-B20D-4D30-A429-B387A4890929}) (Version: - Microsoft)
Microsoft Office Excel 2007 Help - Aggiornamento (KB963678) (HKLM\...\{90120000-0016-0410-0000-0000000FF1CE}_OMUI.it-it_{9F57BDED-B51B-4D2F-B360-5B4EFAAF0F1A}) (Version: - Microsoft)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Language Pack 2007 - Dutch/Nederlands (HKLM\...\OMUI.nl-nl) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Language Pack 2007 - French/Français (HKLM\...\OMUI.fr-fr) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Language Pack 2007 - German/Deutsch (HKLM\...\OMUI.de-de) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Language Pack 2007 - Italian/Italiano (HKLM\...\OMUI.it-it) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Outlook 2007 Help - Aggiornamento (KB963677) (HKLM\...\{90120000-001A-0410-0000-0000000FF1CE}_OMUI.it-it_{2278E02A-AB15-4BF7-B2B4-5C0EEB4B7EEB}) (Version: - Microsoft)
Microsoft Office Powerpoint 2007 Help - Aggiornamento (KB963669) (HKLM\...\{90120000-0018-0410-0000-0000000FF1CE}_OMUI.it-it_{C76C02F1-B07F-4974-876A-A18DEC9887C8}) (Version: - Microsoft)
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2007 (HKLM\...\PROPLUS) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Word 2007 Help - Aggiornamento (KB963665) (HKLM\...\{90120000-001B-0410-0000-0000000FF1CE}_OMUI.it-it_{E5B82DB3-DD7D-4C45-BC5E-09864B26F9BC}) (Version: - Microsoft)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Mise à jour Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-040C-0000-0000000FF1CE}_OMUI.fr-fr_{B761869A-B85C-40E2-994C-A1CE78AC8F2C}) (Version: - Microsoft)
Mise à jour Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-040C-0000-0000000FF1CE}_OMUI.fr-fr_{51EFB347-1F3D-4BAC-8B79-F056B904FE21}) (Version: - Microsoft)
Mise à jour Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-040C-0000-0000000FF1CE}_OMUI.fr-fr_{C3DCA38E-005E-41BA-A52A-7C3429F351C3}) (Version: - Microsoft)
Mise à jour Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-040C-0000-0000000FF1CE}_OMUI.fr-fr_{81536A04-DBFB-4DB3-978F-0F284590C223}) (Version: - Microsoft)
Mozilla Firefox 7.0.1 (x86 de) (HKLM\...\Mozilla Firefox 7.0.1 (x86 de)) (Version: 7.0.1 - Mozilla)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
Ralink RT2860 Wireless LAN Card (HKLM\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309B0}) (Version: 1.2.0.1 - Ralink)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5948 - Realtek Semiconductor Corp.)
Skype web features (HKLM\...\{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}) (Version: 1.0.3971 - Skype Technologies S.A.)
Skype™ 6.11 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Super Hybrid Engine (HKLM\...\{88F08F98-12BC-4613-81A2-8F9B88CFC73E}) (Version: 2.10 - AsusTek Computer)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 13.2.6.1 - Synaptics Incorporated)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_OMUI.de-de_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_PROPLUS_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_PROPLUS_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_OMUI.de-de_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_PROPLUS_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_OMUI.de-de_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_PROPLUS_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
Update voor Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0413-0000-0000000FF1CE}_OMUI.nl-nl_{5CF7002F-6F49-4482-9564-5614FBE560FA}) (Version: - Microsoft)
Update voor Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0413-0000-0000000FF1CE}_OMUI.nl-nl_{15D84E79-1ED7-42C5-B2FD-745C3FBDDDC5}) (Version: - Microsoft)
Update voor Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0413-0000-0000000FF1CE}_OMUI.nl-nl_{A66AE6A1-8D8C-4102-BC18-38CBDE40F809}) (Version: - Microsoft)
Windows Driver Package - Broadcom Bluetooth (07/17/2009 6.2.0.9403) (HKLM\...\B41C7C96D83162A676DA7365ADEFD6C1AF62A4EE) (Version: 07/17/2009 6.2.0.9403 - Broadcom)
Windows Driver Package - Broadcom Bluetooth (07/29/2009 6.1.7100.0) (HKLM\...\B5C82F3814F82FB37F1513B3185399BD88892B08) (Version: 07/29/2009 6.1.7100.0 - Broadcom)
Windows Driver Package - Broadcom HIDClass (07/28/2009 6.2.0.9800) (HKLM\...\BF20603967CFDCB2BBF91950E8A56DFBC5C833FE) (Version: 07/28/2009 6.2.0.9800 - Broadcom)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
11-09-2014 08:04:00 Windows Update
26-09-2014 10:40:03 Windows Update
27-09-2014 06:39:56 Windows Update
05-10-2014 05:18:44 Windows Update
06-10-2014 18:44:55 Windows Update
22-10-2014 15:25:15 Windows Update
24-10-2014 07:35:54 Windows Update
03-11-2014 07:02:49 Windows Update
03-11-2014 07:18:42 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {C4FBF6D9-661D-49FA-8AC5-34203AA420E7} - System32\Tasks\Adobe Flash Player Updater => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-10-22] (Adobe Systems Incorporated)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2010-01-06 22:47 - 2009-08-19 02:35 - 00219136 _____ () C:\Windows\System32\AsusService.exe
2010-01-06 23:49 - 2009-09-15 02:05 - 00044312 _____ () C:\Program Files\Asus\Game Park\GameConsole\OberonGameConsoleService.exe
2010-01-06 23:16 - 2009-11-17 22:47 - 00414384 _____ () C:\Program Files\ASUS\Eee Docking\Eee Docking.exe
2010-01-06 23:30 - 2009-12-30 00:28 - 00104960 _____ () C:\Program Files\ASUS\EPC\EeeSplendid\AsAgent.exe
2009-08-28 00:38 - 2009-08-28 00:38 - 00803304 _____ () C:\Program Files\Asus\LiveUpdate\LiveUpdate.exe
2009-08-28 00:45 - 2009-08-28 00:45 - 00120808 _____ () C:\Program Files\Asus\LiveUpdate\ClientSocket.dll
2009-08-28 01:29 - 2009-08-28 01:29 - 00182240 _____ () C:\Program Files\Asus\LiveUpdate\Parser.dll
2009-08-28 01:22 - 2009-08-28 01:22 - 00161768 _____ () C:\Program Files\Asus\LiveUpdate\Enumeration.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: NcpBudgetGui => "C:\Program Files\WatchGuard\Mobile VPN\NcpBudgetGui.exe" -start
MSCONFIG\startupreg: NcpMonitor => "C:\Program Files\WatchGuard\Mobile VPN\ncpmon.exe" autorun
MSCONFIG\startupreg: NcpPopup => "C:\Program Files\WatchGuard\Mobile VPN\ncppopup.exe" noerrmsg
MSCONFIG\startupreg: NcpRsuGui => "C:\Program Files\WatchGuard\Mobile VPN\rwsrsu.exe" -gui
========================= Accounts: ==========================
Administrator (S-1-5-21-2771088097-4119805611-136013659-500 - Administrator - Disabled)
Gast (S-1-5-21-2771088097-4119805611-136013659-501 - Limited - Disabled)
Nils (S-1-5-21-2771088097-4119805611-136013659-1000 - Administrator - Enabled) => C:\Users\Nils
Test (S-1-5-21-2771088097-4119805611-136013659-1002 - Administrator - Enabled) => C:\Users\Test
==================== Faulty Device Manager Devices =============
Name: Canon MX700 ser Network
Description: Canon MX700 ser Network
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Canon
Service: StillCam
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (11/26/2014 04:10:55 PM) (Source: ESENT) (EventID: 215) (User: )
Description: WinMail (3476) WindowsMail0: Die Sicherung wurde abgebrochen, weil sie vom Client angehalten wurde, oder weil die Verbindung mit dem Client unterbrochen wurde.
Error: (11/26/2014 02:38:17 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: tmlisten.exe, Version: 11.5.0.1049, Zeitstempel: 0x4c736eb2
Name des fehlerhaften Moduls: tmlisten.exe, Version: 11.5.0.1049, Zeitstempel: 0x4c736eb2
Ausnahmecode: 0x40000015
Fehleroffset: 0x000f2b25
ID des fehlerhaften Prozesses: 0xb60
Startzeit der fehlerhaften Anwendung: 0xtmlisten.exe0
Pfad der fehlerhaften Anwendung: tmlisten.exe1
Pfad des fehlerhaften Moduls: tmlisten.exe2
Berichtskennung: tmlisten.exe3
Error: (11/03/2014 00:25:55 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm pccnt.exe, Version 10.5.0.1103 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 384
Startzeit: 01cff758887b2b44
Endzeit: 16
Anwendungspfad: C:\Program Files\Trend Micro\OfficeScan Client\pccnt.exe
Berichts-ID: 272a2ab0-634c-11e4-941b-485b3925aa2e
Error: (10/24/2014 08:38:51 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: OUTLOOK.EXE, Version: 12.0.6691.5000, Zeitstempel: 0x52e8c57c
Name des fehlerhaften Moduls: olmapi32.dll, Version: 12.0.6672.5000, Zeitstempel: 0x50e61339
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00026445
ID des fehlerhaften Prozesses: 0xb58
Startzeit der fehlerhaften Anwendung: 0xOUTLOOK.EXE0
Pfad der fehlerhaften Anwendung: OUTLOOK.EXE1
Pfad des fehlerhaften Moduls: OUTLOOK.EXE2
Berichtskennung: OUTLOOK.EXE3
Error: (09/11/2014 11:19:57 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm OUTLOOK.EXE, Version 12.0.6691.5000 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1554
Startzeit: 01cfcda84e1ea05e
Endzeit: 124
Anwendungspfad: C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
Berichts-ID: 0286ac41-399d-11e4-941b-485b3925aa2e
Error: (09/18/2012 02:01:16 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: AutoRun.exe_AutoRun, Version: 5.1.2.0, Zeitstempel: 0x4b037266
Name des fehlerhaften Moduls: Chameleon.dll, Version: 2.0.2.0, Zeitstempel: 0x48fdc859
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00007383
ID des fehlerhaften Prozesses: 0x152c
Startzeit der fehlerhaften Anwendung: 0xAutoRun.exe_AutoRun0
Pfad der fehlerhaften Anwendung: AutoRun.exe_AutoRun1
Pfad des fehlerhaften Moduls: AutoRun.exe_AutoRun2
Berichtskennung: AutoRun.exe_AutoRun3
Error: (05/01/2012 06:40:14 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\windows\system32\svchost.exe -k netsvcs; Beschreibung = Windows Update; Fehler = 0x81000101).
Error: (04/26/2012 04:09:25 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: rwsrsu.exe, Version: 0.0.0.0, Zeitstempel: 0x4ad3310e
Name des fehlerhaften Moduls: rwsrsu.exe, Version: 0.0.0.0, Zeitstempel: 0x4ad3310e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00037668
ID des fehlerhaften Prozesses: 0xc50
Startzeit der fehlerhaften Anwendung: 0xrwsrsu.exe0
Pfad der fehlerhaften Anwendung: rwsrsu.exe1
Pfad des fehlerhaften Moduls: rwsrsu.exe2
Berichtskennung: rwsrsu.exe3
Error: (02/11/2012 01:49:15 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error: (02/11/2012 01:49:15 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren, die für die Sprach-ID "009" definiert wurden, können nicht gelesen werden. Das erste DWORD im Datenbereich enthält den Win32-Fehlercode.
System errors:
=============
Error: (11/26/2014 04:06:42 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error: (11/26/2014 02:24:44 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error: (11/07/2014 08:50:53 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error: (11/06/2014 07:25:54 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error: (11/06/2014 03:29:20 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error: (11/06/2014 09:33:04 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error: (11/05/2014 10:06:40 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error: (11/03/2014 04:31:51 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst ShellHWDetection erreicht.
Error: (11/03/2014 04:05:06 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error: (11/03/2014 00:22:09 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Microsoft Office Sessions:
=========================
Error: (10/24/2014 08:38:48 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 16 seconds with 0 seconds of active time. This session ended with a crash.
==================== Memory info ===========================
Processor: Intel(R) Atom(TM) CPU N450 @ 1.66GHz
Percentage of memory in use: 30%
Total physical RAM: 2038.18 MB
Available physical RAM: 1413.54 MB
Total Pagefile: 4076.36 MB
Available Pagefile: 3339 MB
Total Virtual: 2047.88 MB
Available Virtual: 1911.05 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:80 GB) (Free:40.3 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:59.03 GB) (Free:48.97 GB) NTFS
Drive e: (Elements) (Fixed) (Total:931.48 GB) (Free:0.27 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149.1 GB) (Disk ID: 9F1192B6)
Partition 1: (Active) - (Size=80 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=59 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=10 GB) - (Type=1B)
Partition 4: (Not Active) - (Size=17 MB) - (Type=EF)
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 931.5 GB) (Disk ID: 52DD04D5)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
27.11.2014, 15:35
| #12 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Netbook auf Virenbefall überprüfenZitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
27.11.2014, 15:39
| #13 |
| | Netbook auf Virenbefall überprüfen Das Office wurde vom Arbeitgeber gestellt und ist eine sehr vergünstigte Lizenz EDU, aber das Netbook wird überwiegend privat genutzt und wurde nicht vom Arbeitgeber gestellt. Ich weiß, dass viele Programme dringend aktualisiert gehören, aber ist ein Virenbefall zu entdecken? Symptome zeigt das Gerät ja nicht, es ist nur, dass es mit einem stark infizierten PC zusammen im gleichen Netzwerk betrieben wurde. |
|
27.11.2014, 15:54
| #14 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Netbook auf Virenbefall überprüfen Ich find eine derartige Office Version nur ungewöhnlich auf nem Netbook, deswegen hab ich dich gefragt... Adware/Junkware/Toolbars entfernen (alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!) 1. Schritt: adwCleaner Downloade Dir bitte  AdwCleaner auf deinen Desktop.
2. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
3. Schritt: Frisches Log mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ Logfiles bitte immer in CODE-Tags posten |
|
27.11.2014, 16:16
| #15 |
| | Netbook auf Virenbefall überprüfen Hier die gewünschten Logs, heute läuft es ja doch schon sehr viel flüssiger als gestern mit den Tools: Code:
ATTFilter # AdwCleaner v4.102 - Bericht erstellt am 27/11/2014 um 16:02:33
# Aktualisiert 23/11/2014 von Xplode
# Database : 2014-11-23.7 [Local]
# Betriebssystem : Windows 7 Starter Service Pack 1 (32 bits)
# Benutzername : Nils - NILS-NETBOOK
# Gestartet von : C:\Users\Nils\Desktop\AdwCleaner_4.102.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.EasyHideBtn
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.EasyHideBtn.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.Localizer
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.Localizer.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.NameHighlighter
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.NameHighlighter.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.NameHighlighterStatistics
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.NameHighlighterStatistics.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.SkypeIEHelper
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.SkypeIEHelper.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.SNameProxy
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.SNameProxy.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{937936AF-28CA-4973-B8AE-F250406149A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{937936AF-28CA-4973-B8AE-F250406149A2}
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17344
-\\ Mozilla Firefox v7.0.1 (de)
-\\ Google Chrome v
[C:\Users\Nils\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://de.ask.com/web?q={searchTerms}
*************************
AdwCleaner[R0].txt - [1946 octets] - [27/11/2014 15:58:07]
AdwCleaner[S0].txt - [1867 octets] - [27/11/2014 16:02:33]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1927 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.9 (11.15.2014:2)
OS: Windows 7 Starter x86
Ran by Nils on 27.11.2014 at 16:04:59,51
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 27.11.2014 at 16:10:28,31
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 26-11-2014 01
Ran by Nils (administrator) on NILS-NETBOOK on 27-11-2014 16:10:56
Running from C:\Users\Nils\Desktop
Loaded Profile: Nils (Available profiles: Nils & Test)
Platform: Microsoft Windows 7 Starter Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
() C:\Windows\System32\AsusService.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\VS7DEBUG\mdm.exe
() C:\Program Files\ASUS\Game Park\GameConsole\OberonGameConsoleService.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe
(ASUS) C:\Windows\AsScrPro.exe
() C:\Program Files\ASUS\EPC\EeeSplendid\AsAgent.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(ASUSTeK Computer Inc.) C:\Program Files\EeePC\HotkeyService\HotKeyMon.exe
(ASUSTeK Computer Inc.) C:\Program Files\EeePC\SHE\SuperHybridEngine.exe
(ASUSTeK Computer Inc.) C:\Program Files\EeePC\HotkeyService\HotkeyService.exe
() C:\Program Files\ASUS\LiveUpdate\LiveUpdate.exe
(Boingo Wireless, Inc.) C:\Program Files\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files\ASUS\Eee Docking\Eee Docking.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1545512 2009-07-20] (Synaptics Incorporated)
HKLM\...\Run: [HotkeyMon] => C:\Program Files\EeePC\HotkeyService\HotKeyMon.exe [100328 2009-09-11] (ASUSTeK Computer Inc.)
HKLM\...\Run: [HotkeyService] => C:\Program Files\EeePC\HotkeyService\HotkeyService.exe [1021424 2009-10-17] (ASUSTeK Computer Inc.)
HKLM\...\Run: [SuperHybridEngine] => C:\Program Files\EeePC\SHE\SuperHybridEngine.exe [413688 2009-10-26] (ASUSTeK Computer Inc.)
HKLM\...\Run: [Eee Docking] => C:\Program Files\ASUS\Eee Docking\Eee Docking.exe [414384 2009-11-17] ()
HKLM\...\Run: [LiveUpdate] => C:\Program Files\Asus\LiveUpdate\LiveUpdate.exe [803304 2009-08-28] ()
HKLM\...\Run: [SynAsusAcpi] => C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [83240 2009-07-20] (Synaptics Incorporated)
HKLM\...\Run: [ASUS Screen Saver Protector] => C:\Windows\AsScrPro.exe [3058304 2010-01-06] (ASUS)
HKLM\...\Run: [EeeSplendidAgent] => C:\Program Files\ASUS\EPC\EeeSplendid\AsAgent.exe [104960 2009-12-30] ()
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7744032 2009-09-29] (Realtek Semiconductor)
HKLM\...\Run: [Boingo Wi-Fi] => C:\Program Files\Boingo\Boingo Wi-Fi\Boingo.lnk [2429 2010-06-09] ()
HKLM\...\Run: [ASUSPRP] => C:\Program Files\ASUS\APRP\APRP.EXE [2018032 2010-01-06] (ASUSTek Computer Inc.)
HKLM\...\Run: [CanonSolutionMenu] => C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe [644696 2007-05-14] (CANON INC.)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [1603152 2007-04-03] (CANON INC.)
HKU\S-1-5-21-2771088097-4119805611-136013659-1000\...\Run: [msnmsgr] => "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\tmchlang.lnk
ShortcutTarget: tmchlang.lnk -> C:\Program Files\Trend Micro\Internet Security\TmChLang.exe (No File)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-2771088097-4119805611-136013659-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus.msn.com
HKU\S-1-5-21-2771088097-4119805611-136013659-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com
HKU\S-1-5-21-2771088097-4119805611-136013659-1000\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://eeepc.asus.com
HKU\S-1-5-21-2771088097-4119805611-136013659-1000\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://eeepc.asus.com
BHO: Skype add-on (mastermind) -> {22BF413B-C6D2-4d91-82A9-A0F997BA588C} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
Toolbar: HKU\S-1-5-21-2771088097-4119805611-136013659-1000 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
FireFox:
========
FF ProfilePath: C:\Users\Nils\AppData\Roaming\Mozilla\Firefox\Profiles\gcrmjyv1.default
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF32_15_0_0_189.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
Chrome:
=======
CHR Profile: C:\Users\Nils\AppData\Local\Google\Chrome\User Data\Default
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AsusService; C:\Windows\System32\AsusService.exe [219136 2009-08-19] () [File not signed]
R2 MDM; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed]
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2009-05-15] (Hewlett-Packard) [File not signed]
R2 OberonGameConsoleService; C:\Program Files\Asus\Game Park\GameConsole\OberonGameConsoleService.exe [44312 2009-09-15] ()
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2009-05-15] (Hewlett-Packard) [File not signed]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 AsUpIO; C:\windows\System32\drivers\AsUpIO.sys [11448 2009-07-06] ()
R3 kbfiltr; C:\windows\System32\DRIVERS\kbfiltr.sys [13880 2009-07-20] ( )
S3 btwaudio; system32\drivers\btwaudio.sys [X]
S3 btwavdt; \SystemRoot\system32\DRIVERS\btwavdt.sys [X]
S3 btwl2cap; system32\DRIVERS\btwl2cap.sys [X]
S3 btwrchid; \SystemRoot\system32\DRIVERS\btwrchid.sys [X]
S3 ncplelhp; system32\DRIVERS\ncplelhp.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-11-27 16:10 - 2014-11-27 16:13 - 00007817 _____ () C:\Users\Nils\Desktop\FRST.txt
2014-11-27 16:10 - 2014-11-27 16:10 - 00000619 _____ () C:\Users\Nils\Desktop\JRT.txt
2014-11-27 16:04 - 2014-11-27 16:04 - 00000000 ____D () C:\windows\ERUNT
2014-11-27 15:58 - 2014-11-27 16:02 - 00000000 ____D () C:\AdwCleaner
2014-11-27 15:57 - 2014-11-27 15:56 - 01707532 _____ (Thisisu) C:\Users\Nils\Desktop\JRT.exe
2014-11-27 15:57 - 2014-11-27 15:55 - 02148864 _____ () C:\Users\Nils\Desktop\AdwCleaner_4.102.exe
2014-11-27 13:54 - 2014-11-27 16:11 - 00000000 ____D () C:\FRST
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 _SHDL () C:\Users\Test\Startmenü
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 _SHDL () C:\Users\Test\Netzwerkumgebung
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 _SHDL () C:\Users\Test\Druckumgebung
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 _SHDL () C:\Users\Test\Documents\Eigene Musik
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 _SHDL () C:\Users\Test\Documents\Eigene Bilder
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 _SHDL () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 _SHDL () C:\Users\Test\AppData\Local\Verlauf
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 ____D () C:\Users\Test\AppData\Local\VirtualStore
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 ____D () C:\Users\Test
2014-11-26 16:10 - 2010-01-07 23:43 - 00000000 ____D () C:\Users\Test\AppData\Roaming\E-Cam
2014-11-26 16:10 - 2010-01-06 23:49 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Game Park
2014-11-26 16:10 - 2010-01-06 23:24 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Adobe
2014-11-26 16:10 - 2010-01-06 23:16 - 00067856 _____ () C:\Users\Test\AppData\Local\GDIPFONTCACHEV1.DAT
2014-11-26 16:10 - 2010-01-06 22:56 - 00000000 ____D () C:\Users\Test\AppData\Local\Microsoft Help
2014-11-26 16:10 - 2010-01-06 22:55 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Macromedia
2014-11-26 16:10 - 2010-01-06 22:55 - 00000000 ____D () C:\Users\Test\AppData\Local\Adobe
2014-11-26 16:10 - 2010-01-06 22:53 - 00000000 ____D () C:\Users\Test\Documents\EBI
2014-11-26 16:10 - 2010-01-06 22:46 - 00000000 ____D () C:\Users\Test\Documents\Bluetooth Exchange Folder
2014-11-26 16:10 - 2010-01-06 22:46 - 00000000 ____D () C:\Users\Test\AppData\Local\Broadcom
2014-11-26 16:10 - 2010-01-06 22:39 - 00000000 ____D () C:\Users\Test\AppData\Roaming\InstallShield
2014-11-26 16:10 - 2009-07-14 05:54 - 00001419 _____ () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-11-26 16:10 - 2009-07-14 05:53 - 00000020 ___SH () C:\Users\Test\ntuser.ini
2014-11-26 16:10 - 2009-07-14 05:42 - 00000000 ___RD () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-11-26 16:10 - 2009-07-14 05:37 - 00000000 ___RD () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-11-26 15:52 - 2014-11-27 13:52 - 01109504 _____ (Farbar) C:\Users\Nils\Desktop\FRST.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-11-27 16:12 - 2012-09-14 10:04 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-11-27 16:10 - 2009-07-14 05:34 - 00016160 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-27 16:10 - 2009-07-14 05:34 - 00016160 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-27 16:08 - 2010-06-10 04:11 - 01882919 _____ () C:\windows\WindowsUpdate.log
2014-11-27 16:03 - 2010-01-06 23:21 - 00110668 _____ () C:\windows\PFRO.log
2014-11-27 16:03 - 2009-07-14 05:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-11-27 16:03 - 2009-07-14 05:39 - 00090734 _____ () C:\windows\setupact.log
2014-11-27 14:07 - 2010-06-09 11:12 - 00000000 ____D () C:\Users\Nils\AppData\Local\Adobe
2014-11-27 14:07 - 2010-01-07 18:04 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-11-27 14:07 - 2010-01-06 22:54 - 00000000 ____D () C:\ProgramData\Adobe
2014-11-27 14:07 - 2010-01-06 22:54 - 00000000 ____D () C:\Program Files\Adobe
2014-11-26 14:55 - 2009-07-25 08:50 - 01750500 _____ () C:\windows\system32\PerfStringBackup.INI
2014-11-26 14:39 - 2010-01-06 22:47 - 00000000 ____D () C:\Program Files\Trend Micro
2014-11-03 22:34 - 2013-06-29 23:10 - 00000328 _____ () C:\windows\TMFilter.log
2014-11-03 17:34 - 2009-07-14 03:37 - 00000000 ____D () C:\windows\Microsoft.NET
2014-11-03 08:20 - 2014-05-20 08:58 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-11-03 07:59 - 2009-07-14 05:33 - 00418496 _____ () C:\windows\system32\FNTCACHE.DAT
Some content of TEMP:
====================
C:\Users\Nils\AppData\Local\Temp\atl80.dll
C:\Users\Nils\AppData\Local\Temp\mfc80.dll
C:\Users\Nils\AppData\Local\Temp\mfc80u.dll
C:\Users\Nils\AppData\Local\Temp\mfcm80.dll
C:\Users\Nils\AppData\Local\Temp\mfcm80u.dll
C:\Users\Nils\AppData\Local\Temp\msvcm80.dll
C:\Users\Nils\AppData\Local\Temp\msvcp80.dll
C:\Users\Nils\AppData\Local\Temp\msvcr80.dll
C:\Users\Nils\AppData\Local\Temp\Quarantine.exe
C:\Users\Nils\AppData\Local\Temp\sqlite3.dll
C:\Users\Nils\AppData\Local\Temp\TmDbg32.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2013-09-13 20:10
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 26-11-2014 01
Ran by Nils at 2014-11-27 16:13:57
Running from C:\Users\Nils\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
32 Bit HP CIO Components Installer (Version: 1.1.0 - Hewlett-Packard) Hidden
Acrobat.com (HKLM\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe AIR (HKLM\...\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.189 - Adobe Systems Incorporated)
ASUS VIBE (HKLM\...\ASUS VIBE) (Version: 1.0.187 - Ecareme, Inc.)
ASUSUpdate for Eee PC (HKLM\...\{587178E7-B1DF-494E-9838-FA4DD36E873C}) (Version: 1.03.06 - ASUSTeK Computer Inc.)
Atheros Client Installation Program (HKLM\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 7.0 - Atheros)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.10 - Atheros Communications Inc.)
Boingo Wi-Fi (HKLM\...\{84C2B80B-64A2-4B22-93EC-F30C3D6BF7D8}) (Version: 1.7.0048 - Boingo Wireless, Inc.)
Canon IJ Network Scan Utility (HKLM\...\Canon_IJ_Network_Scan_UTILITY) (Version: - )
Canon IJ Network Tool (HKLM\...\Canon_IJ_Network_UTILITY) (Version: - )
Canon MP Navigator EX 1.0 (HKLM\...\MP Navigator EX 1.0) (Version: - )
Canon MX700 series (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX700_series) (Version: - )
Canon My Printer (HKLM\...\CanonMyPrinter) (Version: - )
Canon Utilities Easy-PhotoPrint EX (HKLM\...\Easy-PhotoPrint EX) (Version: - )
Canon Utilities Solution Menu (HKLM\...\CanonSolutionMenu) (Version: - )
Chicken Invaders 2 (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110209593}) (Version: - Oberon Media)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
ebi.BookReader3J (HKLM\...\{F3D2DEDC-4732-4188-8A3A-1A3FFBD4D6C8}) (Version: 3.75.14 - eBOOK Initiative Japan Co., Ltd.)
E-Cam (HKLM\...\{185AFA7A-F63E-450B-94AA-011CAC18090E}) (Version: 2.0.2.3 - )
Eee Docking 3.6.0 (HKLM\...\Eee Docking_is1) (Version: 3.6.0 - ASUSTek Computer Inc.)
EeeSplendid (HKLM\...\{6333FC29-BFE5-4024-AC78-958A1A7555D1}) (Version: 5.1.2.0008 - ASUS)
EeeSplendid (Version: 5.1.2.0008 - ASUS) Hidden
FontResizer (HKLM\...\InstallShield_{17780F99-A9DF-450B-81B3-6781B20A17A8}) (Version: 1.01.0011 - ASUSTek)
FontResizer (Version: 1.01.0011 - ASUSTek) Hidden
Game Park Console (HKLM\...\{BB5E5F87-E939-4974-A006-2B4A2F60EEA3}_is1) (Version: 5.2.1.4 - Oberon Media, Inc.)
Hotkey Service (HKLM\...\{71C0E38E-09F2-4386-9977-404D4F6640CD}) (Version: 1.15 - AsusTek Computer)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.14.10.2117 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation)
LiveUpdate (HKLM\...\{38E5A3B1-ADF1-47E0-8024-76310A30EB36}) (Version: 1.19 - Asus)
LocaleMe (HKLM\...\{F58C1D44-4AC9-48E8-9049-7A6CDFCB415C}) (Version: 1.3 - ASUS)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0100-040C-0000-0000000FF1CE}_OMUI.fr-fr_{CF3C20A6-47B7-48DA-95C1-6FBB5A439AF8}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0100-0410-0000-0000000FF1CE}_OMUI.it-it_{7F40286D-09A7-4DC0-A2A4-AA18D026D369}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0100-0413-0000-0000000FF1CE}_OMUI.nl-nl_{26257879-B20D-4D30-A429-B387A4890929}) (Version: - Microsoft)
Microsoft Office Excel 2007 Help - Aggiornamento (KB963678) (HKLM\...\{90120000-0016-0410-0000-0000000FF1CE}_OMUI.it-it_{9F57BDED-B51B-4D2F-B360-5B4EFAAF0F1A}) (Version: - Microsoft)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Language Pack 2007 - Dutch/Nederlands (HKLM\...\OMUI.nl-nl) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Language Pack 2007 - French/Français (HKLM\...\OMUI.fr-fr) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Language Pack 2007 - German/Deutsch (HKLM\...\OMUI.de-de) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Language Pack 2007 - Italian/Italiano (HKLM\...\OMUI.it-it) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Outlook 2007 Help - Aggiornamento (KB963677) (HKLM\...\{90120000-001A-0410-0000-0000000FF1CE}_OMUI.it-it_{2278E02A-AB15-4BF7-B2B4-5C0EEB4B7EEB}) (Version: - Microsoft)
Microsoft Office Powerpoint 2007 Help - Aggiornamento (KB963669) (HKLM\...\{90120000-0018-0410-0000-0000000FF1CE}_OMUI.it-it_{C76C02F1-B07F-4974-876A-A18DEC9887C8}) (Version: - Microsoft)
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2007 (HKLM\...\PROPLUS) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Word 2007 Help - Aggiornamento (KB963665) (HKLM\...\{90120000-001B-0410-0000-0000000FF1CE}_OMUI.it-it_{E5B82DB3-DD7D-4C45-BC5E-09864B26F9BC}) (Version: - Microsoft)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Mise à jour Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-040C-0000-0000000FF1CE}_OMUI.fr-fr_{B761869A-B85C-40E2-994C-A1CE78AC8F2C}) (Version: - Microsoft)
Mise à jour Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-040C-0000-0000000FF1CE}_OMUI.fr-fr_{51EFB347-1F3D-4BAC-8B79-F056B904FE21}) (Version: - Microsoft)
Mise à jour Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-040C-0000-0000000FF1CE}_OMUI.fr-fr_{C3DCA38E-005E-41BA-A52A-7C3429F351C3}) (Version: - Microsoft)
Mise à jour Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-040C-0000-0000000FF1CE}_OMUI.fr-fr_{81536A04-DBFB-4DB3-978F-0F284590C223}) (Version: - Microsoft)
Mozilla Firefox 7.0.1 (x86 de) (HKLM\...\Mozilla Firefox 7.0.1 (x86 de)) (Version: 7.0.1 - Mozilla)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
Ralink RT2860 Wireless LAN Card (HKLM\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309B0}) (Version: 1.2.0.1 - Ralink)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5948 - Realtek Semiconductor Corp.)
Skype web features (HKLM\...\{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}) (Version: 1.0.3971 - Skype Technologies S.A.)
Skype™ 6.11 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Super Hybrid Engine (HKLM\...\{88F08F98-12BC-4613-81A2-8F9B88CFC73E}) (Version: 2.10 - AsusTek Computer)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 13.2.6.1 - Synaptics Incorporated)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_OMUI.de-de_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_PROPLUS_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_PROPLUS_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_OMUI.de-de_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_PROPLUS_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_OMUI.de-de_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_PROPLUS_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
Update voor Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0413-0000-0000000FF1CE}_OMUI.nl-nl_{5CF7002F-6F49-4482-9564-5614FBE560FA}) (Version: - Microsoft)
Update voor Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0413-0000-0000000FF1CE}_OMUI.nl-nl_{15D84E79-1ED7-42C5-B2FD-745C3FBDDDC5}) (Version: - Microsoft)
Update voor Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0413-0000-0000000FF1CE}_OMUI.nl-nl_{A66AE6A1-8D8C-4102-BC18-38CBDE40F809}) (Version: - Microsoft)
Windows Driver Package - Broadcom Bluetooth (07/17/2009 6.2.0.9403) (HKLM\...\B41C7C96D83162A676DA7365ADEFD6C1AF62A4EE) (Version: 07/17/2009 6.2.0.9403 - Broadcom)
Windows Driver Package - Broadcom Bluetooth (07/29/2009 6.1.7100.0) (HKLM\...\B5C82F3814F82FB37F1513B3185399BD88892B08) (Version: 07/29/2009 6.1.7100.0 - Broadcom)
Windows Driver Package - Broadcom HIDClass (07/28/2009 6.2.0.9800) (HKLM\...\BF20603967CFDCB2BBF91950E8A56DFBC5C833FE) (Version: 07/28/2009 6.2.0.9800 - Broadcom)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
26-09-2014 10:40:03 Windows Update
27-09-2014 06:39:56 Windows Update
05-10-2014 05:18:44 Windows Update
06-10-2014 18:44:55 Windows Update
22-10-2014 15:25:15 Windows Update
24-10-2014 07:35:54 Windows Update
03-11-2014 07:02:49 Windows Update
03-11-2014 07:18:42 Windows Update
27-11-2014 13:05:50 Removed Adobe Reader 9.5.5 MUI.
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {C4FBF6D9-661D-49FA-8AC5-34203AA420E7} - System32\Tasks\Adobe Flash Player Updater => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-10-22] (Adobe Systems Incorporated)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2010-01-06 22:47 - 2009-08-19 02:35 - 00219136 _____ () C:\Windows\System32\AsusService.exe
2010-01-06 23:49 - 2009-09-15 02:05 - 00044312 _____ () C:\Program Files\Asus\Game Park\GameConsole\OberonGameConsoleService.exe
2010-01-06 23:30 - 2009-12-30 00:28 - 00104960 _____ () C:\Program Files\ASUS\EPC\EeeSplendid\AsAgent.exe
2009-08-28 00:38 - 2009-08-28 00:38 - 00803304 _____ () C:\Program Files\Asus\LiveUpdate\LiveUpdate.exe
2009-08-28 00:45 - 2009-08-28 00:45 - 00120808 _____ () C:\Program Files\Asus\LiveUpdate\ClientSocket.dll
2009-08-28 01:29 - 2009-08-28 01:29 - 00182240 _____ () C:\Program Files\Asus\LiveUpdate\Parser.dll
2009-08-28 01:22 - 2009-08-28 01:22 - 00161768 _____ () C:\Program Files\Asus\LiveUpdate\Enumeration.dll
2010-01-06 23:16 - 2009-11-17 22:47 - 00414384 _____ () C:\Program Files\Asus\Eee Docking\Eee Docking.exe
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: NcpBudgetGui => "C:\Program Files\WatchGuard\Mobile VPN\NcpBudgetGui.exe" -start
MSCONFIG\startupreg: NcpMonitor => "C:\Program Files\WatchGuard\Mobile VPN\ncpmon.exe" autorun
MSCONFIG\startupreg: NcpPopup => "C:\Program Files\WatchGuard\Mobile VPN\ncppopup.exe" noerrmsg
MSCONFIG\startupreg: NcpRsuGui => "C:\Program Files\WatchGuard\Mobile VPN\rwsrsu.exe" -gui
========================= Accounts: ==========================
Administrator (S-1-5-21-2771088097-4119805611-136013659-500 - Administrator - Disabled)
Gast (S-1-5-21-2771088097-4119805611-136013659-501 - Limited - Disabled)
Nils (S-1-5-21-2771088097-4119805611-136013659-1000 - Administrator - Enabled) => C:\Users\Nils
Test (S-1-5-21-2771088097-4119805611-136013659-1002 - Administrator - Enabled) => C:\Users\Test
==================== Faulty Device Manager Devices =============
Name: Canon MX700 ser Network
Description: Canon MX700 ser Network
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Canon
Service: StillCam
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
System errors:
=============
Microsoft Office Sessions:
=========================
Error: (10/24/2014 08:38:48 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 16 seconds with 0 seconds of active time. This session ended with a crash.
==================== Memory info ===========================
Processor: Intel(R) Atom(TM) CPU N450 @ 1.66GHz
Percentage of memory in use: 32%
Total physical RAM: 2038.18 MB
Available physical RAM: 1384.99 MB
Total Pagefile: 4076.36 MB
Available Pagefile: 3387.78 MB
Total Virtual: 2047.88 MB
Available Virtual: 1934.37 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:80 GB) (Free:42.24 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:59.03 GB) (Free:48.97 GB) NTFS
Drive e: (Elements) (Fixed) (Total:931.48 GB) (Free:0.26 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149.1 GB) (Disk ID: 9F1192B6)
Partition 1: (Active) - (Size=80 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=59 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=10 GB) - (Type=1B)
Partition 4: (Not Active) - (Size=17 MB) - (Type=EF)
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 931.5 GB) (Disk ID: 52DD04D5)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
| Themen zu Netbook auf Virenbefall überprüfen |
| aufforderungen, befall, befallen, checken, ebenfalls, eingefangen, fehlercode 0x40000015, fehlercode 0xc0000005, fehlercode 22, fehlercode windows, gehackt, infektion, interne, internet, komplett, komplette, netzwerk, neuinstallation, posten, spammails, sparkasse, this device is disabled. (code 22), versucht, virenbefall, überprüfen |
Linear-Darstellung
