| |
| |||||||
Log-Analyse und Auswertung: Avira von Virus abgeschaltet, Malware gefunden, Bildschirm acht mal zu sehenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
27.12.2014, 17:47
| #1 |
 |  Avira von Virus abgeschaltet, Malware gefunden, Bildschirm acht mal zu sehen Hallo, nachdem ich auf www.myvideo.de mir mehrere Video´s angeschaut habe bemerkte ich nach dem letzten klick ungewöhnliche Aktivitäten auf meinem Rechner. Habe dann sofort die Internetverbindung getrennt und wollte den Virenscanner (Avira) laufen lassen. Es kam die Fehlermeldung "Program not found". Fast zeitgleich konnte ich dann meinen Desktop acht mal auf meinem Bildschirm sehen. Alles war also mini und sehr sehr unscharf. Nun erstmal alle wichtigen Daten auf externe Festplatte gezogen. Vielleicht kann man diese später noch retten. Habe dann von "sauberen" Rechner verschiedene Programme downgeloadet und per E-mail verschickt. Anschliessend dann vom infizierten Rechner die gesendeten E-Mails aufgerufen und Dateien installiert. 1. Avira (Scan funktionierte nicht) 2. Winzip Malware Protector (weit über 100 Funde, ich glaube es waren 139 Stück, hauptsächlich Adware und Malware) gefundene Dateien wurden dann manuell gelöscht incl. Registry 3. Malwarebytes Antimalware (weitere Funde) gefundene Dateien wurden dann manuell gelöscht incl. Registry 4. rkitt 5. iobituninstaller41 6. revosetup95 Später stellte ich dann noch fest, dass beim Starten von Google Chrome meine Startseite verändert war. Diese neue Seite wurde jedoch nicht gestartet, da diese als unsicher erkannt wurde.Bei jedem Neustart von Google Chrome immer wieder diese Startseite. Erst als ich einen unsichtbaren und geschützten Ordner, welchen ich mit einem der o.a. Programme gefunden hatte, gelöscht wurde war dieses Problem behoben. Anschließend wurde bei einem erneuten Scan 12 "Spyware-Dateien gefunden", welche dann ebenfalls manuell gelöscht wurden. Nun wird meines Erachtens nichts mehr gefunden. Das Problem mit der Darstellung des Desktops besteht immer noch. Das bedeutet alles was man normal nur einmal auf dem Bildschirm sieht, ist bei mir acht mal zu sehen. Teilweise überlappen sich die Ansichten, daher auch nur eingeschränkte Nutzungsmöglichkeiten. Neuinstallation Grafikkartentreiber hat nichts gebracht. Spiegelung ist schon beim starten des PC´s (bevor sich Windows-Vista öffnet) zu erkennen. Und nun meine Fragen: 1. Ist mein PC noch zu retten? 2. Wie sieht es mit der Rettung meiner Daten auf dem PC und auf der "vielleicht verseuchten" externen Festplatte aus? 3. Habe ich etwa auch noch ein Problem mit meiner Grafikkarte? 4. Wie kann ich den Fehler mit dem gespiegelten Bildschirm eingrenzen? Vielen Dank schonmal für die Beantwortung meiner Fragen und Eure Hilfe. Gruß j. newton Bin nun die Anleitung für Hilfesuchende durchgegangen: 1. Defogger: Da ich die einzelnen Buttons so gut wie nicht lesen kann kann ich nicht gerantieren, dass ich nicht den Button "Re-enable" gedrückt habe. Hier das Ergebnis aus der defogger_disable log: defogger_enable by jpshortstuff (23.02.10.1) Log created at 15:18 on 27/12/2014 (Administrator Jürgen) Parsing file... -=E.O.F=- 2.a. FRST.txt: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 27-12-2014 Ran by Administrator Jürgen (administrator) on LAPTOPJN on 27-12-2014 14:13:08 Running from C:\Users\Administrator Jürgen\Desktop Loaded Profile: Administrator Jürgen (Available profiles: Administrator Jürgen & Sabrina) Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 9 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Microsoft Corporation) C:\Windows\System32\SLsvc.exe (Teruten) C:\Windows\System32\FsUsbExService.Exe (O2Micro International) C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe (United Internet AG) C:\Program Files\WEB.DE\WEB.DE SmartSurfer\SmurfService.exe () C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe (Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe (Microsoft Corporation) C:\Windows\System32\conime.exe (Nico Mak Computing) C:\Program Files\WinZip Malware Protector\WinZipMalwareProtector.exe (Google Inc.) C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\System32\wuauclt.exe (Google Inc.) C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\S-1-5-21-1707432137-198735931-3728340409-1000\...\Run: [KiesPDLR] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [20880 2011-06-24] () HKU\S-1-5-21-1707432137-198735931-3728340409-1000\...\Policies\system: [LogonHoursAction] 2 HKU\S-1-5-21-1707432137-198735931-3728340409-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1 ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File GroupPolicyUsers\S-1-5-21-1707432137-198735931-3728340409-1001\User: Group Policy restriction detected <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com StartMenuInternet: IEXPLORE.EXE - iexplore.exe BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Advanced SystemCare Surfing Protection -> {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} -> C:\Program Files\IObit\Surfing Protection\BrowerProtect\ASCPlugin_Protection.dll (IObit) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.) DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} hxxp://liveupdate.msi.com.tw/autobios/LOnline/install.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 FireFox: ======== FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-1707432137-198735931-3728340409-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKU\S-1-5-21-1707432137-198735931-3728340409-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2010-12-22] FF HKU\S-1-5-21-1707432137-198735931-3728340409-1000\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff FF Extension: Download videos and MP3s from YouTube - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff [2014-06-09] Chrome: ======= CHR HomePage: Default -> hxxp://www.google.de/ CHR StartupUrls: Default -> "hxxp://www.google.de/" CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter} CHR Profile: C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Docs) - C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-12-06] CHR Extension: (Google Drive) - C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-12-06] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-03] CHR Extension: (YouTube) - C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-01-21] CHR Extension: (Google-Suche) - C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-01-21] CHR Extension: (Google Wallet) - C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-31] CHR Extension: (Google Mail) - C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-01-21] CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path CHR StartMenuInternet: Google Chrome - Chrome.exe ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [217088 2010-10-25] (Teruten) [File not signed] S2 LiveUpdateSvc; C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe [2631456 2014-11-26] (IObit) R2 o2flash; C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe [65536 2007-02-12] (O2Micro International) [File not signed] S3 ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [620544 2008-11-11] (Nokia.) [File not signed] R2 SmartSurferManager; C:\Program Files\WEB.DE\WEB.DE SmartSurfer\SmurfService.exe [132560 2007-12-18] (United Internet AG) S2 IHProtect Service; C:\Program Files\STab\ProtectService.exe [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36640 2009-12-22] () [File not signed] R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2014-12-27] (Malwarebytes Corporation) S3 MSI_DVD_010507; C:\Program Files\MSI\MSIWDev\DVDSYS32_100507.sys [22328 2010-05-10] (Your Corporation) S3 MSI_MSIBIOS_010507; C:\Program Files\MSI\MSIWDev\msibios32_100507.sys [25912 2010-05-10] (Your Corporation) S3 MSI_VGASYS_010507; C:\Program Files\MSI\MSIWDev\VGASYS32_100507.sys [16696 2010-05-10] () S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S0 navgcswl; System32\drivers\boyygxy.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-27 14:13 - 2014-12-27 14:13 - 00009796 _____ () C:\Users\Administrator Jürgen\Desktop\FRST.txt 2014-12-27 14:12 - 2014-12-27 14:13 - 00000000 ____D () C:\FRST 2014-12-27 14:11 - 2014-12-27 14:11 - 01114624 _____ (Farbar) C:\Users\Administrator Jürgen\Desktop\FRST.exe 2014-12-27 14:09 - 2014-12-27 14:09 - 00000274 _____ () C:\Users\Administrator Jürgen\Desktop\defogger_enable.log 2014-12-27 14:08 - 2014-12-27 14:09 - 00000476 _____ () C:\Users\Administrator Jürgen\Desktop\defogger_disable.log 2014-12-27 14:08 - 2014-12-27 14:08 - 00050477 _____ () C:\Users\Administrator Jürgen\Desktop\Defogger.exe 2014-12-27 13:37 - 2014-12-27 13:37 - 00000986 _____ () C:\Users\Public\Desktop\WinZip Malware Protector.lnk 2014-12-27 13:37 - 2014-12-27 13:37 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\Nico Mak Computing 2014-12-27 13:37 - 2014-12-27 13:37 - 00000000 ____D () C:\ProgramData\Nico Mak Computing 2014-12-27 13:37 - 2014-12-27 13:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector 2014-12-27 13:37 - 2014-12-27 13:37 - 00000000 ____D () C:\Program Files\WinZip Malware Protector 2014-12-27 13:37 - 2013-03-15 17:01 - 00016384 _____ () C:\Windows\system32\wsusnative32.exe 2014-12-27 12:19 - 2014-12-27 12:19 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-12-27 12:19 - 2014-12-27 12:19 - 00000899 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-12-27 12:19 - 2014-12-27 12:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-12-27 12:19 - 2014-12-27 12:19 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-12-27 12:19 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-12-27 12:19 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-12-27 12:19 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-12-07 16:58 - 2014-12-07 16:58 - 00237152 _____ () C:\Windows\Minidump\Mini120714-03.dmp 2014-12-07 15:51 - 2014-12-07 15:51 - 00254616 _____ () C:\Windows\Minidump\Mini120714-02.dmp 2014-12-07 13:23 - 2014-12-07 13:23 - 00250624 _____ () C:\Windows\Minidump\Mini120714-01.dmp 2014-12-05 22:55 - 2014-12-05 22:55 - 00000000 ____D () C:\ProgramData\IHProtectUpDate 2014-12-05 22:54 - 2014-12-06 22:25 - 00318034 _____ () C:\Windows\PFRO.log 2014-12-05 22:52 - 2014-07-02 20:42 - 02556360 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll 2014-12-05 22:52 - 2014-07-02 20:42 - 00670552 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe 2014-12-05 22:52 - 2014-07-02 20:42 - 00062936 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll 2014-12-05 22:52 - 2014-07-02 06:14 - 03826628 _____ () C:\Windows\system32\nvcoproc.bin 2014-12-05 22:51 - 2014-12-05 22:51 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation 2014-12-05 22:51 - 2014-07-02 21:54 - 00061728 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll 2014-12-05 22:50 - 2014-07-02 21:54 - 24198088 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv32.dll 2014-12-05 22:50 - 2014-07-02 21:54 - 16122344 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2um.dll 2014-12-05 22:50 - 2014-07-02 21:54 - 15296456 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll 2014-12-05 22:50 - 2014-07-02 21:54 - 14498552 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dum.dll 2014-12-05 22:50 - 2014-07-02 21:54 - 11283344 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll 2014-12-05 22:50 - 2014-07-02 21:54 - 11222048 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll 2014-12-05 22:50 - 2014-07-02 21:54 - 10681176 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys 2014-12-05 22:50 - 2014-07-02 21:54 - 03988952 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll 2014-12-05 22:50 - 2014-07-02 21:54 - 02814656 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi.dll 2014-12-05 22:50 - 2014-07-02 21:54 - 01054552 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco3234052.dll 2014-12-05 22:50 - 2014-07-02 21:54 - 00907552 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco3234052.dll 2014-12-05 22:50 - 2014-07-02 21:54 - 00021215 _____ () C:\Windows\system32\nvinfo.pb 2014-12-05 22:49 - 2014-12-05 22:49 - 00000000 _____ () C:\Windows\setuperr.log 2014-12-05 22:49 - 2014-12-05 22:49 - 00000000 _____ () C:\Windows\setupact.log 2014-12-05 22:48 - 2014-12-05 22:52 - 00000000 ____D () C:\Program Files\NVIDIA Corporation 2014-12-05 22:47 - 2014-12-05 22:47 - 00000000 ____D () C:\NVIDIA 2014-12-05 20:05 - 2014-12-05 20:05 - 00000344 _____ () C:\Windows\Tasks\ReimageUpdater.job 2014-12-05 20:04 - 2014-12-05 20:05 - 00000156 _____ () C:\Windows\Reimage.ini 2014-12-05 19:53 - 2014-12-05 19:53 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Local\Avg2015 2014-12-05 19:52 - 2014-12-05 20:00 - 00000000 ____D () C:\ProgramData\MFAData 2014-12-05 19:52 - 2014-12-05 19:52 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Local\MFAData 2014-12-05 19:52 - 2014-12-05 19:52 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Local\Avg2014 2014-12-05 19:40 - 2014-12-05 19:40 - 00000000 ____D () C:\Windows\Tasks\ImCleanDisabled 2014-12-05 19:35 - 2014-12-05 19:35 - 00000000 ___HD () C:\Users\Administrator Jürgen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2014-12-05 19:35 - 2014-12-05 19:35 - 00000000 ____D () C:\Program Files\Dropbox 2014-12-05 19:34 - 2014-12-05 19:35 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox 2014-12-05 19:12 - 2014-12-06 22:25 - 00000000 ____D () C:\ProgramData\AVAST Software 2014-12-05 16:02 - 2014-12-05 16:02 - 00001057 _____ () C:\Users\Administrator Jürgen\Desktop\Revo Uninstaller.lnk 2014-12-05 16:02 - 2014-12-05 16:02 - 00000000 ____D () C:\Program Files\VS Revo Group 2014-12-05 15:38 - 2014-12-05 15:38 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\Apple Computer 2014-12-05 15:38 - 2014-12-05 15:38 - 00000000 ____D () C:\ProgramData\{BAF091CA-86C4-4627-ADA1-897E2621C1B0} 2014-12-05 15:38 - 2014-12-05 15:38 - 00000000 ____D () C:\Program Files\Common Files\IObit 2014-12-05 15:37 - 2014-12-27 12:16 - 00000000 ____D () C:\ProgramData\ProductData 2014-12-05 15:37 - 2014-12-05 19:40 - 00000000 ____D () C:\Program Files\IObit 2014-12-05 15:37 - 2014-12-05 15:38 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\IObit 2014-12-05 15:37 - 2014-12-05 15:38 - 00000000 ____D () C:\ProgramData\IObit 2014-12-05 15:37 - 2014-12-05 15:37 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\ProductData 2014-12-05 15:37 - 2014-12-05 15:37 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\IObit 2014-12-05 11:38 - 2014-12-05 11:38 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-12-05 11:37 - 2014-12-27 12:18 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Administrator Jürgen\Downloads\mbam-setup-2.0.4.1028_CB-DL-Manager [1].exe 2014-12-03 21:23 - 2014-12-03 21:23 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\dlg 2014-12-03 21:15 - 2014-12-05 11:59 - 00000000 ____D () C:\ProgramData\SystemMedia 2014-12-03 21:15 - 2014-12-03 21:15 - 00000000 ____D () C:\ProgramData\RfndNSIS 2014-12-03 21:15 - 2014-12-03 21:15 - 00000000 ____D () C:\ProgramData\PicColorData 2014-12-03 21:15 - 2014-12-02 15:23 - 00332584 _____ (Say Media Group LTD) C:\Windows\system32\ColorMedia.dll 2014-12-03 20:54 - 2014-12-06 03:23 - 00000000 ____D () C:\OETemp 2014-12-03 20:46 - 2014-12-03 20:46 - 00000000 ____D () C:\Windows\Registration ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-27 14:10 - 2010-12-19 11:28 - 00001356 _____ () C:\Users\Administrator Jürgen\AppData\Local\d3d9caps.dat 2014-12-27 14:10 - 2006-11-02 13:47 - 00003712 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2014-12-27 14:10 - 2006-11-02 13:47 - 00003712 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2014-12-27 14:04 - 2012-12-02 14:26 - 00001180 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1707432137-198735931-3728340409-1000UA.job 2014-12-27 14:04 - 2008-01-21 02:35 - 01650615 _____ () C:\Windows\WindowsUpdate.log 2014-12-27 12:22 - 2006-11-02 11:33 - 01576246 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-12-27 12:17 - 2013-01-23 19:48 - 00000000 ____D () C:\Users\Administrator Jürgen\Desktop\To Do 2014-12-27 12:15 - 2010-12-31 14:26 - 00000000 ____D () C:\SmartSurfer 2014-12-27 12:15 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-12-25 11:55 - 2010-12-19 13:35 - 00004268 _____ () C:\Windows\bthservsdp.dat 2014-12-25 11:55 - 2006-11-02 14:01 - 00032530 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-12-14 21:38 - 2010-12-31 14:26 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\SmartSurfer 2014-12-07 16:58 - 2011-10-30 13:50 - 00000000 ____D () C:\Windows\Minidump 2014-12-07 16:58 - 2011-10-30 13:49 - 221670998 _____ () C:\Windows\MEMORY.DMP 2014-12-07 16:02 - 2012-12-02 14:26 - 00001128 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1707432137-198735931-3728340409-1000Core.job 2014-12-07 07:52 - 2010-12-19 13:55 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-12-06 07:48 - 2012-01-21 11:36 - 00002109 _____ () C:\Users\Administrator Jürgen\Desktop\Google Chrome.lnk 2014-12-06 07:48 - 2010-12-19 11:43 - 00000919 _____ () C:\Users\Administrator Jürgen\Desktop\Launch Internet Explorer Browser.lnk 2014-12-06 07:48 - 2010-12-19 11:29 - 00000949 ____H () C:\Users\Administrator Jürgen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-12-05 22:51 - 2012-02-08 20:30 - 00000000 ____D () C:\Temp 2014-12-05 19:29 - 2010-12-19 21:15 - 00000000 ____D () C:\Windows\PANTHER 2014-12-05 19:29 - 2010-12-19 12:51 - 00000000 ____D () C:\Program Files\PDFCreator 2014-12-05 18:55 - 2014-08-19 07:50 - 00000000 ____D () C:\ProgramData\Package Cache 2014-12-05 12:33 - 2006-11-02 13:47 - 00318352 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-12-05 10:54 - 2011-08-05 19:02 - 00002451 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk 2014-12-03 21:02 - 2010-12-19 11:29 - 00079472 _____ () C:\Users\Administrator Jürgen\AppData\Local\GDIPFONTCACHEV1.DAT 2014-12-03 20:40 - 2006-11-02 11:22 - 38535168 _____ () C:\Windows\system32\config\software_previous 2014-12-03 20:40 - 2006-11-02 11:22 - 37224448 _____ () C:\Windows\system32\config\components_previous 2014-12-03 20:40 - 2006-11-02 11:22 - 19398656 _____ () C:\Windows\system32\config\system_previous 2014-12-03 20:40 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\security_previous 2014-12-03 20:40 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous 2014-12-03 20:40 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\default_previous 2014-12-03 20:39 - 2012-04-22 21:07 - 00000000 ____D () C:\Users\Sabrina 2014-12-03 20:39 - 2012-01-21 11:36 - 00000000 ___HD () C:\Users\Administrator Jürgen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-12-03 20:39 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\spool 2014-12-03 20:39 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\Msdtc 2014-12-03 20:39 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\registration.tmp 2014-12-03 19:53 - 2010-12-24 08:51 - 00028760 _____ () C:\Users\Administrator Jürgen\AppData\Roaming\nvModes.001 2014-12-02 22:29 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\LiveKernelReports 2014-12-02 21:24 - 2010-12-24 08:28 - 00028760 _____ () C:\Users\Administrator Jürgen\AppData\Roaming\nvModes.dat Some content of TEMP: ==================== C:\Users\Administrator Jürgen\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpj26ntx.dll C:\Users\Administrator Jürgen\AppData\Local\Temp\PCSChecker.exe C:\Users\Administrator Jürgen\AppData\Local\Temp\{837A08FF-493D-41C3-894C-722680E707FA}-39.0.2171.71_38.0.2125.111_chrome_updater.exe C:\Users\Sabrina\AppData\Local\Temp\AskSLib.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-12-27 12:21 ==================== End Of Log ============================ 2. b. Addition.txt:FRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 27-12-2014
Ran by Administrator Jürgen at 2014-12-27 14:13:43
Running from C:\Users\Administrator Jürgen\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 10 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 10.1.102.64 - Adobe Systems Incorporated)
Adobe Reader X (10.1.12) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)
Atheros Driver Installation Program (HKLM\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 7.1 - Atheros)
Brother MFL-Pro Suite (HKLM\...\{A3FEC306-FBFF-4B0D-95B9-F9C67C65079E}) (Version: 1.00 - Brother Industries, Ltd.)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.3.8.2474 - CDBurnerXP)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6514.5001 - Microsoft Corporation)
Dropbox (HKU\S-1-5-21-1707432137-198735931-3728340409-1000\...\Dropbox) (Version: 2.10.52 - Dropbox, Inc.)
ElsterFormular-Upgrade (HKLM\...\ElsterFormular für Privatanwender und Unternehmer 11.5.3.5585) (Version: 15.3.14949 - Landesfinanzdirektion Thüringen)
FaceFilter Studio Brother Edition (HKLM\...\{F59205C8-E5FB-43F5-AAB2-16C1760D4F59}) (Version: 1.0 - )
Free YouTube to MP3 Converter version 3.12.38.530 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.38.530 - DVDVideoSoft Ltd.)
Google Chrome (HKU\S-1-5-21-1707432137-198735931-3728340409-1000\...\Google Chrome) (Version: 38.0.2125.111 - Google Inc.)
Java 7 Update 67 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217040FF}) (Version: 7.0.670 - Oracle)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MSXML 4.0 SP2 (KB927978) (HKLM\...\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}) (Version: 4.20.9841.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)
O2Micro Flash Memory Card Reader Driver (x86) (HKLM\...\{0F667427-AD37-4089-A4A2-15AF5E44CACD}) (Version: 3.25 - O2Micro)
PaperPort Image Printer (HKLM\...\{332CC6BF-E6C7-48EE-BA3D-435E576AD67F}) (Version: 1.00.0000 - Nuance Communications, Inc.)
PC Connectivity Solution (HKLM\...\{34610DE0-3C13-42CA-8E32-01FFA38AB6E8}) (Version: 8.47.7.0 - Nokia)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.2.3 - Frank Heindörfer, Philip Chinery)
Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.0.1.11053_99 - Samsung Electronics Co., Ltd.)
Samsung Kies (Version: 2.0.1.11053_99 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.3.2410.0 - SAMSUNG Electronics Co., Ltd.)
ScanSoft PaperPort 11 (HKLM\...\{B6C89654-A6A2-477C-873B-724EC1C56407}) (Version: 11.1.0000 - Nuance Communications, Inc.)
Surfing Protection (HKLM\...\IObit Surfing Protection_is1) (Version: 1.2 - IObit)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 10.0.13.2 - Synaptics)
VLC media player 1.1.5 (HKLM\...\VLC media player) (Version: 1.1.5 - VideoLAN)
WEB.DE SmartSurfer (HKLM\...\WEB.DE SmartSurfer) (Version: - )
WEB.DE SmartSurfer AutoUpdate 5.2 (HKLM\...\{11CA6E01-3992-4115-AB6E-D325552C166D}) (Version: - )
Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0) (HKLM\...\504244733D18C8F63FF584AEB290E3904E791693) (Version: 08/22/2008 7.0.0.0 - Nokia)
WinRAR Archivierer (HKLM\...\WinRAR archiver) (Version: - )
WinZip Malware Protector (HKLM\...\WinZip Malware Protector_is1) (Version: 2.1.1000.14260 - WinZip International LLC)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\localserver32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\Application\38.0.2125.111\delegate_execute.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\psuser.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\psuser.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
==================== Restore Points =========================
06-12-2014 08:16:44 Revo Uninstaller's restore point - Reimage Repair
06-12-2014 22:35:51 Windows-Sicherung
07-12-2014 17:47:57 Geplanter Prüfpunkt
14-12-2014 21:20:12 Windows-Sicherung
14-12-2014 21:55:15 Revo Uninstaller's restore point - Malwarebytes Anti-Malware Version 2.0.4.1028
14-12-2014 21:59:04 Revo Uninstaller's restore point - SpyHunter 4
14-12-2014 22:04:56 Revo Uninstaller's restore point - WinZip Malware Protector
14-12-2014 22:06:46 Revo Uninstaller's restore point - IObit Uninstaller
27-12-2014 12:33:03 Windows-Sicherung
27-12-2014 13:42:05 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2006-11-02 11:23 - 2006-09-18 22:41 - 00000761 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {11CA1589-97EF-47DF-9672-B4B173D3A457} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1707432137-198735931-3728340409-1000Core => C:\Users\Administrator Jürgen\AppData\Local\Google\Update\GoogleUpdate.exe [2012-12-02] (Google Inc.)
Task: {591FCC94-8D03-4CE3-AEE4-C90278EFD080} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)
Task: {7305E863-6072-49D2-9B92-2DBC6B53BA2E} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1707432137-198735931-3728340409-1000UA => C:\Users\Administrator Jürgen\AppData\Local\Google\Update\GoogleUpdate.exe [2012-12-02] (Google Inc.)
Task: {78601467-1B67-497E-BCBA-A63F1536F21D} - System32\Tasks\{E4A47A3D-9F11-4D0B-AFD8-3A965876B4F8} => pcalua.exe -a "C:\Program Files\WinRAR\WinRAR.exe" -d "C:\Users\Administrator Jürgen\Downloads" -c "C:\Users\Administrator Jürgen\Downloads\Vorlage_WLAN_Verstaerkung.zip"
Task: {EAB8E1C4-6215-432F-A7F7-2A5C5B4CF64E} - System32\Tasks\WinZip Malware Protector_startup => C:\Program Files\WinZip Malware Protector\WinZipMalwareProtector.exe [2014-12-02] (Nico Mak Computing)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1707432137-198735931-3728340409-1000Core.job => C:\Users\Administrator Jürgen\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1707432137-198735931-3728340409-1000UA.job => C:\Users\Administrator Jürgen\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\ReimageUpdater.job => C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe <==== ATTENTION
==================== Loaded Modules (whitelisted) =============
2012-01-21 11:52 - 2001-10-28 17:42 - 00116224 _____ () C:\Windows\System32\pdfcmnnt.dll
2006-03-09 17:33 - 2006-03-09 17:33 - 00049152 _____ () C:\Program Files\WEB.DE\WEB.DE SmartSurfer\xmlparse.dll
2006-03-09 17:33 - 2006-03-09 17:33 - 00073728 _____ () C:\Program Files\WEB.DE\WEB.DE SmartSurfer\xmltok.dll
2010-12-19 12:18 - 2002-05-28 18:11 - 00122880 _____ () C:\Program Files\WinRAR\rarext.dll
2011-06-24 15:54 - 2011-06-24 15:54 - 00020880 _____ () C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
2014-12-14 21:31 - 2014-12-14 21:31 - 00055816 _____ () C:\Users\Administrator Jürgen\AppData\Local\Temp\b01d42a6-0948-4bd0-8dea-54d68f50a791\CliSecureRT.dll
2014-12-27 13:37 - 2013-02-28 16:53 - 00886272 _____ () C:\Program Files\WinZip Malware Protector\System.Data.SQLite.dll
2014-12-27 13:37 - 2014-12-02 11:26 - 01717936 _____ () C:\Program Files\WinZip Malware Protector\aspsys.dll
2014-12-27 13:37 - 2013-02-28 16:53 - 00168448 _____ () C:\Program Files\WinZip Malware Protector\UNRAR.DLL
2014-10-29 19:59 - 2014-10-22 05:04 - 08910664 _____ () C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\Application\38.0.2125.111\pdf.dll
2014-10-29 19:59 - 2014-10-22 05:04 - 01681224 _____ () C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\Application\38.0.2125.111\ffmpegsumo.dll
2014-10-29 19:59 - 2014-10-22 05:05 - 14902600 _____ () C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\Application\38.0.2125.111\PepperFlash\pepflashplayer.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: BrMfcWnd => C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
MSCONFIG\startupreg: ControlCenter3 => C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
MSCONFIG\startupreg: Google Update => "C:\Users\Administrator Jürgen\AppData\Local\Google\Update\GoogleUpdate.exe" /c
MSCONFIG\startupreg: IndexSearch => "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
MSCONFIG\startupreg: InetStat => C:\Users\Administrator Jürgen\AppData\Roaming\InetStat\inetstat.exe
MSCONFIG\startupreg: KiesHelper => C:\Program Files\Samsung\Kies\KiesHelper.exe /s
MSCONFIG\startupreg: KiesPDLR => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
MSCONFIG\startupreg: KiesTrayAgent => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
MSCONFIG\startupreg: NvCplDaemon => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
MSCONFIG\startupreg: NvMediaCenter => RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
MSCONFIG\startupreg: NvSvc => RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
MSCONFIG\startupreg: PaperPort PTD => "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
MSCONFIG\startupreg: PPort11reminder => "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini
MSCONFIG\startupreg: Sidebar => C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
MSCONFIG\startupreg: SSBkgdUpdate => "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: SynTPStart => C:\Program Files\Synaptics\SynTP\SynTPStart.exe
MSCONFIG\startupreg: Windows Defender => %ProgramFiles%\Windows Defender\MSASCui.exe -hide
MSCONFIG\startupreg: WinZip Malware Protector_startup => "C:\Program Files\WinZip Malware Protector\WinZipMalwareProtector.exe" autolaunch
MSCONFIG\startupreg: WMPNSCFG => C:\Program Files\Windows Media Player\WMPNSCFG.exe
========================= Accounts: ==========================
Administrator (S-1-5-21-1707432137-198735931-3728340409-500 - Administrator - Disabled)
Administrator Jürgen (S-1-5-21-1707432137-198735931-3728340409-1000 - Administrator - Enabled) => C:\Users\Administrator Jürgen
Gast (S-1-5-21-1707432137-198735931-3728340409-501 - Limited - Disabled)
Sabrina (S-1-5-21-1707432137-198735931-3728340409-1001 - Limited - Enabled) => C:\Users\Sabrina
==================== Faulty Device Manager Devices =============
Name: NVIDIA GeForce 8400M G
Description: NVIDIA GeForce 8400M G
Class Guid: {4d36e968-e325-11ce-bfc1-08002be10318}
Manufacturer: NVIDIA
Service: nvlddmkm
Problem: : Windows has stopped this device because it has reported problems. (Code 43)
Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation.
==================== Event log errors: =========================
Application errors:
==================
Error: (12/14/2014 10:06:46 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {dfa65fe5-7b6a-49ac-b761-26388d1388ba}
Error: (12/14/2014 10:04:53 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {dfa65fe5-7b6a-49ac-b761-26388d1388ba}
Error: (12/14/2014 09:59:04 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {f01c0026-850b-43ed-8301-aab67b7c5909}
Error: (12/14/2014 09:55:12 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {f01c0026-850b-43ed-8301-aab67b7c5909}
Error: (12/07/2014 09:55:05 AM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c
Error: (12/07/2014 08:00:06 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm SpyHunter4.exe, Version 4.18.9.4384 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: a64
Anfangszeit: 01d011ea78d96917
Zeitpunkt der Beendigung: 15
Error: (12/06/2014 10:44:59 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm SpyHunter4.exe, Version 4.18.9.4384 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: afc
Anfangszeit: 01d0119b69634f92
Zeitpunkt der Beendigung: 31
Error: (12/06/2014 10:24:04 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts auf dem Volume (Prozess = C:\Program Files\AVAST Software\Avast\Setup\Instup.exe Files\AVAST Software\Avast\Setup\Instup.exe" /control_panel /instop:uninstall; Beschreibung = avast! antivirus system restore point; Hr = 0x8007043c).
Error: (12/06/2014 10:23:28 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts auf dem Volume (Prozess = C:\Program Files\VS Revo Group\Revo Uninstaller\Revouninstaller.exe Files\VS Revo Group\Revo Uninstaller\Revouninstaller.exe" ; Beschreibung = Revo Uninstaller's restore point - Avast Free Antivirus; Hr = 0x8007043c).
Error: (12/06/2014 10:37:00 AM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c
System errors:
=============
Error: (12/27/2014 00:17:24 PM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT)
Description: 0x80070032
Error: (12/27/2014 00:17:09 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: navgcswl
Error: (12/27/2014 00:17:09 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: IHProtect Service%%2
Error: (12/25/2014 11:16:59 AM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT)
Description: 0x80070032
Error: (12/25/2014 11:16:30 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: navgcswl
Error: (12/25/2014 11:16:30 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: IHProtect Service%%2
Error: (12/14/2014 10:06:21 PM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT)
Description: 0x80070032
Error: (12/14/2014 10:03:41 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: navgcswl
Error: (12/14/2014 10:03:41 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: IHProtect Service%%2
Error: (12/14/2014 09:32:11 PM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT)
Description: 0x80070032
Microsoft Office Sessions:
=========================
Error: (12/14/2014 10:06:46 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {dfa65fe5-7b6a-49ac-b761-26388d1388ba}
Error: (12/14/2014 10:04:53 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {dfa65fe5-7b6a-49ac-b761-26388d1388ba}
Error: (12/14/2014 09:59:04 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {f01c0026-850b-43ed-8301-aab67b7c5909}
Error: (12/14/2014 09:55:12 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {f01c0026-850b-43ed-8301-aab67b7c5909}
Error: (12/07/2014 09:55:05 AM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c
Error: (12/07/2014 08:00:06 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: SpyHunter4.exe4.18.9.4384a6401d011ea78d9691715
Error: (12/06/2014 10:44:59 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: SpyHunter4.exe4.18.9.4384afc01d0119b69634f9231
Error: (12/06/2014 10:24:04 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Program Files\AVAST Software\Avast\Setup\Instup.exe Files\AVAST Software\Avast\Setup\Instup.exe" /control_panel /instop:uninstallavast! antivirus system restore point0x8007043c
Error: (12/06/2014 10:23:28 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Program Files\VS Revo Group\Revo Uninstaller\Revouninstaller.exe Files\VS Revo Group\Revo Uninstaller\Revouninstaller.exe" Revo Uninstaller's restore point - Avast Free Antivirus0x8007043c
Error: (12/06/2014 10:37:00 AM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c
CodeIntegrity Errors:
===================================
Date: 2014-12-27 14:13:38.761
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-12-27 14:13:38.543
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-12-27 14:13:38.309
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-12-27 14:13:38.059
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-12-27 14:13:37.700
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-12-27 14:13:37.451
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-12-27 14:13:37.232
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-12-27 14:13:36.951
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-12-27 13:25:32.419
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-12-27 13:25:32.185
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 Duo CPU T5550 @ 1.83GHz
Percentage of memory in use: 46%
Total physical RAM: 3070.39 MB
Available physical RAM: 1642.04 MB
Total Pagefile: 6377.05 MB
Available Pagefile: 5177.91 MB
Total Virtual: 2047.88 MB
Available Virtual: 1912.55 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:78.12 GB) (Free:31.14 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATEN) (Fixed) (Total:195.31 GB) (Free:147.29 GB) NTFS
Drive e: (SICHERUNG) (Fixed) (Total:192.32 GB) (Free:53.47 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: 0A255306)
Partition 1: (Active) - (Size=78.1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=195.3 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=192.3 GB) - (Type=07 NTFS)
==================== End Of Log ============================
3. Gmer: GMER Logfile: Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-12-27 14:47:08
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 TOSHIBA_MK5059GSX rev.GK003U 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\ADMINI~1\AppData\Local\Temp\uxlcapow.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[2980] ntdll.dll!DbgUiRemoteBreakin 770BCD84 1 Byte [C3]
---- Devices - GMER 2.1 ----
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys
Device \Driver\BTHUSB \Device\00000066 bthport.sys
Device \Driver\BTHUSB \Device\00000068 bthport.sys
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001bdc0011e6
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001bdc0011e6@e8e5d60f6d9c 0xFA 0x11 0xFD 0xC7 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001bdc0011e6@ccf9e8e6f344 0x67 0x96 0xF6 0xB2 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001bdc0011e6@9c0298f4779b 0x6F 0xD5 0xC5 0x6D ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001bdc0011e6@18cf5e5f442f 0xD2 0x82 0x08 0x69 ...
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001bdc0011e6 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001bdc0011e6@e8e5d60f6d9c 0xFA 0x11 0xFD 0xC7 ...
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001bdc0011e6@ccf9e8e6f344 0x67 0x96 0xF6 0xB2 ...
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001bdc0011e6@9c0298f4779b 0x6F 0xD5 0xC5 0x6D ...
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001bdc0011e6@18cf5e5f442f 0xD2 0x82 0x08 0x69 ...
---- EOF - GMER 2.1 ----
4. weitere Logfiles: Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 27.12.2014 Scan Time: 14:50:07 Logfile: mbam.txt Administrator: Yes Version: 2.00.4.1028 Malware Database: v2014.12.27.04 Rootkit Database: v2014.12.23.02 License: Free Malware Protection: Disabled Malicious Website Protection: Disabled Self-protection: Disabled OS: Windows Vista Service Pack 2 CPU: x86 File System: NTFS User: Administrator Jürgen Scan Type: Threat Scan Result: Completed Objects Scanned: 330774 Time Elapsed: 13 min, 30 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 1 PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\WinZipMalwareProtector.exe, 620, , [2fa12245f4883ff7e5961645e0233fc1] Modules: 9 PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\aspsys.dll, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\Interop.IWshRuntimeLibrary.dll, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\Microsoft.Win32.TaskScheduler.DLL, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\scandll.dll, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\System.Data.SQLite.dll, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\unrar.dll, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\Xceed.Compression.dll, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\Xceed.FileSystem.dll, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\Xceed.Zip.dll, , [2fa12245f4883ff7e5961645e0233fc1], Registry Keys: 3 PUP.Optional.WinZipMalwareProtector.A, HKLM\SOFTWARE\NICO MAK COMPUTING\WinZip Malware Protector, , [d000392e413b290d7fb6d389c340da26], PUP.Optional.WinZipMalwareProtector.A, HKU\S-1-5-21-1707432137-198735931-3728340409-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\NICO MAK COMPUTING\WinZip Malware Protector, , [fcd469fe0d6f43f33afc76e61ee538c8], PUP.Optional.WinZipMalwareProtector.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WinZip Malware Protector_is1, , [2fa12245f4883ff7e5961645e0233fc1], Registry Values: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Folders: 9 PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector, , [b917ec7b334973c37802b1aafc0735cb], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\clamunpack, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector, , [e7e95710a5d7bd79ff7d13489f64d828], PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\signatures, , [e7e95710a5d7bd79ff7d13489f64d828], PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\updates, , [e7e95710a5d7bd79ff7d13489f64d828], PUP.Optional.WinZipMalwareProtector.A, C:\Users\Administrator Jürgen\AppData\Roaming\Nico Mak Computing\WinZip Malware Protector, , [646c8add6d0f3501d3a9015af1129f61], PUP.Optional.WinZipMalwareProtector.A, C:\Users\Administrator Jürgen\AppData\Roaming\Nico Mak Computing\WinZip Malware Protector\2.1.1000.14260, , [646c8add6d0f3501d3a9015af1129f61], PUP.Optional.WinZipMalwareProtector.A, C:\Users\Administrator Jürgen\AppData\Roaming\Nico Mak Computing\WinZip Malware Protector\Logs, , [646c8add6d0f3501d3a9015af1129f61], Files: 69 PUP.Optional.WinZipMalwareProtector.A, C:\Windows\System32\Tasks\WinZip Malware Protector_startup, , [f8d8c4a39fdd9f97fa38bba1d231cb35], PUP.Optional.WinZipMalwareProtector.A, C:\Users\Public\Desktop\WinZip Malware Protector.lnk, , [9c3491d6067614228ea5322a42c1c23e], PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector\Register WinZip Malware Protector.lnk, , [b917ec7b334973c37802b1aafc0735cb], PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector\WinZip Malware Protector entfernen.lnk, , [b917ec7b334973c37802b1aafc0735cb], PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector\WinZip Malware Protector.lnk, , [b917ec7b334973c37802b1aafc0735cb], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\russian_asp_ru.ini, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\AppManager.exe, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\AppResource.dll, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\asp.ico, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\aspsys.dll, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\categories.ini, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\Chinese_asp_ZH-CN.ini, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\danish_asp_DA.ini, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\dutch_asp_NL.ini, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\eng_asp_en.ini, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\filetypehelper.exe, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\Finnish_asp_FI.ini, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\french_asp_FR.ini, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\german_asp_DE.ini, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\Interop.IWshRuntimeLibrary.dll, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\italian_asp_IT.ini, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\japanese_asp_JA.ini, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\loading_withWhiteBG.avi, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\Microsoft.Win32.TaskScheduler.DLL, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\norwegian_asp_NO.ini, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\portuguese_asp_PT-BR.ini, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\scandll.dll, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\spanish_asp_ES.ini, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\swedish_asp_SV.ini, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\System.Core.dll, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\System.Data.SQLite.dll, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\unins000.dat, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\unins000.exe, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\unins000.msg, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\unrar.dll, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\WinZipMalwareProtector.exe, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\WinZipMalwareProtector.exe.config, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\WMPUninstall.exe, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\Xceed.Compression.dll, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\Xceed.Compression.Formats.dll, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\Xceed.FileSystem.dll, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\Xceed.Zip.dll, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\clamunpack\clamscan.exe, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\clamunpack\libclamav.dll, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\clamunpack\readme.txt, , [2fa12245f4883ff7e5961645e0233fc1], PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\AddonSafelist, , [e7e95710a5d7bd79ff7d13489f64d828], PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\log.xslt, , [e7e95710a5d7bd79ff7d13489f64d828], PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\signatures\completedatabase.db, , [e7e95710a5d7bd79ff7d13489f64d828], PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\signatures\Cookies.bin, , [e7e95710a5d7bd79ff7d13489f64d828], PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\signatures\DigSign.bin, , [e7e95710a5d7bd79ff7d13489f64d828], PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\signatures\FilePaths.bin, , [e7e95710a5d7bd79ff7d13489f64d828], PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\signatures\FileSignature.bin, , [e7e95710a5d7bd79ff7d13489f64d828], PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\signatures\Folders.bin, , [e7e95710a5d7bd79ff7d13489f64d828], PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\signatures\Md5.bin, , [e7e95710a5d7bd79ff7d13489f64d828], PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\signatures\Registry.bin, , [e7e95710a5d7bd79ff7d13489f64d828], PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\signatures\SetupSign.bin, , [e7e95710a5d7bd79ff7d13489f64d828], PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\signatures\StrSetupSign.bin, , [e7e95710a5d7bd79ff7d13489f64d828], PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\updates\1997completedatabase.zip, , [e7e95710a5d7bd79ff7d13489f64d828], PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\updates\2074mupdate.zip, , [e7e95710a5d7bd79ff7d13489f64d828], PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\updates\2075update.zip, , [e7e95710a5d7bd79ff7d13489f64d828], PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\updates\2076update.zip, , [e7e95710a5d7bd79ff7d13489f64d828], PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\updates\2077update.zip, , [e7e95710a5d7bd79ff7d13489f64d828], PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\updates\2078update.zip, , [e7e95710a5d7bd79ff7d13489f64d828], PUP.Optional.WinZipMalwareProtector.A, C:\Users\Administrator Jürgen\AppData\Roaming\Nico Mak Computing\WinZip Malware Protector\QDetail.db, , [646c8add6d0f3501d3a9015af1129f61], PUP.Optional.WinZipMalwareProtector.A, C:\Users\Administrator Jürgen\AppData\Roaming\Nico Mak Computing\WinZip Malware Protector\Settings.db, , [646c8add6d0f3501d3a9015af1129f61], PUP.Optional.WinZipMalwareProtector.A, C:\Users\Administrator Jürgen\AppData\Roaming\Nico Mak Computing\WinZip Malware Protector\Update.ini, , [646c8add6d0f3501d3a9015af1129f61], PUP.Optional.WinZipMalwareProtector.A, C:\Users\Administrator Jürgen\AppData\Roaming\Nico Mak Computing\WinZip Malware Protector\2.1.1000.14260\ASPLog.txt, , [646c8add6d0f3501d3a9015af1129f61], PUP.Optional.WinZipMalwareProtector.A, C:\Users\Administrator Jürgen\AppData\Roaming\Nico Mak Computing\WinZip Malware Protector\Logs\log_27-12-14_01-47-42.xml, , [646c8add6d0f3501d3a9015af1129f61], PUP.Optional.WinZipMalwareProtector.A, C:\Users\Administrator Jürgen\AppData\Roaming\Nico Mak Computing\WinZip Malware Protector\Logs\SMLog.xml, , [646c8add6d0f3501d3a9015af1129f61], Physical Sectors: 0 (No malicious items detected) (end) |
Baum-Darstellung