| |
| |||||||
Log-Analyse und Auswertung: Win7 64bit - Spyware.Zbot.ED bzw. HEUR/QVM03.0.Malware.Gen gefunden durch Malwarebytes bzw. 360 Internet SecurityWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
05.12.2014, 02:26
| #1 |
| |  Win7 64bit - Spyware.Zbot.ED bzw. HEUR/QVM03.0.Malware.Gen gefunden durch Malwarebytes bzw. 360 Internet Security Hallo zusammen, ich hab vor ein paar Stunden mit Malwarebytes etwas gefunden, was sich nicht entfernen lässt. In der Registry ist ein Eintrag, der sich auf eine exe-Datei in C:\ProgramData\******.exe bezieht. Wenn man den Eintrag und die Datei löscht, werden diese sofort wieder unter einem anderen 6-digit langen Namen erstellt.  Anbei die bisherigen Logs: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 05.12.2014 Scan Time: 00:57:38 Logfile: mbam_log_20141205_1.txt Administrator: Yes Version: 2.00.4.1028 Malware Database: v2014.12.04.11 Rootkit Database: v2014.12.03.01 License: Free Malware Protection: Disabled Malicious Website Protection: Disabled Self-protection: Disabled OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: FUL Scan Type: Threat Scan Result: Completed Objects Scanned: 370671 Time Elapsed: 5 min, 59 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 0 (No malicious items detected) Registry Values: 1 Spyware.Zbot.ED, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|cjsdbs, C:\ProgramData\cjsdbs.exe, , [cf0cbaa4225ad1655de67d17c73e9d63] Registry Data: 0 (No malicious items detected) Folders: 0 (No malicious items detected) Files: 1 Spyware.Zbot.ED, C:\ProgramData\cjsdbs.exe, , [cf0cbaa4225ad1655de67d17c73e9d63], Physical Sectors: 0 (No malicious items detected) (end) - Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03 -12-2014 Ran by FUL (administrator) on UX32VD on 05-12-2014 01:50:10 Running from C:\Users\FUL\Downloads Loaded Profiles: FUL & UpdatusUser (Available profiles: FUL & UpdatusUser) Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use- farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display \nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe () C:\Windows\SysWOW64\DptfParticipantProcessorService.exe () C:\Windows\SysWOW64\DptfPolicyConfigTDPService.exe (Diskeeper Corporation) C:\Program Files\Diskeeper Corporation \ExpressCache\ExpressCache.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client \HeciServer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (Samsung Electronics Co., Ltd.) C:\Windows\System32\RAPID \SamsungRapidSvc.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Rocket Division Software) C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Microsoft Corporation) C:\Windows\System32\alg.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus \USBChargerPlus.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package \ATKOSD2\ATKOSD2.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\RAPID \CacheFilter\SamsungRapidApp.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe (Canon Inc.) C:\Program Files (x86)\Canon\SELPHY Photo Print \CIC_SPPhelper.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Dropbox, Inc.) C:\Users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey \HControlUser.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files \Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe (CANON INC.) C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display \nvtray.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter \x64\AsusTPLoader.exe (ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe (ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe (AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter \x64\AsusTPCenter.exe (AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter \x64\AsusTPHelper.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Qihu 360 Software Co., Ltd.) C:\Program Files\360\360 Internet Security\deepscan\QHActiveDefense.exe (Qihu 360 Software Co., Ltd.) C:\Program Files\360\360 Internet Security\360sd.exe (Qihu 360 Software Co., Ltd.) C:\Program Files\360\360 Internet Security\360rp.exe (Qihu 360 Software Co., Ltd.) C:\Program Files\360\360 Internet Security\safemon\360Tray.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Microsoft Corporation) C:\Program Files\Internet Explorer \iexplore.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti- Malware\mbam.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [DptfPolicyLpmServiceHelper] => C:\Windows \SysWOW64\DptfPolicyLpmServiceHelper.exe HKLM\...\Run: [SamsungRapidApp] => C:\Program Files (x86)\Samsung \RAPID\CacheFilter\SamsungRapidApp.exe [109280 2013-07-29] (Samsung Electronics Co., Ltd.) HKLM\...\Run: [360sd] => C:\Program Files\360\360 Internet Security \360sdrun.exe [287560 2014-04-16] (Qihu 360 Software Co., Ltd.) HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-05-21] (Intel Corporation) HKLM-x32\...\Run: [ATKOSD2] => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [406328 2013-09-09] (ASUSTek Computer Inc.) HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [205624 2013-05-30] (ASUSTek Computer Inc.) HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files \Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41336 2014-05-08] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840568 2014-05-08] (Adobe Systems Inc.) HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2014-01-10] () HKLM-x32\...\Run: [IJNetworkScanUtility] => C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe [206240 2010-08 -24] (CANON INC.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation) HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes \iTunesHelper.exe [152392 2014-09-01] (Apple Inc.) HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.) HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] => C: \ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \mbamdor.exe [54072 2014-11-21] (Malwarebytes Corporation) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X] HKU\S-1-5-21-965061589-1977914162-274574225-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-08-07] (Apple Inc.) HKU\S-1-5-21-965061589-1977914162-274574225-1000\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple \Internet Services\ApplePhotoStreams.exe [43816 2014-08-14] (Apple Inc.) HKU\S-1-5-21-965061589-1977914162-274574225-1000\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive \googledrivesync.exe [22869088 2014-10-21] (Google) AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows \system32\nvinitx.dll [247144 2012-08-01] (NVIDIA Corporation) AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows \SysWOW64\nvinit.dll [202600 2012-08-01] (NVIDIA Corporation) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup \SELPHY Photo Print Launcher.lnk ShortcutTarget: SELPHY Photo Print Launcher.lnk -> C:\Program Files (x86)\Canon\SELPHY Photo Print\CIC_SPPhelper.exe (Canon Inc.) Startup: C:\Users\FUL\AppData\Roaming\Microsoft\Windows\Start Menu \Programs\Startup\CC-Bewegungen Europaeische Reisevers vsnr407019265DEU.pdf - Verknüpfung.lnk ShortcutTarget: CC-Bewegungen Europaeische Reisevers vsnr407019265DEU.pdf - Verknüpfung.lnk -> C:\Users\FUL\Desktop\CC- Bewegungen Europaeische Reisevers vsnr407019265DEU.pdf () Startup: C:\Users\FUL\AppData\Roaming\Microsoft\Windows\Start Menu \Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\FUL\AppData\Roaming\Dropbox \bin\Dropbox.exe (Dropbox, Inc.) BootExecute: autocheck autochk * sdnclean64.exe ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-965061589-1977914162-274574225-1000\Software\Microsoft \Internet Explorer\Main,Start Page = hxxp://www.google.de/ HKU\S-1-5-21-965061589-1977914162-274574225-1000\Software\Microsoft \Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com SearchScopes: HKLM-x32 -> DefaultScope value is missing. BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB- D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22- 42B3008E02FF} -> C:\Program Files\Microsoft Office \Office14\URLREDIR.DLL (Microsoft Corporation) BHO: SafeMon Class -> {B69F34DD-F0F9-42DC-9EDD-957187DA688D} -> C: \Program Files\360\360 Internet Security\safemon\safemon64.dll (Qihu 360 Software Co., Ltd.) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74- 9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB- D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f- 8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe \Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22- 42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office \Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Free Download Manager -> {CC59E0F9-7E43-44FA-9FAA- 8377850BF205} -> C:\Program Files (x86)\Free Download Manager \iefdm2.dll (FreeDownloadManager.ORG) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74- 9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX \AcroIEFavClient.dll (Adobe Systems Incorporated) Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX \AcroIEFavClient.dll (Adobe Systems Incorporated) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\FUL\AppData\Roaming\Mozilla\Firefox\Profiles \15j8bd6f.default FF NetworkProxy: "socks_remote_dns", true FF NetworkProxy: "type", 0 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed \Flash\NPSWF64_15_0_0_239.dll () FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files \Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files \Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C: \PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed \Flash\NPSWF32_15_0_0_239.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components \IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C: \Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT \npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C: \PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C: \PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.) FF Extension: Avira Browser Safety - C:\Users\FUL\AppData\Roaming \Mozilla\Firefox\Profiles\15j8bd6f.default\Extensions\abs@avira.com [2014-11-20] FF Extension: FoxyProxy Standard - C:\Users\FUL\AppData\Roaming \Mozilla\Firefox\Profiles\15j8bd6f.default\Extensions \foxyproxy@eric.h.jung [2014-09-07] FF Extension: DownloadHelper - C:\Users\FUL\AppData\Roaming\Mozilla \Firefox\Profiles\15j8bd6f.default\Extensions\{b9db16a4-6edc-47ec- a1f4-b86292ed211d} [2014-09-07] FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe \Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2014-03-26] FF Extension: Free Download Manager plugin - C:\ProgramData\Free Download Manager\Firefox\Extensions\1.6.0.8 [2014-11-23] FF Extension: No Name - web2pdfextension@web2pdf.adobedotcom [Not Found] FF Extension: No Name - fdm_ffext@freedownloadmanager.org [Not Found] Chrome: ======= CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S2 360rp; C:\Program Files\360\360 Internet Security\360rps.exe [310352 2014-04-16] (Qihu 360 Software Co., Ltd.) R2 DptfParticipantProcessorService; C:\Windows \SysWOW64\DptfParticipantProcessorService.exe [18944 2012-02-20] () R2 DptfPolicyConfigTDPService; C:\Windows \SysWOW64\DptfPolicyConfigTDPService.exe [19968 2012-02-20] () R2 ExpressCache; C:\Program Files\Diskeeper Corporation\ExpressCache \ExpressCache.exe [79664 2012-03-30] (Diskeeper Corporation) R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation) S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin \iumsvc.exe [174368 2014-02-28] () R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation) R2 SamsungRapidSvc; C:\Windows\System32\RAPID\SamsungRapidSvc.exe [27360 2013-07-29] (Samsung Electronics Co., Ltd.) S3 scan; C:\Program Files\360\360 Internet Security\scan.dll [420424 2014-04-25] (S.C. BitDefender S.R.L) R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.) R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.) R2 StarWindServiceAE; C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [275968 2007-05-28] (Rocket Division Software) [File not signed] R2 ZhuDongFangYu; C:\Program Files\360\360 Internet Security\deepscan \QHActiveDefense.exe [236360 2014-04-23] (Qihu 360 Software Co., Ltd.) S4 AntiVirWebService; "C:\Program Files (x86)\Avira\AntiVir Desktop \avwebg7.exe" [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R1 360AntiHacker; C:\Windows\System32\Drivers\360AntiHacker64.sys [97872 2014-04-21] (Qihu 360 Software Co., Ltd.) R3 360AvFlt; C:\Windows\System32\DRIVERS\360AvFlt.sys [67664 2014-04- 23] (Qihu 360 Software Co., Ltd.) R1 360Box64; C:\Windows\System32\DRIVERS\360Box64.sys [305744 2014-04 -29] (Qihu 360 Software Co., Ltd.) S1 360Camera; C:\Windows\System32\Drivers\360Camera64.sys [41552 2014 -04-29] (Qihu 360 Software Co., Ltd.) R1 360fsflt; C:\Windows\System32\DRIVERS\360FsFlt.sys [304208 2014-05 -07] (Qihu 360 Software Co., Ltd.) R3 ATP; C:\Windows\System32\DRIVERS\AsusTP.sys [65784 2013-02-06] (ASUS Corporation) S3 AX88772B; C:\Windows\System32\DRIVERS\ax88772b.sys [110592 2012-04 -05] (ASIX Electronics Corp.) U1 BAPIDRV; C:\Windows\System32\DRIVERS\BAPIDRV64.sys [180816 2014-04 -18] (Qihu 360 Software Co., Ltd.) R3 DptfDevDram; C:\Windows\System32\DRIVERS\DptfDevDram.sys [107288 2012-02-20] (Intel Corporation) R3 DptfDevFan; C:\Windows\System32\DRIVERS\DptfDevFan.sys [42776 2012 -02-20] (Intel Corporation) R3 DptfDevGen; C:\Windows\System32\DRIVERS\DptfDevGen.sys [64792 2012 -02-20] (Intel Corporation) R3 DptfDevPch; C:\Windows\System32\DRIVERS\DptfDevPch.sys [96024 2012 -02-20] (Intel Corporation) R3 DptfDevProc; C:\Windows\System32\DRIVERS\DptfDevProc.sys [220952 2012-02-20] (Intel Corporation) R3 DptfManager; C:\Windows\System32\DRIVERS\DptfManager.sys [357656 2012-02-20] (Intel Corporation) R1 excfs; C:\Windows\System32\DRIVERS\excfs.sys [23344 2012-03-30] (Diskeeper Corporation) R0 excsd; C:\Windows\System32\DRIVERS\excsd.sys [95024 2012-03-30] (Diskeeper Corporation) R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28656 2013-03-25] (Intel Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-05] (Malwarebytes Corporation) U0 oiuexy; C:\Windows\System32\drivers\xppby.sys [79064 2014-12-05] (Malwarebytes Corporation) R0 SamsungRapidDiskFltr; C:\Windows\System32\DRIVERS \SamsungRapidDiskFltr.sys [240864 2013-07-29] (Samsung Electronics Co., Ltd.) R0 SamsungRapidFSFltr; C:\Windows\System32\DRIVERS \SamsungRapidFSFltr.sys [111328 2013-07-29] (Samsung Electronics Co., Ltd.) S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.) R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-03-26] (Duplex Secure Ltd.) R1 UimBus; C:\Windows\System32\DRIVERS\UimBus.sys [102664 2014-01-23] () R1 Uim_DEVIM; C:\Windows\System32\DRIVERS\uim_devim.sys [25992 2014- 01-23] () R1 Uim_IM; C:\Windows\System32\DRIVERS\uim_im.sys [700680 2014-01-23] () U3 ahkhhxz2; C:\Windows\System32\Drivers\ahkhhxz2.sys [0 ] (Advanced Micro Devices) S1 {2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64; system32\drivers \{2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-05 01:50 - 2014-12-05 01:50 - 00021716 _____ () C:\Users\FUL \Downloads\FRST.txt 2014-12-05 01:50 - 2014-12-05 01:50 - 00000000 ____D () C:\FRST 2014-12-05 01:49 - 2014-12-05 01:49 - 02117632 _____ (Farbar) C: \Users\FUL\Downloads\FRST64.exe 2014-12-05 01:49 - 2014-12-05 01:49 - 00000000 ____D () C:\Users\FUL \Desktop\trojanerboard 2014-12-05 01:11 - 2014-12-05 01:11 - 00143360 _____ (1999-2010 White Shift HatIt Kream) C:\ProgramData\djsdbs.exe 2014-12-05 01:09 - 2014-12-05 01:09 - 00050477 _____ () C:\Users\FUL \Downloads\Defogger.exe 2014-12-05 01:04 - 2014-12-05 01:04 - 00079064 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\xppby.sys 2014-12-05 00:57 - 2009-06-10 22:00 - 00000824 _____ () C:\Windows \system32\Drivers\etc\hosts.20141205-005700.backup 2014-12-05 00:39 - 2014-05-14 10:40 - 00022992 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\efimon.sys 2014-12-05 00:38 - 2014-12-05 01:49 - 00000000 ____D () C:\Users\FUL \AppData\Roaming\360safe 2014-12-05 00:38 - 2014-12-05 00:38 - 00000974 _____ () C:\Users \Public\Desktop\360 Internet Security.lnk 2014-12-05 00:38 - 2014-12-05 00:38 - 00000000 _RSHD () C:\360SANDBOX 2014-12-05 00:38 - 2014-12-05 00:38 - 00000000 ____D () C:\Users\FUL \AppData\Roaming\360SD 2014-12-05 00:38 - 2014-12-05 00:38 - 00000000 ____D () C: \ProgramData\Microsoft\Windows\Start Menu\Programs\360 Internet Security 2014-12-05 00:38 - 2014-12-05 00:38 - 00000000 ____D () C: \ProgramData\360SD 2014-12-05 00:38 - 2014-12-05 00:38 - 00000000 ____D () C:\Program Files\360 2014-12-05 00:38 - 2014-05-07 10:44 - 00304208 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\360FsFlt.sys 2014-12-05 00:38 - 2014-04-29 07:20 - 00305744 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\360Box64.sys 2014-12-05 00:38 - 2014-04-29 04:50 - 00041552 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\360Camera64.sys 2014-12-05 00:38 - 2014-04-23 09:32 - 00067664 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\360AvFlt.sys 2014-12-05 00:38 - 2014-04-21 07:38 - 00097872 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\360AntiHacker64.sys 2014-12-05 00:38 - 2014-04-18 07:42 - 00180816 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\BAPIDRV64.SYS 2014-12-05 00:18 - 2014-12-05 00:18 - 00000753 _____ () C:\Users\FUL \Desktop\JRT.txt 2014-12-05 00:13 - 2014-12-05 00:13 - 00000000 ____D () C:\Windows \ERUNT 2014-12-05 00:06 - 2014-12-05 00:13 - 00000000 ____D () C: \ProgramData\HitmanPro 2014-12-04 23:55 - 2014-12-05 00:03 - 00000000 ____D () C:\AdwCleaner 2014-12-04 22:41 - 2014-12-04 22:41 - 00000000 ____D () C:\OETemp 2014-12-04 22:40 - 2014-12-04 22:40 - 00000000 _____ () C: \ProgramData\rebootpending.txt 2014-12-04 22:36 - 2014-12-05 00:54 - 00000000 ____D () C: \ProgramData\Spybot - Search & Destroy 2014-12-04 22:36 - 2014-12-04 22:39 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2 2014-12-04 22:36 - 2014-12-04 22:36 - 00001391 _____ () C: \ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk 2014-12-04 22:36 - 2014-12-04 22:36 - 00001379 _____ () C:\Users \Public\Desktop\Spybot-S&D Start Center.lnk 2014-12-04 22:36 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe 2014-12-04 22:34 - 2014-12-04 22:38 - 168558440 _____ (Qihu 360 Software Co., Ltd.) C:\Users\FUL\Downloads\360is_4.9.0.4902H.exe 2014-12-04 13:53 - 2014-12-05 00:57 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-12-04 13:52 - 2014-12-04 13:52 - 00001102 _____ () C:\Users \Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-12-04 13:52 - 2014-12-04 13:52 - 00000000 ____D () C: \ProgramData\Malwarebytes 2014-12-04 13:52 - 2014-12-04 13:52 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-12-04 13:52 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-12-04 13:52 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-12-04 13:52 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-12-04 13:41 - 2014-12-04 13:42 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\FUL\Downloads\spybot-2.4.exe 2014-12-04 13:40 - 2014-12-04 13:40 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\FUL\Downloads\mbam-setup-2.0.4.1028.exe 2014-12-02 23:41 - 2014-12-02 23:43 - 57358008 _____ (ZONER software ) C:\Users\FUL\Downloads\zps16_de_pro_chip.exe 2014-12-02 20:23 - 2014-12-02 20:23 - 00026729 _____ () C:\Users\FUL \Downloads\Bluewolf495-40.rec[https___truestracker.de].torrent 2014-12-02 20:23 - 2014-12-02 20:23 - 00026729 _____ () C:\Users\FUL \Downloads\Bluewolf495-39.rec[https___truestracker.de].torrent 2014-12-02 20:23 - 2014-12-02 20:23 - 00026529 _____ () C:\Users\FUL \Downloads\Bluewolf438-44.rec[https___truestracker.de].torrent 2014-12-02 20:22 - 2014-12-02 20:22 - 00028189 _____ () C:\Users\FUL \Downloads\Bluewolf596-13.rec[https___truestracker.de].torrent 2014-12-02 20:22 - 2014-12-02 20:22 - 00028168 _____ () C:\Users\FUL \Downloads\Bluewolf596-7.rec[https___truestracker.de].torrent 2014-12-02 20:22 - 2014-12-02 20:22 - 00028028 _____ () C:\Users\FUL \Downloads\Bluewolf596-8.rec[https___truestracker.de].torrent 2014-12-02 20:22 - 2014-12-02 20:22 - 00028009 _____ () C:\Users\FUL \Downloads\Bluewolf596-14.rec[https___truestracker.de].torrent 2014-12-02 20:22 - 2014-12-02 20:22 - 00027950 _____ () C:\Users\FUL \Downloads\Bluewolf596-8-2.rec[https___truestracker.de].torrent 2014-12-02 20:22 - 2014-12-02 20:22 - 00026669 _____ () C:\Users\FUL \Downloads\Bluewolf438-42.rec[https___truestracker.de].torrent 2014-12-02 20:22 - 2014-12-02 20:22 - 00026489 _____ () C:\Users\FUL \Downloads\Bluewolf438-41.rec[https___truestracker.de].torrent 2014-12-02 20:22 - 2014-12-02 20:22 - 00026349 _____ () C:\Users\FUL \Downloads\Bluewolf438-43.rec[https___truestracker.de].torrent 2014-12-02 16:27 - 2014-12-02 16:27 - 02996728 _____ (Crystal Dew World ) C:\Users\FUL\Downloads\CrystalDiskInfo6_2_1.exe 2014-12-02 16:27 - 2014-12-02 16:27 - 00001186 _____ () C:\Users\FUL \Desktop\CrystalDiskInfo.lnk 2014-12-02 16:27 - 2014-12-02 16:27 - 00000000 ____D () C:\Program Files (x86)\CrystalDiskInfo 2014-12-02 15:14 - 2014-12-02 15:19 - 00000000 ____D () C:\Users\FUL \Desktop\FireTV 2014-12-01 14:12 - 2014-12-01 14:27 - 00000000 ____D () C:\Users\FUL \AppData\Local\Amazon_FireTV_Utility_App 2014-12-01 14:11 - 2014-12-01 14:11 - 00000000 ____D () C:\Users\FUL \.android 2014-11-30 16:19 - 2014-11-30 16:19 - 00000263 _____ () C:\Users\FUL \Desktop\Musterschreiben%20R%C3%BCckforderung %20Bearbeitungsentgelt_207294.log 2014-11-26 22:04 - 2014-11-26 22:04 - 00035849 _____ () C:\Users\FUL \Downloads\Bluewolf494-22.rec[https___truestracker.de].torrent 2014-11-26 22:04 - 2014-11-26 22:04 - 00027048 _____ () C:\Users\FUL \Downloads\Bluewolf600.rec[https___truestracker.de].torrent 2014-11-24 23:48 - 2014-11-24 23:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-11-08 21:27 - 2014-11-08 21:27 - 00000000 ____D () C:\Users \Default\AppData\Local\Google 2014-11-08 21:27 - 2014-11-08 21:27 - 00000000 ____D () C:\Users \Default User\AppData\Local\Google 2014-11-07 08:35 - 2014-11-07 08:35 - 01054912 _____ (Adobe) C:\Users \FUL\Downloads\install_flashplayer15x32au_mssd_aaa_aih.exe ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-05 01:49 - 2014-06-12 10:51 - 00000884 _____ () C:\Windows \Tasks\Adobe Flash Player Updater.job 2014-12-05 01:10 - 2014-03-24 22:11 - 00000000 ____D () C:\Users\FUL \AppData\Local\VirtualStore 2014-12-05 01:04 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows \Registration 2014-12-05 00:51 - 2014-03-28 14:12 - 00001110 _____ () C:\Windows \Tasks\GoogleUpdateTaskMachineUA.job 2014-12-05 00:44 - 2014-03-25 07:06 - 00709888 _____ () C:\Windows \system32\perfh007.dat 2014-12-05 00:44 - 2014-03-25 07:06 - 00153014 _____ () C:\Windows \system32\perfc007.dat 2014-12-05 00:44 - 2009-07-14 06:13 - 01626984 _____ () C:\Windows \system32\PerfStringBackup.INI 2014-12-05 00:42 - 2009-07-14 05:45 - 00026720 ____H () C:\Windows \system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289- 439d-8115-601632D005A0 2014-12-05 00:42 - 2009-07-14 05:45 - 00026720 ____H () C:\Windows \system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289- 439d-8115-601632D005A0 2014-12-05 00:40 - 2014-03-25 22:39 - 00000000 ___RD () C:\Users\FUL \Desktop\Dropbox 2014-12-05 00:40 - 2014-03-25 22:36 - 00000000 ____D () C:\Users\FUL \AppData\Roaming\Dropbox 2014-12-05 00:39 - 2014-09-23 11:37 - 00000000 ___RD () C:\Users\FUL \Desktop\Google Drive 2014-12-05 00:38 - 2014-03-24 22:12 - 01293902 _____ () C:\Windows \WindowsUpdate.log 2014-12-05 00:37 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows \system32\sysprep 2014-12-05 00:36 - 2014-03-28 14:12 - 00001106 _____ () C:\Windows \Tasks\GoogleUpdateTaskMachineCore.job 2014-12-05 00:35 - 2014-03-26 12:20 - 00000433 _____ () C:\Windows \system32\Drivers\etc\hosts.ics 2014-12-05 00:35 - 2014-03-25 09:47 - 00000000 ____D () C: \ProgramData\NVIDIA 2014-12-05 00:35 - 2010-11-21 04:47 - 00240388 _____ () C:\Windows \PFRO.log 2014-12-05 00:35 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows \Tasks\SA.DAT 2014-12-05 00:35 - 2009-07-14 05:51 - 00044551 _____ () C:\Windows \setupact.log 2014-12-05 00:35 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows \schemas 2014-12-05 00:05 - 2014-05-25 10:04 - 00000000 ____D () C:\Users\FUL \Downloads\Malware remover 2014-12-04 23:48 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Vss 2014-12-04 22:41 - 2014-03-25 09:23 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-12-04 22:36 - 2009-07-14 04:20 - 00000000 ___RD () C: \ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools 2014-12-04 16:48 - 2014-03-24 22:11 - 00000000 ____D () C:\Users\FUL 2014-12-04 15:16 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows \system 2014-12-04 15:15 - 2014-03-27 16:13 - 00000000 ____D () C:\Users\FUL \AppData\Roaming\vlc 2014-12-04 12:02 - 2012-08-30 14:04 - 00000000 ____D () C:\Users\FUL \Documents\Outlook-Dateien 2014-12-04 12:00 - 2014-03-28 23:38 - 00000000 ____D () C:\Users\FUL \AppData\Local\4610B230-FA09-4F6C-BD9C-AE65706B9057.aplzod 2014-12-02 18:18 - 2014-03-28 10:37 - 00038912 _____ () C:\Users\FUL \AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-12-02 18:18 - 2014-03-28 10:28 - 00000000 ____D () C:\Users\FUL \AppData\Local\ColdCut 2014-12-02 18:00 - 2014-03-20 11:28 - 00000000 ____D () C:\Users\FUL \Desktop\UDOO 2014-12-01 14:26 - 2014-04-27 11:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-11-30 16:22 - 2014-04-26 14:20 - 00000000 ____D () C:\Users\FUL \AppData\Roaming\Free Download Manager 2014-11-25 23:49 - 2014-06-12 10:51 - 00003822 _____ () C:\Windows \System32\Tasks\Adobe Flash Player Updater 2014-11-25 23:49 - 2014-03-26 12:18 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-11-25 23:49 - 2014-03-26 12:18 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-11-24 19:02 - 2014-03-25 22:53 - 00000000 ____D () C:\Users\FUL \AppData\Roaming\uTorrent 2014-11-18 15:08 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows \system32\FxsTmp 2014-11-18 10:46 - 2014-03-28 14:12 - 00004106 _____ () C:\Windows \System32\Tasks\GoogleUpdateTaskMachineUA 2014-11-18 10:46 - 2014-03-28 14:12 - 00003854 _____ () C:\Windows \System32\Tasks\GoogleUpdateTaskMachineCore 2014-11-13 11:07 - 2014-03-28 09:27 - 00000000 ____D () C:\Users\FUL \AppData\Local\Apple Computer 2014-11-13 04:48 - 2014-09-23 18:31 - 00000000 ____D () C:\Users\FUL \Desktop\iPad mini Backup 2014.09.23 2014-11-10 09:59 - 2013-08-23 11:36 - 00000000 ____D () C:\Users\FUL \Documents\#Vorlagen 2014-11-08 21:28 - 2014-09-23 11:36 - 00000000 ____D () C: \ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive Files to move or delete: ==================== C:\ProgramData\djsdbs.exe Some content of TEMP: ==================== C:\Users\FUL\AppData\Local\Temp\avgnt.exe C:\Users\FUL\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce- 5766-8f84-3e3e7ecf0d81}.tmpfpurdx.dll C:\Users\FUL\AppData\Local\Temp\JDSetup130429822500280238.exe C:\Users\FUL\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe C:\Users\FUL\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe C:\Users\FUL\AppData\Local\Temp\ose00000.exe C:\Users\FUL\AppData\Local\Temp\paint.net.4.0.3.install.exe C:\Users\FUL\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-12-05 01:29 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03
-12-2014
Ran by FUL at 2014-12-05 01:50:41
Running from C:\Users\FUL\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: 360 Internet Security (Enabled - Up to date) {2B66EE1E-E5C8-C2F7-
648F-4E55AC68D37D}
AS: 360 Internet Security (Enabled - Up to date) {90070FFA-C3F2-CD79-
5E3F-7527D7EF99C0}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44
-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-
3CCA-732D-A930-C1CA5F20A4B0}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the
fixlist to unhide them. The adware programs should be uninstalled
manually.)
360 Internet Security (HKLM-x32\...\360 Internet Security) (Version:
4.9.0.4902 - Qihu 360 Software Co., Ltd.)
Adobe Acrobat X Pro - English, Français, Deutsch (HKLM-x32\...
\{AC76BA86-1033-F400-7760-000000000005}) (Version: 10.1.10 - Adobe
Systems)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 13.0.0.111 - Adobe
Systems Incorporated)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player
ActiveX) (Version: 15.0.0.239 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin)
(Version: 15.0.0.239 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-
7C0453561701}) (Version: 3.0.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{B678797F-DF38-4556-8A31-
8B818E261868}) (Version: 8.0.0.23 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-
F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ASUS Smart Gesture (HKLM-x32\...\{4D3286A6-F6AB-498A-82A4-
E4F040529F3D}) (Version: 2.0.1 - ASUS)
ASUS USB Charger Plus (HKLM-x32\...\{A859E3E5-C62F-4BFA-AF1D-
2B95E03166AF}) (Version: 2.1.4 - ASUS)
ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE})
(Version: 1.0.0031 - ASUS)
AX88772B Windows 7 Drivers (HKLM-x32\...\InstallShield_{54A168C9-2250
-4058-80EB-1F4A4192548A}) (Version: 1.0.2.0 - ASIX Electronics
Corporation)
AX88772B Windows 7 Drivers (x32 Version: 1.0.2.0 - ASIX Electronics
Corporation) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version:
3.0.0.10 - Apple Inc.)
Canon IJ Network Scan Utility (HKLM-x32\...
\Canon_IJ_Network_Scan_UTILITY) (Version: - )
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY)
(Version: 3.1.1 - Canon Inc.)
Canon MG6100 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-
FFDB8040B7BF}_Canon_MG6100_series) (Version: - Canon Inc.)
Canon MP Navigator EX 4.0 (HKLM-x32\...\MP Navigator EX 4.0) (Version:
- )
Canon SELPHY CP800 (HKLM\...\Canon SELPHY CP800) (Version: - )
Canon Utilities SELPHY Photo Print (HKLM-x32\...\SELPHY Photo Print)
(Version: 1.2.0.7 - Canon Inc.)
Canon Utilities SELPHY Print Contents 1.1.0 (HKLM-x32\...\SELPHY Print
Contents 110) (Version: 1.1.0.16 - Canon Inc.)
CPUID CPU-Z 1.69 (HKLM\...\CPUID CPU-Z_is1) (Version: - )
CrystalDiskInfo 6.2.1 (HKLM-x32\...\CrystalDiskInfo_is1) (Version:
6.2.1 - Crystal Dew World)
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.100 - DivX, LLC)
Dropbox (HKU\S-1-5-21-965061589-1977914162-274574225-1000\...\Dropbox)
(Version: 2.10.52 - Dropbox, Inc.)
ExpressCache (HKLM\...\{FF607B1F-A78B-4F1D-BC8E-6C2AB3B75405})
(Version: 1.0.87 - Diskeeper Corporation)
ffdshow [rev 2946] [2009-05-15] (HKLM-x32\...\ffdshow_is1) (Version:
1.0 - )
ffdshow x64 v1.3.4500 [2013-01-06] (HKLM\...\ffdshow64_is1) (Version:
1.3.4500.0 - )
Free Download Manager 3.9.3 (HKLM-x32\...\Free Download Manager_is1)
(Version: - FreeDownloadManager.ORG)
Google Calendar Sync (HKLM-x32\...\Google Calendar Sync) (Version: -
)
Google Drive (HKLM-x32\...\{C60F3836-333A-4AE2-B526-CFDBA143A9BA})
(Version: 1.18.7821.2489 - Google, Inc.)
Google Outlook Contact Sync 0.9.1.0 (HKLM-x32\...\{3D6E90E1-602D-48C8
-BBD2-28D1E183AE50}_is1) (Version: - Daniel Polistchuck)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
iCloud (HKLM\...\{6096C0CC-7E19-4355-87F0-627EC5AA146D}) (Version:
4.0.3.56 - Apple Inc.)
Intel(R) Dynamic Platform & Thermal Framework (HKLM-x32\...\FFD10ECE-
F715-4a86-9BD8-F6F47DA5DA1C) (Version: 6.0.1.1067 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-
43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-
B9AC9A5886EA}) (Version: 9.17.10.2828 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...
\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel
Corporation)
Intel(R) Update Manager (HKLM-x32\...\{12914061-EB9B-4AE7-AC7E-
0B8A607C7DF4}) (Version: 2.3.1338 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...
\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.5.235 - Intel
Corporation)
iTunes (HKLM\...\{F46AA0F1-E284-4878-A462-5F11B9166C0E}) (Version:
11.4.0.18 - Apple Inc.)
Java 7 Update 55 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-
2F86417055FF}) (Version: 7.0.550 - Oracle)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF})
(Version: 7.0.670 - Oracle)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...
\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes
Corporation)
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-
45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft
Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-
CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Professional 2010 (HKLM-x32\...\Office14.SingleImage)
(Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-
02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft
Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...
\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 -
Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-
x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 -
Microsoft Corporation)
Mozilla Firefox 33.1.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.1.1
(x86 de)) (Version: 33.1.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService)
(Version: 29.0.1 - Mozilla)
Mp3tag v2.59a (HKLM-x32\...\Mp3tag) (Version: v2.59a - Florian
Heidenreich)
NVIDIA 3D Vision Treiber 305.46 (HKLM\...\{B2FE1952-0186-46C3-BAEC-
A80AA35AC5B8}_Display.3DVision) (Version: 305.46 - NVIDIA Corporation)
NVIDIA Grafiktreiber 305.46 (HKLM\...\{B2FE1952-0186-46C3-BAEC-
A80AA35AC5B8}_Display.Driver) (Version: 305.46 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.12.0613 (HKLM\...\{B2FE1952-0186-46C3-
BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.0613 - NVIDIA
Corporation)
NVIDIA Update 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
_Display.Update) (Version: 1.10.8 - NVIDIA Corporation)
paint.net (HKLM\...\{F509C1F4-0029-49F9-B145-A4C4E8DF481A}) (Version:
4.0.3 - dotPDN LLC)
Paragon Backup & Recovery™ 2014 Free (HKLM\...\{C268B5E1-A5DA-11DF-
A289-005056C00008}) (Version: 90.00.0003 - Paragon Software)
Paragon Partition Manager™ 2014 Free (HKLM-x32\...\{47E5588F-C3A0-
11DE-9857-005056C00008}) (Version: 90.00.0003 - Paragon Software)
Passbild-Generator v4.0a (HKLM-x32\...\Passbild-Generator_is1)
(Version: - Passbild-Generator)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
RAPID Mode (Version: 1.0.1.42 - Samsung Electronics Co., Ltd.) Hidden
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-
1091A8127911}) (Version: 6.1.7601.39025 - Realtek Semiconductor Corp.)
Saal Design Software (HKLM-x32\...\SaalDesignSoftware) (Version:
3.2.30 - Saal Digital Fotoservice GmbH)
Saal Design Software (x32 Version: 3.2.30 - Saal Digital Fotoservice
GmbH) Hidden
Samsung Magician (HKLM-x32\...\{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}
_is1) (Version: 4.3.0 - Samsung Electronics)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition
(HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}
_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B})
(Version: - Microsoft)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-
FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VLC media player 2.1.4 (HKLM\...\VLC media player) (Version: 2.1.4 -
VideoLAN)
Windows-Treiberpaket - ASUS (ATP) Mouse (01/10/2013 1.0.0.170) (HKLM
\...\4A9DE1E9EBC800B7F01739D4DE7363EF6751BDF5) (Version: 01/10/2013
1.0.0.170 - ASUS)
WinRAR 5.01 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 -
win.rar GmbH)
==================== Custom CLSID (selected items):
==========================
(If an entry is included in the fixlist, it will be removed from
registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes
\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:
\Users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes
\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:
\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox,
Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes
\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:
\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox,
Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes
\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:
\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox,
Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes
\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:
\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox,
Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes
\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:
\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox,
Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes
\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:
\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox,
Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes
\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:
\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox,
Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes
\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:
\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox,
Inc.)
==================== Restore Points =========================
01-12-2014 13:55:28 Geplanter Prüfpunkt
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset
Hosts.)
2009-07-14 03:34 - 2014-12-05 00:57 - 00450771 ____R C:\Windows
\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com
There are 1000 more lines.
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from
registry. Any associated file could be listed separately to be moved.)
Task: {3F51DDB9-03FD-425D-9FBE-9871E08E0609} - System32\Tasks\ATKOSD2
=> C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [2013-
09-09] (ASUSTek Computer Inc.)
Task: {57440847-8931-4450-A8E6-89CA3200B9AD} - System32\Tasks\ASUS USB
Charger Plus => C:\Program Files (x86)\ASUS\USBChargerPlus
\USBChargerPlus.exe [2012-07-24] (ASUSTek Computer Inc.)
Task: {6883AAF1-063F-4CDD-A85C-0B05CD0F9660} - System32\Tasks\IUM-
F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel
\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
Task: {6EE8C071-A3CF-40E9-A891-017AEA220B66} - System32\Tasks
\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update
\GoogleUpdate.exe [2014-03-28] (Google Inc.)
Task: {A28E8D22-1470-49EF-9E80-CE024C8B15E8} - System32\Tasks\ASUS
Touchpad Launcher (x64) => C:\Program Files (x86)\ASUS\ASUS Smart
Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2013-02-06] (AsusTek)
Task: {C87CCA25-AC66-4726-91B6-E93A789FDBD5} - System32\Tasks\Adobe
Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash
\FlashPlayerUpdateService.exe [2014-11-25] (Adobe Systems
Incorporated)
Task: {D816101D-1253-48DA-ACF9-0FF69BD9DA3A} - System32\Tasks\IUM-
F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => C:\Program Files
(x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
Task: {E4B3F530-CCB5-418E-A57E-38547223F637} - System32\Tasks
\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update
\GoogleUpdate.exe [2014-03-28] (Google Inc.)
Task: {ED6F1B18-66E6-4706-9523-979356F19BCE} - System32\Tasks
\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start
osppsvc
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows
\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program
Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program
Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2014-03-25 09:47 - 2012-07-31 17:25 - 00086888 _____ () C:\Program
Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-03-25 09:17 - 2012-02-20 11:31 - 00018944 _____ () C:\Windows
\SysWOW64\DptfParticipantProcessorService.exe
2014-03-25 09:17 - 2012-02-20 11:31 - 00019968 _____ () C:\Windows
\SysWOW64\DptfPolicyConfigTDPService.exe
2014-03-25 09:16 - 2012-08-16 01:52 - 00094208 _____ () C:\Windows
\System32\IccLibDll_x64.dll
2014-01-10 06:26 - 2014-01-10 06:26 - 01861968 _____ () C:\Program
Files (x86)\DivX\DivX Update\DivXUpdate.exe
2014-02-12 20:58 - 2014-02-12 20:58 - 00073544 _____ () C:\Program
Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-12 20:58 - 2014-02-12 20:58 - 01044808 _____ () C:\Program
Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-12-04 22:36 - 2014-05-13 12:04 - 00109400 _____ () C:\Program
Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-12-04 22:36 - 2014-05-13 12:04 - 00416600 _____ () C:\Program
Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-12-04 22:36 - 2014-05-13 12:04 - 00167768 _____ () C:\Program
Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-12-04 22:36 - 2012-08-23 10:38 - 00574840 _____ () C:\Program
Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-12-04 22:36 - 2012-04-03 17:06 - 00565640 _____ () C:\Program
Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2006-10-31 17:53 - 2006-10-31 17:53 - 00270336 _____ () C:\Program
Files (x86)\Canon\SELPHY Photo Print\EnoJPEG4.dll
2014-12-05 00:36 - 2014-12-05 00:36 - 00043008 _____ () c:\users\ful
\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-
3e3e7ecf0d81}.tmpfpurdx.dll
2013-08-23 20:01 - 2013-08-23 20:01 - 25100288 _____ () C:\Users\FUL
\AppData\Roaming\Dropbox\bin\libcef.dll
2014-05-08 12:22 - 2014-05-08 12:22 - 00019968 _____ () C:\Program
Files (x86)\Adobe\Acrobat 10.0\Acrobat\locale\de_de\acrotray.deu
2014-01-10 06:28 - 2014-01-10 06:28 - 00100688 _____ () C:\Program
Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
2014-12-05 00:36 - 2014-12-05 00:36 - 00098816 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32api.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00110080 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\pywintypes27.dll
2014-12-05 00:36 - 2014-12-05 00:36 - 00364544 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\pythoncom27.dll
2014-12-05 00:36 - 2014-12-05 00:36 - 00045568 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\_socket.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 01160704 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\_ssl.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00320512 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32com.shell.shell.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00713216 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\_hashlib.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 01175040 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\wx._core_.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00805888 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\wx._gdi_.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00811008 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\wx._windows_.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 01062400 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\wx._controls_.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00735232 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\wx._misc_.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00128512 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\_elementtree.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00127488 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\pyexpat.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00557056 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\pysqlite2._sqlite.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00087552 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\_ctypes.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00119808 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32file.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00108544 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32security.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00007168 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\hashobjs_ext.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00167936 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32gui.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00018432 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32event.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00038912 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32inet.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00011264 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32crypt.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00070656 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\wx._html2.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00027136 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\_multiprocessing.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00035840 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32process.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00686080 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\unicodedata.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00122368 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\wx._wizard.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00024064 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32pipe.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00025600 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32pdh.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00525640 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\windows._lib_cacheinvalidation.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00010240 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\select.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00017408 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32profile.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00022528 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32ts.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00078336 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\wx._animate.pyd
2014-03-25 11:04 - 2012-06-25 10:41 - 01198912 _____ () C:\Program
Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2014-04-26 14:20 - 2013-10-25 20:58 - 00397312 _____ () C:\Program
Files (x86)\Free Download Manager\iefdmdm.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data
Streams will be removed.)
AlternateDataStreams: C:\Users\FUL\Desktop
\Bild.jpg:com.dropbox.attributes
AlternateDataStreams: C:\Users\FUL\Desktop
\IMG_3657.JPG:com.dropbox.attributes
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the
registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored.
None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-965061589-1977914162-274574225-500 -
Administrator - Disabled)
FUL (S-1-5-21-965061589-1977914162-274574225-1000 - Administrator -
Enabled) => C:\Users\FUL
Gast (S-1-5-21-965061589-1977914162-274574225-501 - Limited -
Disabled)
HomeGroupUser$ (S-1-5-21-965061589-1977914162-274574225-1002 - Limited
- Enabled)
UpdatusUser (S-1-5-21-965061589-1977914162-274574225-1003 - Limited -
Enabled) => C:\Users\UpdatusUser
==================== Faulty Device Manager Devices =============
Name: {2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64
Description: {2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: {2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64
Problem: : This device is not present, is not working properly, or
does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be
a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device,
and this error should be resolved.
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update
the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to
start the troubleshooting wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (12/05/2014 00:35:51 AM) (Source: WinMgmt) (EventID: 10) (User:
)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent
WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND
TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (12/05/2014 00:35:51 AM) (Source: Service Control Manager)
(EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist
fehlgeschlagen:
{2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64
Microsoft Office Sessions:
=========================
Error: (12/05/2014 00:35:51 AM) (Source: WinMgmt) (EventID: 10) (User:
)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent
WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND
TargetInstance.LoadPercentage > 990x80041003
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-3317U CPU @ 1.70GHz
Percentage of memory in use: 87%
Total physical RAM: 3981.57 MB
Available physical RAM: 481.2 MB
Total Pagefile: 4796.88 MB
Available Pagefile: 690.65 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:931.29 GB) (Free:184.89 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 059A1B33)
Partition: GPT Partition Type.
========================================================
Disk: 1 (Size: 22.4 GB) (Disk ID: 74F02DEA)
Partition 1: (Not Active) - (Size=22.4 GB) - (Type=73)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-12-05 02:52:00
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000079 ATA_____ rev.BB6Q 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\FUL\AppData\Local\Temp\pwldapob.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff80002fef000 45 bytes [00, 10, 00, 00, 00, 00, 00, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575 fffff80002fef02f 30 bytes [00, 00, 00, 00, 00, 00, 00, ...]
---- User code sections - GMER 2.1 ----
.text C:\Program Files\360\360 Internet Security\deepscan\QHActiveDefense.exe[1600] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files\360\360 Internet Security\deepscan\QHActiveDefense.exe[1600] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2324] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2324] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe[3088] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe[3088] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2632] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2632] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[4244] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[4244] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4360] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4360] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
? C:\Windows\system32\mssprxy.dll [4360] entry point in ".rdata" section 00000000731171e6
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[4484] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[4484] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4512] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4512] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe[3628] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe[3628] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files\360\360 Internet Security\360sdUpd.exe[4372] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files\360\360 Internet Security\360sdUpd.exe[4372] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Users\FUL\Downloads\Gmer-19357.exe[5608] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Users\FUL\Downloads\Gmer-19357.exe[5608] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
---- Devices - GMER 2.1 ----
Device \Driver\a79j3r5m \Device\Scsi\a79j3r5m1 fffffa8009a362c0
Device \FileSystem\Ntfs \Ntfs fffffa80043362c0
Device \FileSystem\fastfat \Fat fffffa8009df82c0
Device \Driver\iaStorA \Device\0000007a fffffa80043322c0
Device \Driver\usbehci \Device\USBPDO-1 fffffa80099b42c0
Device \Driver\iaStorA \Device\RaidPort0 fffffa80043322c0
Device \Driver\iaStorA \Device\00000079 fffffa80043322c0
Device \Driver\usbehci \Device\USBFDO-0 fffffa80099b42c0
Device \Driver\usbehci \Device\USBFDO-1 fffffa80099b42c0
Device \Driver\NetBT \Device\NetBT_Tcpip_{B659D313-2901-4231-AABD-2C0313B0EFF7} fffffa80094c62c0
Device \Driver\NetBT \Device\NetBt_Wins_Export fffffa80094c62c0
Device \Driver\iaStorA \Device\ScsiPort0 fffffa80043322c0
Device \Driver\usbehci \Device\USBPDO-0 fffffa80099b42c0
Device \Driver\a79j3r5m \Device\ScsiPort1 fffffa8009a362c0
---- Trace I/O - GMER 2.1 ----
Trace ntoskrnl.exe CLASSPNP.SYS disk.sys iaStorF.sys SamsungRapidDiskFltr.sys >>UNKNOWN [0xfffffa80043322c0]<< sptd.sys storport.sys hal.dll iaStorA.sys fffffa80043322c0
Trace 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80071da060] fffffa80071da060
Trace 3 CLASSPNP.SYS[fffff88001f2a43f] -> nt!IofCallDriver -> [0xfffffa80070db9f0] fffffa80070db9f0
Trace 5 iaStorF.sys[fffff88001bf4a2c] -> nt!IofCallDriver -> [0xfffffa80070dbde0] fffffa80070dbde0
Trace 7 SamsungRapidDiskFltr.sys[fffff88000c17ad1] -> nt!IofCallDriver -> \Device\00000079[0xfffffa8006fe29c0] fffffa8006fe29c0
Trace \Driver\iaStorA[0xfffffa80052cd6d0] -> IRP_MJ_CREATE -> 0xfffffa80043322c0 fffffa80043322c0
---- Modules - GMER 2.1 ----
Module \SystemRoot\System32\Drivers\a79j3r5m.SYS fffff8800f657000-fffff8800f69a000 (274432 bytes)
---- Processes - GMER 2.1 ----
Library C:\Users\FUL\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe [3752](2014-11-13 06:49:58) 0000000004060000
Library c:\users\ful\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpw216rf.dll (*** suspicious ***) @ C:\Users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe [3752](2014-12-05 01:49:14) 0000000004750000
Library C:\Users\FUL\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe [3752](2013-08-23 19:01:44) 00000000678b0000
Library C:\Users\FUL\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe [3752] (ICU Data DLL/The ICU Project)(2013-08-23 19:01:42) 0000000066f20000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\python27.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001e000000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32api.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001e8c0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\pywintypes27.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001e7a0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\pythoncom27.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000002c0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\_socket.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000000240000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\_ssl.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000010000000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32com.shell.shell.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001e800000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\_hashlib.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000001f60000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._core_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000002f40000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wxbase294u_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000003070000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wxbase294u_net_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000000280000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wxmsw294u_core_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000003260000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wxmsw294u_adv_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000003700000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._gdi_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000003840000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._windows_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000004150000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wxmsw294u_html_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000004220000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._controls_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000044e0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._misc_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000045f0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\_elementtree.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001d100000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\pyexpat.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000005b0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\pysqlite2._sqlite.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000042c0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\_ctypes.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001d1a0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32file.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001ea10000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32security.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001ec80000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\hashobjs_ext.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000000610000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32gui.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001ea40000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32event.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001e9b0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32inet.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001eaa0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32crypt.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001e980000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._html2.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000002810000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wxmsw294u_webview_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000003910000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\_multiprocessing.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000003930000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32process.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001ebf0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\unicodedata.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000005900000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._wizard.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000058c0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32pipe.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001eb90000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32pdh.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001eb60000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\windows._lib_cacheinvalidation.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000735a0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\select.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000058a0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32profile.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001ec20000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32ts.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001ed40000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._animate.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000059b0000
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Vielen Dank für Eure Hilfe! lolofufu Geändert von lolofufu (05.12.2014 um 02:56 Uhr) |
|
05.12.2014, 08:03
| #2 |
| /// the machine /// TB-Ausbilder    | Win7 64bit - Spyware.Zbot.ED bzw. HEUR/QVM03.0.Malware.Gen gefunden durch Malwarebytes bzw. 360 Internet Security hi,
__________________Bitte mal Wordwrap in deinem Editor abschalten und die Logs nochmal posten, das kann ja ein Mensch lesen 
__________________ |
|
05.12.2014, 10:50
| #3 |
| | Win7 64bit - Spyware.Zbot.ED bzw. HEUR/QVM03.0.Malware.Gen gefunden durch Malwarebytes bzw. 360 Internet Security Neuer Versuch!
__________________Falls der Zeilenumbruch(=wordwrap??) immer noch besteht, brauch ich dazu auch Hilfe  HTML-Code: Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 05.12.2014 Scan Time: 00:57:38 Logfile: mbam_log_20141205_1.txt Administrator: Yes Version: 2.00.4.1028 Malware Database: v2014.12.04.11 Rootkit Database: v2014.12.03.01 License: Free Malware Protection: Disabled Malicious Website Protection: Disabled Self-protection: Disabled OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: FUL Scan Type: Threat Scan Result: Completed Objects Scanned: 370671 Time Elapsed: 5 min, 59 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 0 (No malicious items detected) Registry Values: 1 Spyware.Zbot.ED, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|cjsdbs, C:\ProgramData\cjsdbs.exe, , [cf0cbaa4225ad1655de67d17c73e9d63] Registry Data: 0 (No malicious items detected) Folders: 0 (No malicious items detected) Files: 1 Spyware.Zbot.ED, C:\ProgramData\cjsdbs.exe, , [cf0cbaa4225ad1655de67d17c73e9d63], Physical Sectors: 0 (No malicious items detected) (end) FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-12-2014 Ran by FUL (administrator) on UX32VD on 05-12-2014 01:50:10 Running from C:\Users\FUL\Downloads Loaded Profiles: FUL & UpdatusUser (Available profiles: FUL & UpdatusUser) Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe () C:\Windows\SysWOW64\DptfParticipantProcessorService.exe () C:\Windows\SysWOW64\DptfPolicyConfigTDPService.exe (Diskeeper Corporation) C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (Samsung Electronics Co., Ltd.) C:\Windows\System32\RAPID\SamsungRapidSvc.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Rocket Division Software) C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Microsoft Corporation) C:\Windows\System32\alg.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\RAPID\CacheFilter\SamsungRapidApp.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe (Canon Inc.) C:\Program Files (x86)\Canon\SELPHY Photo Print\CIC_SPPhelper.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Dropbox, Inc.) C:\Users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe (CANON INC.) C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe (ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe (ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe (AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe (AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Qihu 360 Software Co., Ltd.) C:\Program Files\360\360 Internet Security\deepscan\QHActiveDefense.exe (Qihu 360 Software Co., Ltd.) C:\Program Files\360\360 Internet Security\360sd.exe (Qihu 360 Software Co., Ltd.) C:\Program Files\360\360 Internet Security\360rp.exe (Qihu 360 Software Co., Ltd.) C:\Program Files\360\360 Internet Security\safemon\360Tray.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [DptfPolicyLpmServiceHelper] => C:\Windows\SysWOW64\DptfPolicyLpmServiceHelper.exe HKLM\...\Run: [SamsungRapidApp] => C:\Program Files (x86)\Samsung\RAPID\CacheFilter\SamsungRapidApp.exe [109280 2013-07-29] (Samsung Electronics Co., Ltd.) HKLM\...\Run: [360sd] => C:\Program Files\360\360 Internet Security\360sdrun.exe [287560 2014-04-16] (Qihu 360 Software Co., Ltd.) HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-05-21] (Intel Corporation) HKLM-x32\...\Run: [ATKOSD2] => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [406328 2013-09-09] (ASUSTek Computer Inc.) HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [205624 2013-05-30] (ASUSTek Computer Inc.) HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41336 2014-05-08] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840568 2014-05-08] (Adobe Systems Inc.) HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2014-01-10] () HKLM-x32\...\Run: [IJNetworkScanUtility] => C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe [206240 2010-08-24] (CANON INC.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation) HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.) HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.) HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] => C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \mbamdor.exe [54072 2014-11-21] (Malwarebytes Corporation) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X] HKU\S-1-5-21-965061589-1977914162-274574225-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-08-07] (Apple Inc.) HKU\S-1-5-21-965061589-1977914162-274574225-1000\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2014-08-14] (Apple Inc.) HKU\S-1-5-21-965061589-1977914162-274574225-1000\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22869088 2014-10-21] (Google) AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [247144 2012-08-01] (NVIDIA Corporation) AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [202600 2012-08-01] (NVIDIA Corporation) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SELPHY Photo Print Launcher.lnk ShortcutTarget: SELPHY Photo Print Launcher.lnk -> C:\Program Files (x86)\Canon\SELPHY Photo Print\CIC_SPPhelper.exe (Canon Inc.) Startup: C:\Users\FUL\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CC-Bewegungen Europaeische Reisevers vsnr407019265DEU.pdf - Verknüpfung.lnk ShortcutTarget: CC-Bewegungen Europaeische Reisevers vsnr407019265DEU.pdf - Verknüpfung.lnk -> C:\Users\FUL\Desktop\CC-Bewegungen Europaeische Reisevers vsnr407019265DEU.pdf () Startup: C:\Users\FUL\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) BootExecute: autocheck autochk * sdnclean64.exe ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-965061589-1977914162-274574225-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ HKU\S-1-5-21-965061589-1977914162-274574225-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com SearchScopes: HKLM-x32 -> DefaultScope value is missing. BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: SafeMon Class -> {B69F34DD-F0F9-42DC-9EDD-957187DA688D} -> C:\Program Files\360\360 Internet Security\safemon\safemon64.dll (Qihu 360 Software Co., Ltd.) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Free Download Manager -> {CC59E0F9-7E43-44FA-9FAA-8377850BF205} -> C:\Program Files (x86)\Free Download Manager\iefdm2.dll (FreeDownloadManager.ORG) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\FUL\AppData\Roaming\Mozilla\Firefox\Profiles\15j8bd6f.default FF NetworkProxy: "socks_remote_dns", true FF NetworkProxy: "type", 0 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_239.dll () FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_239.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.) FF Extension: Avira Browser Safety - C:\Users\FUL\AppData\Roaming\Mozilla\Firefox\Profiles\15j8bd6f.default\Extensions\abs@avira.com [2014-11-20] FF Extension: FoxyProxy Standard - C:\Users\FUL\AppData\Roaming\Mozilla\Firefox\Profiles\15j8bd6f.default\Extensions\foxyproxy@eric.h.jung [2014-09-07] FF Extension: DownloadHelper - C:\Users\FUL\AppData\Roaming\Mozilla\Firefox\Profiles\15j8bd6f.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-09-07] FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2014-03-26] FF Extension: Free Download Manager plugin - C:\ProgramData\Free Download Manager\Firefox\Extensions\1.6.0.8 [2014-11-23] FF Extension: No Name - web2pdfextension@web2pdf.adobedotcom [Not Found] FF Extension: No Name - fdm_ffext@freedownloadmanager.org [Not Found] Chrome: ======= CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S2 360rp; C:\Program Files\360\360 Internet Security\360rps.exe [310352 2014-04-16] (Qihu 360 Software Co., Ltd.) R2 DptfParticipantProcessorService; C:\Windows\SysWOW64\DptfParticipantProcessorService.exe [18944 2012-02-20] () R2 DptfPolicyConfigTDPService; C:\Windows\SysWOW64\DptfPolicyConfigTDPService.exe [19968 2012-02-20] () R2 ExpressCache; C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe [79664 2012-03-30] (Diskeeper Corporation) R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation) S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-02-28] () R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation) R2 SamsungRapidSvc; C:\Windows\System32\RAPID\SamsungRapidSvc.exe [27360 2013-07-29] (Samsung Electronics Co., Ltd.) S3 scan; C:\Program Files\360\360 Internet Security\scan.dll [420424 2014-04-25] (S.C. BitDefender S.R.L) R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.) R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.) R2 StarWindServiceAE; C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [275968 2007-05-28] (Rocket Division Software) [File not signed] R2 ZhuDongFangYu; C:\Program Files\360\360 Internet Security\deepscan\QHActiveDefense.exe [236360 2014-04-23] (Qihu 360 Software Co., Ltd.) S4 AntiVirWebService; "C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe" [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R1 360AntiHacker; C:\Windows\System32\Drivers\360AntiHacker64.sys [97872 2014-04-21] (Qihu 360 Software Co., Ltd.) R3 360AvFlt; C:\Windows\System32\DRIVERS\360AvFlt.sys [67664 2014-04-23] (Qihu 360 Software Co., Ltd.) R1 360Box64; C:\Windows\System32\DRIVERS\360Box64.sys [305744 2014-04-29] (Qihu 360 Software Co., Ltd.) S1 360Camera; C:\Windows\System32\Drivers\360Camera64.sys [41552 2014-04-29] (Qihu 360 Software Co., Ltd.) R1 360fsflt; C:\Windows\System32\DRIVERS\360FsFlt.sys [304208 2014-05-07] (Qihu 360 Software Co., Ltd.) R3 ATP; C:\Windows\System32\DRIVERS\AsusTP.sys [65784 2013-02-06] (ASUS Corporation) S3 AX88772B; C:\Windows\System32\DRIVERS\ax88772b.sys [110592 2012-04-05] (ASIX Electronics Corp.) U1 BAPIDRV; C:\Windows\System32\DRIVERS\BAPIDRV64.sys [180816 2014-04-18] (Qihu 360 Software Co., Ltd.) R3 DptfDevDram; C:\Windows\System32\DRIVERS\DptfDevDram.sys [107288 2012-02-20] (Intel Corporation) R3 DptfDevFan; C:\Windows\System32\DRIVERS\DptfDevFan.sys [42776 2012-02-20] (Intel Corporation) R3 DptfDevGen; C:\Windows\System32\DRIVERS\DptfDevGen.sys [64792 2012-02-20] (Intel Corporation) R3 DptfDevPch; C:\Windows\System32\DRIVERS\DptfDevPch.sys [96024 2012-02-20] (Intel Corporation) R3 DptfDevProc; C:\Windows\System32\DRIVERS\DptfDevProc.sys [220952 2012-02-20] (Intel Corporation) R3 DptfManager; C:\Windows\System32\DRIVERS\DptfManager.sys [357656 2012-02-20] (Intel Corporation) R1 excfs; C:\Windows\System32\DRIVERS\excfs.sys [23344 2012-03-30] (Diskeeper Corporation) R0 excsd; C:\Windows\System32\DRIVERS\excsd.sys [95024 2012-03-30] (Diskeeper Corporation) R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28656 2013-03-25] (Intel Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-05] (Malwarebytes Corporation) U0 oiuexy; C:\Windows\System32\drivers\xppby.sys [79064 2014-12-05] (Malwarebytes Corporation) R0 SamsungRapidDiskFltr; C:\Windows\System32\DRIVERS\SamsungRapidDiskFltr.sys [240864 2013-07-29] (Samsung Electronics Co., Ltd.) R0 SamsungRapidFSFltr; C:\Windows\System32\DRIVERS\SamsungRapidFSFltr.sys [111328 2013-07-29] (Samsung Electronics Co., Ltd.) S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.) R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-03-26] (Duplex Secure Ltd.) R1 UimBus; C:\Windows\System32\DRIVERS\UimBus.sys [102664 2014-01-23] () R1 Uim_DEVIM; C:\Windows\System32\DRIVERS\uim_devim.sys [25992 2014-01-23] () R1 Uim_IM; C:\Windows\System32\DRIVERS\uim_im.sys [700680 2014-01-23] () U3 ahkhhxz2; C:\Windows\System32\Drivers\ahkhhxz2.sys [0 ] (Advanced Micro Devices) S1 {2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64; system32\drivers\{2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-05 01:50 - 2014-12-05 01:50 - 00021716 _____ () C:\Users\FUL\Downloads\FRST.txt 2014-12-05 01:50 - 2014-12-05 01:50 - 00000000 ____D () C:\FRST 2014-12-05 01:49 - 2014-12-05 01:49 - 02117632 _____ (Farbar) C:\Users\FUL\Downloads\FRST64.exe 2014-12-05 01:49 - 2014-12-05 01:49 - 00000000 ____D () C:\Users\FUL\Desktop\trojanerboard 2014-12-05 01:11 - 2014-12-05 01:11 - 00143360 _____ (1999-2010 White Shift HatIt Kream) C:\ProgramData\djsdbs.exe 2014-12-05 01:09 - 2014-12-05 01:09 - 00050477 _____ () C:\Users\FUL\Downloads\Defogger.exe 2014-12-05 01:04 - 2014-12-05 01:04 - 00079064 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\xppby.sys 2014-12-05 00:57 - 2009-06-10 22:00 - 00000824 _____ () C:\Windows\system32\Drivers\etc\hosts.20141205-005700.backup 2014-12-05 00:39 - 2014-05-14 10:40 - 00022992 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\efimon.sys 2014-12-05 00:38 - 2014-12-05 01:49 - 00000000 ____D () C:\Users\FUL\AppData\Roaming\360safe 2014-12-05 00:38 - 2014-12-05 00:38 - 00000974 _____ () C:\Users\Public\Desktop\360 Internet Security.lnk 2014-12-05 00:38 - 2014-12-05 00:38 - 00000000 _RSHD () C:\360SANDBOX 2014-12-05 00:38 - 2014-12-05 00:38 - 00000000 ____D () C:\Users\FUL\AppData\Roaming\360SD 2014-12-05 00:38 - 2014-12-05 00:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\360 Internet Security 2014-12-05 00:38 - 2014-12-05 00:38 - 00000000 ____D () C:\ProgramData\360SD 2014-12-05 00:38 - 2014-12-05 00:38 - 00000000 ____D () C:\Program Files\360 2014-12-05 00:38 - 2014-05-07 10:44 - 00304208 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\360FsFlt.sys 2014-12-05 00:38 - 2014-04-29 07:20 - 00305744 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\360Box64.sys 2014-12-05 00:38 - 2014-04-29 04:50 - 00041552 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\360Camera64.sys 2014-12-05 00:38 - 2014-04-23 09:32 - 00067664 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\360AvFlt.sys 2014-12-05 00:38 - 2014-04-21 07:38 - 00097872 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\360AntiHacker64.sys 2014-12-05 00:38 - 2014-04-18 07:42 - 00180816 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\BAPIDRV64.SYS 2014-12-05 00:18 - 2014-12-05 00:18 - 00000753 _____ () C:\Users\FUL\Desktop\JRT.txt 2014-12-05 00:13 - 2014-12-05 00:13 - 00000000 ____D () C:\Windows\ERUNT 2014-12-05 00:06 - 2014-12-05 00:13 - 00000000 ____D () C:\ProgramData\HitmanPro 2014-12-04 23:55 - 2014-12-05 00:03 - 00000000 ____D () C:\AdwCleaner 2014-12-04 22:41 - 2014-12-04 22:41 - 00000000 ____D () C:\OETemp 2014-12-04 22:40 - 2014-12-04 22:40 - 00000000 _____ () C:\ProgramData\rebootpending.txt 2014-12-04 22:36 - 2014-12-05 00:54 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy 2014-12-04 22:36 - 2014-12-04 22:39 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2 2014-12-04 22:36 - 2014-12-04 22:36 - 00001391 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk 2014-12-04 22:36 - 2014-12-04 22:36 - 00001379 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk 2014-12-04 22:36 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe 2014-12-04 22:34 - 2014-12-04 22:38 - 168558440 _____ (Qihu 360 Software Co., Ltd.) C:\Users\FUL\Downloads\360is_4.9.0.4902H.exe 2014-12-04 13:53 - 2014-12-05 00:57 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-12-04 13:52 - 2014-12-04 13:52 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-12-04 13:52 - 2014-12-04 13:52 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-12-04 13:52 - 2014-12-04 13:52 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-12-04 13:52 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-12-04 13:52 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-12-04 13:52 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-12-04 13:41 - 2014-12-04 13:42 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\FUL\Downloads\spybot-2.4.exe 2014-12-04 13:40 - 2014-12-04 13:40 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\FUL\Downloads\mbam-setup-2.0.4.1028.exe 2014-12-02 23:41 - 2014-12-02 23:43 - 57358008 _____ (ZONER software ) C:\Users\FUL\Downloads\zps16_de_pro_chip.exe 2014-12-02 20:23 - 2014-12-02 20:23 - 00026729 _____ () C:\Users\FUL\Downloads\Bluewolf495-40.rec[https___truestracker.de].torrent 2014-12-02 20:23 - 2014-12-02 20:23 - 00026729 _____ () C:\Users\FUL\Downloads\Bluewolf495-39.rec[https___truestracker.de].torrent 2014-12-02 20:23 - 2014-12-02 20:23 - 00026529 _____ () C:\Users\FUL\Downloads\Bluewolf438-44.rec[https___truestracker.de].torrent 2014-12-02 20:22 - 2014-12-02 20:22 - 00028189 _____ () C:\Users\FUL\Downloads\Bluewolf596-13.rec[https___truestracker.de].torrent 2014-12-02 20:22 - 2014-12-02 20:22 - 00028168 _____ () C:\Users\FUL\Downloads\Bluewolf596-7.rec[https___truestracker.de].torrent 2014-12-02 20:22 - 2014-12-02 20:22 - 00028028 _____ () C:\Users\FUL\Downloads\Bluewolf596-8.rec[https___truestracker.de].torrent 2014-12-02 20:22 - 2014-12-02 20:22 - 00028009 _____ () C:\Users\FUL\Downloads\Bluewolf596-14.rec[https___truestracker.de].torrent 2014-12-02 20:22 - 2014-12-02 20:22 - 00027950 _____ () C:\Users\FUL\Downloads\Bluewolf596-8-2.rec[https___truestracker.de].torrent 2014-12-02 20:22 - 2014-12-02 20:22 - 00026669 _____ () C:\Users\FUL\Downloads\Bluewolf438-42.rec[https___truestracker.de].torrent 2014-12-02 20:22 - 2014-12-02 20:22 - 00026489 _____ () C:\Users\FUL\Downloads\Bluewolf438-41.rec[https___truestracker.de].torrent 2014-12-02 20:22 - 2014-12-02 20:22 - 00026349 _____ () C:\Users\FUL\Downloads\Bluewolf438-43.rec[https___truestracker.de].torrent 2014-12-02 16:27 - 2014-12-02 16:27 - 02996728 _____ (Crystal Dew World ) C:\Users\FUL\Downloads\CrystalDiskInfo6_2_1.exe 2014-12-02 16:27 - 2014-12-02 16:27 - 00001186 _____ () C:\Users\FUL\Desktop\CrystalDiskInfo.lnk 2014-12-02 16:27 - 2014-12-02 16:27 - 00000000 ____D () C:\Program Files (x86)\CrystalDiskInfo 2014-12-02 15:14 - 2014-12-02 15:19 - 00000000 ____D () C:\Users\FUL\Desktop\FireTV 2014-12-01 14:12 - 2014-12-01 14:27 - 00000000 ____D () C:\Users\FUL\AppData\Local\Amazon_FireTV_Utility_App 2014-12-01 14:11 - 2014-12-01 14:11 - 00000000 ____D () C:\Users\FUL\.android 2014-11-30 16:19 - 2014-11-30 16:19 - 00000263 _____ () C:\Users\FUL\Desktop\Musterschreiben%20R%C3%BCckforderung%20Bearbeitungsentgelt_207294.log 2014-11-26 22:04 - 2014-11-26 22:04 - 00035849 _____ () C:\Users\FUL\Downloads\Bluewolf494-22.rec[https___truestracker.de].torrent 2014-11-26 22:04 - 2014-11-26 22:04 - 00027048 _____ () C:\Users\FUL\Downloads\Bluewolf600.rec[https___truestracker.de].torrent 2014-11-24 23:48 - 2014-11-24 23:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-11-08 21:27 - 2014-11-08 21:27 - 00000000 ____D () C:\Users\Default\AppData\Local\Google 2014-11-08 21:27 - 2014-11-08 21:27 - 00000000 ____D () C:\Users\Default User\AppData\Local\Google 2014-11-07 08:35 - 2014-11-07 08:35 - 01054912 _____ (Adobe) C:\Users\FUL\Downloads\install_flashplayer15x32au_mssd_aaa_aih.exe ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-05 01:49 - 2014-06-12 10:51 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-12-05 01:10 - 2014-03-24 22:11 - 00000000 ____D () C:\Users\FUL\AppData\Local\VirtualStore 2014-12-05 01:04 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Registration 2014-12-05 00:51 - 2014-03-28 14:12 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-12-05 00:44 - 2014-03-25 07:06 - 00709888 _____ () C:\Windows\system32\perfh007.dat 2014-12-05 00:44 - 2014-03-25 07:06 - 00153014 _____ () C:\Windows\system32\perfc007.dat 2014-12-05 00:44 - 2009-07-14 06:13 - 01626984 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-12-05 00:42 - 2009-07-14 05:45 - 00026720 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-12-05 00:42 - 2009-07-14 05:45 - 00026720 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-12-05 00:40 - 2014-03-25 22:39 - 00000000 ___RD () C:\Users\FUL\Desktop\Dropbox 2014-12-05 00:40 - 2014-03-25 22:36 - 00000000 ____D () C:\Users\FUL\AppData\Roaming\Dropbox 2014-12-05 00:39 - 2014-09-23 11:37 - 00000000 ___RD () C:\Users\FUL\Desktop\Google Drive 2014-12-05 00:38 - 2014-03-24 22:12 - 01293902 _____ () C:\Windows\WindowsUpdate.log 2014-12-05 00:37 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\sysprep 2014-12-05 00:36 - 2014-03-28 14:12 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-12-05 00:35 - 2014-03-26 12:20 - 00000433 _____ () C:\Windows\system32\Drivers\etc\hosts.ics 2014-12-05 00:35 - 2014-03-25 09:47 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-12-05 00:35 - 2010-11-21 04:47 - 00240388 _____ () C:\Windows\PFRO.log 2014-12-05 00:35 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-12-05 00:35 - 2009-07-14 05:51 - 00044551 _____ () C:\Windows\setupact.log 2014-12-05 00:35 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\schemas 2014-12-05 00:05 - 2014-05-25 10:04 - 00000000 ____D () C:\Users\FUL\Downloads\Malware remover 2014-12-04 23:48 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Vss 2014-12-04 22:41 - 2014-03-25 09:23 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-12-04 22:36 - 2009-07-14 04:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools 2014-12-04 16:48 - 2014-03-24 22:11 - 00000000 ____D () C:\Users\FUL 2014-12-04 15:16 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system 2014-12-04 15:15 - 2014-03-27 16:13 - 00000000 ____D () C:\Users\FUL\AppData\Roaming\vlc 2014-12-04 12:02 - 2012-08-30 14:04 - 00000000 ____D () C:\Users\FUL\Documents\Outlook-Dateien 2014-12-04 12:00 - 2014-03-28 23:38 - 00000000 ____D () C:\Users\FUL\AppData\Local\4610B230-FA09-4F6C-BD9C-AE65706B9057.aplzod 2014-12-02 18:18 - 2014-03-28 10:37 - 00038912 _____ () C:\Users\FUL\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-12-02 18:18 - 2014-03-28 10:28 - 00000000 ____D () C:\Users\FUL\AppData\Local\ColdCut 2014-12-02 18:00 - 2014-03-20 11:28 - 00000000 ____D () C:\Users\FUL\Desktop\UDOO 2014-12-01 14:26 - 2014-04-27 11:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-11-30 16:22 - 2014-04-26 14:20 - 00000000 ____D () C:\Users\FUL\AppData\Roaming\Free Download Manager 2014-11-25 23:49 - 2014-06-12 10:51 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-11-25 23:49 - 2014-03-26 12:18 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-11-25 23:49 - 2014-03-26 12:18 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-11-24 19:02 - 2014-03-25 22:53 - 00000000 ____D () C:\Users\FUL\AppData\Roaming\uTorrent 2014-11-18 15:08 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp 2014-11-18 10:46 - 2014-03-28 14:12 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-11-18 10:46 - 2014-03-28 14:12 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-11-13 11:07 - 2014-03-28 09:27 - 00000000 ____D () C:\Users\FUL\AppData\Local\Apple Computer 2014-11-13 04:48 - 2014-09-23 18:31 - 00000000 ____D () C:\Users\FUL\Desktop\iPad mini Backup 2014.09.23 2014-11-10 09:59 - 2013-08-23 11:36 - 00000000 ____D () C:\Users\FUL\Documents\#Vorlagen 2014-11-08 21:28 - 2014-09-23 11:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive Files to move or delete: ==================== C:\ProgramData\djsdbs.exe Some content of TEMP: ==================== C:\Users\FUL\AppData\Local\Temp\avgnt.exe C:\Users\FUL\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpfpurdx.dll C:\Users\FUL\AppData\Local\Temp\JDSetup130429822500280238.exe C:\Users\FUL\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe C:\Users\FUL\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe C:\Users\FUL\AppData\Local\Temp\ose00000.exe C:\Users\FUL\AppData\Local\Temp\paint.net.4.0.3.install.exe C:\Users\FUL\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-12-05 01:29 ==================== End Of Log ============================ --- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03-12-2014
Ran by FUL at 2014-12-05 01:50:41
Running from C:\Users\FUL\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: 360 Internet Security (Enabled - Up to date) {2B66EE1E-E5C8-C2F7-648F-4E55AC68D37D}
AS: 360 Internet Security (Enabled - Up to date) {90070FFA-C3F2-CD79-5E3F-7527D7EF99C0}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
360 Internet Security (HKLM-x32\...\360 Internet Security) (Version: 4.9.0.4902 - Qihu 360 Software Co., Ltd.)
Adobe Acrobat X Pro - English, Français, Deutsch (HKLM-x32\...\{AC76BA86-1033-F400-7760-000000000005}) (Version: 10.1.10 - Adobe Systems)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 13.0.0.111 - Adobe Systems Incorporated)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.239 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.239 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{B678797F-DF38-4556-8A31-8B818E261868}) (Version: 8.0.0.23 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ASUS Smart Gesture (HKLM-x32\...\{4D3286A6-F6AB-498A-82A4-E4F040529F3D}) (Version: 2.0.1 - ASUS)
ASUS USB Charger Plus (HKLM-x32\...\{A859E3E5-C62F-4BFA-AF1D-2B95E03166AF}) (Version: 2.1.4 - ASUS)
ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0031 - ASUS)
AX88772B Windows 7 Drivers (HKLM-x32\...\InstallShield_{54A168C9-2250-4058-80EB-1F4A4192548A}) (Version: 1.0.2.0 - ASIX Electronics Corporation)
AX88772B Windows 7 Drivers (x32 Version: 1.0.2.0 - ASIX Electronics Corporation) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Canon IJ Network Scan Utility (HKLM-x32\...\Canon_IJ_Network_Scan_UTILITY) (Version: - )
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: 3.1.1 - Canon Inc.)
Canon MG6100 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG6100_series) (Version: - Canon Inc.)
Canon MP Navigator EX 4.0 (HKLM-x32\...\MP Navigator EX 4.0) (Version: - )
Canon SELPHY CP800 (HKLM\...\Canon SELPHY CP800) (Version: - )
Canon Utilities SELPHY Photo Print (HKLM-x32\...\SELPHY Photo Print) (Version: 1.2.0.7 - Canon Inc.)
Canon Utilities SELPHY Print Contents 1.1.0 (HKLM-x32\...\SELPHY Print Contents 110) (Version: 1.1.0.16 - Canon Inc.)
CPUID CPU-Z 1.69 (HKLM\...\CPUID CPU-Z_is1) (Version: - )
CrystalDiskInfo 6.2.1 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 6.2.1 - Crystal Dew World)
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.100 - DivX, LLC)
Dropbox (HKU\S-1-5-21-965061589-1977914162-274574225-1000\...\Dropbox) (Version: 2.10.52 - Dropbox, Inc.)
ExpressCache (HKLM\...\{FF607B1F-A78B-4F1D-BC8E-6C2AB3B75405}) (Version: 1.0.87 - Diskeeper Corporation)
ffdshow [rev 2946] [2009-05-15] (HKLM-x32\...\ffdshow_is1) (Version: 1.0 - )
ffdshow x64 v1.3.4500 [2013-01-06] (HKLM\...\ffdshow64_is1) (Version: 1.3.4500.0 - )
Free Download Manager 3.9.3 (HKLM-x32\...\Free Download Manager_is1) (Version: - FreeDownloadManager.ORG)
Google Calendar Sync (HKLM-x32\...\Google Calendar Sync) (Version: - )
Google Drive (HKLM-x32\...\{C60F3836-333A-4AE2-B526-CFDBA143A9BA}) (Version: 1.18.7821.2489 - Google, Inc.)
Google Outlook Contact Sync 0.9.1.0 (HKLM-x32\...\{3D6E90E1-602D-48C8-BBD2-28D1E183AE50}_is1) (Version: - Daniel Polistchuck)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
iCloud (HKLM\...\{6096C0CC-7E19-4355-87F0-627EC5AA146D}) (Version: 4.0.3.56 - Apple Inc.)
Intel(R) Dynamic Platform & Thermal Framework (HKLM-x32\...\FFD10ECE-F715-4a86-9BD8-F6F47DA5DA1C) (Version: 6.0.1.1067 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2828 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel(R) Update Manager (HKLM-x32\...\{12914061-EB9B-4AE7-AC7E-0B8A607C7DF4}) (Version: 2.3.1338 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.5.235 - Intel Corporation)
iTunes (HKLM\...\{F46AA0F1-E284-4878-A462-5F11B9166C0E}) (Version: 11.4.0.18 - Apple Inc.)
Java 7 Update 55 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417055FF}) (Version: 7.0.550 - Oracle)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.670 - Oracle)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Professional 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 33.1.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.1.1 (x86 de)) (Version: 33.1.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mp3tag v2.59a (HKLM-x32\...\Mp3tag) (Version: v2.59a - Florian Heidenreich)
NVIDIA 3D Vision Treiber 305.46 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 305.46 - NVIDIA Corporation)
NVIDIA Grafiktreiber 305.46 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 305.46 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.12.0613 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.0613 - NVIDIA Corporation)
NVIDIA Update 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.10.8 - NVIDIA Corporation)
paint.net (HKLM\...\{F509C1F4-0029-49F9-B145-A4C4E8DF481A}) (Version: 4.0.3 - dotPDN LLC)
Paragon Backup & Recovery™ 2014 Free (HKLM\...\{C268B5E1-A5DA-11DF-A289-005056C00008}) (Version: 90.00.0003 - Paragon Software)
Paragon Partition Manager™ 2014 Free (HKLM-x32\...\{47E5588F-C3A0-11DE-9857-005056C00008}) (Version: 90.00.0003 - Paragon Software)
Passbild-Generator v4.0a (HKLM-x32\...\Passbild-Generator_is1) (Version: - Passbild-Generator)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
RAPID Mode (Version: 1.0.1.42 - Samsung Electronics Co., Ltd.) Hidden
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7601.39025 - Realtek Semiconductor Corp.)
Saal Design Software (HKLM-x32\...\SaalDesignSoftware) (Version: 3.2.30 - Saal Digital Fotoservice GmbH)
Saal Design Software (x32 Version: 3.2.30 - Saal Digital Fotoservice GmbH) Hidden
Samsung Magician (HKLM-x32\...\{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}_is1) (Version: 4.3.0 - Samsung Electronics)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VLC media player 2.1.4 (HKLM\...\VLC media player) (Version: 2.1.4 - VideoLAN)
Windows-Treiberpaket - ASUS (ATP) Mouse (01/10/2013 1.0.0.170) (HKLM\...\4A9DE1E9EBC800B7F01739D4DE7363EF6751BDF5) (Version: 01/10/2013 1.0.0.170 - ASUS)
WinRAR 5.01 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
==================== Restore Points =========================
01-12-2014 13:55:28 Geplanter Prüfpunkt
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2014-12-05 00:57 - 00450771 ____R C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com
There are 1000 more lines.
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {3F51DDB9-03FD-425D-9FBE-9871E08E0609} - System32\Tasks\ATKOSD2 => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [2013-09-09] (ASUSTek Computer Inc.)
Task: {57440847-8931-4450-A8E6-89CA3200B9AD} - System32\Tasks\ASUS USB Charger Plus => C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe [2012-07-24] (ASUSTek Computer Inc.)
Task: {6883AAF1-063F-4CDD-A85C-0B05CD0F9660} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
Task: {6EE8C071-A3CF-40E9-A891-017AEA220B66} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-03-28] (Google Inc.)
Task: {A28E8D22-1470-49EF-9E80-CE024C8B15E8} - System32\Tasks\ASUS Touchpad Launcher (x64) => C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2013-02-06] (AsusTek)
Task: {C87CCA25-AC66-4726-91B6-E93A789FDBD5} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-25] (Adobe Systems Incorporated)
Task: {D816101D-1253-48DA-ACF9-0FF69BD9DA3A} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
Task: {E4B3F530-CCB5-418E-A57E-38547223F637} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-03-28] (Google Inc.)
Task: {ED6F1B18-66E6-4706-9523-979356F19BCE} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2014-03-25 09:47 - 2012-07-31 17:25 - 00086888 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-03-25 09:17 - 2012-02-20 11:31 - 00018944 _____ () C:\Windows\SysWOW64\DptfParticipantProcessorService.exe
2014-03-25 09:17 - 2012-02-20 11:31 - 00019968 _____ () C:\Windows\SysWOW64\DptfPolicyConfigTDPService.exe
2014-03-25 09:16 - 2012-08-16 01:52 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-01-10 06:26 - 2014-01-10 06:26 - 01861968 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
2014-02-12 20:58 - 2014-02-12 20:58 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-12 20:58 - 2014-02-12 20:58 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-12-04 22:36 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-12-04 22:36 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-12-04 22:36 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-12-04 22:36 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-12-04 22:36 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2006-10-31 17:53 - 2006-10-31 17:53 - 00270336 _____ () C:\Program Files (x86)\Canon\SELPHY Photo Print\EnoJPEG4.dll
2014-12-05 00:36 - 2014-12-05 00:36 - 00043008 _____ () c:\users\ful\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpfpurdx.dll
2013-08-23 20:01 - 2013-08-23 20:01 - 25100288 _____ () C:\Users\FUL\AppData\Roaming\Dropbox\bin\libcef.dll
2014-05-08 12:22 - 2014-05-08 12:22 - 00019968 _____ () C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\locale\de_de\acrotray.deu
2014-01-10 06:28 - 2014-01-10 06:28 - 00100688 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
2014-12-05 00:36 - 2014-12-05 00:36 - 00098816 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\win32api.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00110080 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\pywintypes27.dll
2014-12-05 00:36 - 2014-12-05 00:36 - 00364544 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\pythoncom27.dll
2014-12-05 00:36 - 2014-12-05 00:36 - 00045568 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\_socket.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 01160704 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\_ssl.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00320512 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\win32com.shell.shell.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00713216 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\_hashlib.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 01175040 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\wx._core_.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00805888 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\wx._gdi_.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00811008 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\wx._windows_.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 01062400 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\wx._controls_.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00735232 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\wx._misc_.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00128512 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\_elementtree.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00127488 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\pyexpat.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00557056 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\pysqlite2._sqlite.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00087552 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\_ctypes.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00119808 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\win32file.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00108544 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\win32security.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00007168 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\hashobjs_ext.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00167936 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\win32gui.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00018432 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\win32event.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00038912 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\win32inet.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00011264 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\win32crypt.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00070656 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\wx._html2.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00027136 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\_multiprocessing.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00035840 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\win32process.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00686080 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\unicodedata.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00122368 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\wx._wizard.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00024064 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\win32pipe.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00025600 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\win32pdh.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00525640 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\windows._lib_cacheinvalidation.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00010240 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\select.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00017408 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\win32profile.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00022528 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\win32ts.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00078336 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI40042\wx._animate.pyd
2014-03-25 11:04 - 2012-06-25 10:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2014-04-26 14:20 - 2013-10-25 20:58 - 00397312 _____ () C:\Program Files (x86)\Free Download Manager\iefdmdm.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\FUL\Desktop\Bild.jpg:com.dropbox.attributes
AlternateDataStreams: C:\Users\FUL\Desktop\IMG_3657.JPG:com.dropbox.attributes
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-965061589-1977914162-274574225-500 - Administrator - Disabled)
FUL (S-1-5-21-965061589-1977914162-274574225-1000 - Administrator - Enabled) => C:\Users\FUL
Gast (S-1-5-21-965061589-1977914162-274574225-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-965061589-1977914162-274574225-1002 - Limited - Enabled)
UpdatusUser (S-1-5-21-965061589-1977914162-274574225-1003 - Limited - Enabled) => C:\Users\UpdatusUser
==================== Faulty Device Manager Devices =============
Name: {2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64
Description: {2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: {2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (12/05/2014 00:35:51 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (12/05/2014 00:35:51 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
{2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64
Microsoft Office Sessions:
=========================
Error: (12/05/2014 00:35:51 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-3317U CPU @ 1.70GHz
Percentage of memory in use: 87%
Total physical RAM: 3981.57 MB
Available physical RAM: 481.2 MB
Total Pagefile: 4796.88 MB
Available Pagefile: 690.65 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:931.29 GB) (Free:184.89 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 059A1B33)
Partition: GPT Partition Type.
========================================================
Disk: 1 (Size: 22.4 GB) (Disk ID: 74F02DEA)
Partition 1: (Not Active) - (Size=22.4 GB) - (Type=73)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-12-05 02:51:56
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000079 ATA_____ rev.BB6Q 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\FUL\AppData\Local\Temp\pwldapob.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff80002fef000 45 bytes [00, 10, 00, 00, 00, 00, 00, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575 fffff80002fef02f 30 bytes [00, 00, 00, 00, 00, 00, 00, ...]
---- User code sections - GMER 2.1 ----
.text C:\Program Files\360\360 Internet Security\deepscan\QHActiveDefense.exe[1600] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files\360\360 Internet Security\deepscan\QHActiveDefense.exe[1600] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2324] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2324] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe[3088] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe[3088] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2632] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2632] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[4244] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[4244] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4360] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4360] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
? C:\Windows\system32\mssprxy.dll [4360] entry point in ".rdata" section 00000000731171e6
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[4484] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[4484] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4512] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4512] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe[3628] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe[3628] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files\360\360 Internet Security\360sdUpd.exe[4372] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files\360\360 Internet Security\360sdUpd.exe[4372] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Users\FUL\Downloads\Gmer-19357.exe[5608] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Users\FUL\Downloads\Gmer-19357.exe[5608] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
---- Devices - GMER 2.1 ----
Device \Driver\a79j3r5m \Device\Scsi\a79j3r5m1 fffffa8009a362c0
Device \FileSystem\Ntfs \Ntfs fffffa80043362c0
Device \FileSystem\fastfat \Fat fffffa8009df82c0
Device \Driver\iaStorA \Device\0000007a fffffa80043322c0
Device \Driver\usbehci \Device\USBPDO-1 fffffa80099b42c0
Device \Driver\iaStorA \Device\RaidPort0 fffffa80043322c0
Device \Driver\iaStorA \Device\00000079 fffffa80043322c0
Device \Driver\usbehci \Device\USBFDO-0 fffffa80099b42c0
Device \Driver\usbehci \Device\USBFDO-1 fffffa80099b42c0
Device \Driver\NetBT \Device\NetBT_Tcpip_{B659D313-2901-4231-AABD-2C0313B0EFF7} fffffa80094c62c0
Device \Driver\NetBT \Device\NetBt_Wins_Export fffffa80094c62c0
Device \Driver\iaStorA \Device\ScsiPort0 fffffa80043322c0
Device \Driver\usbehci \Device\USBPDO-0 fffffa80099b42c0
Device \Driver\a79j3r5m \Device\ScsiPort1 fffffa8009a362c0
---- Trace I/O - GMER 2.1 ----
Trace ntoskrnl.exe CLASSPNP.SYS disk.sys iaStorF.sys SamsungRapidDiskFltr.sys >>UNKNOWN [0xfffffa80043322c0]<< sptd.sys storport.sys hal.dll iaStorA.sys fffffa80043322c0
Trace 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80071da060] fffffa80071da060
Trace 3 CLASSPNP.SYS[fffff88001f2a43f] -> nt!IofCallDriver -> [0xfffffa80070db9f0] fffffa80070db9f0
Trace 5 iaStorF.sys[fffff88001bf4a2c] -> nt!IofCallDriver -> [0xfffffa80070dbde0] fffffa80070dbde0
Trace 7 SamsungRapidDiskFltr.sys[fffff88000c17ad1] -> nt!IofCallDriver -> \Device\00000079[0xfffffa8006fe29c0] fffffa8006fe29c0
Trace \Driver\iaStorA[0xfffffa80052cd6d0] -> IRP_MJ_CREATE -> 0xfffffa80043322c0 fffffa80043322c0
---- Modules - GMER 2.1 ----
Module \SystemRoot\System32\Drivers\a79j3r5m.SYS fffff8800f657000-fffff8800f69a000 (274432 bytes)
---- Processes - GMER 2.1 ----
Library C:\Users\FUL\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe [3752](2014-11-13 06:49:58) 0000000004060000
Library c:\users\ful\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpw216rf.dll (*** suspicious ***) @ C:\Users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe [3752](2014-12-05 01:49:14) 0000000004750000
Library C:\Users\FUL\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe [3752](2013-08-23 19:01:44) 00000000678b0000
Library C:\Users\FUL\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe [3752] (ICU Data DLL/The ICU Project)(2013-08-23 19:01:42) 0000000066f20000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\python27.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001e000000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32api.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001e8c0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\pywintypes27.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001e7a0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\pythoncom27.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000002c0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\_socket.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000000240000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\_ssl.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000010000000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32com.shell.shell.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001e800000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\_hashlib.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000001f60000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._core_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000002f40000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wxbase294u_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000003070000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wxbase294u_net_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000000280000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wxmsw294u_core_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000003260000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wxmsw294u_adv_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000003700000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._gdi_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000003840000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._windows_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000004150000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wxmsw294u_html_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000004220000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._controls_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000044e0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._misc_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000045f0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\_elementtree.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001d100000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\pyexpat.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000005b0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\pysqlite2._sqlite.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000042c0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\_ctypes.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001d1a0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32file.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001ea10000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32security.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001ec80000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\hashobjs_ext.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000000610000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32gui.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001ea40000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32event.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001e9b0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32inet.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001eaa0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32crypt.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001e980000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._html2.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000002810000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wxmsw294u_webview_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000003910000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\_multiprocessing.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000003930000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32process.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001ebf0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\unicodedata.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000005900000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._wizard.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000058c0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32pipe.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001eb90000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32pdh.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001eb60000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\windows._lib_cacheinvalidation.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000735a0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\select.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000058a0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32profile.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001ec20000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32ts.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001ed40000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._animate.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000059b0000
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
|
|
06.12.2014, 09:22
| #4 |
| /// the machine /// TB-Ausbilder | Win7 64bit - Spyware.Zbot.ED bzw. HEUR/QVM03.0.Malware.Gen gefunden durch Malwarebytes bzw. 360 Internet Security besser Scan mit Combofix
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
06.12.2014, 12:01
| #5 |
| | Win7 64bit - Spyware.Zbot.ED bzw. HEUR/QVM03.0.Malware.Gen gefunden durch Malwarebytes bzw. 360 Internet Security das Combofix Log Code:
ATTFilter ComboFix 14-12-04.01 - FUL 06.12.2014 11:23:00.1.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.3982.1610 [GMT 1:00]
ausgeführt von:: c:\users\FUL\Downloads\ComboFix.exe
AV: 360 Internet Security *Disabled/Updated* {2B66EE1E-E5C8-C2F7-648F-4E55AC68D37D}
SP: 360 Internet Security *Disabled/Updated* {90070FFA-C3F2-CD79-5E3F-7527D7EF99C0}
SP: Spybot - Search and Destroy *Enabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\FUL\AppData\Local\Temp\_MEI25602\_ctypes.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\_elementtree.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\_hashlib.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\_multiprocessing.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\_socket.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\_ssl.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\hashobjs_ext.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\pyexpat.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\pysqlite2._sqlite.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\python27.dll
c:\users\FUL\AppData\Local\Temp\_MEI25602\pythoncom27.dll
c:\users\FUL\AppData\Local\Temp\_MEI25602\PyWinTypes27.dll
c:\users\FUL\AppData\Local\Temp\_MEI25602\select.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\unicodedata.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\win32api.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\win32com.shell.shell.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\win32crypt.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\win32event.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\win32file.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\win32gui.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\win32inet.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\win32pdh.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\win32pipe.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\win32process.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\win32profile.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\win32security.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\win32ts.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\windows._lib_cacheinvalidation.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\wx._animate.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\wx._controls_.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\wx._core_.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\wx._gdi_.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\wx._html2.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\wx._misc_.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\wx._windows_.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\wx._wizard.pyd
c:\users\FUL\AppData\Local\Temp\_MEI25602\wxbase294u_net_vc90.dll
c:\users\FUL\AppData\Local\Temp\_MEI25602\wxbase294u_vc90.dll
c:\users\FUL\AppData\Local\Temp\_MEI25602\wxmsw294u_adv_vc90.dll
c:\users\FUL\AppData\Local\Temp\_MEI25602\wxmsw294u_core_vc90.dll
c:\users\FUL\AppData\Local\Temp\_MEI25602\wxmsw294u_html_vc90.dll
c:\users\FUL\AppData\Local\Temp\_MEI25602\wxmsw294u_webview_vc90.dll
c:\users\FUL\Documents\2005073.tmp
c:\users\FUL\Documents\2438659.tmp
c:\windows\wininit.ini
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-11-06 bis 2014-12-06 ))))))))))))))))))))))))))))))
.
.
2014-12-05 00:50 . 2014-12-05 00:51 -------- d-----w- C:\FRST
2014-12-04 23:39 . 2014-05-14 09:40 22992 ----a-w- c:\windows\system32\drivers\efimon.sys
2014-12-04 23:38 . 2014-12-04 23:38 -------- d-----w- c:\users\FUL\AppData\Roaming\360SD
2014-12-04 23:38 . 2014-12-04 23:38 -------- d-----w- c:\programdata\360SD
2014-12-04 23:38 . 2014-04-23 08:32 67664 ----a-w- c:\windows\system32\drivers\360AvFlt.sys
2014-12-04 23:38 . 2014-12-05 00:52 -------- d-----w- c:\users\FUL\AppData\Roaming\360safe
2014-12-04 23:38 . 2014-05-07 09:44 304208 ----a-w- c:\windows\system32\drivers\360FsFlt.sys
2014-12-04 23:38 . 2014-04-18 06:42 180816 ----a-w- c:\windows\system32\drivers\BAPIDRV64.SYS
2014-12-04 23:38 . 2014-12-04 23:38 -------- d-----r- C:\360SANDBOX
2014-12-04 23:38 . 2014-04-29 06:20 305744 ----a-w- c:\windows\system32\drivers\360Box64.sys
2014-12-04 23:38 . 2014-04-29 03:50 41552 ----a-w- c:\windows\system32\drivers\360Camera64.sys
2014-12-04 23:38 . 2014-04-21 06:38 97872 ----a-w- c:\windows\system32\drivers\360AntiHacker64.sys
2014-12-04 23:38 . 2014-12-04 23:38 -------- d-----w- c:\program files\360
2014-12-04 23:13 . 2014-12-04 23:13 -------- d-----w- c:\windows\ERUNT
2014-12-04 23:06 . 2014-12-04 23:13 -------- d-----w- c:\programdata\HitmanPro
2014-12-04 22:55 . 2014-12-04 23:03 -------- d-----w- C:\AdwCleaner
2014-12-04 21:41 . 2014-12-04 21:41 -------- d-----w- C:\OETemp
2014-12-04 21:36 . 2014-12-06 10:21 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2014-12-04 21:36 . 2014-12-06 10:34 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy 2
2014-12-04 12:53 . 2014-12-05 13:50 129752 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-12-04 12:52 . 2014-12-04 12:52 -------- d-----w- c:\program files (x86)\ Malwarebytes Anti-Malware
2014-12-04 12:52 . 2014-12-04 12:52 -------- d-----w- c:\programdata\Malwarebytes
2014-12-04 12:52 . 2014-11-21 05:14 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-12-04 12:52 . 2014-11-21 05:14 93400 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-12-04 12:52 . 2014-11-21 05:14 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-12-02 15:27 . 2014-12-02 15:27 -------- d-----w- c:\program files (x86)\CrystalDiskInfo
2014-12-01 13:12 . 2014-12-01 13:27 -------- d-----w- c:\users\FUL\AppData\Local\Amazon_FireTV_Utility_App
2014-12-01 13:11 . 2014-12-01 13:11 -------- d-----w- c:\users\FUL\.android
2014-11-08 20:27 . 2014-11-08 20:27 -------- d-----w- c:\users\Default\AppData\Local\Google
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-11-25 22:49 . 2014-03-26 11:18 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-11-25 22:49 . 2014-03-26 11:18 701104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 131480 ----a-w- c:\users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 131480 ----a-w- c:\users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 131480 ----a-w- c:\users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iCloudServices"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [2014-08-07 43816]
"ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2014-08-14 43816]
"GoogleDriveSync"="c:\program files (x86)\Google\Drive\googledrivesync.exe" [2014-10-21 22869088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-05-20 291648]
"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2013-09-09 406328]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2013-05-30 205624]
"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2014-05-08 41336]
"Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2014-05-08 840568]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2014-01-10 1861968]
"IJNetworkScanUtility"="c:\program files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe" [2010-08-24 206240]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-07-25 256896]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-09-01 152392]
.
c:\users\FUL\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
CC-Bewegungen Europaeische Reisevers vsnr407019265DEU.pdf - Verknüpfung.lnk - c:\users\FUL\Desktop\CC-Bewegungen Europaeische Reisevers vsnr407019265DEU.pdf [2014-3-30 33819]
Dropbox.lnk - c:\users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-11-13 35419192]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
SELPHY Photo Print Launcher.lnk - c:\program files (x86)\Canon\SELPHY Photo Print\CIC_SPPhelper.exe [2010-4-20 794624]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
R1 {2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64;{2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64;c:\windows\system32\drivers\{2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64.sys;c:\windows\SYSNATIVE\drivers\{2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 360AntiHacker;360Safe Anti Hacker Service;c:\windows\system32\Drivers\360AntiHacker64.sys;c:\windows\SYSNATIVE\Drivers\360AntiHacker64.sys [x]
R3 360AvFlt;360AvFlt mini-filter driver;c:\windows\system32\DRIVERS\360AvFlt.sys;c:\windows\SYSNATIVE\DRIVERS\360AvFlt.sys [x]
R3 360Camera;360Safe Camera Filter Service;c:\windows\system32\Drivers\360Camera64.sys;c:\windows\SYSNATIVE\Drivers\360Camera64.sys [x]
R3 AX88772B;ASIX AX88772B USB2.0 to Fast Ethernet Adapter;c:\windows\system32\DRIVERS\ax88772b.sys;c:\windows\SYSNATIVE\DRIVERS\ax88772b.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 iumsvc;Intel(R) Update Manager;c:\program files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe;c:\program files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [x]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys;c:\windows\SYSNATIVE\drivers\nusb3hub.sys [x]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys;c:\windows\SYSNATIVE\drivers\nusb3xhc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys;c:\windows\SYSNATIVE\DRIVERS\wdcsam64.sys [x]
R4 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe [x]
S0 excsd;ExpressCache Storage Filter Driver;c:\windows\system32\DRIVERS\excsd.sys;c:\windows\SYSNATIVE\DRIVERS\excsd.sys [x]
S0 iaStorA;iaStorA;c:\windows\system32\DRIVERS\iaStorA.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorA.sys [x]
S0 iaStorF;iaStorF;c:\windows\system32\DRIVERS\iaStorF.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorF.sys [x]
S0 iusb3hcs;Intel(R) USB 3.0 Hostcontroller-Switchtreiber;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S0 SamsungRapidDiskFltr;SAMSUNG RAPID Mode Disk Filter Driver;c:\windows\system32\DRIVERS\SamsungRapidDiskFltr.sys;c:\windows\SYSNATIVE\DRIVERS\SamsungRapidDiskFltr.sys [x]
S0 SamsungRapidFSFltr;SamsungRapidFSFltr;c:\windows\system32\DRIVERS\SamsungRapidFSFltr.sys;c:\windows\SYSNATIVE\DRIVERS\SamsungRapidFSFltr.sys [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 360Box64;360Box mini-filter driver;c:\windows\system32\DRIVERS\360Box64.sys;c:\windows\SYSNATIVE\DRIVERS\360Box64.sys [x]
S1 360fsflt;360FsFlt mini-filter driver;c:\windows\system32\DRIVERS\360FsFlt.sys;c:\windows\SYSNATIVE\DRIVERS\360FsFlt.sys [x]
S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [x]
S1 BAPIDRV;BAPIDRV;c:\windows\system32\DRIVERS\BAPIDRV64.sys;c:\windows\SYSNATIVE\DRIVERS\BAPIDRV64.sys [x]
S1 excfs;ExpressCache File System Filter Driver;c:\windows\system32\DRIVERS\excfs.sys;c:\windows\SYSNATIVE\DRIVERS\excfs.sys [x]
S1 Uim_DEVIM;UIM Direct Device Image Plugin;c:\windows\system32\DRIVERS\uim_devim.sys;c:\windows\SYSNATIVE\DRIVERS\uim_devim.sys [x]
S2 360rp;360 Internet Security Real-time Protection Loading Service;c:\program files\360\360 Internet Security\360rps.exe;c:\program files\360\360 Internet Security\360rps.exe [x]
S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [x]
S2 DptfParticipantProcessorService;Intel(R) Dynamic Platform & Thermal Framework Processor Participant Service Application;c:\windows\SysWOW64\DptfParticipantProcessorService.exe;c:\windows\SysWOW64\DptfParticipantProcessorService.exe [x]
S2 DptfPolicyConfigTDPService;Intel(R) Dynamic Platform & Thermal Framework Config TDP Service Application;c:\windows\SysWOW64\DptfPolicyConfigTDPService.exe;c:\windows\SysWOW64\DptfPolicyConfigTDPService.exe [x]
S2 ExpressCache;ExpressCache;c:\program files\Diskeeper Corporation\ExpressCache\ExpressCache.exe;c:\program files\Diskeeper Corporation\ExpressCache\ExpressCache.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 Intel(R) ME Service;Intel(R) ME Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 SamsungRapidSvc;Samsung RAPID Mode Service;c:\windows\system32\RAPID\SamsungRapidSvc.exe;c:\windows\SYSNATIVE\RAPID\SamsungRapidSvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 ZhuDongFangYu;Proactive Defence;c:\program files\360\360 Internet Security\deepscan\QHActiveDefense.exe;c:\program files\360\360 Internet Security\deepscan\QHActiveDefense.exe [x]
S3 acpials;ALS-Sensorfilter;c:\windows\system32\DRIVERS\acpials.sys;c:\windows\SYSNATIVE\DRIVERS\acpials.sys [x]
S3 AiCharger;ASUS Charger Driver;c:\windows\system32\DRIVERS\AiCharger.sys;c:\windows\SYSNATIVE\DRIVERS\AiCharger.sys [x]
S3 ATP;ASUS Input Device;c:\windows\system32\DRIVERS\AsusTP.sys;c:\windows\SYSNATIVE\DRIVERS\AsusTP.sys [x]
S3 DptfDevDram;DptfDevDram;c:\windows\system32\DRIVERS\DptfDevDram.sys;c:\windows\SYSNATIVE\DRIVERS\DptfDevDram.sys [x]
S3 DptfDevFan;DptfDevFan;c:\windows\system32\DRIVERS\DptfDevFan.sys;c:\windows\SYSNATIVE\DRIVERS\DptfDevFan.sys [x]
S3 DptfDevGen;DptfDevGen;c:\windows\system32\DRIVERS\DptfDevGen.sys;c:\windows\SYSNATIVE\DRIVERS\DptfDevGen.sys [x]
S3 DptfDevPch;DptfDevPch;c:\windows\system32\DRIVERS\DptfDevPch.sys;c:\windows\SYSNATIVE\DRIVERS\DptfDevPch.sys [x]
S3 DptfDevProc;DptfDevProc;c:\windows\system32\DRIVERS\DptfDevProc.sys;c:\windows\SYSNATIVE\DRIVERS\DptfDevProc.sys [x]
S3 DptfManager;DptfManager;c:\windows\system32\DRIVERS\DptfManager.sys;c:\windows\SYSNATIVE\DRIVERS\DptfManager.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 iusb3hub;Intel(R) USB 3.0-Hubtreiber;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible-Hostcontrollertreiber;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUVStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUVStor.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2014-12-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-26 22:49]
.
2014-12-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-03-28 13:12]
.
2014-12-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-03-28 13:12]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 164760 ----a-w- c:\users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 164760 ----a-w- c:\users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 164760 ----a-w- c:\users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 164760 ----a-w- c:\users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2014-10-21 16:52 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2014-10-21 16:52 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2014-10-21 16:52 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2014-10-21 16:52 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2014-10-21 16:52 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-08-16 170304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-08-16 398656]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-08-16 440640]
"SamsungRapidApp"="c:\program files (x86)\Samsung\RAPID\CacheFilter\SamsungRapidApp.exe" [2013-07-29 109280]
"360sd"="c:\program files\360\360 Internet Security\360sdrun.exe" [2014-04-16 287560]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = localhost:8080
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Alles mit FDM herunterladen - file://c:\program files (x86)\Free Download Manager\dlall.htm
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Auswahl mit FDM herunterladen - file://c:\program files (x86)\Free Download Manager\dlselected.htm
IE: Datei mit FDM herunterladen - file://c:\program files (x86)\Free Download Manager\dllink.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Videos mit FDM herunterladen - file://c:\program files (x86)\Free Download Manager\dlfvideo.htm
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\FUL\AppData\Roaming\Mozilla\Firefox\Profiles\15j8bd6f.default\
FF - prefs.js: network.proxy.type - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM-Run-DptfPolicyLpmServiceHelper - c:\windows\SysWOW64\DptfPolicyLpmServiceHelper.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_239_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_239_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_239_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_239_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_239.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.15"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_239.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_239.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_239.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
c:\program files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-12-06 11:43:11 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2014-12-06 10:43
.
Vor Suchlauf: 13 Verzeichnis(se), 198.885.158.912 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 199.136.694.272 Bytes frei
.
- - End Of File - - D91016E9795E04C6DC2FC2D97A3F4E14
5FB38429D5D77768867C76DCBDB35194
|
|
07.12.2014, 09:29
| #6 |
| /// the machine /// TB-Ausbilder | Win7 64bit - Spyware.Zbot.ED bzw. HEUR/QVM03.0.Malware.Gen gefunden durch Malwarebytes bzw. 360 Internet Security Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ --> Win7 64bit - Spyware.Zbot.ED bzw. HEUR/QVM03.0.Malware.Gen gefunden durch Malwarebytes bzw. 360 Internet Security |
|
07.12.2014, 16:30
| #7 |
| | Win7 64bit - Spyware.Zbot.ED bzw. HEUR/QVM03.0.Malware.Gen gefunden durch Malwarebytes bzw. 360 Internet Security Vielen Dank für die Hilfe! Anbei die Logs: Code:
ATTFilter # AdwCleaner v4.103 - Bericht erstellt am 07/12/2014 um 14:48:53
# Aktualisiert 01/12/2014 von Xplode
# Database : 2014-12-03.1 [Live]
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : FUL - UX32VD
# Gestartet von : C:\Users\FUL\Downloads\AdwCleaner_4.103.exe
# Option : Löschen
***** [ Dienste ] *****
[#] Dienst Gelöscht : {2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64
***** [ Dateien / Ordner ] *****
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16521
-\\ Mozilla Firefox v33.1.1 (x86 de)
*************************
AdwCleaner[R0].txt - [1172 octets] - [04/12/2014 23:55:39]
AdwCleaner[R1].txt - [947 octets] - [05/12/2014 00:03:35]
AdwCleaner[R2].txt - [1016 octets] - [07/12/2014 14:47:45]
AdwCleaner[S0].txt - [1183 octets] - [05/12/2014 00:01:27]
AdwCleaner[S1].txt - [943 octets] - [07/12/2014 14:48:53]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1002 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.0 (11.29.2014:1)
OS: Windows 7 Professional x64
Ran by FUL on 07.12.2014 at 14:52:00,38
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\util wiseenhance
~~~ Files
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 07.12.2014 at 14:55:02,07
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-12-2014 01
Ran by FUL (administrator) on UX32VD on 07-12-2014 15:18:44
Running from C:\Users\FUL\Downloads
Loaded Profiles: FUL & UpdatusUser (Available profiles: FUL & UpdatusUser)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(Qihu 360 Software Co., Ltd.) C:\Program Files\360\360 Internet Security\360rps.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Qihu 360 Software Co., Ltd.) C:\Program Files\360\360 Internet Security\deepscan\QHActiveDefense.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Windows\SysWOW64\DptfParticipantProcessorService.exe
() C:\Windows\SysWOW64\DptfPolicyConfigTDPService.exe
(Diskeeper Corporation) C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Samsung Electronics Co., Ltd.) C:\Windows\System32\RAPID\SamsungRapidSvc.exe
(Rocket Division Software) C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\RAPID\CacheFilter\SamsungRapidApp.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Canon Inc.) C:\Program Files (x86)\Canon\SELPHY Photo Print\CIC_SPPhelper.exe
(Qihu 360 Software Co., Ltd.) C:\Program Files\360\360 Internet Security\360sd.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Dropbox, Inc.) C:\Users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Qihu 360 Software Co., Ltd.) C:\Program Files\360\360 Internet Security\360rp.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(CANON INC.) C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Qihu 360 Software Co., Ltd.) C:\Program Files\360\360 Internet Security\safemon\360Tray.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [DptfPolicyLpmServiceHelper] => C:\Windows\SysWOW64\DptfPolicyLpmServiceHelper.exe
HKLM\...\Run: [SamsungRapidApp] => C:\Program Files (x86)\Samsung\RAPID\CacheFilter\SamsungRapidApp.exe [109280 2013-07-29] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [360sd] => C:\Program Files\360\360 Internet Security\360sdrun.exe [287560 2014-04-16] (Qihu 360 Software Co., Ltd.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-05-21] (Intel Corporation)
HKLM-x32\...\Run: [ATKOSD2] => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [406328 2013-09-09] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [205624 2013-05-30] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41336 2014-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840568 2014-05-08] (Adobe Systems Inc.)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2014-01-10] ()
HKLM-x32\...\Run: [IJNetworkScanUtility] => C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe [206240 2010-08-24] (CANON INC.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-965061589-1977914162-274574225-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-08-07] (Apple Inc.)
HKU\S-1-5-21-965061589-1977914162-274574225-1000\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2014-08-14] (Apple Inc.)
HKU\S-1-5-21-965061589-1977914162-274574225-1000\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22869088 2014-10-21] (Google)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [247144 2012-08-01] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [202600 2012-08-01] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SELPHY Photo Print Launcher.lnk
ShortcutTarget: SELPHY Photo Print Launcher.lnk -> C:\Program Files (x86)\Canon\SELPHY Photo Print\CIC_SPPhelper.exe (Canon Inc.)
Startup: C:\Users\FUL\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CC-Bewegungen Europaeische Reisevers vsnr407019265DEU.pdf - Verknüpfung.lnk
ShortcutTarget: CC-Bewegungen Europaeische Reisevers vsnr407019265DEU.pdf - Verknüpfung.lnk -> C:\Users\FUL\Desktop\CC-Bewegungen Europaeische Reisevers vsnr407019265DEU.pdf ()
Startup: C:\Users\FUL\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-965061589-1977914162-274574225-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyServer: [S-1-5-21-965061589-1977914162-274574225-1000] => localhost:8080
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-965061589-1977914162-274574225-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-965061589-1977914162-274574225-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 -> DefaultScope value is missing.
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: SafeMon Class -> {B69F34DD-F0F9-42DC-9EDD-957187DA688D} -> C:\Program Files\360\360 Internet Security\safemon\safemon64.dll (Qihu 360 Software Co., Ltd.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Free Download Manager -> {CC59E0F9-7E43-44FA-9FAA-8377850BF205} -> C:\Program Files (x86)\Free Download Manager\iefdm2.dll (FreeDownloadManager.ORG)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\FUL\AppData\Roaming\Mozilla\Firefox\Profiles\15j8bd6f.default
FF NetworkProxy: "socks_remote_dns", true
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_239.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_239.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Avira Browser Safety - C:\Users\FUL\AppData\Roaming\Mozilla\Firefox\Profiles\15j8bd6f.default\Extensions\abs@avira.com [2014-11-20]
FF Extension: FoxyProxy Standard - C:\Users\FUL\AppData\Roaming\Mozilla\Firefox\Profiles\15j8bd6f.default\Extensions\foxyproxy@eric.h.jung [2014-09-07]
FF Extension: DownloadHelper - C:\Users\FUL\AppData\Roaming\Mozilla\Firefox\Profiles\15j8bd6f.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-09-07]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2014-03-26]
FF Extension: Free Download Manager plugin - C:\ProgramData\Free Download Manager\Firefox\Extensions\1.6.0.8 [2014-11-23]
FF Extension: No Name - web2pdfextension@web2pdf.adobedotcom [Not Found]
FF Extension: No Name - fdm_ffext@freedownloadmanager.org [Not Found]
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 360rp; C:\Program Files\360\360 Internet Security\360rps.exe [310352 2014-04-16] (Qihu 360 Software Co., Ltd.)
R2 DptfParticipantProcessorService; C:\Windows\SysWOW64\DptfParticipantProcessorService.exe [18944 2012-02-20] ()
R2 DptfPolicyConfigTDPService; C:\Windows\SysWOW64\DptfPolicyConfigTDPService.exe [19968 2012-02-20] ()
R2 ExpressCache; C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe [79664 2012-03-30] (Diskeeper Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-02-28] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
R2 SamsungRapidSvc; C:\Windows\System32\RAPID\SamsungRapidSvc.exe [27360 2013-07-29] (Samsung Electronics Co., Ltd.)
S3 scan; C:\Program Files\360\360 Internet Security\scan.dll [420424 2014-04-25] (S.C. BitDefender S.R.L)
R2 StarWindServiceAE; C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [275968 2007-05-28] (Rocket Division Software) [File not signed]
R2 ZhuDongFangYu; C:\Program Files\360\360 Internet Security\deepscan\QHActiveDefense.exe [236360 2014-04-23] (Qihu 360 Software Co., Ltd.)
S4 AntiVirWebService; "C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe" [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 360AntiHacker; C:\Windows\System32\Drivers\360AntiHacker64.sys [97872 2014-04-21] (Qihu 360 Software Co., Ltd.)
R3 360AvFlt; C:\Windows\System32\DRIVERS\360AvFlt.sys [67664 2014-04-23] (Qihu 360 Software Co., Ltd.)
R1 360Box64; C:\Windows\System32\DRIVERS\360Box64.sys [305744 2014-04-29] (Qihu 360 Software Co., Ltd.)
R1 360Camera; C:\Windows\System32\Drivers\360Camera64.sys [41552 2014-04-29] (Qihu 360 Software Co., Ltd.)
R1 360fsflt; C:\Windows\System32\DRIVERS\360FsFlt.sys [304208 2014-05-07] (Qihu 360 Software Co., Ltd.)
R3 ATP; C:\Windows\System32\DRIVERS\AsusTP.sys [65784 2013-02-06] (ASUS Corporation)
S3 AX88772B; C:\Windows\System32\DRIVERS\ax88772b.sys [110592 2012-04-05] (ASIX Electronics Corp.)
R1 BAPIDRV; C:\Windows\System32\DRIVERS\BAPIDRV64.sys [180816 2014-04-18] (Qihu 360 Software Co., Ltd.)
R3 DptfDevDram; C:\Windows\System32\DRIVERS\DptfDevDram.sys [107288 2012-02-20] (Intel Corporation)
R3 DptfDevFan; C:\Windows\System32\DRIVERS\DptfDevFan.sys [42776 2012-02-20] (Intel Corporation)
R3 DptfDevGen; C:\Windows\System32\DRIVERS\DptfDevGen.sys [64792 2012-02-20] (Intel Corporation)
R3 DptfDevPch; C:\Windows\System32\DRIVERS\DptfDevPch.sys [96024 2012-02-20] (Intel Corporation)
R3 DptfDevProc; C:\Windows\System32\DRIVERS\DptfDevProc.sys [220952 2012-02-20] (Intel Corporation)
R3 DptfManager; C:\Windows\System32\DRIVERS\DptfManager.sys [357656 2012-02-20] (Intel Corporation)
R1 excfs; C:\Windows\System32\DRIVERS\excfs.sys [23344 2012-03-30] (Diskeeper Corporation)
R0 excsd; C:\Windows\System32\DRIVERS\excsd.sys [95024 2012-03-30] (Diskeeper Corporation)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28656 2013-03-25] (Intel Corporation)
R0 SamsungRapidDiskFltr; C:\Windows\System32\DRIVERS\SamsungRapidDiskFltr.sys [240864 2013-07-29] (Samsung Electronics Co., Ltd.)
R0 SamsungRapidFSFltr; C:\Windows\System32\DRIVERS\SamsungRapidFSFltr.sys [111328 2013-07-29] (Samsung Electronics Co., Ltd.)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-03-26] (Duplex Secure Ltd.)
R1 UimBus; C:\Windows\System32\DRIVERS\UimBus.sys [102664 2014-01-23] ()
R1 Uim_DEVIM; C:\Windows\System32\DRIVERS\uim_devim.sys [25992 2014-01-23] ()
R1 Uim_IM; C:\Windows\System32\DRIVERS\uim_im.sys [700680 2014-01-23] ()
U3 ajg89dsc; C:\Windows\System32\Drivers\ajg89dsc.sys [0 ] (Intel Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-07 15:18 - 2014-12-07 15:18 - 00000000 ____D () C:\Users\FUL\Downloads\FRST-OlderVersion
2014-12-07 14:55 - 2014-12-07 14:55 - 00000754 _____ () C:\Users\FUL\Desktop\JRT.txt
2014-12-07 14:46 - 2014-12-07 14:46 - 02154496 _____ () C:\Users\FUL\Downloads\AdwCleaner_4.103.exe
2014-12-07 14:44 - 2014-12-07 14:44 - 01707646 _____ (Thisisu) C:\Users\FUL\Downloads\JRT.exe
2014-12-06 12:04 - 2014-12-06 12:03 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-12-06 12:03 - 2014-12-06 12:03 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-12-06 12:03 - 2014-12-06 12:03 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-12-06 12:03 - 2014-12-06 12:03 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-12-06 11:21 - 2014-12-06 11:21 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-12-06 11:21 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-12-06 11:21 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-12-06 11:21 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-12-06 11:21 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-12-06 11:21 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-12-06 11:21 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-12-06 11:21 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-12-06 11:21 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-12-06 11:19 - 2014-12-06 11:43 - 00000000 ____D () C:\Qoobox
2014-12-06 11:19 - 2014-12-06 11:40 - 00000000 ____D () C:\Windows\erdnt
2014-12-06 11:18 - 2014-12-06 11:18 - 05600479 ____R (Swearware) C:\Users\FUL\Downloads\ComboFix.exe
2014-12-05 01:52 - 2014-12-05 01:52 - 00380416 _____ () C:\Users\FUL\Downloads\Gmer-19357.exe
2014-12-05 01:50 - 2014-12-07 15:18 - 00021204 _____ () C:\Users\FUL\Downloads\FRST.txt
2014-12-05 01:50 - 2014-12-07 15:18 - 00000000 ____D () C:\FRST
2014-12-05 01:50 - 2014-12-05 01:51 - 00025182 _____ () C:\Users\FUL\Downloads\Addition.txt
2014-12-05 01:49 - 2014-12-07 15:18 - 02119680 _____ (Farbar) C:\Users\FUL\Downloads\FRST64.exe
2014-12-05 01:49 - 2014-12-07 15:15 - 00000000 ____D () C:\Users\FUL\Desktop\trojanerboard
2014-12-05 01:09 - 2014-12-05 01:09 - 00050477 _____ () C:\Users\FUL\Downloads\Defogger.exe
2014-12-05 00:57 - 2009-06-10 22:00 - 00000824 _____ () C:\Windows\system32\Drivers\etc\hosts.20141205-005700.backup
2014-12-05 00:39 - 2014-05-14 10:40 - 00022992 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\efimon.sys
2014-12-05 00:38 - 2014-12-07 14:46 - 00000000 ____D () C:\Users\FUL\AppData\Roaming\360safe
2014-12-05 00:38 - 2014-12-05 00:38 - 00000974 _____ () C:\Users\Public\Desktop\360 Internet Security.lnk
2014-12-05 00:38 - 2014-12-05 00:38 - 00000000 _RSHD () C:\360SANDBOX
2014-12-05 00:38 - 2014-12-05 00:38 - 00000000 ____D () C:\Users\FUL\AppData\Roaming\360SD
2014-12-05 00:38 - 2014-12-05 00:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\360 Internet Security
2014-12-05 00:38 - 2014-12-05 00:38 - 00000000 ____D () C:\ProgramData\360SD
2014-12-05 00:38 - 2014-12-05 00:38 - 00000000 ____D () C:\Program Files\360
2014-12-05 00:38 - 2014-05-07 10:44 - 00304208 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\360FsFlt.sys
2014-12-05 00:38 - 2014-04-29 07:20 - 00305744 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\360Box64.sys
2014-12-05 00:38 - 2014-04-29 04:50 - 00041552 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\360Camera64.sys
2014-12-05 00:38 - 2014-04-23 09:32 - 00067664 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\360AvFlt.sys
2014-12-05 00:38 - 2014-04-21 07:38 - 00097872 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\360AntiHacker64.sys
2014-12-05 00:38 - 2014-04-18 07:42 - 00180816 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\BAPIDRV64.SYS
2014-12-05 00:13 - 2014-12-05 00:13 - 00000000 ____D () C:\Windows\ERUNT
2014-12-05 00:06 - 2014-12-05 00:13 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-12-04 23:55 - 2014-12-07 14:48 - 00000000 ____D () C:\AdwCleaner
2014-12-04 22:41 - 2014-12-04 22:41 - 00000000 ____D () C:\OETemp
2014-12-04 22:40 - 2014-12-04 22:40 - 00000000 _____ () C:\ProgramData\rebootpending.txt
2014-12-04 22:36 - 2014-12-06 11:34 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-12-04 22:36 - 2014-12-06 11:21 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-12-04 22:34 - 2014-12-04 22:38 - 168558440 _____ (Qihu 360 Software Co., Ltd.) C:\Users\FUL\Downloads\360is_4.9.0.4902H.exe
2014-12-04 13:53 - 2014-12-05 14:50 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-04 13:52 - 2014-12-04 13:52 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-12-04 13:52 - 2014-12-04 13:52 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-04 13:52 - 2014-12-04 13:52 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-12-04 13:52 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-04 13:52 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-12-04 13:52 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-12-04 13:41 - 2014-12-04 13:42 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\FUL\Downloads\spybot-2.4.exe
2014-12-04 13:40 - 2014-12-04 13:40 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\FUL\Downloads\mbam-setup-2.0.4.1028.exe
2014-12-02 23:41 - 2014-12-02 23:43 - 57358008 _____ (ZONER software ) C:\Users\FUL\Downloads\zps16_de_pro_chip.exe
2014-12-02 20:23 - 2014-12-02 20:23 - 00026729 _____ () C:\Users\FUL\Downloads\Bluewolf495-40.rec[https___truestracker.de].torrent
2014-12-02 20:23 - 2014-12-02 20:23 - 00026729 _____ () C:\Users\FUL\Downloads\Bluewolf495-39.rec[https___truestracker.de].torrent
2014-12-02 20:23 - 2014-12-02 20:23 - 00026529 _____ () C:\Users\FUL\Downloads\Bluewolf438-44.rec[https___truestracker.de].torrent
2014-12-02 20:22 - 2014-12-02 20:22 - 00028189 _____ () C:\Users\FUL\Downloads\Bluewolf596-13.rec[https___truestracker.de].torrent
2014-12-02 20:22 - 2014-12-02 20:22 - 00028168 _____ () C:\Users\FUL\Downloads\Bluewolf596-7.rec[https___truestracker.de].torrent
2014-12-02 20:22 - 2014-12-02 20:22 - 00028028 _____ () C:\Users\FUL\Downloads\Bluewolf596-8.rec[https___truestracker.de].torrent
2014-12-02 20:22 - 2014-12-02 20:22 - 00028009 _____ () C:\Users\FUL\Downloads\Bluewolf596-14.rec[https___truestracker.de].torrent
2014-12-02 20:22 - 2014-12-02 20:22 - 00027950 _____ () C:\Users\FUL\Downloads\Bluewolf596-8-2.rec[https___truestracker.de].torrent
2014-12-02 20:22 - 2014-12-02 20:22 - 00026669 _____ () C:\Users\FUL\Downloads\Bluewolf438-42.rec[https___truestracker.de].torrent
2014-12-02 20:22 - 2014-12-02 20:22 - 00026489 _____ () C:\Users\FUL\Downloads\Bluewolf438-41.rec[https___truestracker.de].torrent
2014-12-02 20:22 - 2014-12-02 20:22 - 00026349 _____ () C:\Users\FUL\Downloads\Bluewolf438-43.rec[https___truestracker.de].torrent
2014-12-02 16:27 - 2014-12-02 16:27 - 02996728 _____ (Crystal Dew World ) C:\Users\FUL\Downloads\CrystalDiskInfo6_2_1.exe
2014-12-02 16:27 - 2014-12-02 16:27 - 00001186 _____ () C:\Users\FUL\Desktop\CrystalDiskInfo.lnk
2014-12-02 16:27 - 2014-12-02 16:27 - 00000000 ____D () C:\Program Files (x86)\CrystalDiskInfo
2014-12-02 15:14 - 2014-12-02 15:19 - 00000000 ____D () C:\Users\FUL\Desktop\FireTV
2014-12-01 14:12 - 2014-12-01 14:27 - 00000000 ____D () C:\Users\FUL\AppData\Local\Amazon_FireTV_Utility_App
2014-12-01 14:11 - 2014-12-01 14:11 - 00000000 ____D () C:\Users\FUL\.android
2014-11-30 16:19 - 2014-11-30 16:19 - 00000263 _____ () C:\Users\FUL\Desktop\Musterschreiben%20R%C3%BCckforderung%20Bearbeitungsentgelt_207294.log
2014-11-26 22:04 - 2014-11-26 22:04 - 00035849 _____ () C:\Users\FUL\Downloads\Bluewolf494-22.rec[https___truestracker.de].torrent
2014-11-26 22:04 - 2014-11-26 22:04 - 00027048 _____ () C:\Users\FUL\Downloads\Bluewolf600.rec[https___truestracker.de].torrent
2014-11-24 23:48 - 2014-11-24 23:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-11-08 21:27 - 2014-11-08 21:27 - 00000000 ____D () C:\Users\Default\AppData\Local\Google
2014-11-08 21:27 - 2014-11-08 21:27 - 00000000 ____D () C:\Users\Default User\AppData\Local\Google
2014-11-07 08:35 - 2014-11-07 08:35 - 01054912 _____ (Adobe) C:\Users\FUL\Downloads\install_flashplayer15x32au_mssd_aaa_aih.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-07 15:17 - 2014-09-23 11:37 - 00000000 ___RD () C:\Users\FUL\Desktop\Google Drive
2014-12-07 15:17 - 2014-03-25 22:39 - 00000000 ___RD () C:\Users\FUL\Desktop\Dropbox
2014-12-07 15:17 - 2014-03-25 22:36 - 00000000 ____D () C:\Users\FUL\AppData\Roaming\Dropbox
2014-12-07 15:16 - 2014-03-28 14:12 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-12-07 15:16 - 2014-03-26 12:20 - 00000433 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-12-07 15:16 - 2014-03-25 09:47 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-12-07 15:16 - 2010-11-21 04:47 - 00264098 _____ () C:\Windows\PFRO.log
2014-12-07 15:16 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-07 15:16 - 2009-07-14 05:51 - 00044999 _____ () C:\Windows\setupact.log
2014-12-07 15:15 - 2014-03-24 22:12 - 01319258 _____ () C:\Windows\WindowsUpdate.log
2014-12-07 14:56 - 2009-07-14 05:45 - 00026720 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-07 14:56 - 2009-07-14 05:45 - 00026720 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-07 14:55 - 2014-03-25 07:06 - 00709888 _____ () C:\Windows\system32\perfh007.dat
2014-12-07 14:55 - 2014-03-25 07:06 - 00153014 _____ () C:\Windows\system32\perfc007.dat
2014-12-07 14:55 - 2009-07-14 06:13 - 01626984 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-07 14:52 - 2014-03-28 14:12 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-12-07 14:49 - 2014-06-12 10:51 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-12-06 12:12 - 2014-04-26 10:13 - 00000000 ____D () C:\ProgramData\Oracle
2014-12-06 11:34 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-12-06 11:21 - 2009-07-14 04:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools
2014-12-05 14:54 - 2014-03-25 09:47 - 00000000 ____D () C:\temp
2014-12-05 02:49 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-05 02:48 - 2014-08-14 08:30 - 00000000 ____D () C:\Windows\Minidump
2014-12-05 02:48 - 2014-03-24 22:07 - 00335509 ____N () C:\Windows\Minidump\120514-11934-01.dmp
2014-12-05 02:48 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Registration
2014-12-05 01:10 - 2014-03-24 22:11 - 00000000 ____D () C:\Users\FUL\AppData\Local\VirtualStore
2014-12-05 00:37 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\sysprep
2014-12-05 00:35 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\schemas
2014-12-05 00:05 - 2014-05-25 10:04 - 00000000 ____D () C:\Users\FUL\Downloads\Malware remover
2014-12-04 23:48 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Vss
2014-12-04 22:41 - 2014-03-25 09:23 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-12-04 16:48 - 2014-03-24 22:11 - 00000000 ____D () C:\Users\FUL
2014-12-04 15:16 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system
2014-12-04 15:15 - 2014-03-27 16:13 - 00000000 ____D () C:\Users\FUL\AppData\Roaming\vlc
2014-12-04 12:02 - 2012-08-30 14:04 - 00000000 ____D () C:\Users\FUL\Documents\Outlook-Dateien
2014-12-04 12:00 - 2014-03-28 23:38 - 00000000 ____D () C:\Users\FUL\AppData\Local\4610B230-FA09-4F6C-BD9C-AE65706B9057.aplzod
2014-12-02 18:18 - 2014-03-28 10:37 - 00038912 _____ () C:\Users\FUL\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-12-02 18:18 - 2014-03-28 10:28 - 00000000 ____D () C:\Users\FUL\AppData\Local\ColdCut
2014-12-02 18:00 - 2014-03-20 11:28 - 00000000 ____D () C:\Users\FUL\Desktop\UDOO
2014-12-01 14:26 - 2014-04-27 11:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-11-30 16:22 - 2014-04-26 14:20 - 00000000 ____D () C:\Users\FUL\AppData\Roaming\Free Download Manager
2014-11-25 23:49 - 2014-06-12 10:51 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-11-25 23:49 - 2014-03-26 12:18 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-11-25 23:49 - 2014-03-26 12:18 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-11-24 19:02 - 2014-03-25 22:53 - 00000000 ____D () C:\Users\FUL\AppData\Roaming\uTorrent
2014-11-18 15:08 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-11-18 10:46 - 2014-03-28 14:12 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-11-18 10:46 - 2014-03-28 14:12 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-11-13 11:07 - 2014-03-28 09:27 - 00000000 ____D () C:\Users\FUL\AppData\Local\Apple Computer
2014-11-13 04:48 - 2014-09-23 18:31 - 00000000 ____D () C:\Users\FUL\Desktop\iPad mini Backup 2014.09.23
2014-11-10 09:59 - 2013-08-23 11:36 - 00000000 ____D () C:\Users\FUL\Documents\#Vorlagen
2014-11-08 21:28 - 2014-09-23 11:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
Some content of TEMP:
====================
C:\Users\FUL\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpn2lgsv.dll
C:\Users\FUL\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
C:\Users\FUL\AppData\Local\Temp\Quarantine.exe
C:\Users\FUL\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-12-05 01:29
==================== End Of Log ============================
--- --- --- Schönen Sonntag noch! |
|
08.12.2014, 14:54
| #8 |
| /// the machine /// TB-Ausbilder | Win7 64bit - Spyware.Zbot.ED bzw. HEUR/QVM03.0.Malware.Gen gefunden durch Malwarebytes bzw. 360 Internet SecurityESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
09.12.2014, 01:07
| #9 |
| | Win7 64bit - Spyware.Zbot.ED bzw. HEUR/QVM03.0.Malware.Gen gefunden durch Malwarebytes bzw. 360 Internet Security Hallo Schrauber, hier sind die neuen Logs: Code:
ATTFilter # product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=f91db4e16414cc4fbd29616263187ebf
# engine=21458
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-12-08 10:59:06
# local_time=2014-12-08 11:59:06 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 22342519 169709396 0 0
# compatibility_mode_1='360 Internet Security'
# compatibility_mode=16386 16777213 100 100 0 56804953 0 0
# scanned=236941
# found=0
# cleaned=0
# scan_time=5578
Code:
ATTFilter Results of screen317's Security Check version 0.99.91
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
360 Internet Security
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Java 7 Update 71
Adobe Flash Player 15.0.0.239
Mozilla Firefox (33.1.1)
````````Process Check: objlist.exe by Laurent````````
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-12-2014 01
Ran by FUL (administrator) on UX32VD on 09-12-2014 00:55:59
Running from C:\Users\FUL\Downloads\Malware remover
Loaded Profiles: FUL & UpdatusUser (Available profiles: FUL & UpdatusUser)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Qihu 360 Software Co., Ltd.) C:\Program Files\360\360 Internet Security\360rps.exe
(Qihu 360 Software Co., Ltd.) C:\Program Files\360\360 Internet Security\deepscan\QHActiveDefense.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Windows\SysWOW64\DptfParticipantProcessorService.exe
() C:\Windows\SysWOW64\DptfPolicyConfigTDPService.exe
(Diskeeper Corporation) C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Samsung Electronics Co., Ltd.) C:\Windows\System32\RAPID\SamsungRapidSvc.exe
(Rocket Division Software) C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\RAPID\CacheFilter\SamsungRapidApp.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Canon Inc.) C:\Program Files (x86)\Canon\SELPHY Photo Print\CIC_SPPhelper.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(Qihu 360 Software Co., Ltd.) C:\Program Files\360\360 Internet Security\360sd.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat.exe
(Dropbox, Inc.) C:\Users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Qihu 360 Software Co., Ltd.) C:\Program Files\360\360 Internet Security\360rp.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(CANON INC.) C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Qihu 360 Software Co., Ltd.) C:\Program Files\360\360 Internet Security\safemon\360Tray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [DptfPolicyLpmServiceHelper] => C:\Windows\SysWOW64\DptfPolicyLpmServiceHelper.exe
HKLM\...\Run: [SamsungRapidApp] => C:\Program Files (x86)\Samsung\RAPID\CacheFilter\SamsungRapidApp.exe [109280 2013-07-29] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [360sd] => C:\Program Files\360\360 Internet Security\360sdrun.exe [287560 2014-04-16] (Qihu 360 Software Co., Ltd.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-05-21] (Intel Corporation)
HKLM-x32\...\Run: [ATKOSD2] => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [406328 2013-09-09] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [205624 2013-05-30] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41336 2014-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840568 2014-05-08] (Adobe Systems Inc.)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2014-01-10] ()
HKLM-x32\...\Run: [IJNetworkScanUtility] => C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe [206240 2010-08-24] (CANON INC.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-965061589-1977914162-274574225-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-08-07] (Apple Inc.)
HKU\S-1-5-21-965061589-1977914162-274574225-1000\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2014-08-14] (Apple Inc.)
HKU\S-1-5-21-965061589-1977914162-274574225-1000\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22869088 2014-10-21] (Google)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [247144 2012-08-01] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [202600 2012-08-01] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SELPHY Photo Print Launcher.lnk
ShortcutTarget: SELPHY Photo Print Launcher.lnk -> C:\Program Files (x86)\Canon\SELPHY Photo Print\CIC_SPPhelper.exe (Canon Inc.)
Startup: C:\Users\FUL\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CC-Bewegungen Europaeische Reisevers vsnr407019265DEU.pdf - Verknüpfung.lnk
ShortcutTarget: CC-Bewegungen Europaeische Reisevers vsnr407019265DEU.pdf - Verknüpfung.lnk -> C:\Users\FUL\Desktop\CC-Bewegungen Europaeische Reisevers vsnr407019265DEU.pdf ()
Startup: C:\Users\FUL\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-965061589-1977914162-274574225-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyServer: [S-1-5-21-965061589-1977914162-274574225-1000] => localhost:8080
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-965061589-1977914162-274574225-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-965061589-1977914162-274574225-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 -> DefaultScope value is missing.
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: SafeMon Class -> {B69F34DD-F0F9-42DC-9EDD-957187DA688D} -> C:\Program Files\360\360 Internet Security\safemon\safemon64.dll (Qihu 360 Software Co., Ltd.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Free Download Manager -> {CC59E0F9-7E43-44FA-9FAA-8377850BF205} -> C:\Program Files (x86)\Free Download Manager\iefdm2.dll (FreeDownloadManager.ORG)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\FUL\AppData\Roaming\Mozilla\Firefox\Profiles\15j8bd6f.default
FF NetworkProxy: "socks_remote_dns", true
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_239.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_239.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Avira Browser Safety - C:\Users\FUL\AppData\Roaming\Mozilla\Firefox\Profiles\15j8bd6f.default\Extensions\abs@avira.com [2014-11-20]
FF Extension: FoxyProxy Standard - C:\Users\FUL\AppData\Roaming\Mozilla\Firefox\Profiles\15j8bd6f.default\Extensions\foxyproxy@eric.h.jung [2014-09-07]
FF Extension: DownloadHelper - C:\Users\FUL\AppData\Roaming\Mozilla\Firefox\Profiles\15j8bd6f.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-09-07]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2014-03-26]
FF Extension: Free Download Manager plugin - C:\ProgramData\Free Download Manager\Firefox\Extensions\1.6.0.8 [2014-11-23]
FF Extension: No Name - web2pdfextension@web2pdf.adobedotcom [Not Found]
FF Extension: No Name - fdm_ffext@freedownloadmanager.org [Not Found]
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 360rp; C:\Program Files\360\360 Internet Security\360rps.exe [310352 2014-04-16] (Qihu 360 Software Co., Ltd.)
R2 DptfParticipantProcessorService; C:\Windows\SysWOW64\DptfParticipantProcessorService.exe [18944 2012-02-20] ()
R2 DptfPolicyConfigTDPService; C:\Windows\SysWOW64\DptfPolicyConfigTDPService.exe [19968 2012-02-20] ()
R2 ExpressCache; C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe [79664 2012-03-30] (Diskeeper Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-02-28] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
R2 SamsungRapidSvc; C:\Windows\System32\RAPID\SamsungRapidSvc.exe [27360 2013-07-29] (Samsung Electronics Co., Ltd.)
S3 scan; C:\Program Files\360\360 Internet Security\scan.dll [420424 2014-04-25] (S.C. BitDefender S.R.L)
R2 StarWindServiceAE; C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [275968 2007-05-28] (Rocket Division Software) [File not signed]
R2 ZhuDongFangYu; C:\Program Files\360\360 Internet Security\deepscan\QHActiveDefense.exe [236360 2014-04-23] (Qihu 360 Software Co., Ltd.)
S4 AntiVirWebService; "C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe" [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 360AntiHacker; C:\Windows\System32\Drivers\360AntiHacker64.sys [97872 2014-04-21] (Qihu 360 Software Co., Ltd.)
R3 360AvFlt; C:\Windows\System32\DRIVERS\360AvFlt.sys [67664 2014-04-23] (Qihu 360 Software Co., Ltd.)
R1 360Box64; C:\Windows\System32\DRIVERS\360Box64.sys [305744 2014-04-29] (Qihu 360 Software Co., Ltd.)
R1 360Camera; C:\Windows\System32\Drivers\360Camera64.sys [41552 2014-04-29] (Qihu 360 Software Co., Ltd.)
R1 360fsflt; C:\Windows\System32\DRIVERS\360FsFlt.sys [304208 2014-05-07] (Qihu 360 Software Co., Ltd.)
R3 ATP; C:\Windows\System32\DRIVERS\AsusTP.sys [65784 2013-02-06] (ASUS Corporation)
S3 AX88772B; C:\Windows\System32\DRIVERS\ax88772b.sys [110592 2012-04-05] (ASIX Electronics Corp.)
R1 BAPIDRV; C:\Windows\System32\DRIVERS\BAPIDRV64.sys [180816 2014-04-18] (Qihu 360 Software Co., Ltd.)
R3 DptfDevDram; C:\Windows\System32\DRIVERS\DptfDevDram.sys [107288 2012-02-20] (Intel Corporation)
R3 DptfDevFan; C:\Windows\System32\DRIVERS\DptfDevFan.sys [42776 2012-02-20] (Intel Corporation)
R3 DptfDevGen; C:\Windows\System32\DRIVERS\DptfDevGen.sys [64792 2012-02-20] (Intel Corporation)
R3 DptfDevPch; C:\Windows\System32\DRIVERS\DptfDevPch.sys [96024 2012-02-20] (Intel Corporation)
R3 DptfDevProc; C:\Windows\System32\DRIVERS\DptfDevProc.sys [220952 2012-02-20] (Intel Corporation)
R3 DptfManager; C:\Windows\System32\DRIVERS\DptfManager.sys [357656 2012-02-20] (Intel Corporation)
R1 excfs; C:\Windows\System32\DRIVERS\excfs.sys [23344 2012-03-30] (Diskeeper Corporation)
R0 excsd; C:\Windows\System32\DRIVERS\excsd.sys [95024 2012-03-30] (Diskeeper Corporation)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28656 2013-03-25] (Intel Corporation)
R0 SamsungRapidDiskFltr; C:\Windows\System32\DRIVERS\SamsungRapidDiskFltr.sys [240864 2013-07-29] (Samsung Electronics Co., Ltd.)
R0 SamsungRapidFSFltr; C:\Windows\System32\DRIVERS\SamsungRapidFSFltr.sys [111328 2013-07-29] (Samsung Electronics Co., Ltd.)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-03-26] (Duplex Secure Ltd.)
R1 UimBus; C:\Windows\System32\DRIVERS\UimBus.sys [102664 2014-01-23] ()
R1 Uim_DEVIM; C:\Windows\System32\DRIVERS\uim_devim.sys [25992 2014-01-23] ()
R1 Uim_IM; C:\Windows\System32\DRIVERS\uim_im.sys [700680 2014-01-23] ()
U3 aux0ffxt; C:\Windows\System32\Drivers\aux0ffxt.sys [0 ] (Advanced Micro Devices)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-09 00:09 - 2014-12-09 00:12 - 00000000 ____D () C:\Users\FUL\Desktop\FlightCrew Proposal
2014-12-08 22:22 - 2014-12-08 22:22 - 138956888 _____ () C:\Users\FUL\Desktop\FireTV.rar
2014-12-08 21:22 - 2014-12-08 21:22 - 00852490 _____ () C:\Users\FUL\Downloads\SecurityCheck.exe
2014-12-08 21:18 - 2014-12-08 21:18 - 02347384 _____ (ESET) C:\Users\FUL\Downloads\esetsmartinstaller_deu.exe
2014-12-07 14:55 - 2014-12-07 14:55 - 00000754 _____ () C:\Users\FUL\Desktop\JRT.txt
2014-12-06 12:04 - 2014-12-06 12:03 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-12-06 12:03 - 2014-12-06 12:03 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-12-06 12:03 - 2014-12-06 12:03 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-12-06 12:03 - 2014-12-06 12:03 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-12-06 11:21 - 2014-12-06 11:21 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-12-06 11:21 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-12-06 11:21 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-12-06 11:21 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-12-06 11:21 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-12-06 11:21 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-12-06 11:21 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-12-06 11:21 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-12-06 11:21 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-12-06 11:19 - 2014-12-06 11:43 - 00000000 ____D () C:\Qoobox
2014-12-06 11:19 - 2014-12-06 11:40 - 00000000 ____D () C:\Windows\erdnt
2014-12-05 01:50 - 2014-12-09 00:56 - 00000000 ____D () C:\FRST
2014-12-05 01:49 - 2014-12-09 00:53 - 00000000 ____D () C:\Users\FUL\Desktop\trojanerboard
2014-12-05 00:57 - 2009-06-10 22:00 - 00000824 _____ () C:\Windows\system32\Drivers\etc\hosts.20141205-005700.backup
2014-12-05 00:39 - 2014-05-14 10:40 - 00022992 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\efimon.sys
2014-12-05 00:38 - 2014-12-08 21:18 - 00000000 ____D () C:\Users\FUL\AppData\Roaming\360safe
2014-12-05 00:38 - 2014-12-05 00:38 - 00000974 _____ () C:\Users\Public\Desktop\360 Internet Security.lnk
2014-12-05 00:38 - 2014-12-05 00:38 - 00000000 _RSHD () C:\360SANDBOX
2014-12-05 00:38 - 2014-12-05 00:38 - 00000000 ____D () C:\Users\FUL\AppData\Roaming\360SD
2014-12-05 00:38 - 2014-12-05 00:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\360 Internet Security
2014-12-05 00:38 - 2014-12-05 00:38 - 00000000 ____D () C:\ProgramData\360SD
2014-12-05 00:38 - 2014-12-05 00:38 - 00000000 ____D () C:\Program Files\360
2014-12-05 00:38 - 2014-05-07 10:44 - 00304208 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\360FsFlt.sys
2014-12-05 00:38 - 2014-04-29 07:20 - 00305744 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\360Box64.sys
2014-12-05 00:38 - 2014-04-29 04:50 - 00041552 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\360Camera64.sys
2014-12-05 00:38 - 2014-04-23 09:32 - 00067664 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\360AvFlt.sys
2014-12-05 00:38 - 2014-04-21 07:38 - 00097872 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\360AntiHacker64.sys
2014-12-05 00:38 - 2014-04-18 07:42 - 00180816 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\BAPIDRV64.SYS
2014-12-05 00:13 - 2014-12-05 00:13 - 00000000 ____D () C:\Windows\ERUNT
2014-12-05 00:06 - 2014-12-05 00:13 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-12-04 23:55 - 2014-12-07 14:48 - 00000000 ____D () C:\AdwCleaner
2014-12-04 22:41 - 2014-12-04 22:41 - 00000000 ____D () C:\OETemp
2014-12-04 22:40 - 2014-12-04 22:40 - 00000000 _____ () C:\ProgramData\rebootpending.txt
2014-12-04 22:36 - 2014-12-06 11:34 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-12-04 22:36 - 2014-12-06 11:21 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-12-04 13:53 - 2014-12-08 21:17 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-04 13:52 - 2014-12-04 13:52 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-12-04 13:52 - 2014-12-04 13:52 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-04 13:52 - 2014-12-04 13:52 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-12-04 13:52 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-04 13:52 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-12-04 13:52 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-12-02 23:41 - 2014-12-02 23:43 - 57358008 _____ (ZONER software ) C:\Users\FUL\Downloads\zps16_de_pro_chip.exe
2014-12-02 20:23 - 2014-12-02 20:23 - 00026729 _____ () C:\Users\FUL\Downloads\Bluewolf495-40.rec[https___truestracker.de].torrent
2014-12-02 20:23 - 2014-12-02 20:23 - 00026729 _____ () C:\Users\FUL\Downloads\Bluewolf495-39.rec[https___truestracker.de].torrent
2014-12-02 20:23 - 2014-12-02 20:23 - 00026529 _____ () C:\Users\FUL\Downloads\Bluewolf438-44.rec[https___truestracker.de].torrent
2014-12-02 20:22 - 2014-12-02 20:22 - 00028189 _____ () C:\Users\FUL\Downloads\Bluewolf596-13.rec[https___truestracker.de].torrent
2014-12-02 20:22 - 2014-12-02 20:22 - 00028168 _____ () C:\Users\FUL\Downloads\Bluewolf596-7.rec[https___truestracker.de].torrent
2014-12-02 20:22 - 2014-12-02 20:22 - 00028028 _____ () C:\Users\FUL\Downloads\Bluewolf596-8.rec[https___truestracker.de].torrent
2014-12-02 20:22 - 2014-12-02 20:22 - 00028009 _____ () C:\Users\FUL\Downloads\Bluewolf596-14.rec[https___truestracker.de].torrent
2014-12-02 20:22 - 2014-12-02 20:22 - 00027950 _____ () C:\Users\FUL\Downloads\Bluewolf596-8-2.rec[https___truestracker.de].torrent
2014-12-02 20:22 - 2014-12-02 20:22 - 00026669 _____ () C:\Users\FUL\Downloads\Bluewolf438-42.rec[https___truestracker.de].torrent
2014-12-02 20:22 - 2014-12-02 20:22 - 00026489 _____ () C:\Users\FUL\Downloads\Bluewolf438-41.rec[https___truestracker.de].torrent
2014-12-02 20:22 - 2014-12-02 20:22 - 00026349 _____ () C:\Users\FUL\Downloads\Bluewolf438-43.rec[https___truestracker.de].torrent
2014-12-02 16:27 - 2014-12-02 16:27 - 02996728 _____ (Crystal Dew World ) C:\Users\FUL\Downloads\CrystalDiskInfo6_2_1.exe
2014-12-02 16:27 - 2014-12-02 16:27 - 00001186 _____ () C:\Users\FUL\Desktop\CrystalDiskInfo.lnk
2014-12-02 16:27 - 2014-12-02 16:27 - 00000000 ____D () C:\Program Files (x86)\CrystalDiskInfo
2014-12-01 14:12 - 2014-12-01 14:27 - 00000000 ____D () C:\Users\FUL\AppData\Local\Amazon_FireTV_Utility_App
2014-12-01 14:11 - 2014-12-01 14:11 - 00000000 ____D () C:\Users\FUL\.android
2014-11-30 16:19 - 2014-11-30 16:19 - 00000263 _____ () C:\Users\FUL\Desktop\Musterschreiben%20R%C3%BCckforderung%20Bearbeitungsentgelt_207294.log
2014-11-26 22:04 - 2014-11-26 22:04 - 00035849 _____ () C:\Users\FUL\Downloads\Bluewolf494-22.rec[https___truestracker.de].torrent
2014-11-26 22:04 - 2014-11-26 22:04 - 00027048 _____ () C:\Users\FUL\Downloads\Bluewolf600.rec[https___truestracker.de].torrent
2014-11-24 23:48 - 2014-11-24 23:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-09 00:55 - 2014-05-25 10:04 - 00000000 ____D () C:\Users\FUL\Downloads\Malware remover
2014-12-09 00:51 - 2014-03-28 14:12 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-12-09 00:49 - 2014-06-12 10:51 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-12-08 23:44 - 2009-07-14 05:51 - 00045864 _____ () C:\Windows\setupact.log
2014-12-08 20:51 - 2009-07-14 05:45 - 00026720 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-08 20:51 - 2009-07-14 05:45 - 00026720 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-08 20:48 - 2014-03-25 07:06 - 00709888 _____ () C:\Windows\system32\perfh007.dat
2014-12-08 20:48 - 2014-03-25 07:06 - 00153014 _____ () C:\Windows\system32\perfc007.dat
2014-12-08 20:48 - 2009-07-14 06:13 - 01626984 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-08 20:47 - 2014-03-24 22:12 - 01325061 _____ () C:\Windows\WindowsUpdate.log
2014-12-08 20:44 - 2014-09-23 11:37 - 00000000 ___RD () C:\Users\FUL\Desktop\Google Drive
2014-12-08 20:44 - 2014-03-28 14:12 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-12-08 20:44 - 2014-03-26 12:20 - 00000433 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-12-08 20:44 - 2014-03-25 22:39 - 00000000 ___RD () C:\Users\FUL\Desktop\Dropbox
2014-12-08 20:44 - 2014-03-25 22:36 - 00000000 ____D () C:\Users\FUL\AppData\Roaming\Dropbox
2014-12-08 20:44 - 2014-03-25 09:47 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-12-08 20:44 - 2010-11-21 04:47 - 00266560 _____ () C:\Windows\PFRO.log
2014-12-08 20:44 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-06 12:12 - 2014-04-26 10:13 - 00000000 ____D () C:\ProgramData\Oracle
2014-12-06 11:34 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-12-06 11:21 - 2009-07-14 04:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools
2014-12-05 14:54 - 2014-03-25 09:47 - 00000000 ____D () C:\temp
2014-12-05 02:49 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-05 02:48 - 2014-08-14 08:30 - 00000000 ____D () C:\Windows\Minidump
2014-12-05 02:48 - 2014-03-24 22:07 - 00335509 ____N () C:\Windows\Minidump\120514-11934-01.dmp
2014-12-05 02:48 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Registration
2014-12-05 01:10 - 2014-03-24 22:11 - 00000000 ____D () C:\Users\FUL\AppData\Local\VirtualStore
2014-12-05 00:37 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\sysprep
2014-12-05 00:35 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\schemas
2014-12-04 23:48 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Vss
2014-12-04 22:41 - 2014-03-25 09:23 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-12-04 16:48 - 2014-03-24 22:11 - 00000000 ____D () C:\Users\FUL
2014-12-04 15:16 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system
2014-12-04 15:15 - 2014-03-27 16:13 - 00000000 ____D () C:\Users\FUL\AppData\Roaming\vlc
2014-12-04 12:02 - 2012-08-30 14:04 - 00000000 ____D () C:\Users\FUL\Documents\Outlook-Dateien
2014-12-04 12:00 - 2014-03-28 23:38 - 00000000 ____D () C:\Users\FUL\AppData\Local\4610B230-FA09-4F6C-BD9C-AE65706B9057.aplzod
2014-12-02 18:18 - 2014-03-28 10:37 - 00038912 _____ () C:\Users\FUL\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-12-02 18:18 - 2014-03-28 10:28 - 00000000 ____D () C:\Users\FUL\AppData\Local\ColdCut
2014-12-02 18:00 - 2014-03-20 11:28 - 00000000 ____D () C:\Users\FUL\Desktop\UDOO
2014-12-01 14:26 - 2014-04-27 11:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-11-30 16:22 - 2014-04-26 14:20 - 00000000 ____D () C:\Users\FUL\AppData\Roaming\Free Download Manager
2014-11-25 23:49 - 2014-06-12 10:51 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-11-25 23:49 - 2014-03-26 12:18 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-11-25 23:49 - 2014-03-26 12:18 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-11-24 19:02 - 2014-03-25 22:53 - 00000000 ____D () C:\Users\FUL\AppData\Roaming\uTorrent
2014-11-18 15:08 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-11-18 10:46 - 2014-03-28 14:12 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-11-18 10:46 - 2014-03-28 14:12 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-11-13 11:07 - 2014-03-28 09:27 - 00000000 ____D () C:\Users\FUL\AppData\Local\Apple Computer
2014-11-13 04:48 - 2014-09-23 18:31 - 00000000 ____D () C:\Users\FUL\Desktop\iPad mini Backup 2014.09.23
2014-11-10 09:59 - 2013-08-23 11:36 - 00000000 ____D () C:\Users\FUL\Documents\#Vorlagen
Some content of TEMP:
====================
C:\Users\FUL\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp6vfjzo.dll
C:\Users\FUL\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
C:\Users\FUL\AppData\Local\Temp\Quarantine.exe
C:\Users\FUL\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-12-05 01:29
==================== End Of Log ============================
--- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-12-2014 01
Ran by FUL at 2014-12-09 00:56:29
Running from C:\Users\FUL\Downloads\Malware remover
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: 360 Internet Security (Enabled - Up to date) {2B66EE1E-E5C8-C2F7-648F-4E55AC68D37D}
AS: 360 Internet Security (Enabled - Up to date) {90070FFA-C3F2-CD79-5E3F-7527D7EF99C0}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
360 Internet Security (HKLM-x32\...\360 Internet Security) (Version: 4.9.0.4902 - Qihu 360 Software Co., Ltd.)
Adobe Acrobat X Pro - English, Français, Deutsch (HKLM-x32\...\{AC76BA86-1033-F400-7760-000000000005}) (Version: 10.1.10 - Adobe Systems)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 13.0.0.111 - Adobe Systems Incorporated)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.239 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.239 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{B678797F-DF38-4556-8A31-8B818E261868}) (Version: 8.0.0.23 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ASUS Smart Gesture (HKLM-x32\...\{4D3286A6-F6AB-498A-82A4-E4F040529F3D}) (Version: 2.0.1 - ASUS)
ASUS USB Charger Plus (HKLM-x32\...\{A859E3E5-C62F-4BFA-AF1D-2B95E03166AF}) (Version: 2.1.4 - ASUS)
ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0031 - ASUS)
AX88772B Windows 7 Drivers (HKLM-x32\...\InstallShield_{54A168C9-2250-4058-80EB-1F4A4192548A}) (Version: 1.0.2.0 - ASIX Electronics Corporation)
AX88772B Windows 7 Drivers (x32 Version: 1.0.2.0 - ASIX Electronics Corporation) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Canon IJ Network Scan Utility (HKLM-x32\...\Canon_IJ_Network_Scan_UTILITY) (Version: - )
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: 3.1.1 - Canon Inc.)
Canon MG6100 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG6100_series) (Version: - Canon Inc.)
Canon MP Navigator EX 4.0 (HKLM-x32\...\MP Navigator EX 4.0) (Version: - )
Canon SELPHY CP800 (HKLM\...\Canon SELPHY CP800) (Version: - )
Canon Utilities SELPHY Photo Print (HKLM-x32\...\SELPHY Photo Print) (Version: 1.2.0.7 - Canon Inc.)
Canon Utilities SELPHY Print Contents 1.1.0 (HKLM-x32\...\SELPHY Print Contents 110) (Version: 1.1.0.16 - Canon Inc.)
CPUID CPU-Z 1.69 (HKLM\...\CPUID CPU-Z_is1) (Version: - )
CrystalDiskInfo 6.2.1 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 6.2.1 - Crystal Dew World)
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.100 - DivX, LLC)
Dropbox (HKU\S-1-5-21-965061589-1977914162-274574225-1000\...\Dropbox) (Version: 2.10.52 - Dropbox, Inc.)
ExpressCache (HKLM\...\{FF607B1F-A78B-4F1D-BC8E-6C2AB3B75405}) (Version: 1.0.87 - Diskeeper Corporation)
ffdshow [rev 2946] [2009-05-15] (HKLM-x32\...\ffdshow_is1) (Version: 1.0 - )
ffdshow x64 v1.3.4500 [2013-01-06] (HKLM\...\ffdshow64_is1) (Version: 1.3.4500.0 - )
Free Download Manager 3.9.3 (HKLM-x32\...\Free Download Manager_is1) (Version: - FreeDownloadManager.ORG)
Google Calendar Sync (HKLM-x32\...\Google Calendar Sync) (Version: - )
Google Drive (HKLM-x32\...\{C60F3836-333A-4AE2-B526-CFDBA143A9BA}) (Version: 1.18.7821.2489 - Google, Inc.)
Google Outlook Contact Sync 0.9.1.0 (HKLM-x32\...\{3D6E90E1-602D-48C8-BBD2-28D1E183AE50}_is1) (Version: - Daniel Polistchuck)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
iCloud (HKLM\...\{6096C0CC-7E19-4355-87F0-627EC5AA146D}) (Version: 4.0.3.56 - Apple Inc.)
Intel(R) Dynamic Platform & Thermal Framework (HKLM-x32\...\FFD10ECE-F715-4a86-9BD8-F6F47DA5DA1C) (Version: 6.0.1.1067 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2828 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel(R) Update Manager (HKLM-x32\...\{12914061-EB9B-4AE7-AC7E-0B8A607C7DF4}) (Version: 2.3.1338 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.5.235 - Intel Corporation)
iTunes (HKLM\...\{F46AA0F1-E284-4878-A462-5F11B9166C0E}) (Version: 11.4.0.18 - Apple Inc.)
Java 7 Update 55 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417055FF}) (Version: 7.0.550 - Oracle)
Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Professional 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 33.1.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.1.1 (x86 de)) (Version: 33.1.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mp3tag v2.59a (HKLM-x32\...\Mp3tag) (Version: v2.59a - Florian Heidenreich)
NVIDIA 3D Vision Treiber 305.46 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 305.46 - NVIDIA Corporation)
NVIDIA Grafiktreiber 305.46 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 305.46 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.12.0613 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.0613 - NVIDIA Corporation)
NVIDIA Update 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.10.8 - NVIDIA Corporation)
paint.net (HKLM\...\{F509C1F4-0029-49F9-B145-A4C4E8DF481A}) (Version: 4.0.3 - dotPDN LLC)
Paragon Backup & Recovery™ 2014 Free (HKLM\...\{C268B5E1-A5DA-11DF-A289-005056C00008}) (Version: 90.00.0003 - Paragon Software)
Paragon Partition Manager™ 2014 Free (HKLM-x32\...\{47E5588F-C3A0-11DE-9857-005056C00008}) (Version: 90.00.0003 - Paragon Software)
Passbild-Generator v4.0a (HKLM-x32\...\Passbild-Generator_is1) (Version: - Passbild-Generator)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
RAPID Mode (Version: 1.0.1.42 - Samsung Electronics Co., Ltd.) Hidden
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7601.39025 - Realtek Semiconductor Corp.)
Saal Design Software (HKLM-x32\...\SaalDesignSoftware) (Version: 3.2.30 - Saal Digital Fotoservice GmbH)
Saal Design Software (x32 Version: 3.2.30 - Saal Digital Fotoservice GmbH) Hidden
Samsung Magician (HKLM-x32\...\{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}_is1) (Version: 4.3.0 - Samsung Electronics)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VLC media player 2.1.4 (HKLM\...\VLC media player) (Version: 2.1.4 - VideoLAN)
Windows-Treiberpaket - ASUS (ATP) Mouse (01/10/2013 1.0.0.170) (HKLM\...\4A9DE1E9EBC800B7F01739D4DE7363EF6751BDF5) (Version: 01/10/2013 1.0.0.170 - ASUS)
WinRAR 5.01 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
==================== Restore Points =========================
01-12-2014 13:55:28 Geplanter Prüfpunkt
06-12-2014 10:21:30 ComboFix created restore point
06-12-2014 11:03:31 Installed Java 7 Update 71
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2014-12-06 11:34 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {3F51DDB9-03FD-425D-9FBE-9871E08E0609} - System32\Tasks\ATKOSD2 => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [2013-09-09] (ASUSTek Computer Inc.)
Task: {57440847-8931-4450-A8E6-89CA3200B9AD} - System32\Tasks\ASUS USB Charger Plus => C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe [2012-07-24] (ASUSTek Computer Inc.)
Task: {6883AAF1-063F-4CDD-A85C-0B05CD0F9660} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
Task: {6EE8C071-A3CF-40E9-A891-017AEA220B66} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-03-28] (Google Inc.)
Task: {A28E8D22-1470-49EF-9E80-CE024C8B15E8} - System32\Tasks\ASUS Touchpad Launcher (x64) => C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2013-02-06] (AsusTek)
Task: {C87CCA25-AC66-4726-91B6-E93A789FDBD5} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-25] (Adobe Systems Incorporated)
Task: {D816101D-1253-48DA-ACF9-0FF69BD9DA3A} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
Task: {E4B3F530-CCB5-418E-A57E-38547223F637} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-03-28] (Google Inc.)
Task: {ED6F1B18-66E6-4706-9523-979356F19BCE} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2014-03-25 09:47 - 2012-07-31 17:25 - 00086888 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-03-25 09:17 - 2012-02-20 11:31 - 00018944 _____ () C:\Windows\SysWOW64\DptfParticipantProcessorService.exe
2014-03-25 09:17 - 2012-02-20 11:31 - 00019968 _____ () C:\Windows\SysWOW64\DptfPolicyConfigTDPService.exe
2014-03-25 09:16 - 2012-08-16 01:52 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-01-10 06:26 - 2014-01-10 06:26 - 01861968 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
2014-02-12 20:58 - 2014-02-12 20:58 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-12 20:58 - 2014-02-12 20:58 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2006-10-31 17:53 - 2006-10-31 17:53 - 00270336 _____ () C:\Program Files (x86)\Canon\SELPHY Photo Print\EnoJPEG4.dll
2014-03-25 09:46 - 2012-08-01 00:02 - 00004096 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
2014-06-18 16:23 - 2014-06-18 16:23 - 10616832 _____ () C:\Users\FUL\AppData\Local\Adobe\Acrobat\10.0\Cache\AcLang_exlang32.deu
2014-05-08 12:22 - 2014-05-08 12:22 - 00305520 _____ () C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\sqlite.dll
2014-06-18 16:23 - 2014-06-18 16:23 - 00014336 _____ () C:\Users\FUL\AppData\Local\Adobe\Acrobat\10.0\Cache\AcLang_Updater.DEU
2014-12-08 20:44 - 2014-12-08 20:44 - 00043008 _____ () c:\users\ful\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp6vfjzo.dll
2013-08-23 20:01 - 2013-08-23 20:01 - 25100288 _____ () C:\Users\FUL\AppData\Roaming\Dropbox\bin\libcef.dll
2014-05-08 12:22 - 2014-05-08 12:22 - 00019968 _____ () C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\locale\de_de\acrotray.deu
2014-01-10 06:28 - 2014-01-10 06:28 - 00100688 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
2014-12-08 20:44 - 2014-12-08 20:44 - 00098816 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\win32api.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 00110080 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\pywintypes27.dll
2014-12-08 20:44 - 2014-12-08 20:44 - 00364544 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\pythoncom27.dll
2014-12-08 20:44 - 2014-12-08 20:44 - 00045568 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\_socket.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 01160704 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\_ssl.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 00320512 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\win32com.shell.shell.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 00713216 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\_hashlib.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 01175040 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\wx._core_.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 00805888 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\wx._gdi_.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 00811008 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\wx._windows_.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 01062400 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\wx._controls_.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 00735232 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\wx._misc_.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 00128512 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\_elementtree.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 00127488 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\pyexpat.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 00557056 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\pysqlite2._sqlite.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 00087552 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\_ctypes.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 00119808 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\win32file.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 00108544 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\win32security.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 00007168 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\hashobjs_ext.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 00167936 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\win32gui.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 00018432 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\win32event.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 00038912 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\win32inet.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 00011264 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\win32crypt.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 00070656 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\wx._html2.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 00027136 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\_multiprocessing.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 00035840 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\win32process.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 00686080 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\unicodedata.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 00122368 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\wx._wizard.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 00024064 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\win32pipe.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 00025600 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\win32pdh.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 00525640 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\windows._lib_cacheinvalidation.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 00010240 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\select.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 00017408 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\win32profile.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 00022528 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\win32ts.pyd
2014-12-08 20:44 - 2014-12-08 20:44 - 00078336 _____ () C:\Users\FUL\AppData\Local\Temp\_MEI37562\wx._animate.pyd
2014-03-25 11:04 - 2012-06-25 10:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\FUL\Desktop\Bild.jpg:com.dropbox.attributes
AlternateDataStreams: C:\Users\FUL\Desktop\IMG_3657.JPG:com.dropbox.attributes
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-965061589-1977914162-274574225-500 - Administrator - Disabled)
FUL (S-1-5-21-965061589-1977914162-274574225-1000 - Administrator - Enabled) => C:\Users\FUL
Gast (S-1-5-21-965061589-1977914162-274574225-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-965061589-1977914162-274574225-1002 - Limited - Enabled)
UpdatusUser (S-1-5-21-965061589-1977914162-274574225-1003 - Limited - Enabled) => C:\Users\UpdatusUser
==================== Faulty Device Manager Devices =============
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (12/08/2014 10:24:43 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (12/08/2014 10:24:13 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (12/08/2014 10:24:10 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (12/08/2014 10:24:10 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (12/08/2014 09:20:28 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (12/08/2014 09:19:31 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (12/08/2014 09:19:28 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (12/08/2014 09:19:11 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (12/08/2014 08:46:17 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (12/07/2014 03:18:12 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (12/08/2014 08:44:38 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error: (12/07/2014 11:46:24 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Error: (12/07/2014 03:16:53 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0
Error: (12/07/2014 03:16:53 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0
Error: (12/07/2014 03:16:53 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0
Error: (12/07/2014 03:16:27 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error: (12/07/2014 03:10:34 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
Microsoft Office Sessions:
=========================
Error: (12/08/2014 10:24:43 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe
Error: (12/08/2014 10:24:13 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\FUL\Downloads\esetsmartinstaller_deu.exe
Error: (12/08/2014 10:24:10 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\FUL\Downloads\esetsmartinstaller_deu.exe
Error: (12/08/2014 10:24:10 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\FUL\Downloads\esetsmartinstaller_deu.exe
Error: (12/08/2014 09:20:28 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\FUL\Downloads\esetsmartinstaller_deu.exe
Error: (12/08/2014 09:19:31 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\FUL\Downloads\esetsmartinstaller_deu.exe
Error: (12/08/2014 09:19:28 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\FUL\Downloads\esetsmartinstaller_deu.exe
Error: (12/08/2014 09:19:11 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\FUL\Downloads\esetsmartinstaller_deu.exe
Error: (12/08/2014 08:46:17 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (12/07/2014 03:18:12 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
CodeIntegrity Errors:
===================================
Date: 2014-12-06 11:28:15.336
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-12-06 11:28:15.321
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-3317U CPU @ 1.70GHz
Percentage of memory in use: 87%
Total physical RAM: 3981.57 MB
Available physical RAM: 495.88 MB
Total Pagefile: 4528.75 MB
Available Pagefile: 837.66 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:931.29 GB) (Free:183.61 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 059A1B33)
Partition: GPT Partition Type.
========================================================
Disk: 1 (Size: 22.4 GB) (Disk ID: 74F02DEA)
Partition 1: (Not Active) - (Size=22.4 GB) - (Type=73)
==================== End Of Log ============================
Findest du denn noch Spuren? Schon mal vielen Dank für deine tolle Hilfe! |
|
09.12.2014, 16:40
| #10 |
| /// the machine /// TB-Ausbilder | Win7 64bit - Spyware.Zbot.ED bzw. HEUR/QVM03.0.Malware.Gen gefunden durch Malwarebytes bzw. 360 Internet Security Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKU\S-1-5-21-965061589-1977914162-274574225-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyServer: [S-1-5-21-965061589-1977914162-274574225-1000] => localhost:8080
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
19.12.2014, 01:00
| #11 |
| | Win7 64bit - Spyware.Zbot.ED bzw. HEUR/QVM03.0.Malware.Gen gefunden durch Malwarebytes bzw. 360 Internet Security Hallo Schrauber, sorry für die späte Rückmeldung! Aber erst mal herzlichen Dank für die tolle Hilfe und die ausführliche Beschreibung. hier das letzte Log: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 14-12-2014 01
Ran by FUL at 2014-12-16 01:16:04 Run:1
Running from C:\Users\FUL\Downloads\Malware remover
Loaded Profiles: FUL & UpdatusUser (Available profiles: FUL & UpdatusUser)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
HKU\S-1-5-21-965061589-1977914162-274574225-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyServer: [S-1-5-21-965061589-1977914162-274574225-1000] => localhost:8080
*****************
"HKU\S-1-5-21-965061589-1977914162-274574225-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
HKU\S-1-5-21-965061589-1977914162-274574225-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
==== End of Fixlog ====
Frohes Fest! lolofufu |
|
19.12.2014, 22:39
| #12 |
| /// the machine /// TB-Ausbilder | Win7 64bit - Spyware.Zbot.ED bzw. HEUR/QVM03.0.Malware.Gen gefunden durch Malwarebytes bzw. 360 Internet Security Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Win7 64bit - Spyware.Zbot.ED bzw. HEUR/QVM03.0.Malware.Gen gefunden durch Malwarebytes bzw. 360 Internet Security |
| adobe, adware, avg, avira, bonjour, browser, canon, computer, cpu-z, crystaldiskinfo, defender, desktop, entfernen, error, explorer, failed, flash player, free download, google, hal.dll, heur/qvm03.0.malware.gen, internet, mozilla, nvidia, registry, safer networking, security, software, spyware.zbot.ed, svchost.exe, system, teredo, windows, winlogon.exe |
WARNUNG an die MITLESER: 
Linear-Darstellung
