| |
| |||||||
Log-Analyse und Auswertung: Vista: Nach BKA Virus startet der Sicherheitsdienst nicht mehrWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
04.01.2015, 14:50
| #1 |
| /// the machine /// TB-Ausbilder    |  Vista: Nach BKA Virus startet der Sicherheitsdienst nicht mehr Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
05.01.2015, 11:32
| #2 |
 | Vista: Nach BKA Virus startet der Sicherheitsdienst nicht mehr mbam.txt
__________________Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Update, 05.01.2015 09:11:04, SYSTEM, XXXXXXXXXXXXXXXX-PC, Manual, Rootkit Database, 2014.11.18.1, 2014.12.30.1, Update, 05.01.2015 09:11:04, SYSTEM, XXXXXXXXXXXXXXXX-PC, Manual, Remediation Database, 2013.10.16.1, 2014.12.6.1, Update, 05.01.2015 09:11:11, SYSTEM, XXXXXXXXXXXXXXXX-PC, Manual, Malware Database, 2014.11.20.6, 2015.1.5.4, (end) AdvCleaner.txt Code:
ATTFilter # AdwCleaner v4.106 - Bericht erstellt am 05/01/2015 um 10:39:31
# Aktualisiert 21/12/2014 von Xplode
# Database : 2015-01-03.1 [Live]
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzername : XXXXXXXX - XXXXXXXXXXXXXXXX-PC
# Gestartet von : C:\Users\XXXXXXXX\Downloads\AdwCleaner_4.106.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Users\XXXXXXXX\AppData\LocalLow\BabylonToolbar
Ordner Gelöscht : C:\Users\XXXXXXXX\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl
Datei Gelöscht : C:\Users\XXXXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\pfwduqny.default\invalidprefs.js
Datei Gelöscht : C:\Users\XXXXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\pfwduqny.default\user.js
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKCU\Software\530dbdeb56eea42
Schlüssel Gelöscht : HKLM\SOFTWARE\530dbdeb56eea42
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
***** [ Browser ] *****
-\\ Internet Explorer v7.0.6002.18005
-\\ Mozilla Firefox v34.0 (x86 de)
[pfwduqny.default\prefs.js] - Zeile gelöscht : user_pref("extensions.BabylonToolbar.admin", false);
[pfwduqny.default\prefs.js] - Zeile gelöscht : user_pref("extensions.BabylonToolbar.aflt", "babsst");
[pfwduqny.default\prefs.js] - Zeile gelöscht : user_pref("extensions.BabylonToolbar.appId", "{BDB69379-802F-4eaf-B541-F8DE92DD98DB}");
[pfwduqny.default\prefs.js] - Zeile gelöscht : user_pref("extensions.BabylonToolbar.autoRvrt", "false");
[pfwduqny.default\prefs.js] - Zeile gelöscht : user_pref("extensions.BabylonToolbar.dfltLng", "en");
[pfwduqny.default\prefs.js] - Zeile gelöscht : user_pref("extensions.BabylonToolbar.excTlbr", false);
[pfwduqny.default\prefs.js] - Zeile gelöscht : user_pref("extensions.BabylonToolbar.id", "86571b630000000000000015af7a28b5");
[pfwduqny.default\prefs.js] - Zeile gelöscht : user_pref("extensions.BabylonToolbar.instlDay", "15690");
[pfwduqny.default\prefs.js] - Zeile gelöscht : user_pref("extensions.BabylonToolbar.instlRef", "sst");
[pfwduqny.default\prefs.js] - Zeile gelöscht : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");
[pfwduqny.default\prefs.js] - Zeile gelöscht : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");
[pfwduqny.default\prefs.js] - Zeile gelöscht : user_pref("extensions.BabylonToolbar.rvrt", "false");
[pfwduqny.default\prefs.js] - Zeile gelöscht : user_pref("extensions.BabylonToolbar.tlbrId", "base");
[pfwduqny.default\prefs.js] - Zeile gelöscht : user_pref("extensions.BabylonToolbar.vrsn", "1.8.4.9");
[pfwduqny.default\prefs.js] - Zeile gelöscht : user_pref("extensions.BabylonToolbar.vrsni", "1.8.4.9");
[pfwduqny.default\prefs.js] - Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.babExt", "");
[pfwduqny.default\prefs.js] - Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=117023&tt=5012_5");
[pfwduqny.default\prefs.js] - Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.excTlbr", false);
[pfwduqny.default\prefs.js] - Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.newTab", false);
[pfwduqny.default\prefs.js] - Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
[pfwduqny.default\prefs.js] - Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
[pfwduqny.default\prefs.js] - Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.8.4.912:34:31");
-\\ Google Chrome v39.0.2171.95
*************************
AdwCleaner[R0].txt - [4546 octets] - [05/01/2015 10:19:50]
AdwCleaner[S0].txt - [4665 octets] - [05/01/2015 10:39:31]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4725 octets] ##########
JRT.txt Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.1 (12.28.2014:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Klaus Walde on 05.01.2015 at 10:54:51,81
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{7E853D72-626A-48EC-A868-BA8D5E23E045}
~~~ Files
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\Klaus Walde\AppData\Roaming\mozilla\firefox\profiles\pfwduqny.default\minidumps [110 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 05.01.2015 at 11:04:00,56
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST.txt FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-01-2015 01 Ran by XXXXXXXX (administrator) on XXXXXXXXXXXXXXXX-PC on 05-01-2015 11:23:05 Running from C:\Users\XXXXXXXX\Downloads Loaded Profile: XXXXXXXX (Available profiles: XXXXXXXX) Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 7 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Softex Inc.) C:\Program Files\Softex\OmniPass\OmniServ.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation) C:\Windows\System32\SLsvc.exe () C:\Program Files\Softex\OmniPass\opvapp.exe (Agere Systems) C:\Windows\System32\agrsmsvc.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Empolis GmbH) C:\Program Files\Common Files\Gnab\Service\ServiceController.exe (Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Empolis GmbH) C:\Program Files\Medion\MEDIONbox\Program\GCS.exe (Nero AG) C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (Nuance Communications, Inc.) C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe () C:\Program Files\CyberLink\Shared Files\RichVideo.exe (Microsoft Corporation) C:\Windows\System32\Locator.exe (Buhl Data Service GmbH) C:\Program Files\Sceneo\AbsolutTV\Services\PVR\pvrservice.exe () C:\Program Files\Synology Data Replicator 3\SynoDrService.exe (TeamViewer GmbH) C:\Program Files\TeamViewer\TeamViewer_Service.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe (Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPStart.exe () C:\Program Files\Launch Manager\LaunchAp.exe (Wistron) C:\Program Files\Launch Manager\HotkeyApp.exe (Wistron Corp.) C:\Program Files\Launch Manager\OSD.exe (Wistron) C:\Program Files\Launch Manager\WButton.exe (Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Nuance Communications, Inc.) C:\Program Files\Nuance\PaperPort\pptd40nt.exe (Realtek Semiconductor) C:\Windows\RtHDVCpl.exe (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) C:\Windows\ehome\ehtray.exe (Acresso Corporation) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Nero AG) C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe (Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Microsoft Corporation) C:\Windows\ehome\ehmsas.exe (Wistron Corp.) C:\Program Files\Launch Manager\WisLMSvc.exe (Brother Industries, Ltd.) C:\Program Files\Browny02\BrYNSvc.exe (Nero AG) C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe (Nero AG) C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Microsoft Corporation) C:\Windows\System32\conime.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [SynTPStart] => C:\Program Files\Synaptics\SynTP\SynTPStart.exe [102400 2007-08-31] (Synaptics, Inc.) HKLM\...\Run: [PLFSetL] => C:\Windows\PLFSetL.exe [94208 2007-07-05] (sonix) HKLM\...\Run: [LaunchAp] => C:\Program Files\Launch Manager\LaunchAp.exe [32768 2007-09-01] () HKLM\...\Run: [HotkeyApp] => C:\Program Files\Launch Manager\HotkeyApp.exe [188416 2007-09-06] (Wistron) HKLM\...\Run: [LMgrOSD] => C:\Program Files\Launch Manager\OSD.exe [180224 2006-12-26] (Wistron Corp.) HKLM\...\Run: [Wbutton] => C:\Program Files\Launch Manager\Wbutton.exe [86016 2007-09-07] (Wistron) HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [178712 2007-10-03] (Intel Corporation) HKLM\...\Run: [NvSvc] => RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup HKLM\...\Run: [NvMediaCenter] => RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit HKLM\...\Run: [IndexSearch] => C:\Program Files\Nuance\PaperPort\IndexSearch.exe [46368 2010-03-08] (Nuance Communications, Inc.) HKLM\...\Run: [PaperPort PTD] => C:\Program Files\Nuance\PaperPort\pptd40nt.exe [29984 2010-03-08] (Nuance Communications, Inc.) HKLM\...\Run: [PPort12reminder] => C:\Program Files\Nuance\PaperPort\Ereg\Ereg.exe [328992 2010-02-09] (Nuance Communications, Inc.) HKLM\...\Run: [ControlCenter4] => C:\Program Files\ControlCenter4\BrCcBoot.exe [139264 2010-10-26] (Brother Industries, Ltd.) HKLM\...\Run: [BrStsMon00] => C:\Program Files\Browny02\Brother\BrStMonW.exe [2621440 2010-06-10] (Brother Industries, Ltd.) HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.) HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [4702208 2007-10-31] (Realtek Semiconductor) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.) HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [974432 2014-08-22] (Microsoft Corporation) Winlogon\Notify\igfxcui: igfxdev.dll [X] HKU\S-1-5-21-61975679-4228261104-3588041665-1003\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation) HKU\S-1-5-21-61975679-4228261104-3588041665-1003\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation) HKU\S-1-5-21-61975679-4228261104-3588041665-1003\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe [202024 2007-10-15] (Nero AG) BootExecute: autocheck autochk * sdnclean.exe ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-61975679-4228261104-3588041665-1003\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome HKU\S-1-5-21-61975679-4228261104-3588041665-1003\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) BHO: PlusIEEventHelper Class -> {551A852F-39A6-44A7-9C13-AFBEC9185A9D} -> C:\Program Files\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation) BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> c:\program files\google\googletoolbar1.dll (Google Germany GmbH) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) Toolbar: HKU\S-1-5-21-61975679-4228261104-3588041665-1003 -> &Google - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (Google Germany GmbH) DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation) Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation) Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 Tcpip\..\Interfaces\{6C395699-C9E9-4033-BBF3-620ECC9DDFB9}: [NameServer] 8.8.8.8,8.8.8.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1 FireFox: ======== FF ProfilePath: C:\Users\XXXXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\pfwduqny.default FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_235.dll () FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF Plugin: @divx.com/DivX Player Plugin,version=1.0.0 -> C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll No File FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Extension: Microsoft .NET Framework Assistant - C:\Users\XXXXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\pfwduqny.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-04-30] FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-12-02] FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-02-26] FF HKLM\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013-01-17] FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird FF HKU\S-1-5-21-61975679-4228261104-3588041665-1003\...\Thunderbird\Extensions: [{0E810812-F4BB-4309-942A-755587587A5E}] - C:\Program Files\BullGuard Software\BullGuard\antispam\tbspamfilter Chrome: ======= CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\39.0.2171.71\PepperFlash\pepflashplayer.dll () CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\39.0.2171.71\ppGoogleNaClPluginChrome.dll No File CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\39.0.2171.71\pdf.dll () CHR Plugin: (Skype Toolbars) - C:\Users\XXXXXXXX\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\npSkypeChromePlugin.dll No File CHR Plugin: (Java Deployment Toolkit 6.0.290.11) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.) CHR Plugin: (Java(TM) Platform SE 6 U29) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) CHR Plugin: (DivX Player Netscape Plugin) - C:\Program Files\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc) CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) CHR Plugin: (DivX Plus Web Player) - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll No File CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) CHR Profile: C:\Users\XXXXXXXX\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\XXXXXXXX\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-12-02] CHR Extension: (Google Wallet) - C:\Users\XXXXXXXX\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-11] CHR Extension: (Mehr Leistung und Videoformate für dein HTML5 <video>) - C:\Users\XXXXXXXX\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2013-01-18] CHR HKLM\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2011-12-12] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R3 BrYNSvc; C:\Program Files\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not signed] R2 GnabService; c:\program files\common files\gnab\service\servicecontroller.exe [36864 2007-04-19] (Empolis GmbH) [File not signed] R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22192 2014-08-22] (Microsoft Corporation) R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [288120 2014-08-22] (Microsoft Corporation) R2 omniserv; C:\Program Files\Softex\OmniPass\OmniServ.exe [40960 2007-11-02] (Softex Inc.) [File not signed] R2 PDFProFiltSrvPP; C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-03-08] (Nuance Communications, Inc.) R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2007-01-09] () R2 srvcPVR; C:\Program Files\Sceneo\AbsolutTV\Services\PVR\PVRService.exe [1681408 2007-08-16] (Buhl Data Service GmbH) [File not signed] R2 SynoDrService; C:\Program Files\Synology Data Replicator 3\SynoDrService.exe [245760 2013-05-07] () [File not signed] R2 TeamViewer; C:\Program Files\TeamViewer\TeamViewer_Service.exe [5426448 2014-12-15] (TeamViewer GmbH) S3 usnjsvc; C:\Program Files\MSN Messenger\usnsvc.exe [97136 2007-01-19] (Microsoft Corporation) R3 WisLMSvc; C:\Program Files\Launch Manager\WisLMSvc.exe [118784 2007-09-11] (Wistron Corp.) [File not signed] S4 AntiVirWebService; "C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE" [X] S3 FirebirdServerMAGIXInstance; C:\Program Files\ALDI Sued Foto Service\Common\Database\bin\fbserver.exe [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 ATSWPDRV; C:\Windows\System32\DRIVERS\ATSwpDrv.sys [146560 2007-08-28] (AuthenTec, Inc.) S3 Cam5607; C:\Windows\System32\Drivers\BisonC07.sys [805416 2007-08-30] (Bison Electronics. Inc. ) S3 ElgTaDrv; C:\Windows\System32\Drivers\ElgTaDrv.sys [73660 2002-07-15] (elmeg Kommunikationstechnik) [File not signed] S3 FETNDIS; C:\Windows\System32\DRIVERS\fetnd5.sys [45568 2006-11-02] (VIA Technologies, Inc. ) R1 Hotkey; C:\Windows\system32\Drivers\Hotkey.sys [9867 2003-04-28] () [File not signed] R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [231800 2014-07-17] (Microsoft Corporation) S3 PhilCap; C:\Windows\System32\DRIVERS\PhilCap.sys [908896 2007-07-31] (NXP Semiconductors Germany GmbH) R0 Si3531; C:\Windows\System32\DRIVERS\Si3531.sys [212520 2009-02-05] (Silicon Image, Inc) R0 SiFilter; C:\Windows\System32\DRIVERS\SiWinAcc.sys [17064 2009-02-05] (Silicon Image, Inc.) R0 SiRemFil; C:\Windows\System32\DRIVERS\SiRemFil.sys [12200 2009-02-05] (Silicon Image, Inc.) R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1749760 2007-08-22] () R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-10] (Avira GmbH) S3 USBAAPL; C:\Windows\System32\Drivers\usbaapl.sys [45056 2013-03-18] (Apple, Inc.) [File not signed] S3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [27416 2006-11-30] (X10 Wireless Technology, Inc.) U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-19] (Microsoft Corporation) S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X] S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 igfx; system32\DRIVERS\igdkmd32.sys [X] S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-05 11:04 - 2015-01-05 11:04 - 00001070 _____ () C:\Users\XXXXXXXX\Desktop\JRT.txt 2015-01-05 10:54 - 2015-01-05 10:54 - 00000000 ____D () C:\Windows\ERUNT 2015-01-05 10:53 - 2015-01-05 10:53 - 01707939 _____ (Thisisu) C:\Users\XXXXXXXX\Downloads\JRT.exe 2015-01-05 10:49 - 2015-01-05 10:49 - 00004793 _____ () C:\Users\XXXXXXXX\Desktop\AdwCleaner[S0].txt 2015-01-05 10:19 - 2015-01-05 10:43 - 00000000 ____D () C:\AdwCleaner 2015-01-05 10:18 - 2015-01-05 10:50 - 00000403 _____ () C:\Users\XXXXXXXX\Desktop\mbam.txt 2015-01-05 10:18 - 2015-01-05 10:19 - 02173952 _____ () C:\Users\XXXXXXXX\Downloads\AdwCleaner_4.106.exe 2015-01-05 09:11 - 2015-01-05 10:50 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-01-05 09:10 - 2015-01-05 09:10 - 00000903 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-01-05 09:10 - 2015-01-05 09:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-01-05 09:10 - 2015-01-05 09:10 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2015-01-05 09:10 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-01-05 09:10 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-01-05 09:10 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-01-05 09:07 - 2015-01-05 09:07 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\XXXXXXXX\Downloads\mbam-setup-2.0.4.1028.exe 2015-01-04 11:40 - 2015-01-04 11:40 - 00014822 _____ () C:\Users\XXXXXXXX\Downloads\ComboFix.txt 2015-01-04 10:46 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe 2015-01-04 10:46 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe 2015-01-04 10:46 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2015-01-04 10:46 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2015-01-04 10:46 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2015-01-04 10:46 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe 2015-01-04 10:46 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe 2015-01-04 10:46 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe 2015-01-04 10:45 - 2015-01-04 11:40 - 00000000 ____D () C:\Qoobox 2015-01-04 10:42 - 2015-01-04 11:34 - 00000000 ____D () C:\Windows\erdnt 2015-01-03 16:04 - 2015-01-03 16:15 - 00030552 _____ () C:\Users\XXXXXXXX\Downloads\Addition.txt 2015-01-03 16:02 - 2015-01-05 11:23 - 00019320 _____ () C:\Users\XXXXXXXX\Downloads\FRST.txt 2015-01-03 16:02 - 2015-01-05 11:23 - 00000000 ____D () C:\FRST 2015-01-03 16:01 - 2015-01-03 16:01 - 01115136 _____ (Farbar) C:\Users\XXXXXXXX\Downloads\FRST.exe 2014-12-31 08:57 - 2014-12-31 08:57 - 00001830 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk 2014-12-31 08:56 - 2014-12-31 08:57 - 00000000 ____D () C:\Program Files\Microsoft Security Client 2014-12-31 08:55 - 2010-04-05 21:00 - 00221568 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys 2014-12-31 08:26 - 2014-12-31 08:26 - 11473216 _____ (Microsoft Corporation) C:\Users\XXXXXXXX\Downloads\mseinstall.exe 2014-12-17 13:14 - 2006-09-18 22:41 - 00000761 _____ () C:\Windows\system32\Drivers\etc\hosts.20141217-131427.backup 2014-12-10 13:15 - 2014-11-04 01:19 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-12-10 13:14 - 2014-11-07 02:33 - 00974848 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-12-10 13:14 - 2014-10-25 02:01 - 00430080 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-12-10 13:02 - 2014-12-03 03:06 - 00278528 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2014-12-10 13:00 - 2014-10-25 02:01 - 01177600 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-12-10 13:00 - 2014-10-25 02:01 - 00834048 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-12-10 13:00 - 2014-10-25 02:01 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2014-12-10 13:00 - 2014-10-25 02:00 - 06119936 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-12-10 13:00 - 2014-10-25 02:00 - 03635200 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-12-10 13:00 - 2014-10-25 02:00 - 01827328 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-12-10 13:00 - 2014-10-25 02:00 - 00671744 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll 2014-12-10 13:00 - 2014-10-25 02:00 - 00498688 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-12-10 13:00 - 2014-10-25 02:00 - 00480768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-12-10 13:00 - 2014-10-25 02:00 - 00380928 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-12-10 13:00 - 2014-10-25 02:00 - 00273408 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-12-10 13:00 - 2014-10-25 02:00 - 00193024 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2014-12-10 13:00 - 2014-10-25 02:00 - 00180736 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-12-10 13:00 - 2014-10-25 02:00 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-12-10 13:00 - 2014-10-25 01:59 - 00347136 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-12-10 13:00 - 2014-10-25 01:59 - 00214528 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-12-10 13:00 - 2014-10-25 01:59 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\corpol.dll 2014-12-10 13:00 - 2014-10-25 00:33 - 00389632 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2014-12-10 13:00 - 2014-10-25 00:26 - 01383424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-12-10 09:28 - 2006-09-18 22:41 - 00000761 _____ () C:\Windows\system32\Drivers\etc\hosts.20141210-092801.backup 2014-12-10 09:13 - 2006-09-18 22:41 - 00000761 _____ () C:\Windows\system32\Drivers\etc\hosts.20141210-091344.backup ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-05 11:16 - 2012-09-04 09:51 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-01-05 10:51 - 2008-02-25 19:38 - 01610750 _____ () C:\Windows\WindowsUpdate.log 2015-01-05 10:47 - 2008-02-28 10:13 - 00028409 _____ () C:\Users\XXXXXXXX\AppData\Roaming\nvModes.001 2015-01-05 10:44 - 2013-01-17 14:19 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-01-05 10:44 - 2007-10-16 09:09 - 00194616 _____ () C:\Windows\PFRO.log 2015-01-05 10:44 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-01-05 10:44 - 2006-11-02 13:47 - 00003296 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2015-01-05 10:44 - 2006-11-02 13:47 - 00003296 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2015-01-05 10:43 - 2006-11-02 14:01 - 00032578 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2015-01-05 10:40 - 2013-01-17 14:19 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-01-05 09:10 - 2013-01-11 13:58 - 00000000 ____D () C:\ProgramData\Malwarebytes 2015-01-04 11:40 - 2006-11-02 12:18 - 00000000 __RHD () C:\Users\Default 2015-01-04 11:40 - 2006-11-02 12:18 - 00000000 ___RD () C:\Users\Public 2015-01-04 11:34 - 2006-11-02 11:33 - 01608072 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-01-04 11:27 - 2006-11-02 11:23 - 00000215 _____ () C:\Windows\system.ini 2015-01-02 13:09 - 2008-02-25 20:45 - 00105024 _____ () C:\Users\XXXXXXXX\AppData\Local\GDIPFONTCACHEV1.DAT 2015-01-02 13:07 - 2006-11-02 13:47 - 00389592 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-12-31 09:00 - 2013-01-11 16:23 - 00000000 ____D () C:\Program Files\Spybot - Search & Destroy 2 2014-12-31 08:40 - 2013-08-10 13:37 - 00000000 ____D () C:\ProgramData\Avira 2014-12-31 08:16 - 2012-09-04 09:51 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2014-12-31 08:16 - 2011-09-28 09:23 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2014-12-31 08:16 - 2008-05-25 18:10 - 00000000 ____D () C:\Users\XXXXXXXX\AppData\Local\Adobe 2014-12-19 11:06 - 2014-11-10 13:11 - 00000844 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk 2014-12-19 11:06 - 2014-11-10 13:11 - 00000832 _____ () C:\Users\Public\Desktop\TeamViewer 10.lnk 2014-12-19 11:06 - 2011-11-13 16:01 - 00000000 ____D () C:\Program Files\TeamViewer 2014-12-18 10:33 - 2013-04-11 08:53 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk 2014-12-13 11:42 - 2013-01-17 14:22 - 00001967 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-12-10 13:52 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\rescache 2014-12-10 13:32 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\de-DE 2014-12-10 13:14 - 2013-08-14 19:26 - 00000000 ____D () C:\Windows\system32\MRT 2014-12-10 13:04 - 2006-11-02 11:24 - 109818608 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe Files to move or delete: ==================== C:\Users\XXXXXXXX\Hkey.reg Some content of TEMP: ==================== C:\Users\XXXXXXXX\AppData\Local\temp\Quarantine.exe C:\Users\XXXXXXXX\AppData\Local\temp\sqlite3.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-05 10:51 ==================== End Of Log ============================ --- --- --- Das Sicherheitscenter läuft wieder. Dafür möchte ich mich jetzt schon einmal bedanken und hoffe, dass die obigen Logs auch so weit grünes Licht geben. Geändert von Superwaldi (05.01.2015 um 11:48 Uhr) |
|
| Themen zu Vista: Nach BKA Virus startet der Sicherheitsdienst nicht mehr |
| antivir, antivirus, autorun, avira, bho, bonjour, defender, desktop, ebay, error, firefox, format, helper, home, kaspersky, launch, logfile, mozilla, realtek, registry, required, rundll, scan, security, software, synology, virus, vista |
Hybrid-Darstellung
