| |
| |||||||
Log-Analyse und Auswertung: Win7 64bit - Spyware.Zbot.ED bzw. HEUR/QVM03.0.Malware.Gen gefunden durch Malwarebytes bzw. 360 Internet SecurityWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
05.12.2014, 02:26
| #1 |
| |  Win7 64bit - Spyware.Zbot.ED bzw. HEUR/QVM03.0.Malware.Gen gefunden durch Malwarebytes bzw. 360 Internet Security Hallo zusammen, ich hab vor ein paar Stunden mit Malwarebytes etwas gefunden, was sich nicht entfernen lässt. In der Registry ist ein Eintrag, der sich auf eine exe-Datei in C:\ProgramData\******.exe bezieht. Wenn man den Eintrag und die Datei löscht, werden diese sofort wieder unter einem anderen 6-digit langen Namen erstellt.  Anbei die bisherigen Logs: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 05.12.2014 Scan Time: 00:57:38 Logfile: mbam_log_20141205_1.txt Administrator: Yes Version: 2.00.4.1028 Malware Database: v2014.12.04.11 Rootkit Database: v2014.12.03.01 License: Free Malware Protection: Disabled Malicious Website Protection: Disabled Self-protection: Disabled OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: FUL Scan Type: Threat Scan Result: Completed Objects Scanned: 370671 Time Elapsed: 5 min, 59 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 0 (No malicious items detected) Registry Values: 1 Spyware.Zbot.ED, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|cjsdbs, C:\ProgramData\cjsdbs.exe, , [cf0cbaa4225ad1655de67d17c73e9d63] Registry Data: 0 (No malicious items detected) Folders: 0 (No malicious items detected) Files: 1 Spyware.Zbot.ED, C:\ProgramData\cjsdbs.exe, , [cf0cbaa4225ad1655de67d17c73e9d63], Physical Sectors: 0 (No malicious items detected) (end) - Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03 -12-2014 Ran by FUL (administrator) on UX32VD on 05-12-2014 01:50:10 Running from C:\Users\FUL\Downloads Loaded Profiles: FUL & UpdatusUser (Available profiles: FUL & UpdatusUser) Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use- farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display \nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe () C:\Windows\SysWOW64\DptfParticipantProcessorService.exe () C:\Windows\SysWOW64\DptfPolicyConfigTDPService.exe (Diskeeper Corporation) C:\Program Files\Diskeeper Corporation \ExpressCache\ExpressCache.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client \HeciServer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (Samsung Electronics Co., Ltd.) C:\Windows\System32\RAPID \SamsungRapidSvc.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Rocket Division Software) C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Microsoft Corporation) C:\Windows\System32\alg.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus \USBChargerPlus.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package \ATKOSD2\ATKOSD2.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\RAPID \CacheFilter\SamsungRapidApp.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe (Canon Inc.) C:\Program Files (x86)\Canon\SELPHY Photo Print \CIC_SPPhelper.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Dropbox, Inc.) C:\Users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey \HControlUser.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files \Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe (CANON INC.) C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display \nvtray.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter \x64\AsusTPLoader.exe (ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe (ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe (AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter \x64\AsusTPCenter.exe (AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter \x64\AsusTPHelper.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Qihu 360 Software Co., Ltd.) C:\Program Files\360\360 Internet Security\deepscan\QHActiveDefense.exe (Qihu 360 Software Co., Ltd.) C:\Program Files\360\360 Internet Security\360sd.exe (Qihu 360 Software Co., Ltd.) C:\Program Files\360\360 Internet Security\360rp.exe (Qihu 360 Software Co., Ltd.) C:\Program Files\360\360 Internet Security\safemon\360Tray.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Microsoft Corporation) C:\Program Files\Internet Explorer \iexplore.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti- Malware\mbam.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [DptfPolicyLpmServiceHelper] => C:\Windows \SysWOW64\DptfPolicyLpmServiceHelper.exe HKLM\...\Run: [SamsungRapidApp] => C:\Program Files (x86)\Samsung \RAPID\CacheFilter\SamsungRapidApp.exe [109280 2013-07-29] (Samsung Electronics Co., Ltd.) HKLM\...\Run: [360sd] => C:\Program Files\360\360 Internet Security \360sdrun.exe [287560 2014-04-16] (Qihu 360 Software Co., Ltd.) HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-05-21] (Intel Corporation) HKLM-x32\...\Run: [ATKOSD2] => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [406328 2013-09-09] (ASUSTek Computer Inc.) HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [205624 2013-05-30] (ASUSTek Computer Inc.) HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files \Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41336 2014-05-08] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840568 2014-05-08] (Adobe Systems Inc.) HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2014-01-10] () HKLM-x32\...\Run: [IJNetworkScanUtility] => C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe [206240 2010-08 -24] (CANON INC.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation) HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes \iTunesHelper.exe [152392 2014-09-01] (Apple Inc.) HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.) HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] => C: \ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \mbamdor.exe [54072 2014-11-21] (Malwarebytes Corporation) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X] HKU\S-1-5-21-965061589-1977914162-274574225-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-08-07] (Apple Inc.) HKU\S-1-5-21-965061589-1977914162-274574225-1000\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple \Internet Services\ApplePhotoStreams.exe [43816 2014-08-14] (Apple Inc.) HKU\S-1-5-21-965061589-1977914162-274574225-1000\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive \googledrivesync.exe [22869088 2014-10-21] (Google) AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows \system32\nvinitx.dll [247144 2012-08-01] (NVIDIA Corporation) AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows \SysWOW64\nvinit.dll [202600 2012-08-01] (NVIDIA Corporation) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup \SELPHY Photo Print Launcher.lnk ShortcutTarget: SELPHY Photo Print Launcher.lnk -> C:\Program Files (x86)\Canon\SELPHY Photo Print\CIC_SPPhelper.exe (Canon Inc.) Startup: C:\Users\FUL\AppData\Roaming\Microsoft\Windows\Start Menu \Programs\Startup\CC-Bewegungen Europaeische Reisevers vsnr407019265DEU.pdf - Verknüpfung.lnk ShortcutTarget: CC-Bewegungen Europaeische Reisevers vsnr407019265DEU.pdf - Verknüpfung.lnk -> C:\Users\FUL\Desktop\CC- Bewegungen Europaeische Reisevers vsnr407019265DEU.pdf () Startup: C:\Users\FUL\AppData\Roaming\Microsoft\Windows\Start Menu \Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\FUL\AppData\Roaming\Dropbox \bin\Dropbox.exe (Dropbox, Inc.) BootExecute: autocheck autochk * sdnclean64.exe ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-965061589-1977914162-274574225-1000\Software\Microsoft \Internet Explorer\Main,Start Page = hxxp://www.google.de/ HKU\S-1-5-21-965061589-1977914162-274574225-1000\Software\Microsoft \Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com SearchScopes: HKLM-x32 -> DefaultScope value is missing. BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB- D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22- 42B3008E02FF} -> C:\Program Files\Microsoft Office \Office14\URLREDIR.DLL (Microsoft Corporation) BHO: SafeMon Class -> {B69F34DD-F0F9-42DC-9EDD-957187DA688D} -> C: \Program Files\360\360 Internet Security\safemon\safemon64.dll (Qihu 360 Software Co., Ltd.) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74- 9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB- D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f- 8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe \Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22- 42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office \Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Free Download Manager -> {CC59E0F9-7E43-44FA-9FAA- 8377850BF205} -> C:\Program Files (x86)\Free Download Manager \iefdm2.dll (FreeDownloadManager.ORG) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74- 9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX \AcroIEFavClient.dll (Adobe Systems Incorporated) Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX \AcroIEFavClient.dll (Adobe Systems Incorporated) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\FUL\AppData\Roaming\Mozilla\Firefox\Profiles \15j8bd6f.default FF NetworkProxy: "socks_remote_dns", true FF NetworkProxy: "type", 0 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed \Flash\NPSWF64_15_0_0_239.dll () FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files \Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files \Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C: \PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed \Flash\NPSWF32_15_0_0_239.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components \IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C: \Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT \npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C: \PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C: \PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.) FF Extension: Avira Browser Safety - C:\Users\FUL\AppData\Roaming \Mozilla\Firefox\Profiles\15j8bd6f.default\Extensions\abs@avira.com [2014-11-20] FF Extension: FoxyProxy Standard - C:\Users\FUL\AppData\Roaming \Mozilla\Firefox\Profiles\15j8bd6f.default\Extensions \foxyproxy@eric.h.jung [2014-09-07] FF Extension: DownloadHelper - C:\Users\FUL\AppData\Roaming\Mozilla \Firefox\Profiles\15j8bd6f.default\Extensions\{b9db16a4-6edc-47ec- a1f4-b86292ed211d} [2014-09-07] FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe \Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2014-03-26] FF Extension: Free Download Manager plugin - C:\ProgramData\Free Download Manager\Firefox\Extensions\1.6.0.8 [2014-11-23] FF Extension: No Name - web2pdfextension@web2pdf.adobedotcom [Not Found] FF Extension: No Name - fdm_ffext@freedownloadmanager.org [Not Found] Chrome: ======= CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S2 360rp; C:\Program Files\360\360 Internet Security\360rps.exe [310352 2014-04-16] (Qihu 360 Software Co., Ltd.) R2 DptfParticipantProcessorService; C:\Windows \SysWOW64\DptfParticipantProcessorService.exe [18944 2012-02-20] () R2 DptfPolicyConfigTDPService; C:\Windows \SysWOW64\DptfPolicyConfigTDPService.exe [19968 2012-02-20] () R2 ExpressCache; C:\Program Files\Diskeeper Corporation\ExpressCache \ExpressCache.exe [79664 2012-03-30] (Diskeeper Corporation) R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation) S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin \iumsvc.exe [174368 2014-02-28] () R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation) R2 SamsungRapidSvc; C:\Windows\System32\RAPID\SamsungRapidSvc.exe [27360 2013-07-29] (Samsung Electronics Co., Ltd.) S3 scan; C:\Program Files\360\360 Internet Security\scan.dll [420424 2014-04-25] (S.C. BitDefender S.R.L) R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.) R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.) R2 StarWindServiceAE; C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [275968 2007-05-28] (Rocket Division Software) [File not signed] R2 ZhuDongFangYu; C:\Program Files\360\360 Internet Security\deepscan \QHActiveDefense.exe [236360 2014-04-23] (Qihu 360 Software Co., Ltd.) S4 AntiVirWebService; "C:\Program Files (x86)\Avira\AntiVir Desktop \avwebg7.exe" [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R1 360AntiHacker; C:\Windows\System32\Drivers\360AntiHacker64.sys [97872 2014-04-21] (Qihu 360 Software Co., Ltd.) R3 360AvFlt; C:\Windows\System32\DRIVERS\360AvFlt.sys [67664 2014-04- 23] (Qihu 360 Software Co., Ltd.) R1 360Box64; C:\Windows\System32\DRIVERS\360Box64.sys [305744 2014-04 -29] (Qihu 360 Software Co., Ltd.) S1 360Camera; C:\Windows\System32\Drivers\360Camera64.sys [41552 2014 -04-29] (Qihu 360 Software Co., Ltd.) R1 360fsflt; C:\Windows\System32\DRIVERS\360FsFlt.sys [304208 2014-05 -07] (Qihu 360 Software Co., Ltd.) R3 ATP; C:\Windows\System32\DRIVERS\AsusTP.sys [65784 2013-02-06] (ASUS Corporation) S3 AX88772B; C:\Windows\System32\DRIVERS\ax88772b.sys [110592 2012-04 -05] (ASIX Electronics Corp.) U1 BAPIDRV; C:\Windows\System32\DRIVERS\BAPIDRV64.sys [180816 2014-04 -18] (Qihu 360 Software Co., Ltd.) R3 DptfDevDram; C:\Windows\System32\DRIVERS\DptfDevDram.sys [107288 2012-02-20] (Intel Corporation) R3 DptfDevFan; C:\Windows\System32\DRIVERS\DptfDevFan.sys [42776 2012 -02-20] (Intel Corporation) R3 DptfDevGen; C:\Windows\System32\DRIVERS\DptfDevGen.sys [64792 2012 -02-20] (Intel Corporation) R3 DptfDevPch; C:\Windows\System32\DRIVERS\DptfDevPch.sys [96024 2012 -02-20] (Intel Corporation) R3 DptfDevProc; C:\Windows\System32\DRIVERS\DptfDevProc.sys [220952 2012-02-20] (Intel Corporation) R3 DptfManager; C:\Windows\System32\DRIVERS\DptfManager.sys [357656 2012-02-20] (Intel Corporation) R1 excfs; C:\Windows\System32\DRIVERS\excfs.sys [23344 2012-03-30] (Diskeeper Corporation) R0 excsd; C:\Windows\System32\DRIVERS\excsd.sys [95024 2012-03-30] (Diskeeper Corporation) R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28656 2013-03-25] (Intel Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-05] (Malwarebytes Corporation) U0 oiuexy; C:\Windows\System32\drivers\xppby.sys [79064 2014-12-05] (Malwarebytes Corporation) R0 SamsungRapidDiskFltr; C:\Windows\System32\DRIVERS \SamsungRapidDiskFltr.sys [240864 2013-07-29] (Samsung Electronics Co., Ltd.) R0 SamsungRapidFSFltr; C:\Windows\System32\DRIVERS \SamsungRapidFSFltr.sys [111328 2013-07-29] (Samsung Electronics Co., Ltd.) S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.) R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-03-26] (Duplex Secure Ltd.) R1 UimBus; C:\Windows\System32\DRIVERS\UimBus.sys [102664 2014-01-23] () R1 Uim_DEVIM; C:\Windows\System32\DRIVERS\uim_devim.sys [25992 2014- 01-23] () R1 Uim_IM; C:\Windows\System32\DRIVERS\uim_im.sys [700680 2014-01-23] () U3 ahkhhxz2; C:\Windows\System32\Drivers\ahkhhxz2.sys [0 ] (Advanced Micro Devices) S1 {2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64; system32\drivers \{2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-05 01:50 - 2014-12-05 01:50 - 00021716 _____ () C:\Users\FUL \Downloads\FRST.txt 2014-12-05 01:50 - 2014-12-05 01:50 - 00000000 ____D () C:\FRST 2014-12-05 01:49 - 2014-12-05 01:49 - 02117632 _____ (Farbar) C: \Users\FUL\Downloads\FRST64.exe 2014-12-05 01:49 - 2014-12-05 01:49 - 00000000 ____D () C:\Users\FUL \Desktop\trojanerboard 2014-12-05 01:11 - 2014-12-05 01:11 - 00143360 _____ (1999-2010 White Shift HatIt Kream) C:\ProgramData\djsdbs.exe 2014-12-05 01:09 - 2014-12-05 01:09 - 00050477 _____ () C:\Users\FUL \Downloads\Defogger.exe 2014-12-05 01:04 - 2014-12-05 01:04 - 00079064 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\xppby.sys 2014-12-05 00:57 - 2009-06-10 22:00 - 00000824 _____ () C:\Windows \system32\Drivers\etc\hosts.20141205-005700.backup 2014-12-05 00:39 - 2014-05-14 10:40 - 00022992 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\efimon.sys 2014-12-05 00:38 - 2014-12-05 01:49 - 00000000 ____D () C:\Users\FUL \AppData\Roaming\360safe 2014-12-05 00:38 - 2014-12-05 00:38 - 00000974 _____ () C:\Users \Public\Desktop\360 Internet Security.lnk 2014-12-05 00:38 - 2014-12-05 00:38 - 00000000 _RSHD () C:\360SANDBOX 2014-12-05 00:38 - 2014-12-05 00:38 - 00000000 ____D () C:\Users\FUL \AppData\Roaming\360SD 2014-12-05 00:38 - 2014-12-05 00:38 - 00000000 ____D () C: \ProgramData\Microsoft\Windows\Start Menu\Programs\360 Internet Security 2014-12-05 00:38 - 2014-12-05 00:38 - 00000000 ____D () C: \ProgramData\360SD 2014-12-05 00:38 - 2014-12-05 00:38 - 00000000 ____D () C:\Program Files\360 2014-12-05 00:38 - 2014-05-07 10:44 - 00304208 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\360FsFlt.sys 2014-12-05 00:38 - 2014-04-29 07:20 - 00305744 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\360Box64.sys 2014-12-05 00:38 - 2014-04-29 04:50 - 00041552 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\360Camera64.sys 2014-12-05 00:38 - 2014-04-23 09:32 - 00067664 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\360AvFlt.sys 2014-12-05 00:38 - 2014-04-21 07:38 - 00097872 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\360AntiHacker64.sys 2014-12-05 00:38 - 2014-04-18 07:42 - 00180816 _____ (Qihu 360 Software Co., Ltd.) C:\Windows\system32\Drivers\BAPIDRV64.SYS 2014-12-05 00:18 - 2014-12-05 00:18 - 00000753 _____ () C:\Users\FUL \Desktop\JRT.txt 2014-12-05 00:13 - 2014-12-05 00:13 - 00000000 ____D () C:\Windows \ERUNT 2014-12-05 00:06 - 2014-12-05 00:13 - 00000000 ____D () C: \ProgramData\HitmanPro 2014-12-04 23:55 - 2014-12-05 00:03 - 00000000 ____D () C:\AdwCleaner 2014-12-04 22:41 - 2014-12-04 22:41 - 00000000 ____D () C:\OETemp 2014-12-04 22:40 - 2014-12-04 22:40 - 00000000 _____ () C: \ProgramData\rebootpending.txt 2014-12-04 22:36 - 2014-12-05 00:54 - 00000000 ____D () C: \ProgramData\Spybot - Search & Destroy 2014-12-04 22:36 - 2014-12-04 22:39 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2 2014-12-04 22:36 - 2014-12-04 22:36 - 00001391 _____ () C: \ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk 2014-12-04 22:36 - 2014-12-04 22:36 - 00001379 _____ () C:\Users \Public\Desktop\Spybot-S&D Start Center.lnk 2014-12-04 22:36 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe 2014-12-04 22:34 - 2014-12-04 22:38 - 168558440 _____ (Qihu 360 Software Co., Ltd.) C:\Users\FUL\Downloads\360is_4.9.0.4902H.exe 2014-12-04 13:53 - 2014-12-05 00:57 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-12-04 13:52 - 2014-12-04 13:52 - 00001102 _____ () C:\Users \Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-12-04 13:52 - 2014-12-04 13:52 - 00000000 ____D () C: \ProgramData\Malwarebytes 2014-12-04 13:52 - 2014-12-04 13:52 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-12-04 13:52 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-12-04 13:52 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-12-04 13:52 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-12-04 13:41 - 2014-12-04 13:42 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\FUL\Downloads\spybot-2.4.exe 2014-12-04 13:40 - 2014-12-04 13:40 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\FUL\Downloads\mbam-setup-2.0.4.1028.exe 2014-12-02 23:41 - 2014-12-02 23:43 - 57358008 _____ (ZONER software ) C:\Users\FUL\Downloads\zps16_de_pro_chip.exe 2014-12-02 20:23 - 2014-12-02 20:23 - 00026729 _____ () C:\Users\FUL \Downloads\Bluewolf495-40.rec[https___truestracker.de].torrent 2014-12-02 20:23 - 2014-12-02 20:23 - 00026729 _____ () C:\Users\FUL \Downloads\Bluewolf495-39.rec[https___truestracker.de].torrent 2014-12-02 20:23 - 2014-12-02 20:23 - 00026529 _____ () C:\Users\FUL \Downloads\Bluewolf438-44.rec[https___truestracker.de].torrent 2014-12-02 20:22 - 2014-12-02 20:22 - 00028189 _____ () C:\Users\FUL \Downloads\Bluewolf596-13.rec[https___truestracker.de].torrent 2014-12-02 20:22 - 2014-12-02 20:22 - 00028168 _____ () C:\Users\FUL \Downloads\Bluewolf596-7.rec[https___truestracker.de].torrent 2014-12-02 20:22 - 2014-12-02 20:22 - 00028028 _____ () C:\Users\FUL \Downloads\Bluewolf596-8.rec[https___truestracker.de].torrent 2014-12-02 20:22 - 2014-12-02 20:22 - 00028009 _____ () C:\Users\FUL \Downloads\Bluewolf596-14.rec[https___truestracker.de].torrent 2014-12-02 20:22 - 2014-12-02 20:22 - 00027950 _____ () C:\Users\FUL \Downloads\Bluewolf596-8-2.rec[https___truestracker.de].torrent 2014-12-02 20:22 - 2014-12-02 20:22 - 00026669 _____ () C:\Users\FUL \Downloads\Bluewolf438-42.rec[https___truestracker.de].torrent 2014-12-02 20:22 - 2014-12-02 20:22 - 00026489 _____ () C:\Users\FUL \Downloads\Bluewolf438-41.rec[https___truestracker.de].torrent 2014-12-02 20:22 - 2014-12-02 20:22 - 00026349 _____ () C:\Users\FUL \Downloads\Bluewolf438-43.rec[https___truestracker.de].torrent 2014-12-02 16:27 - 2014-12-02 16:27 - 02996728 _____ (Crystal Dew World ) C:\Users\FUL\Downloads\CrystalDiskInfo6_2_1.exe 2014-12-02 16:27 - 2014-12-02 16:27 - 00001186 _____ () C:\Users\FUL \Desktop\CrystalDiskInfo.lnk 2014-12-02 16:27 - 2014-12-02 16:27 - 00000000 ____D () C:\Program Files (x86)\CrystalDiskInfo 2014-12-02 15:14 - 2014-12-02 15:19 - 00000000 ____D () C:\Users\FUL \Desktop\FireTV 2014-12-01 14:12 - 2014-12-01 14:27 - 00000000 ____D () C:\Users\FUL \AppData\Local\Amazon_FireTV_Utility_App 2014-12-01 14:11 - 2014-12-01 14:11 - 00000000 ____D () C:\Users\FUL \.android 2014-11-30 16:19 - 2014-11-30 16:19 - 00000263 _____ () C:\Users\FUL \Desktop\Musterschreiben%20R%C3%BCckforderung %20Bearbeitungsentgelt_207294.log 2014-11-26 22:04 - 2014-11-26 22:04 - 00035849 _____ () C:\Users\FUL \Downloads\Bluewolf494-22.rec[https___truestracker.de].torrent 2014-11-26 22:04 - 2014-11-26 22:04 - 00027048 _____ () C:\Users\FUL \Downloads\Bluewolf600.rec[https___truestracker.de].torrent 2014-11-24 23:48 - 2014-11-24 23:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-11-08 21:27 - 2014-11-08 21:27 - 00000000 ____D () C:\Users \Default\AppData\Local\Google 2014-11-08 21:27 - 2014-11-08 21:27 - 00000000 ____D () C:\Users \Default User\AppData\Local\Google 2014-11-07 08:35 - 2014-11-07 08:35 - 01054912 _____ (Adobe) C:\Users \FUL\Downloads\install_flashplayer15x32au_mssd_aaa_aih.exe ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-05 01:49 - 2014-06-12 10:51 - 00000884 _____ () C:\Windows \Tasks\Adobe Flash Player Updater.job 2014-12-05 01:10 - 2014-03-24 22:11 - 00000000 ____D () C:\Users\FUL \AppData\Local\VirtualStore 2014-12-05 01:04 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows \Registration 2014-12-05 00:51 - 2014-03-28 14:12 - 00001110 _____ () C:\Windows \Tasks\GoogleUpdateTaskMachineUA.job 2014-12-05 00:44 - 2014-03-25 07:06 - 00709888 _____ () C:\Windows \system32\perfh007.dat 2014-12-05 00:44 - 2014-03-25 07:06 - 00153014 _____ () C:\Windows \system32\perfc007.dat 2014-12-05 00:44 - 2009-07-14 06:13 - 01626984 _____ () C:\Windows \system32\PerfStringBackup.INI 2014-12-05 00:42 - 2009-07-14 05:45 - 00026720 ____H () C:\Windows \system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289- 439d-8115-601632D005A0 2014-12-05 00:42 - 2009-07-14 05:45 - 00026720 ____H () C:\Windows \system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289- 439d-8115-601632D005A0 2014-12-05 00:40 - 2014-03-25 22:39 - 00000000 ___RD () C:\Users\FUL \Desktop\Dropbox 2014-12-05 00:40 - 2014-03-25 22:36 - 00000000 ____D () C:\Users\FUL \AppData\Roaming\Dropbox 2014-12-05 00:39 - 2014-09-23 11:37 - 00000000 ___RD () C:\Users\FUL \Desktop\Google Drive 2014-12-05 00:38 - 2014-03-24 22:12 - 01293902 _____ () C:\Windows \WindowsUpdate.log 2014-12-05 00:37 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows \system32\sysprep 2014-12-05 00:36 - 2014-03-28 14:12 - 00001106 _____ () C:\Windows \Tasks\GoogleUpdateTaskMachineCore.job 2014-12-05 00:35 - 2014-03-26 12:20 - 00000433 _____ () C:\Windows \system32\Drivers\etc\hosts.ics 2014-12-05 00:35 - 2014-03-25 09:47 - 00000000 ____D () C: \ProgramData\NVIDIA 2014-12-05 00:35 - 2010-11-21 04:47 - 00240388 _____ () C:\Windows \PFRO.log 2014-12-05 00:35 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows \Tasks\SA.DAT 2014-12-05 00:35 - 2009-07-14 05:51 - 00044551 _____ () C:\Windows \setupact.log 2014-12-05 00:35 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows \schemas 2014-12-05 00:05 - 2014-05-25 10:04 - 00000000 ____D () C:\Users\FUL \Downloads\Malware remover 2014-12-04 23:48 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Vss 2014-12-04 22:41 - 2014-03-25 09:23 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-12-04 22:36 - 2009-07-14 04:20 - 00000000 ___RD () C: \ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools 2014-12-04 16:48 - 2014-03-24 22:11 - 00000000 ____D () C:\Users\FUL 2014-12-04 15:16 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows \system 2014-12-04 15:15 - 2014-03-27 16:13 - 00000000 ____D () C:\Users\FUL \AppData\Roaming\vlc 2014-12-04 12:02 - 2012-08-30 14:04 - 00000000 ____D () C:\Users\FUL \Documents\Outlook-Dateien 2014-12-04 12:00 - 2014-03-28 23:38 - 00000000 ____D () C:\Users\FUL \AppData\Local\4610B230-FA09-4F6C-BD9C-AE65706B9057.aplzod 2014-12-02 18:18 - 2014-03-28 10:37 - 00038912 _____ () C:\Users\FUL \AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-12-02 18:18 - 2014-03-28 10:28 - 00000000 ____D () C:\Users\FUL \AppData\Local\ColdCut 2014-12-02 18:00 - 2014-03-20 11:28 - 00000000 ____D () C:\Users\FUL \Desktop\UDOO 2014-12-01 14:26 - 2014-04-27 11:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-11-30 16:22 - 2014-04-26 14:20 - 00000000 ____D () C:\Users\FUL \AppData\Roaming\Free Download Manager 2014-11-25 23:49 - 2014-06-12 10:51 - 00003822 _____ () C:\Windows \System32\Tasks\Adobe Flash Player Updater 2014-11-25 23:49 - 2014-03-26 12:18 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-11-25 23:49 - 2014-03-26 12:18 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-11-24 19:02 - 2014-03-25 22:53 - 00000000 ____D () C:\Users\FUL \AppData\Roaming\uTorrent 2014-11-18 15:08 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows \system32\FxsTmp 2014-11-18 10:46 - 2014-03-28 14:12 - 00004106 _____ () C:\Windows \System32\Tasks\GoogleUpdateTaskMachineUA 2014-11-18 10:46 - 2014-03-28 14:12 - 00003854 _____ () C:\Windows \System32\Tasks\GoogleUpdateTaskMachineCore 2014-11-13 11:07 - 2014-03-28 09:27 - 00000000 ____D () C:\Users\FUL \AppData\Local\Apple Computer 2014-11-13 04:48 - 2014-09-23 18:31 - 00000000 ____D () C:\Users\FUL \Desktop\iPad mini Backup 2014.09.23 2014-11-10 09:59 - 2013-08-23 11:36 - 00000000 ____D () C:\Users\FUL \Documents\#Vorlagen 2014-11-08 21:28 - 2014-09-23 11:36 - 00000000 ____D () C: \ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive Files to move or delete: ==================== C:\ProgramData\djsdbs.exe Some content of TEMP: ==================== C:\Users\FUL\AppData\Local\Temp\avgnt.exe C:\Users\FUL\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce- 5766-8f84-3e3e7ecf0d81}.tmpfpurdx.dll C:\Users\FUL\AppData\Local\Temp\JDSetup130429822500280238.exe C:\Users\FUL\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe C:\Users\FUL\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe C:\Users\FUL\AppData\Local\Temp\ose00000.exe C:\Users\FUL\AppData\Local\Temp\paint.net.4.0.3.install.exe C:\Users\FUL\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-12-05 01:29 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03
-12-2014
Ran by FUL at 2014-12-05 01:50:41
Running from C:\Users\FUL\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: 360 Internet Security (Enabled - Up to date) {2B66EE1E-E5C8-C2F7-
648F-4E55AC68D37D}
AS: 360 Internet Security (Enabled - Up to date) {90070FFA-C3F2-CD79-
5E3F-7527D7EF99C0}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44
-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-
3CCA-732D-A930-C1CA5F20A4B0}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the
fixlist to unhide them. The adware programs should be uninstalled
manually.)
360 Internet Security (HKLM-x32\...\360 Internet Security) (Version:
4.9.0.4902 - Qihu 360 Software Co., Ltd.)
Adobe Acrobat X Pro - English, Français, Deutsch (HKLM-x32\...
\{AC76BA86-1033-F400-7760-000000000005}) (Version: 10.1.10 - Adobe
Systems)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 13.0.0.111 - Adobe
Systems Incorporated)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player
ActiveX) (Version: 15.0.0.239 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin)
(Version: 15.0.0.239 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-
7C0453561701}) (Version: 3.0.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{B678797F-DF38-4556-8A31-
8B818E261868}) (Version: 8.0.0.23 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-
F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ASUS Smart Gesture (HKLM-x32\...\{4D3286A6-F6AB-498A-82A4-
E4F040529F3D}) (Version: 2.0.1 - ASUS)
ASUS USB Charger Plus (HKLM-x32\...\{A859E3E5-C62F-4BFA-AF1D-
2B95E03166AF}) (Version: 2.1.4 - ASUS)
ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE})
(Version: 1.0.0031 - ASUS)
AX88772B Windows 7 Drivers (HKLM-x32\...\InstallShield_{54A168C9-2250
-4058-80EB-1F4A4192548A}) (Version: 1.0.2.0 - ASIX Electronics
Corporation)
AX88772B Windows 7 Drivers (x32 Version: 1.0.2.0 - ASIX Electronics
Corporation) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version:
3.0.0.10 - Apple Inc.)
Canon IJ Network Scan Utility (HKLM-x32\...
\Canon_IJ_Network_Scan_UTILITY) (Version: - )
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY)
(Version: 3.1.1 - Canon Inc.)
Canon MG6100 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-
FFDB8040B7BF}_Canon_MG6100_series) (Version: - Canon Inc.)
Canon MP Navigator EX 4.0 (HKLM-x32\...\MP Navigator EX 4.0) (Version:
- )
Canon SELPHY CP800 (HKLM\...\Canon SELPHY CP800) (Version: - )
Canon Utilities SELPHY Photo Print (HKLM-x32\...\SELPHY Photo Print)
(Version: 1.2.0.7 - Canon Inc.)
Canon Utilities SELPHY Print Contents 1.1.0 (HKLM-x32\...\SELPHY Print
Contents 110) (Version: 1.1.0.16 - Canon Inc.)
CPUID CPU-Z 1.69 (HKLM\...\CPUID CPU-Z_is1) (Version: - )
CrystalDiskInfo 6.2.1 (HKLM-x32\...\CrystalDiskInfo_is1) (Version:
6.2.1 - Crystal Dew World)
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.100 - DivX, LLC)
Dropbox (HKU\S-1-5-21-965061589-1977914162-274574225-1000\...\Dropbox)
(Version: 2.10.52 - Dropbox, Inc.)
ExpressCache (HKLM\...\{FF607B1F-A78B-4F1D-BC8E-6C2AB3B75405})
(Version: 1.0.87 - Diskeeper Corporation)
ffdshow [rev 2946] [2009-05-15] (HKLM-x32\...\ffdshow_is1) (Version:
1.0 - )
ffdshow x64 v1.3.4500 [2013-01-06] (HKLM\...\ffdshow64_is1) (Version:
1.3.4500.0 - )
Free Download Manager 3.9.3 (HKLM-x32\...\Free Download Manager_is1)
(Version: - FreeDownloadManager.ORG)
Google Calendar Sync (HKLM-x32\...\Google Calendar Sync) (Version: -
)
Google Drive (HKLM-x32\...\{C60F3836-333A-4AE2-B526-CFDBA143A9BA})
(Version: 1.18.7821.2489 - Google, Inc.)
Google Outlook Contact Sync 0.9.1.0 (HKLM-x32\...\{3D6E90E1-602D-48C8
-BBD2-28D1E183AE50}_is1) (Version: - Daniel Polistchuck)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
iCloud (HKLM\...\{6096C0CC-7E19-4355-87F0-627EC5AA146D}) (Version:
4.0.3.56 - Apple Inc.)
Intel(R) Dynamic Platform & Thermal Framework (HKLM-x32\...\FFD10ECE-
F715-4a86-9BD8-F6F47DA5DA1C) (Version: 6.0.1.1067 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-
43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-
B9AC9A5886EA}) (Version: 9.17.10.2828 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...
\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel
Corporation)
Intel(R) Update Manager (HKLM-x32\...\{12914061-EB9B-4AE7-AC7E-
0B8A607C7DF4}) (Version: 2.3.1338 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...
\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.5.235 - Intel
Corporation)
iTunes (HKLM\...\{F46AA0F1-E284-4878-A462-5F11B9166C0E}) (Version:
11.4.0.18 - Apple Inc.)
Java 7 Update 55 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-
2F86417055FF}) (Version: 7.0.550 - Oracle)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF})
(Version: 7.0.670 - Oracle)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...
\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes
Corporation)
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-
45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft
Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-
CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Professional 2010 (HKLM-x32\...\Office14.SingleImage)
(Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-
02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft
Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...
\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 -
Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-
x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 -
Microsoft Corporation)
Mozilla Firefox 33.1.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.1.1
(x86 de)) (Version: 33.1.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService)
(Version: 29.0.1 - Mozilla)
Mp3tag v2.59a (HKLM-x32\...\Mp3tag) (Version: v2.59a - Florian
Heidenreich)
NVIDIA 3D Vision Treiber 305.46 (HKLM\...\{B2FE1952-0186-46C3-BAEC-
A80AA35AC5B8}_Display.3DVision) (Version: 305.46 - NVIDIA Corporation)
NVIDIA Grafiktreiber 305.46 (HKLM\...\{B2FE1952-0186-46C3-BAEC-
A80AA35AC5B8}_Display.Driver) (Version: 305.46 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.12.0613 (HKLM\...\{B2FE1952-0186-46C3-
BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.0613 - NVIDIA
Corporation)
NVIDIA Update 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
_Display.Update) (Version: 1.10.8 - NVIDIA Corporation)
paint.net (HKLM\...\{F509C1F4-0029-49F9-B145-A4C4E8DF481A}) (Version:
4.0.3 - dotPDN LLC)
Paragon Backup & Recovery™ 2014 Free (HKLM\...\{C268B5E1-A5DA-11DF-
A289-005056C00008}) (Version: 90.00.0003 - Paragon Software)
Paragon Partition Manager™ 2014 Free (HKLM-x32\...\{47E5588F-C3A0-
11DE-9857-005056C00008}) (Version: 90.00.0003 - Paragon Software)
Passbild-Generator v4.0a (HKLM-x32\...\Passbild-Generator_is1)
(Version: - Passbild-Generator)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
RAPID Mode (Version: 1.0.1.42 - Samsung Electronics Co., Ltd.) Hidden
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-
1091A8127911}) (Version: 6.1.7601.39025 - Realtek Semiconductor Corp.)
Saal Design Software (HKLM-x32\...\SaalDesignSoftware) (Version:
3.2.30 - Saal Digital Fotoservice GmbH)
Saal Design Software (x32 Version: 3.2.30 - Saal Digital Fotoservice
GmbH) Hidden
Samsung Magician (HKLM-x32\...\{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}
_is1) (Version: 4.3.0 - Samsung Electronics)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition
(HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}
_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B})
(Version: - Microsoft)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-
FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VLC media player 2.1.4 (HKLM\...\VLC media player) (Version: 2.1.4 -
VideoLAN)
Windows-Treiberpaket - ASUS (ATP) Mouse (01/10/2013 1.0.0.170) (HKLM
\...\4A9DE1E9EBC800B7F01739D4DE7363EF6751BDF5) (Version: 01/10/2013
1.0.0.170 - ASUS)
WinRAR 5.01 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 -
win.rar GmbH)
==================== Custom CLSID (selected items):
==========================
(If an entry is included in the fixlist, it will be removed from
registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes
\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:
\Users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes
\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:
\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox,
Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes
\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:
\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox,
Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes
\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:
\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox,
Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes
\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:
\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox,
Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes
\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:
\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox,
Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes
\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:
\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox,
Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes
\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:
\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox,
Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes
\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:
\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox,
Inc.)
==================== Restore Points =========================
01-12-2014 13:55:28 Geplanter Prüfpunkt
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset
Hosts.)
2009-07-14 03:34 - 2014-12-05 00:57 - 00450771 ____R C:\Windows
\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com
There are 1000 more lines.
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from
registry. Any associated file could be listed separately to be moved.)
Task: {3F51DDB9-03FD-425D-9FBE-9871E08E0609} - System32\Tasks\ATKOSD2
=> C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [2013-
09-09] (ASUSTek Computer Inc.)
Task: {57440847-8931-4450-A8E6-89CA3200B9AD} - System32\Tasks\ASUS USB
Charger Plus => C:\Program Files (x86)\ASUS\USBChargerPlus
\USBChargerPlus.exe [2012-07-24] (ASUSTek Computer Inc.)
Task: {6883AAF1-063F-4CDD-A85C-0B05CD0F9660} - System32\Tasks\IUM-
F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel
\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
Task: {6EE8C071-A3CF-40E9-A891-017AEA220B66} - System32\Tasks
\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update
\GoogleUpdate.exe [2014-03-28] (Google Inc.)
Task: {A28E8D22-1470-49EF-9E80-CE024C8B15E8} - System32\Tasks\ASUS
Touchpad Launcher (x64) => C:\Program Files (x86)\ASUS\ASUS Smart
Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2013-02-06] (AsusTek)
Task: {C87CCA25-AC66-4726-91B6-E93A789FDBD5} - System32\Tasks\Adobe
Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash
\FlashPlayerUpdateService.exe [2014-11-25] (Adobe Systems
Incorporated)
Task: {D816101D-1253-48DA-ACF9-0FF69BD9DA3A} - System32\Tasks\IUM-
F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => C:\Program Files
(x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
Task: {E4B3F530-CCB5-418E-A57E-38547223F637} - System32\Tasks
\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update
\GoogleUpdate.exe [2014-03-28] (Google Inc.)
Task: {ED6F1B18-66E6-4706-9523-979356F19BCE} - System32\Tasks
\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start
osppsvc
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows
\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program
Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program
Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2014-03-25 09:47 - 2012-07-31 17:25 - 00086888 _____ () C:\Program
Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-03-25 09:17 - 2012-02-20 11:31 - 00018944 _____ () C:\Windows
\SysWOW64\DptfParticipantProcessorService.exe
2014-03-25 09:17 - 2012-02-20 11:31 - 00019968 _____ () C:\Windows
\SysWOW64\DptfPolicyConfigTDPService.exe
2014-03-25 09:16 - 2012-08-16 01:52 - 00094208 _____ () C:\Windows
\System32\IccLibDll_x64.dll
2014-01-10 06:26 - 2014-01-10 06:26 - 01861968 _____ () C:\Program
Files (x86)\DivX\DivX Update\DivXUpdate.exe
2014-02-12 20:58 - 2014-02-12 20:58 - 00073544 _____ () C:\Program
Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-12 20:58 - 2014-02-12 20:58 - 01044808 _____ () C:\Program
Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-12-04 22:36 - 2014-05-13 12:04 - 00109400 _____ () C:\Program
Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-12-04 22:36 - 2014-05-13 12:04 - 00416600 _____ () C:\Program
Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-12-04 22:36 - 2014-05-13 12:04 - 00167768 _____ () C:\Program
Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-12-04 22:36 - 2012-08-23 10:38 - 00574840 _____ () C:\Program
Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-12-04 22:36 - 2012-04-03 17:06 - 00565640 _____ () C:\Program
Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2006-10-31 17:53 - 2006-10-31 17:53 - 00270336 _____ () C:\Program
Files (x86)\Canon\SELPHY Photo Print\EnoJPEG4.dll
2014-12-05 00:36 - 2014-12-05 00:36 - 00043008 _____ () c:\users\ful
\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-
3e3e7ecf0d81}.tmpfpurdx.dll
2013-08-23 20:01 - 2013-08-23 20:01 - 25100288 _____ () C:\Users\FUL
\AppData\Roaming\Dropbox\bin\libcef.dll
2014-05-08 12:22 - 2014-05-08 12:22 - 00019968 _____ () C:\Program
Files (x86)\Adobe\Acrobat 10.0\Acrobat\locale\de_de\acrotray.deu
2014-01-10 06:28 - 2014-01-10 06:28 - 00100688 _____ () C:\Program
Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
2014-12-05 00:36 - 2014-12-05 00:36 - 00098816 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32api.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00110080 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\pywintypes27.dll
2014-12-05 00:36 - 2014-12-05 00:36 - 00364544 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\pythoncom27.dll
2014-12-05 00:36 - 2014-12-05 00:36 - 00045568 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\_socket.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 01160704 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\_ssl.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00320512 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32com.shell.shell.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00713216 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\_hashlib.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 01175040 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\wx._core_.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00805888 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\wx._gdi_.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00811008 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\wx._windows_.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 01062400 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\wx._controls_.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00735232 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\wx._misc_.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00128512 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\_elementtree.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00127488 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\pyexpat.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00557056 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\pysqlite2._sqlite.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00087552 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\_ctypes.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00119808 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32file.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00108544 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32security.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00007168 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\hashobjs_ext.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00167936 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32gui.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00018432 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32event.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00038912 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32inet.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00011264 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32crypt.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00070656 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\wx._html2.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00027136 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\_multiprocessing.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00035840 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32process.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00686080 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\unicodedata.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00122368 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\wx._wizard.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00024064 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32pipe.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00025600 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32pdh.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00525640 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\windows._lib_cacheinvalidation.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00010240 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\select.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00017408 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32profile.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00022528 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32ts.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00078336 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\wx._animate.pyd
2014-03-25 11:04 - 2012-06-25 10:41 - 01198912 _____ () C:\Program
Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2014-04-26 14:20 - 2013-10-25 20:58 - 00397312 _____ () C:\Program
Files (x86)\Free Download Manager\iefdmdm.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data
Streams will be removed.)
AlternateDataStreams: C:\Users\FUL\Desktop
\Bild.jpg:com.dropbox.attributes
AlternateDataStreams: C:\Users\FUL\Desktop
\IMG_3657.JPG:com.dropbox.attributes
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the
registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored.
None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-965061589-1977914162-274574225-500 -
Administrator - Disabled)
FUL (S-1-5-21-965061589-1977914162-274574225-1000 - Administrator -
Enabled) => C:\Users\FUL
Gast (S-1-5-21-965061589-1977914162-274574225-501 - Limited -
Disabled)
HomeGroupUser$ (S-1-5-21-965061589-1977914162-274574225-1002 - Limited
- Enabled)
UpdatusUser (S-1-5-21-965061589-1977914162-274574225-1003 - Limited -
Enabled) => C:\Users\UpdatusUser
==================== Faulty Device Manager Devices =============
Name: {2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64
Description: {2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: {2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64
Problem: : This device is not present, is not working properly, or
does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be
a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device,
and this error should be resolved.
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update
the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to
start the troubleshooting wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (12/05/2014 00:35:51 AM) (Source: WinMgmt) (EventID: 10) (User:
)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent
WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND
TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (12/05/2014 00:35:51 AM) (Source: Service Control Manager)
(EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist
fehlgeschlagen:
{2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64
Microsoft Office Sessions:
=========================
Error: (12/05/2014 00:35:51 AM) (Source: WinMgmt) (EventID: 10) (User:
)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent
WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND
TargetInstance.LoadPercentage > 990x80041003
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-3317U CPU @ 1.70GHz
Percentage of memory in use: 87%
Total physical RAM: 3981.57 MB
Available physical RAM: 481.2 MB
Total Pagefile: 4796.88 MB
Available Pagefile: 690.65 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:931.29 GB) (Free:184.89 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 059A1B33)
Partition: GPT Partition Type.
========================================================
Disk: 1 (Size: 22.4 GB) (Disk ID: 74F02DEA)
Partition 1: (Not Active) - (Size=22.4 GB) - (Type=73)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-12-05 02:52:00
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000079 ATA_____ rev.BB6Q 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\FUL\AppData\Local\Temp\pwldapob.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff80002fef000 45 bytes [00, 10, 00, 00, 00, 00, 00, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575 fffff80002fef02f 30 bytes [00, 00, 00, 00, 00, 00, 00, ...]
---- User code sections - GMER 2.1 ----
.text C:\Program Files\360\360 Internet Security\deepscan\QHActiveDefense.exe[1600] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files\360\360 Internet Security\deepscan\QHActiveDefense.exe[1600] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2324] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2324] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe[3088] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe[3088] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2632] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2632] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[4244] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[4244] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4360] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4360] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
? C:\Windows\system32\mssprxy.dll [4360] entry point in ".rdata" section 00000000731171e6
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[4484] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[4484] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4512] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4512] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe[3628] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe[3628] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files\360\360 Internet Security\360sdUpd.exe[4372] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files\360\360 Internet Security\360sdUpd.exe[4372] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Users\FUL\Downloads\Gmer-19357.exe[5608] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Users\FUL\Downloads\Gmer-19357.exe[5608] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
---- Devices - GMER 2.1 ----
Device \Driver\a79j3r5m \Device\Scsi\a79j3r5m1 fffffa8009a362c0
Device \FileSystem\Ntfs \Ntfs fffffa80043362c0
Device \FileSystem\fastfat \Fat fffffa8009df82c0
Device \Driver\iaStorA \Device\0000007a fffffa80043322c0
Device \Driver\usbehci \Device\USBPDO-1 fffffa80099b42c0
Device \Driver\iaStorA \Device\RaidPort0 fffffa80043322c0
Device \Driver\iaStorA \Device\00000079 fffffa80043322c0
Device \Driver\usbehci \Device\USBFDO-0 fffffa80099b42c0
Device \Driver\usbehci \Device\USBFDO-1 fffffa80099b42c0
Device \Driver\NetBT \Device\NetBT_Tcpip_{B659D313-2901-4231-AABD-2C0313B0EFF7} fffffa80094c62c0
Device \Driver\NetBT \Device\NetBt_Wins_Export fffffa80094c62c0
Device \Driver\iaStorA \Device\ScsiPort0 fffffa80043322c0
Device \Driver\usbehci \Device\USBPDO-0 fffffa80099b42c0
Device \Driver\a79j3r5m \Device\ScsiPort1 fffffa8009a362c0
---- Trace I/O - GMER 2.1 ----
Trace ntoskrnl.exe CLASSPNP.SYS disk.sys iaStorF.sys SamsungRapidDiskFltr.sys >>UNKNOWN [0xfffffa80043322c0]<< sptd.sys storport.sys hal.dll iaStorA.sys fffffa80043322c0
Trace 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80071da060] fffffa80071da060
Trace 3 CLASSPNP.SYS[fffff88001f2a43f] -> nt!IofCallDriver -> [0xfffffa80070db9f0] fffffa80070db9f0
Trace 5 iaStorF.sys[fffff88001bf4a2c] -> nt!IofCallDriver -> [0xfffffa80070dbde0] fffffa80070dbde0
Trace 7 SamsungRapidDiskFltr.sys[fffff88000c17ad1] -> nt!IofCallDriver -> \Device\00000079[0xfffffa8006fe29c0] fffffa8006fe29c0
Trace \Driver\iaStorA[0xfffffa80052cd6d0] -> IRP_MJ_CREATE -> 0xfffffa80043322c0 fffffa80043322c0
---- Modules - GMER 2.1 ----
Module \SystemRoot\System32\Drivers\a79j3r5m.SYS fffff8800f657000-fffff8800f69a000 (274432 bytes)
---- Processes - GMER 2.1 ----
Library C:\Users\FUL\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe [3752](2014-11-13 06:49:58) 0000000004060000
Library c:\users\ful\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpw216rf.dll (*** suspicious ***) @ C:\Users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe [3752](2014-12-05 01:49:14) 0000000004750000
Library C:\Users\FUL\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe [3752](2013-08-23 19:01:44) 00000000678b0000
Library C:\Users\FUL\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe [3752] (ICU Data DLL/The ICU Project)(2013-08-23 19:01:42) 0000000066f20000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\python27.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001e000000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32api.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001e8c0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\pywintypes27.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001e7a0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\pythoncom27.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000002c0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\_socket.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000000240000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\_ssl.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000010000000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32com.shell.shell.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001e800000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\_hashlib.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000001f60000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._core_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000002f40000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wxbase294u_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000003070000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wxbase294u_net_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000000280000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wxmsw294u_core_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000003260000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wxmsw294u_adv_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000003700000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._gdi_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000003840000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._windows_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000004150000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wxmsw294u_html_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000004220000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._controls_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000044e0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._misc_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000045f0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\_elementtree.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001d100000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\pyexpat.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000005b0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\pysqlite2._sqlite.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000042c0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\_ctypes.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001d1a0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32file.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001ea10000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32security.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001ec80000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\hashobjs_ext.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000000610000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32gui.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001ea40000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32event.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001e9b0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32inet.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001eaa0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32crypt.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001e980000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._html2.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000002810000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wxmsw294u_webview_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000003910000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\_multiprocessing.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000003930000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32process.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001ebf0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\unicodedata.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000005900000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._wizard.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000058c0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32pipe.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001eb90000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32pdh.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001eb60000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\windows._lib_cacheinvalidation.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000735a0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\select.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000058a0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32profile.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001ec20000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32ts.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001ed40000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._animate.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000059b0000
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Vielen Dank für Eure Hilfe! lolofufu Geändert von lolofufu (05.12.2014 um 02:56 Uhr) |
| Themen zu Win7 64bit - Spyware.Zbot.ED bzw. HEUR/QVM03.0.Malware.Gen gefunden durch Malwarebytes bzw. 360 Internet Security |
| adobe, adware, avg, avira, bonjour, browser, canon, computer, cpu-z, crystaldiskinfo, defender, desktop, entfernen, error, explorer, failed, flash player, free download, google, hal.dll, heur/qvm03.0.malware.gen, internet, mozilla, nvidia, registry, safer networking, security, software, spyware.zbot.ed, svchost.exe, system, teredo, windows, winlogon.exe |
Baum-Darstellung