| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: G data blockiert , keine Systemwiederherstellung möglich , Taskmanager funktioniert nichtWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
31.03.2015, 11:13
| #5 |
 |  G data blockiert , keine Systemwiederherstellung möglich , Taskmanager funktioniert nicht Hallo, hier noch die Addition txt Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 11-03-2015
Ran by Steffen at 2015-03-31 12:10:01
Running from C:\Users\Steffen\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: G Data InternetSecurity CBE (Enabled - Out of date) {545C8713-0744-B079-87F8-349A6D5C8CF0}
AS: G Data InternetSecurity CBE (Enabled - Out of date) {EF3D66F7-217E-BFF7-BD48-0FE816DBC64D}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: G Data Personal Firewall (Enabled) {6C670636-4D2B-B121-ACA7-9DAF938FCB8B}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
1und1 Desktop Icons (HKLM\...\1&1 Mail & Media GmbH 1und1DesktopIconsInstaller) (Version: 3.0.3.0 - 1&1 Mail & Media GmbH)
1und1 Softwareaktualisierung (HKLM\...\1&1 Mail & Media GmbH 1und1Softwareaktualisierung) (Version: 3.0.0.55 - 1&1 Mail & Media GmbH)
7-Zip 4.65 (HKLM\...\7-Zip) (Version: - )
Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.239 - Adobe Systems Incorporated)
Adobe Reader 9.5.4 - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-A95000000001}) (Version: 9.5.4 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKU\S-1-5-21-3764681053-1311214435-963443542-1000\...\Akamai) (Version: - Akamai Technologies, Inc)
AntiBrowserSpy (HKLM\...\{F78B5B4F-075A-4C81-AA27-E707861EB5B7}_is1) (Version: 141 - Abelssoft)
Autodesk Design Review 2013 (HKLM\...\Autodesk Design Review 2013) (Version: 13.0.0.82 - Autodesk, Inc.)
Autodesk Design Review 2013 (Version: 13.0.0.82 - Autodesk, Inc.) Hidden
Autodesk Design Review Browser Add-on v1.2 (HKLM\...\{CD49E43B-88B1-48AD-A3AF-43FAAAB41CB8}) (Version: 1.2.0 - Autodesk)
Autodesk DWG TrueView 2014 (HKLM\...\DWG TrueView 2014) (Version: 19.1.18.0 - Autodesk)
AVM FRITZ!Box Dokumentation (HKLM\...\AVMFBox) (Version: - AVM Berlin)
AVM FRITZ!Box Druckeranschluss (HKLM\...\AVMFBoxPrinter) (Version: - AVM Berlin)
CCleaner (HKLM\...\CCleaner) (Version: 4.12 - Piriform)
Chinese Simplified Fonts Support For Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-2447-0000-900000000003}) (Version: 9.0.0 - Adobe Systems Incorporated)
Dassault Systemes Software VC10 Prerequisites x86 (HKLM\...\{B7066BF6-394F-4DA6-B21E-06DF44684816}) (Version: 10.1.1 - Dassault Systemes)
Dassault Systemes Software VC9 Prerequisites x86 (HKLM\...\{50BFDB3B-9CA8-477E-82FE-D3CD5F58F8C4}) (Version: 9.1.2 - Dassault Systemes)
DesignCAD Light 16.3 (HKLM\...\{B4E6AB20-5DBF-42C3-B67D-5E22C5F51D29}) (Version: 16.3 - IMSI)
DWG TrueView 2013 (HKLM\...\DWG TrueView 2013) (Version: 19.0.55.0 - Autodesk)
DWG TrueView 2013 (Version: 19.0.55.0 - Autodesk) Hidden
DWG TrueView 2014 (Version: 19.1.18.0 - Autodesk) Hidden
eDrawings 2014 (HKLM\...\{81A2E9BB-F9EF-4CF3-84C3-A75E1CE542B6}) (Version: 14.0.5006 - Dassault Systèmes SolidWorks Corp)
ElsterFormular-Upgrade (HKLM\...\ElsterFormular für Unternehmer 12.0.0.5880u) (Version: 15.2.13992 - Landesfinanzdirektion Thüringen)
G Data InternetSecurity CBE (HKLM\...\{85203592-3610-4FB9-AA11-15B2255B5A12}) (Version: 25.0.1.2 - G Data Software AG)
HP USB Disk Storage Format Tool (HKLM\...\{0E0DF90C-D0BA-4C89-9262-AD78D1A3DE51}) (Version: - )
J2SE Runtime Environment 5.0 (HKLM\...\{3248F0A8-6813-11D6-A77B-00B0D0150000}) (Version: 1.5.0 - Sun Microsystems, Inc.)
Java(TM) 6 Update 37 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216037FF}) (Version: 6.0.370 - Oracle)
Malwarebytes Anti-Malware Version 2.1.4.1018 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.4.1018 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.5614.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 24.5.0 - Mozilla)
Mozilla Thunderbird 31.5.0 (x86 de) (HKLM\...\Mozilla Thunderbird 31.5.0 (x86 de)) (Version: 31.5.0 - Mozilla)
NVIDIA 3D Vision Treiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 311.06 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: - )
NVIDIA Grafiktreiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 311.06 - NVIDIA Corporation)
NVIDIA Update 1.11.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.11.3 - NVIDIA Corporation)
OpenSSL 1.0.0l Light (32-bit) (HKLM\...\OpenSSL Light (32-bit)_is1) (Version: - OpenSSL Win32 Installer Team)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 0.9.9 - Frank Heindörfer, Philip Chinery)
Solid Edge 2D Drafting ST6 (HKLM\...\{4DDED18B-9C9C-434B-95FE-CFA9C9EE626F}) (Version: 106.00.02005 - Siemens)
SolidView Lite 2014 (HKLM\...\{7F5CB40E-C3BF-4AAE-A05C-88EC949B9C25}) (Version: 14.0.0131 - Solid Concepts Inc)
STP Viewer 2.3 (HKLM\...\{CECCF8B1-F595-4845-9AA6-1EC57B9BECBA}_is1) (Version: - IdeaMK)
Windows-Treiberpaket - 3D Robotics (usbser) Ports (07/31/2013 2.0.0.3) (HKLM\...\3C34FF4EF99EAC8D565419CDF431F96703771360) (Version: 07/31/2013 2.0.0.3 - 3D Robotics)
Windows-Treiberpaket - Arduino LLC (www.arduino.cc) (usbser) Ports (11/15/2012 5.1.2600.0) (HKLM\...\4414E25DD1DDB3A149E9A6222CA82E070C630A02) (Version: 11/15/2012 5.1.2600.0 - Arduino LLC (www.arduino.cc))
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{08244EE6-92F0-47F2-9FC9-929BAA2E7235}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{36A21736-36C2-4C11-8ACB-D4136F2B57BD}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{3faa4380-a399-11cf-a466-00805fe418f6}\InprocServer32 -> C:\Program Files\Autodesk\DWG TrueView 2013\en-US\dwgviewrficn.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{6A221957-2D85-42A7-8E19-BE33950D1DEB}\localserver32 -> C:\Program Files\Autodesk\DWG TrueView 2013\dwgviewr.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{76D0CB12-7604-4048-B83C-1005C7DDC503}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{A4A1A128-768F-41E0-BF75-E4FDDD701CBA}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{EEFDB0DA-DD97-4F5D-8268-E4C2F6826CE7}\localserver32 -> C:\Program Files\Solid Edge 2D Drafting ST6\Program\PLMVis\Products\JT2Go\VisView.exe (Siemens)
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{FFE2A43C-56B9-4BF5-9A79-CC6D4285608A}\InprocServer32 -> No File Path
==================== Restore Points =========================
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:04 - 2013-10-31 11:02 - 00000893 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 www.google-analytics.com
127.0.0.1 google-analytics.com
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {1B441022-AB98-44B1-AF2C-31FC0BC1A1DB} - System32\Tasks\AntiBrowserSpy - BrowserMask => C:\Program Files\AntiBrowserSpy\BrowserMask.exe [2014-01-13] ()
Task: {3A10ACAD-BD9D-48BD-A32E-580D563C4DBA} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-03-18] (Piriform Ltd)
Task: {45B0C38E-87F4-4BE0-A9F2-E5F916340473} - System32\Tasks\{1F61290C-8E0C-4416-AEE5-1CEBB920A1AD} => pcalua.exe -a C:\PROGRA~1\bhv\DRAFTB~1.0\UNWISE32.EXE -c /Z /R C:\PROGRA~1\bhv\DRAFTB~1.0\INSTALL.LOG "DraftBoard Pocket 4.0"
Task: {52994C93-3B9F-45C4-94D6-E7EA53191B89} - System32\Tasks\Registration 1und1 Task => C:\Program Files\1und1Softwareaktualisierung\cdsupdclient.exe [2013-06-18] (1&1 Mail & Media GmbH)
Task: {65D81529-5BD3-4B57-A165-FC90F36CD01F} - System32\Tasks\Norton Internet Security CBE\Norton Error Processor => C:\Program Files\Norton Internet Security CBE\Norton Internet Security CBE\Engine\20.4.0.40\SymErr.exe
Task: {696703F2-9B2C-4E51-B104-D6097FCD4AD9} - System32\Tasks\AntiBrowserSpy - SocialBlock - IE => C:\Program Files\AntiBrowserSpy\AntiBrowserSpy-IE-SocialBlock.exe [2014-01-13] ()
Task: {7C37AA85-98F3-40D9-BE59-EF4EBA7E8931} - System32\Tasks\Norton Internet Security CBE\Norton Error Analyzer => C:\Program Files\Norton Internet Security CBE\Norton Internet Security CBE\Engine\20.4.0.40\SymErr.exe
Task: {B2901578-B14F-404F-A90F-EF3F8A679913} - System32\Tasks\{2750B4D7-494F-428C-8A3C-19B2D344C44C} => C:\Program Files\bhv\DraftBoard Pocket 4.0\DraftBoard.exe [2005-02-28] (Concepts Technology Co., Ltd)
Task: {B8B6A3AE-A707-4734-9541-96D566563C6D} - System32\Tasks\AntiBrowserSpy - SocialBlock - IEProxyCheck => C:\Program Files\AntiBrowserSpy\SocialBlock_ProxyCheck.exe [2014-01-13] ()
Task: {D804DEA6-8DFD-469A-B001-AE7A11787A7C} - System32\Tasks\{B7C30487-AE42-4463-809F-B00DA8DA5F58} => pcalua.exe -a D:\FSetup.exe -d D:\
Task: {FAF08DF0-926A-4597-8AD2-128B0AF1BBF4} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-04] (Adobe Systems Incorporated)
Task: {FCAC9E6F-8017-474A-8237-B4A9CCA74AB7} - System32\Tasks\{E5549D03-68E0-4D25-A30A-ED02F2D126BD} => pcalua.exe -a "C:\Users\Steffen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZNCKPWEY\SE2DDraftV106GERMAN.exe" -d C:\Users\Steffen\Desktop
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) ==============
2013-04-10 12:50 - 2013-03-19 06:48 - 00038912 _____ () C:\Windows\system32\CSRSRV.dll
2009-07-14 01:11 - 2009-07-14 03:16 - 00033280 _____ () C:\Windows\system32\pcwum.dll
2009-07-14 01:11 - 2009-07-14 03:16 - 00033280 _____ () C:\Windows\system32\pcwum.DLL
2009-07-14 01:11 - 2009-07-14 03:16 - 00033280 _____ () c:\windows\system32\pcwum.dll
2012-11-18 17:17 - 2013-01-18 16:20 - 00079648 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax.dll
2010-04-15 15:48 - 2001-10-28 16:42 - 00116224 _____ () C:\Windows\System32\pdfcmnnt.dll
2015-03-27 18:38 - 2014-01-13 11:15 - 00823424 _____ () C:\Program Files\AntiBrowserSpy\BrowserMask.exe
2015-03-27 18:38 - 2014-01-13 11:15 - 00778240 _____ () C:\Program Files\AntiBrowserSpy\SocialBlock_ProxyCheck.exe
2015-03-27 18:38 - 2014-01-13 11:08 - 01136640 _____ () C:\Program Files\AntiBrowserSpy\AntiBrowserSpy-IE-SocialBlock.exe
2013-12-19 04:42 - 2013-12-19 04:42 - 00287864 ____N () C:\Program Files\Common Files\G Data\AVKProxy\PktIcpt2.dll
2009-07-14 01:11 - 2009-07-14 03:16 - 00033280 _____ () C:\Windows\System32\pcwum.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\Steffen\Downloads\Datenblatt für SMC 4100-T2 Schrittmotorcontroller.eml:OECustomProperty
AlternateDataStreams: C:\Users\Steffen\Documents\Angebot.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Steffen\Documents\Angebot.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Steffen\Documents\Centerplatte bemaßt.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Steffen\Documents\Centerplatte bemaßt.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Steffen\Documents\depot.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Steffen\Documents\depot.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Steffen\Documents\Grundsteuer1.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Steffen\Documents\Grundsteuer1.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Steffen\Documents\Grundsteuer2.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Steffen\Documents\Grundsteuer2.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Steffen\Documents\Rente1.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Steffen\Documents\Rente1.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Steffen\Documents\Rente2.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Steffen\Documents\Rente2.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Steffen\Documents\Rente3.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Steffen\Documents\Rente3.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Steffen\Documents\Vertrag Sandra.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Steffen\Documents\Vertrag Sandra.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Steffen\Documents\Vertrag Sandra1.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Steffen\Documents\Vertrag Sandra1.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-3764681053-1311214435-963443542-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Steffen\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== Accounts: =============================
Administrator (S-1-5-21-3764681053-1311214435-963443542-500 - Administrator - Disabled)
Gast (S-1-5-21-3764681053-1311214435-963443542-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3764681053-1311214435-963443542-1002 - Limited - Enabled)
Steffen (S-1-5-21-3764681053-1311214435-963443542-1000 - Administrator - Enabled) => C:\Users\Steffen
UpdatusUser (S-1-5-21-3764681053-1311214435-963443542-1003 - Limited - Enabled) => C:\Users\UpdatusUser
==================== Faulty Device Manager Devices =============
Name: GDPkIcpt
Description: GDPkIcpt
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: GDPkIcpt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Event log errors: =========================
Application errors:
==================
Error: (03/31/2015 11:23:17 AM) (Source: AVKWCtl) (EventID: 0) (User: )
Description: Der Filter Treiber konnte aus dem folgenden Grund nicht gestartet werden: Error loading GDMnIcpt (C:\Windows\system32\drivers\MiniIcpt.sys): 31
Error: (03/31/2015 11:23:00 AM) (Source: GDFwSvc) (EventID: 0) (User: )
Description: Error loading GDPkIcpt (C:\Windows\system32\drivers\PktIcpt.sys): 31
Error: (03/31/2015 10:47:49 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: EModelViewer.exe, Version: 14.0.0.5006, Zeitstempel: 0x523b68b4
Name des fehlerhaften Moduls: MSVCR100.dll, Version: 10.0.40219.332, Zeitstempel: 0x4e1a9f56
Ausnahmecode: 0x40000015
Fehleroffset: 0x0008d6fd
ID des fehlerhaften Prozesses: 0x3cd8
Startzeit der fehlerhaften Anwendung: 0xEModelViewer.exe0
Pfad der fehlerhaften Anwendung: EModelViewer.exe1
Pfad des fehlerhaften Moduls: EModelViewer.exe2
Berichtskennung: EModelViewer.exe3
Error: (03/31/2015 09:30:10 AM) (Source: Software Protection Platform Service) (EventID: 1001) (User: )
Description: Fehler beim Starten des Softwareschutzdiensts. 0xD0000022
6.1.7601.17514
Error: (03/31/2015 09:28:10 AM) (Source: GDFwSvc) (EventID: 0) (User: )
Description: Error loading GDPkIcpt (C:\Windows\system32\drivers\PktIcpt.sys): 31
Error: (03/31/2015 09:28:05 AM) (Source: AVKWCtl) (EventID: 0) (User: )
Description: Der Filter Treiber konnte aus dem folgenden Grund nicht gestartet werden: Error loading GDMnIcpt (C:\Windows\system32\drivers\MiniIcpt.sys): 31
Error: (03/30/2015 01:23:04 PM) (Source: GDFwSvc) (EventID: 0) (User: )
Description: Error loading GDPkIcpt (C:\Windows\system32\drivers\PktIcpt.sys): 31
Error: (03/30/2015 01:23:00 PM) (Source: AVKWCtl) (EventID: 0) (User: )
Description: Der Filter Treiber konnte aus dem folgenden Grund nicht gestartet werden: Error loading GDMnIcpt (C:\Windows\system32\drivers\MiniIcpt.sys): 31
Error: (03/30/2015 00:51:24 PM) (Source: GDFwSvc) (EventID: 0) (User: )
Description: Error loading GDPkIcpt (C:\Windows\system32\drivers\PktIcpt.sys): 31
Error: (03/30/2015 11:57:34 AM) (Source: AVKWCtl) (EventID: 0) (User: )
Description: Der Filter Treiber konnte aus dem folgenden Grund nicht gestartet werden: Error loading GDMnIcpt (C:\Windows\system32\drivers\MiniIcpt.sys): 31
System errors:
=============
Error: (03/31/2015 00:01:40 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "STEFFEN-PC :20" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.20
registriert werden. Der Computer mit IP-Adresse 192.168.178.22 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.
Error: (03/31/2015 00:01:40 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "STEFFEN-PC :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.20
registriert werden. Der Computer mit IP-Adresse 192.168.178.22 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.
Error: (03/31/2015 00:01:40 PM) (Source: Server) (EventID: 2505) (User: )
Description: Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{FD3F84CA-8427-4FD4-AD26-67270566FB1F} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden.
Error: (03/31/2015 11:39:36 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "GDMnIcpt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%31
Error: (03/31/2015 11:39:36 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "GDMnIcpt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%31
Error: (03/31/2015 11:39:36 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "GDMnIcpt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%31
Error: (03/31/2015 11:39:36 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "GDMnIcpt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%31
Error: (03/31/2015 11:39:36 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "GDBehave" wurde aufgrund folgenden Fehlers nicht gestartet:
%%31
Error: (03/31/2015 11:39:35 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "GDBehave" wurde aufgrund folgenden Fehlers nicht gestartet:
%%31
Error: (03/31/2015 11:39:35 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "GDBehave" wurde aufgrund folgenden Fehlers nicht gestartet:
%%31
Microsoft Office Sessions:
=========================
Error: (03/31/2015 11:23:17 AM) (Source: AVKWCtl) (EventID: 0) (User: )
Description: Der Filter Treiber konnte aus dem folgenden Grund nicht gestartet werden: Error loading GDMnIcpt (C:\Windows\system32\drivers\MiniIcpt.sys): 31
Error: (03/31/2015 11:23:00 AM) (Source: GDFwSvc) (EventID: 0) (User: )
Description: Error loading GDPkIcpt (C:\Windows\system32\drivers\PktIcpt.sys): 31
Error: (03/31/2015 10:47:49 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: EModelViewer.exe14.0.0.5006523b68b4MSVCR100.dll10.0.40219.3324e1a9f56400000150008d6fd3cd801d06b8ed8e77198C:\Program Files\Common Files\eDrawings2014\EModelViewer.exeC:\Windows\system32\MSVCR100.dll9ba24d98-d782-11e4-a0da-00040ec9f7d9
Error: (03/31/2015 09:30:10 AM) (Source: Software Protection Platform Service) (EventID: 1001) (User: )
Description: 0xD00000226.1.7601.17514
Error: (03/31/2015 09:28:10 AM) (Source: GDFwSvc) (EventID: 0) (User: )
Description: Error loading GDPkIcpt (C:\Windows\system32\drivers\PktIcpt.sys): 31
Error: (03/31/2015 09:28:05 AM) (Source: AVKWCtl) (EventID: 0) (User: )
Description: Der Filter Treiber konnte aus dem folgenden Grund nicht gestartet werden: Error loading GDMnIcpt (C:\Windows\system32\drivers\MiniIcpt.sys): 31
Error: (03/30/2015 01:23:04 PM) (Source: GDFwSvc) (EventID: 0) (User: )
Description: Error loading GDPkIcpt (C:\Windows\system32\drivers\PktIcpt.sys): 31
Error: (03/30/2015 01:23:00 PM) (Source: AVKWCtl) (EventID: 0) (User: )
Description: Der Filter Treiber konnte aus dem folgenden Grund nicht gestartet werden: Error loading GDMnIcpt (C:\Windows\system32\drivers\MiniIcpt.sys): 31
Error: (03/30/2015 00:51:24 PM) (Source: GDFwSvc) (EventID: 0) (User: )
Description: Error loading GDPkIcpt (C:\Windows\system32\drivers\PktIcpt.sys): 31
Error: (03/30/2015 11:57:34 AM) (Source: AVKWCtl) (EventID: 0) (User: )
Description: Der Filter Treiber konnte aus dem folgenden Grund nicht gestartet werden: Error loading GDMnIcpt (C:\Windows\system32\drivers\MiniIcpt.sys): 31
CodeIntegrity Errors:
===================================
Date: 2012-05-06 17:37:55.537
Description: N/A
Date: 2012-05-06 17:37:55.475
Description: N/A
Date: 2012-05-06 17:37:55.412
Description: N/A
Date: 2012-05-06 17:37:55.350
Description: N/A
Date: 2012-05-06 17:37:55.287
Description: N/A
Date: 2012-05-06 17:37:55.225
Description: N/A
Date: 2012-05-06 17:37:55.163
Description: N/A
Date: 2012-05-06 18:32:59.885
Description: N/A
Date: 2012-05-06 18:32:59.807
Description: N/A
Date: 2012-05-06 18:32:59.760
Description: N/A
==================== Memory info ===========================
Processor: AMD Athlon(tm) 7550 Dual-Core Processor
Percentage of memory in use: 27%
Total physical RAM: 3327.24 MB
Available physical RAM: 2404.2 MB
Total Pagefile: 6652.78 MB
Available Pagefile: 5173.39 MB
Total Virtual: 2047.88 MB
Available Virtual: 1918.47 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:232.79 GB) (Free:187.42 GB) NTFS
Drive e: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 79E5775B)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=232.8 GB) - (Type=07 NTFS)
==================== End Of Log ============================
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-03-2015 Ran by Steffen (administrator) on STEFFEN-PC on 31-03-2015 12:09:24 Running from C:\Users\Steffen\Downloads Loaded Profiles: Steffen (Available profiles: Steffen & UpdatusUser) Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: IE) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (G Data Software AG) C:\Program Files\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG) C:\Program Files\G Data\InternetSecurity\AVK\AVKWCtl.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (G Data Software AG) C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG) C:\Program Files\G Data\InternetSecurity\AVK\AVKService.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe (G Data Software AG) C:\Program Files\G Data\InternetSecurity\AVKTray\AVKTray.exe () C:\Program Files\AntiBrowserSpy\BrowserMask.exe () C:\Program Files\AntiBrowserSpy\SocialBlock_ProxyCheck.exe () C:\Program Files\AntiBrowserSpy\AntiBrowserSpy-IE-SocialBlock.exe (G Data Software AG) C:\Program Files\G Data\InternetSecurity\Firewall\GDFwSvc.exe (AVM Berlin GmbH) C:\Program Files\avmwlanstick\FRITZWLANMini.exe (Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe (G Data Software AG) C:\Program Files\G Data\InternetSecurity\Firewall\GDFirewallTray.exe (Akamai Technologies, Inc.) C:\Users\Steffen\AppData\Local\Akamai\netsession_win.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Akamai Technologies, Inc.) C:\Users\Steffen\AppData\Local\Akamai\netsession_win.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil32_15_0_0_239_ActiveX.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [AVMWlanClient] => C:\Program Files\avmwlanstick\FRITZWLANMini.exe [323584 2006-04-20] (AVM Berlin GmbH) HKLM\...\Run: [G Data ASM] => C:\Program Files\G Data\InternetSecurity\DelayLoader\AutorunDelayLoader.exe [431224 2013-12-19] (G Data Software AG) HKLM\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [41208 2012-12-19] (Adobe Systems Incorporated) HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [946352 2012-12-03] (Adobe Systems Incorporated) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254696 2011-04-08] (Sun Microsystems, Inc.) HKLM\...\Run: [GDFirewallTray] => C:\Program Files\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1724728 2013-12-19] (G Data Software AG) HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files\G Data\InternetSecurity\AVKTray\AVKTray.exe,c:\program files\g data\internetsecurity\avkkid\avkcks.exe, HKU\S-1-5-19\...\Winlogon: [Shell] C:\Windows\explorer.exe [2616320 2011-02-25] (Microsoft Corporation) <==== ATTENTION HKU\S-1-5-20\...\Winlogon: [Shell] C:\Windows\explorer.exe [2616320 2011-02-25] (Microsoft Corporation) <==== ATTENTION HKU\S-1-5-21-3764681053-1311214435-963443542-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Steffen\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-30] (Akamai Technologies, Inc.) HKU\S-1-5-21-3764681053-1311214435-963443542-1000\...\MountPoints2: G - G:\pushinst.exe HKU\S-1-5-21-3764681053-1311214435-963443542-1000\...\MountPoints2: {27a82824-2466-11df-ad1a-003067031c7a} - G:\pushinst.exe HKU\S-1-5-21-3764681053-1311214435-963443542-1000\...\MountPoints2: {e245abf6-f955-11e3-ab17-003067031c7a} - F:\pushinst.exe HKU\S-1-5-21-3764681053-1311214435-963443542-1000\...\Winlogon: [Shell] C:\Windows\explorer.exe [2616320 2011-02-25] (Microsoft Corporation) <==== ATTENTION HKU\S-1-5-18\...\Winlogon: [Shell] C:\Windows\explorer.exe [2616320 2011-02-25] (Microsoft Corporation) <==== ATTENTION ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll (Autodesk, Inc.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-3764681053-1311214435-963443542-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = HKU\S-1-5-21-3764681053-1311214435-963443542-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-21-3764681053-1311214435-963443542-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp SearchScopes: HKU\S-1-5-21-3764681053-1311214435-963443542-1000 -> {09038620-190C-402B-A92F-18864E6AB22F} URL = hxxp://go.1und1.de/br/ie9_search_web/?su={searchTerms} SearchScopes: HKU\S-1-5-21-3764681053-1311214435-963443542-1000 -> {15A29993-9DCD-469B-8AB5-678C5F72FF3E} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=302398&p={searchTerms} SearchScopes: HKU\S-1-5-21-3764681053-1311214435-963443542-1000 -> {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://tbsearch.ask.com/redirect?client=ie&tb=WBG&o=15132&src=crm&q={searchTerms}&locale=de_DE SearchScopes: HKU\S-1-5-21-3764681053-1311214435-963443542-1000 -> {5A817CF6-92D5-4DE5-AC38-82DF8A73EF28} URL = hxxp://go.gmx.net/br/ie9_search_web/?su={searchTerms} SearchScopes: HKU\S-1-5-21-3764681053-1311214435-963443542-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = SearchScopes: HKU\S-1-5-21-3764681053-1311214435-963443542-1000 -> {6B1D1FB7-7233-4F7C-802C-21A1DDB12754} URL = hxxp://go.web.de/br/ie9_search_web/?su={searchTerms} SearchScopes: HKU\S-1-5-21-3764681053-1311214435-963443542-1000 -> {81CE708B-5104-4C62-B333-94B417473B29} URL = hxxp://go.mail.com/br/ie9_search_web/?su={searchTerms} BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-12-18] (Adobe Systems Incorporated) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre6\bin\ssv.dll [2012-11-23] (Sun Microsystems, Inc.) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll [2012-11-23] (Sun Microsystems, Inc.) Toolbar: HKU\S-1-5-21-3764681053-1311214435-963443542-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF Plugin: @java.com/DTPlugin,version=1.6.0_37 -> C:\Windows\system32\npdeployJava1.dll [2012-11-23] (Sun Microsystems, Inc.) FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll [2012-11-23] (Sun Microsystems, Inc.) FF Plugin: @nvidia.com/3DVision -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll [2013-01-18] (NVIDIA Corporation) FF Plugin: @nvidia.com/3DVisionStreaming -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2013-01-18] (NVIDIA Corporation) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll [2013-02-15] (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-3764681053-1311214435-963443542-1000: @autodesk.com/DWF -> C:\Program Files\Autodesk\Autodesk Design Review Browser Add-on v1.2\npADRdwf.dll [2011-01-24] (Autodesk) Chrome: ======= CHR Profile: C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (YouTube) - C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-03-04] CHR Extension: (Google Search) - C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-03-04] CHR Extension: (avast! WebRep) - C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda [2012-03-04] CHR Extension: (Gmail) - C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-03-04] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) Locked "98730404f2d3d842" service could not be unlocked. <===== ATTENTION R2 AVKProxy; C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe [2244728 2014-02-12] (G Data Software AG) R2 AVKService; C:\Program Files\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG) R2 AVKWCtl; C:\Program Files\G Data\InternetSecurity\AVK\AVKWCtl.exe [2159472 2014-03-25] (G Data Software AG) R3 GDFwSvc; C:\Program Files\G Data\InternetSecurity\Firewall\GDFwSvc.exe [2409280 2014-01-30] (G Data Software AG) R3 GDScan; C:\Program Files\Common Files\G Data\GDScan\GDScan.exe [700024 2014-02-03] (G Data Software AG) R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-03-17] (Malwarebytes Corporation) S2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation) U2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 drmkaud; C:\Windows\system32\drivers\drmkaud.sys [5120 2009-07-14] () [File not signed] R3 DXGKrnl; C:\Windows\System32\drivers\dxgkrnl.sys [730048 2014-06-16] () [File not signed] S3 ebdrv; C:\Windows\system32\DRIVERS\evbdx.sys [3100160 2009-07-14] () [File not signed] S3 elxstor; C:\Windows\system32\DRIVERS\elxstor.sys [453712 2009-07-14] () [File not signed] S3 ErrDev; C:\Windows\system32\drivers\errdev.sys [7168 2009-07-14] () [File not signed] S3 exfat; C:\Windows\system32\Drivers\exfat.sys [142336 2009-07-14] () [File not signed] R3 fastfat; C:\Windows\system32\Drivers\fastfat.sys [148480 2009-07-14] () [File not signed] R3 fdc; C:\Windows\System32\DRIVERS\fdc.sys [25088 2009-07-14] () [File not signed] R0 FileInfo; C:\Windows\System32\drivers\fileinfo.sys [58448 2009-07-14] () [File not signed] S3 Filetrace; C:\Windows\System32\drivers\filetrace.sys [28160 2009-07-14] () [File not signed] R3 flpydisk; C:\Windows\System32\DRIVERS\flpydisk.sys [19968 2009-07-14] () [File not signed] R0 FltMgr; C:\Windows\System32\drivers\fltmgr.sys [198208 2009-07-14] () [File not signed] S3 FsDepends; C:\Windows\System32\drivers\FsDepends.sys [46160 2009-07-14] () [File not signed] U0 Fs_Rec; C:\Windows\system32\Drivers\Fs_Rec.sys [19824 2012-03-01] () [File not signed] R0 fvevol; C:\Windows\System32\DRIVERS\fvevol.sys [196328 2013-01-24] () [File not signed] R3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [264704 2006-04-06] () [File not signed] S3 gagp30kx; C:\Windows\system32\DRIVERS\gagp30kx.sys [57936 2009-07-14] () [File not signed] S0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [44544 2015-03-27] (G Data Software AG) S1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [101504 2015-03-27] (G Data Software AG) S3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [56832 2015-03-27] (G Data Software AG) S1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd32.sys [53248 2015-03-27] (G Data Software AG) S3 hcw85cir; C:\Windows\system32\drivers\hcw85cir.sys [26624 2009-07-14] () [File not signed] R3 HdAudAddService; C:\Windows\system32\drivers\HdAudio.sys [304128 2010-11-20] () [File not signed] R3 HDAudBus; C:\Windows\system32\drivers\HDAudBus.sys [108544 2010-11-20] () [File not signed] S3 HidBatt; C:\Windows\system32\DRIVERS\HidBatt.sys [21504 2009-07-14] () [File not signed] S3 HidBth; C:\Windows\system32\DRIVERS\hidbth.sys [91136 2009-07-14] () [File not signed] S3 HidIr; C:\Windows\system32\DRIVERS\hidir.sys [37888 2009-07-14] () [File not signed] R3 HidUsb; C:\Windows\System32\DRIVERS\hidusb.sys [24064 2010-11-20] () [File not signed] S1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [50176 2015-03-27] (G Data Software AG) S3 HpSAMD; C:\Windows\system32\drivers\HpSAMD.sys [67152 2009-07-14] () [File not signed] R3 HTTP; C:\Windows\System32\drivers\HTTP.sys [513536 2010-11-20] () [File not signed] R0 hwpolicy; C:\Windows\System32\drivers\hwpolicy.sys [14208 2010-11-20] () [File not signed] S3 i8042prt; C:\Windows\System32\DRIVERS\i8042prt.sys [80896 2009-07-14] () [File not signed] S3 iaStorV; C:\Windows\system32\drivers\iaStorV.sys [332160 2011-03-11] () [File not signed] S3 iirsp; C:\Windows\system32\DRIVERS\iirsp.sys [41040 2009-07-14] () [File not signed] S3 intelide; C:\Windows\system32\drivers\intelide.sys [15424 2009-07-14] () [File not signed] S3 intelppm; C:\Windows\system32\DRIVERS\intelppm.sys [53760 2009-07-14] () [File not signed] S3 IpFilterDriver; C:\Windows\System32\DRIVERS\ipfltdrv.sys [58880 2009-07-14] () [File not signed] S3 IPMIDRV; C:\Windows\system32\drivers\IPMIDrv.sys [65536 2010-11-20] () [File not signed] S3 IPNAT; C:\Windows\System32\drivers\ipnat.sys [101888 2009-07-14] () [File not signed] S3 IRENUM; C:\Windows\System32\drivers\irenum.sys [13824 2009-07-14] () [File not signed] S3 isapnp; C:\Windows\system32\drivers\isapnp.sys [46656 2009-07-14] () [File not signed] S3 iScsiPrt; C:\Windows\system32\drivers\msiscsi.sys [234432 2014-02-04] () [File not signed] R3 kbdclass; C:\Windows\System32\DRIVERS\kbdclass.sys [42576 2009-07-14] () [File not signed] R3 kbdhid; C:\Windows\System32\DRIVERS\kbdhid.sys [28160 2010-11-20] () [File not signed] R0 KSecDD; C:\Windows\System32\Drivers\ksecdd.sys [67520 2015-01-15] () [File not signed] R0 KSecPkg; C:\Windows\System32\Drivers\ksecpkg.sys [136640 2015-01-15] () [File not signed] R2 lltdio; C:\Windows\System32\DRIVERS\lltdio.sys [48128 2009-07-14] () [File not signed] S3 LSI_FC; C:\Windows\system32\DRIVERS\lsi_fc.sys [95824 2009-07-14] () [File not signed] S3 LSI_SAS; C:\Windows\system32\DRIVERS\lsi_sas.sys [89168 2009-07-14] () [File not signed] S3 LSI_SAS2; C:\Windows\system32\DRIVERS\lsi_sas2.sys [54864 2009-07-14] () [File not signed] S3 LSI_SCSI; C:\Windows\system32\DRIVERS\lsi_scsi.sys [96848 2009-07-14] () [File not signed] R2 luafv; C:\Windows\system32\drivers\luafv.sys [86528 2009-07-14] () [File not signed] S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-03-17] (Malwarebytes Corporation) S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2015-03-31] (Malwarebytes Corporation) S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-03-17] (Malwarebytes Corporation) S3 megasas; C:\Windows\system32\DRIVERS\megasas.sys [30800 2009-07-14] () [File not signed] S3 MegaSR; C:\Windows\system32\DRIVERS\MegaSR.sys [235584 2009-07-14] () [File not signed] S3 Modem; C:\Windows\System32\drivers\modem.sys [31744 2009-07-14] () [File not signed] R3 monitor; C:\Windows\System32\DRIVERS\monitor.sys [23552 2009-07-14] () [File not signed] R3 mouclass; C:\Windows\System32\DRIVERS\mouclass.sys [41552 2009-07-14] () [File not signed] R3 mouhid; C:\Windows\System32\DRIVERS\mouhid.sys [26112 2009-07-14] () [File not signed] R0 mountmgr; C:\Windows\System32\drivers\mountmgr.sys [78208 2010-11-20] () [File not signed] S3 mpio; C:\Windows\system32\drivers\mpio.sys [130432 2010-11-20] () [File not signed] R3 mpsdrv; C:\Windows\System32\drivers\mpsdrv.sys [60416 2009-07-14] () [File not signed] S3 MRxDAV; C:\Windows\system32\drivers\mrxdav.sys [116224 2014-12-19] () [File not signed] R3 mrxsmb; C:\Windows\System32\DRIVERS\mrxsmb.sys [123904 2011-04-27] () [File not signed] R3 mrxsmb10; C:\Windows\System32\DRIVERS\mrxsmb10.sys [223744 2011-07-09] () [File not signed] R3 mrxsmb20; C:\Windows\System32\DRIVERS\mrxsmb20.sys [96768 2011-04-27] () [File not signed] S3 msahci; C:\Windows\system32\drivers\msahci.sys [28032 2010-11-20] () [File not signed] S3 msdsm; C:\Windows\system32\drivers\msdsm.sys [116096 2010-11-20] () [File not signed] R1 Msfs; C:\Windows\system32\Drivers\Msfs.sys [22528 2009-07-14] () S3 mshidkmdf; C:\Windows\System32\drivers\mshidkmdf.sys [4096 2009-07-14] () [File not signed] R0 msisadrv; C:\Windows\System32\drivers\msisadrv.sys [13888 2009-07-14] () [File not signed] S3 MSKSSRV; C:\Windows\System32\drivers\MSKSSRV.sys [8320 2009-07-14] () [File not signed] S3 MSPCLOCK; C:\Windows\System32\drivers\MSPCLOCK.sys [5888 2009-07-14] () [File not signed] S3 MSPQM; C:\Windows\System32\drivers\MSPQM.sys [5504 2009-07-14] () [File not signed] S3 MsRPC; C:\Windows\system32\Drivers\MsRPC.sys [162896 2009-07-14] () [File not signed] R1 mssmbios; C:\Windows\system32\drivers\mssmbios.sys [28240 2009-07-14] () [File not signed] S3 MSTEE; C:\Windows\System32\drivers\MSTEE.sys [6144 2009-07-14] () [File not signed] S3 MTConfig; C:\Windows\system32\DRIVERS\MTConfig.sys [12288 2009-07-14] () [File not signed] R0 Mup; C:\Windows\System32\Drivers\mup.sys [49728 2009-07-14] () [File not signed] R3 NativeWifiP; C:\Windows\System32\DRIVERS\nwifi.sys [267264 2009-07-14] () [File not signed] R0 NDIS; C:\Windows\System32\drivers\ndis.sys [712048 2012-08-22] () [File not signed] S3 NdisCap; C:\Windows\System32\DRIVERS\ndiscap.sys [27136 2009-07-14] () [File not signed] R3 NdisTapi; C:\Windows\System32\DRIVERS\ndistapi.sys [20992 2009-07-14] () [File not signed] R3 Ndisuio; C:\Windows\System32\DRIVERS\ndisuio.sys [46080 2010-11-20] () [File not signed] R3 NdisWan; C:\Windows\System32\DRIVERS\ndiswan.sys [118784 2010-11-20] () [File not signed] R3 NDProxy; C:\Windows\system32\Drivers\NDProxy.sys [48640 2010-11-20] () [File not signed] R1 NetBIOS; C:\Windows\System32\DRIVERS\netbios.sys [36352 2009-07-14] () [File not signed] R1 NetBT; C:\Windows\System32\DRIVERS\netbt.sys [187904 2010-11-20] () [File not signed] S3 nfrd960; C:\Windows\system32\DRIVERS\nfrd960.sys [44624 2009-07-14] () [File not signed] R1 Npfs; C:\Windows\system32\Drivers\Npfs.sys [35328 2009-07-14] () [File not signed] R1 nsiproxy; C:\Windows\System32\drivers\nsiproxy.sys [16896 2009-07-14] () [File not signed] R3 Ntfs; C:\Windows\system32\Drivers\Ntfs.sys [1212352 2014-01-24] () R1 Null; C:\Windows\system32\Drivers\Null.sys [4608 2009-07-14] () [File not signed] R3 NVENETFD; C:\Windows\System32\DRIVERS\nvm62x32.sys [347264 2009-07-14] () [File not signed] S3 nvlddmkm; C:\Windows\System32\DRIVERS\nvlddmkm.sys [8939296 2013-02-26] () [File not signed] S3 nvraid; C:\Windows\system32\drivers\nvraid.sys [117120 2011-03-11] () [File not signed] R3 nvsmu; C:\Windows\System32\DRIVERS\nvsmu.sys [13312 2007-10-12] () [File not signed] S3 nvstor; C:\Windows\system32\drivers\nvstor.sys [143744 2011-03-11] () [File not signed] S3 nv_agp; C:\Windows\system32\drivers\nv_agp.sys [105024 2009-07-14] () [File not signed] S3 ohci1394; C:\Windows\system32\drivers\ohci1394.sys [62464 2009-07-14] () [File not signed] R3 Parport; C:\Windows\System32\DRIVERS\parport.sys [79360 2009-07-14] () [File not signed] R0 partmgr; C:\Windows\System32\drivers\partmgr.sys [56176 2012-03-17] () [File not signed] R2 Parvdm; C:\Windows\System32\DRIVERS\parvdm.sys [8704 2009-07-14] () [File not signed] R0 pci; C:\Windows\System32\drivers\pci.sys [153984 2010-11-20] () [File not signed] R0 pciide; C:\Windows\System32\drivers\pciide.sys [12368 2009-07-14] () [File not signed] S3 pcmcia; C:\Windows\system32\DRIVERS\pcmcia.sys [180288 2009-07-14] () [File not signed] R0 pcw; C:\Windows\System32\drivers\pcw.sys [43088 2009-07-14] () [File not signed] R2 PEAUTH; C:\Windows\System32\drivers\peauth.sys [586752 2009-07-14] () [File not signed] R3 PptpMiniport; C:\Windows\System32\DRIVERS\raspptp.sys [73728 2009-07-14] () [File not signed] S3 Processor; C:\Windows\system32\DRIVERS\processr.sys [52224 2009-07-14] () [File not signed] R1 Psched; C:\Windows\System32\DRIVERS\pacer.sys [104448 2009-07-14] () [File not signed] S3 ql2300; C:\Windows\system32\DRIVERS\ql2300.sys [1383488 2009-07-14] () [File not signed] S3 ql40xx; C:\Windows\system32\DRIVERS\ql40xx.sys [106064 2009-07-14] () [File not signed] S3 QWAVEdrv; C:\Windows\system32\drivers\qwavedrv.sys [31744 2009-07-14] () [File not signed] S3 RasAcd; C:\Windows\System32\DRIVERS\rasacd.sys [11776 2009-07-14] () [File not signed] R3 RasAgileVpn; C:\Windows\System32\DRIVERS\AgileVpn.sys [49152 2009-07-14] () [File not signed] R3 Rasl2tp; C:\Windows\System32\DRIVERS\rasl2tp.sys [78848 2009-07-14] () [File not signed] R3 RasPppoe; C:\Windows\System32\DRIVERS\raspppoe.sys [77824 2009-07-14] () [File not signed] R3 RasSstp; C:\Windows\System32\DRIVERS\rassstp.sys [75264 2009-07-14] () [File not signed] R1 rdbss; C:\Windows\System32\DRIVERS\rdbss.sys [242688 2010-11-20] () [File not signed] S3 rdpbus; C:\Windows\system32\DRIVERS\rdpbus.sys [18944 2009-07-14] () [File not signed] R1 RDPCDD; C:\Windows\System32\DRIVERS\RDPCDD.sys [6656 2010-11-20] () [File not signed] R1 RDPENCDD; C:\Windows\System32\drivers\rdpencdd.sys [6656 2009-07-14] () [File not signed] R1 RDPREFMP; C:\Windows\System32\drivers\rdprefmp.sys [7168 2009-07-14] () [File not signed] S3 RDPWD; C:\Windows\system32\Drivers\RDPWD.sys [184320 2014-07-17] () [File not signed] R0 rdyboost; C:\Windows\System32\drivers\rdyboost.sys [173440 2010-11-20] () [File not signed] R2 rspndr; C:\Windows\System32\DRIVERS\rspndr.sys [60928 2009-07-14] () [File not signed] S3 sbp2port; C:\Windows\system32\drivers\sbp2port.sys [85376 2010-11-20] () [File not signed] S3 scfilter; C:\Windows\System32\DRIVERS\scfilter.sys [26624 2010-11-20] () [File not signed] R2 secdrv; C:\Windows\system32\Drivers\secdrv.sys [20480 2009-07-13] () [File not signed] R3 Serenum; C:\Windows\System32\DRIVERS\serenum.sys [17920 2009-07-14] () [File not signed] R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [83456 2009-07-14] () [File not signed] S3 sermouse; C:\Windows\system32\DRIVERS\sermouse.sys [19968 2009-07-14] () [File not signed] S3 sffdisk; C:\Windows\system32\drivers\sffdisk.sys [11264 2009-07-14] () [File not signed] S3 sffp_mmc; C:\Windows\system32\drivers\sffp_mmc.sys [12288 2009-07-14] () [File not signed] S3 sffp_sd; C:\Windows\system32\drivers\sffp_sd.sys [12800 2010-11-20] () [File not signed] S3 sfloppy; C:\Windows\System32\DRIVERS\sfloppy.sys [13824 2009-07-14] () [File not signed] S3 sisagp; C:\Windows\system32\drivers\sisagp.sys [52304 2009-07-14] () [File not signed] S3 SiSRaid2; C:\Windows\system32\DRIVERS\SiSRaid2.sys [40016 2009-07-14] () [File not signed] S3 SiSRaid4; C:\Windows\system32\DRIVERS\sisraid4.sys [77888 2009-07-14] () [File not signed] S3 Smb; C:\Windows\System32\DRIVERS\smb.sys [71168 2009-07-14] () [File not signed] R0 spldr; C:\Windows\system32\Drivers\spldr.sys [17472 2009-07-14] () [File not signed] R3 srv; C:\Windows\System32\DRIVERS\srv.sys [311808 2011-04-29] () [File not signed] R3 srv2; C:\Windows\System32\DRIVERS\srv2.sys [310272 2011-04-29] () [File not signed] R3 srvnet; C:\Windows\System32\DRIVERS\srvnet.sys [114688 2011-04-29] () [File not signed] S3 stexstor; C:\Windows\system32\DRIVERS\stexstor.sys [21072 2009-07-14] () [File not signed] R3 swenum; C:\Windows\system32\drivers\swenum.sys [12240 2009-07-14] () [File not signed] R0 Tcpip; C:\Windows\System32\drivers\tcpip.sys [1294272 2014-04-05] () [File not signed] S3 TCPIP6; C:\Windows\System32\DRIVERS\tcpip.sys [1294272 2014-04-05] () [File not signed] R2 tcpipreg; C:\Windows\System32\drivers\tcpipreg.sys [35328 2012-10-03] () [File not signed] S3 TDPIPE; C:\Windows\System32\drivers\tdpipe.sys [18432 2010-11-20] () [File not signed] S3 TDTCP; C:\Windows\System32\drivers\tdtcp.sys [24576 2012-02-17] () [File not signed] R1 tdx; C:\Windows\System32\DRIVERS\tdx.sys [74752 2014-11-11] () [File not signed] R1 TermDD; C:\Windows\system32\drivers\termdd.sys [53120 2010-11-20] () [File not signed] S3 tssecsrv; C:\Windows\System32\DRIVERS\tssecsrv.sys [31232 2014-07-17] () [File not signed] S3 TsUsbFlt; C:\Windows\System32\drivers\tsusbflt.sys [52224 2010-11-20] () [File not signed] R3 tunnel; C:\Windows\System32\DRIVERS\tunnel.sys [108544 2010-11-20] () [File not signed] S3 uagp35; C:\Windows\system32\DRIVERS\uagp35.sys [55888 2009-07-14] () [File not signed] S4 udfs; C:\Windows\System32\DRIVERS\udfs.sys [246784 2010-11-20] () [File not signed] S3 uliagpkx; C:\Windows\system32\drivers\uliagpkx.sys [57424 2009-07-14] () [File not signed] R3 umbus; C:\Windows\system32\drivers\umbus.sys [39936 2010-11-20] () [File not signed] S3 UmPass; C:\Windows\system32\DRIVERS\umpass.sys [8192 2009-07-14] () [File not signed] R3 usbccgp; C:\Windows\System32\DRIVERS\usbccgp.sys [76288 2013-11-27] () [File not signed] S3 usbcir; C:\Windows\system32\drivers\usbcir.sys [86016 2013-07-12] () [File not signed] R3 usbehci; C:\Windows\System32\DRIVERS\usbehci.sys [43520 2013-11-27] () [File not signed] R3 usbhub; C:\Windows\System32\DRIVERS\usbhub.sys [258560 2013-11-27] () [File not signed] R3 usbohci; C:\Windows\System32\DRIVERS\usbohci.sys [20480 2013-11-27] () [File not signed] S3 usbprint; C:\Windows\System32\DRIVERS\usbprint.sys [19968 2009-07-14] () [File not signed] S3 usbscan; C:\Windows\System32\DRIVERS\usbscan.sys [35840 2009-07-14] () [File not signed] S3 usbser; C:\Windows\System32\DRIVERS\usbser.sys [28160 2013-08-29] () [File not signed] S3 USBSTOR; C:\Windows\system32\drivers\USBSTOR.SYS [76288 2011-03-11] () [File not signed] S3 usbuhci; C:\Windows\system32\drivers\usbuhci.sys [24064 2013-11-27] () [File not signed] R0 vdrvroot; C:\Windows\System32\drivers\vdrvroot.sys [32832 2009-07-14] () [File not signed] S3 vga; C:\Windows\System32\DRIVERS\vgapnp.sys [26112 2009-07-14] () [File not signed] R1 VgaSave; C:\Windows\System32\drivers\vga.sys [25088 2009-07-14] () [File not signed] S3 vhdmp; C:\Windows\system32\drivers\vhdmp.sys [160128 2010-11-20] () [File not signed] S3 viaagp; C:\Windows\system32\drivers\viaagp.sys [53328 2009-07-14] () [File not signed] S3 ViaC7; C:\Windows\system32\DRIVERS\viac7.sys [52736 2009-07-14] () [File not signed] S3 viaide; C:\Windows\system32\drivers\viaide.sys [16976 2009-07-14] () [File not signed] R0 volmgr; C:\Windows\System32\drivers\volmgr.sys [53120 2010-11-20] () [File not signed] R0 volmgrx; C:\Windows\System32\drivers\volmgrx.sys [297040 2009-07-14] () [File not signed] R0 volsnap; C:\Windows\System32\drivers\volsnap.sys [245632 2010-11-20] () [File not signed] S3 vsmraid; C:\Windows\system32\DRIVERS\vsmraid.sys [141904 2009-07-14] () [File not signed] S3 vwifibus; C:\Windows\System32\drivers\vwifibus.sys [19968 2009-07-14] () [File not signed] S3 WacomPen; C:\Windows\system32\DRIVERS\wacompen.sys [21632 2009-07-14] () [File not signed] S3 WANARP; C:\Windows\System32\DRIVERS\wanarp.sys [63488 2010-11-20] () [File not signed] R1 Wanarpv6; C:\Windows\System32\DRIVERS\wanarp.sys [63488 2010-11-20] () [File not signed] S3 Wd; C:\Windows\system32\DRIVERS\wd.sys [19024 2009-07-14] () [File not signed] R0 Wdf01000; C:\Windows\System32\drivers\Wdf01000.sys [527064 2013-06-26] () [File not signed] R1 WfpLwf; C:\Windows\System32\DRIVERS\wfplwf.sys [9728 2009-07-14] () [File not signed] S3 WIMMount; C:\Windows\System32\drivers\wimmount.sys [19008 2009-07-14] () [File not signed] S3 WinUsb; C:\Windows\System32\DRIVERS\WinUsb.sys [35968 2010-11-20] () [File not signed] R3 WmiAcpi; C:\Windows\system32\drivers\wmiacpi.sys [11264 2009-07-14] () [File not signed] S4 ws2ifsl; C:\Windows\system32\drivers\ws2ifsl.sys [16384 2009-07-14] () [File not signed] S3 WudfPf; C:\Windows\System32\drivers\WudfPf.sys [66560 2012-07-26] () [File not signed] S3 WUDFRd; C:\Windows\System32\DRIVERS\WUDFRd.sys [155136 2012-07-26] () [File not signed] U5 98730404f2d3d842; C:\Windows\System32\Drivers\98730404f2d3d842.sys [81408 2015-02-27] () <===== ATTENTION Necurs Rootkit? U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] () [File not signed] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-03-30 13:28 - 2015-03-30 13:28 - 00027102 _____ () C:\Users\Steffen\Downloads\Addition.txt 2015-03-30 13:27 - 2015-03-30 13:27 - 00001106 _____ () C:\Users\Steffen\Desktop\FRST - Verknüpfung.lnk 2015-03-30 13:26 - 2015-03-31 12:09 - 00029670 _____ () C:\Users\Steffen\Downloads\FRST.txt 2015-03-30 13:26 - 2015-03-31 12:09 - 00000000 ____D () C:\FRST 2015-03-30 13:26 - 2015-03-30 13:26 - 01135104 _____ (Farbar) C:\Users\Steffen\Downloads\FRST.exe 2015-03-27 23:42 - 2015-03-27 23:45 - 00000050 _____ () C:\Windows\system32\bridf08b.dat 2015-03-27 23:41 - 2015-03-27 23:41 - 00000000 ____D () C:\ProgramData\Brother 2015-03-27 22:11 - 2015-03-27 22:11 - 311218386 _____ () C:\Windows\MEMORY.DMP 2015-03-27 22:11 - 2015-03-27 22:11 - 00143800 _____ () C:\Windows\Minidump\032715-18798-01.dmp 2015-03-27 21:00 - 2015-03-31 09:28 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-03-27 21:00 - 2015-03-27 21:10 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2015-03-27 21:00 - 2015-03-27 21:00 - 00001060 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-03-27 21:00 - 2015-03-27 21:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-03-27 21:00 - 2015-03-27 21:00 - 00000000 ____D () C:\ProgramData\Malwarebytes 2015-03-27 21:00 - 2015-03-17 07:15 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-03-27 21:00 - 2015-03-17 07:15 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-03-27 21:00 - 2015-03-17 07:15 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-03-27 20:57 - 2015-03-27 21:00 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Steffen\Downloads\mbam-setup-2.1.4.1018 (1).exe 2015-03-27 20:47 - 2015-03-31 11:21 - 00000784 _____ () C:\Windows\setupact.log 2015-03-27 20:47 - 2015-03-30 11:56 - 00012366 _____ () C:\Windows\PFRO.log 2015-03-27 20:47 - 2015-03-27 20:47 - 00000000 _____ () C:\Windows\setuperr.log 2015-03-27 20:03 - 2015-03-27 22:36 - 00004306 _____ () C:\Windows\WindowsUpdate.log 2015-03-27 20:00 - 2015-03-27 20:00 - 00003520 _____ () C:\Users\Steffen\Documents\cc_20150327_190017.reg 2015-03-27 19:36 - 2015-03-27 19:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity CBE 2015-03-27 19:28 - 2015-03-27 19:28 - 00002008 _____ () C:\Users\Public\Desktop\G Data InternetSecurity CBE.lnk 2015-03-27 19:25 - 2015-03-27 19:25 - 00056832 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys 2015-03-27 19:22 - 2015-03-27 19:22 - 00053248 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd32.sys 2015-03-27 19:21 - 2015-03-27 19:21 - 00101504 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys 2015-03-27 19:21 - 2015-03-27 19:21 - 00050176 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys 2015-03-27 19:21 - 2015-03-27 19:21 - 00044544 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys 2015-03-27 19:19 - 2015-03-27 19:19 - 00000000 ____D () C:\Program Files\Common Files\G Data 2015-03-27 18:38 - 2015-03-27 18:38 - 00001037 _____ () C:\Users\Public\Desktop\AntiBrowserSpy.lnk 2015-03-27 18:38 - 2015-03-27 18:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AntiBrowserSpy 2015-03-19 13:43 - 2015-03-19 13:43 - 00000000 ____D () C:\Users\Steffen\AppData\Local\Solid Concepts Inc 2015-03-19 13:42 - 2015-03-19 13:42 - 00002171 _____ () C:\Users\Public\Desktop\SolidView Lite 2014.lnk 2015-03-19 13:42 - 2015-03-19 13:42 - 00000000 ____D () C:\ProgramData\Solid Concepts Inc 2015-03-19 13:42 - 2015-03-19 13:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Solid Concepts Inc 2015-03-19 13:42 - 2015-03-19 13:42 - 00000000 ____D () C:\Program Files\Solid Concepts Inc 2015-03-19 12:55 - 2015-03-19 13:41 - 163663800 _____ (Solid Concepts Inc) C:\Users\Steffen\Downloads\svlite_2014v0_x86.exe 2015-03-09 17:44 - 2015-03-09 17:48 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird 2015-03-09 17:35 - 2015-03-09 17:35 - 00057337 _____ () C:\Users\Steffen\Downloads\Drehteile (2).zip ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-03-31 11:29 - 2009-07-14 06:34 - 00022368 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-03-31 11:29 - 2009-07-14 06:34 - 00022368 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-03-31 11:25 - 2010-02-28 14:47 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-03-31 11:21 - 2012-11-18 17:18 - 00000000 ____D () C:\ProgramData\NVIDIA 2015-03-31 11:21 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-03-31 10:48 - 2013-07-20 09:16 - 00000000 ____D () C:\Users\Steffen\AppData\Local\CrashDumps 2015-03-28 16:09 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\LogFiles 2015-03-27 23:45 - 2013-03-08 13:01 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information 2015-03-27 23:45 - 2010-08-07 16:25 - 00000000 ____D () C:\Program Files\Brother 2015-03-27 23:21 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Globalization 2015-03-27 22:33 - 2014-07-22 18:17 - 00000000 ____D () C:\Users\Steffen\Downloads\Neuer Ordner 2015-03-27 22:18 - 2010-11-07 13:25 - 00498176 ___SH () C:\Users\Steffen\Documents\Thumbs.db 2015-03-27 22:11 - 2010-04-07 12:10 - 00000000 ____D () C:\Windows\Minidump 2015-03-27 21:11 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Web 2015-03-27 19:55 - 2014-05-08 19:09 - 00000000 ____D () C:\ProgramData\G Data 2015-03-27 19:55 - 2012-09-03 08:32 - 00000000 ____D () C:\Program Files\AntiBrowserSpy 2015-03-27 19:21 - 2014-05-08 20:11 - 00001558 _____ () C:\Users\Steffen\AppData\Roaming\gdscan.log 2015-03-27 19:19 - 2014-05-08 20:10 - 00000000 ____D () C:\Program Files\G Data 2015-03-27 18:37 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\spool 2015-03-27 18:34 - 2009-07-14 06:52 - 00000000 ____D () C:\Windows\system32\WinBioPlugIns 2015-03-27 18:34 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\winevt 2015-03-27 18:34 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\SMI 2015-03-27 18:34 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\MUI 2015-03-27 18:34 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\com 2015-03-27 18:12 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\wfp 2015-03-27 18:12 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\registration 2015-03-09 22:23 - 2012-12-17 18:51 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service 2015-03-09 17:48 - 2015-01-20 13:28 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird.bak 2015-03-09 16:54 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache ==================== Files in the root of some directories ======= 2012-05-23 17:35 - 2012-09-03 09:24 - 0000048 _____ () C:\Users\Steffen\AppData\Roaming\AcroIEHelpe.txt 2012-08-26 13:44 - 2012-09-03 10:06 - 0000017 _____ () C:\Users\Steffen\AppData\Roaming\blckdom.res 2014-05-08 20:11 - 2014-05-08 20:11 - 0000000 _____ () C:\Users\Steffen\AppData\Roaming\gdfw.log 2014-05-08 20:11 - 2015-03-27 19:21 - 0001558 _____ () C:\Users\Steffen\AppData\Roaming\gdscan.log 2012-05-23 17:35 - 2012-05-23 17:35 - 0000264 _____ () C:\Users\Steffen\AppData\Roaming\srvblck5.tmp 2014-10-20 17:22 - 2014-10-20 17:22 - 0004096 ____H () C:\Users\Steffen\AppData\Local\keyfile3.drm 2014-05-08 19:55 - 2014-09-13 15:31 - 0007597 _____ () C:\Users\Steffen\AppData\Local\Resmon.ResmonCfg 2012-09-03 08:55 - 2012-09-03 08:55 - 0017408 _____ () C:\Users\Steffen\AppData\Local\WebpageIcons.db 2012-08-11 11:10 - 2012-08-11 11:38 - 4503728 ____T () C:\ProgramData\00etadpu.pad 2013-12-19 17:18 - 2013-12-19 17:20 - 95025368 ____T () C:\ProgramData\8odwoemq.fee 2013-12-19 17:18 - 2013-12-19 17:18 - 0000000 _____ () C:\ProgramData\8odwoemq.odd 2013-10-29 12:00 - 2013-10-29 12:02 - 95025368 ____T () C:\ProgramData\8zwwlhrq.bxx 2013-10-29 12:00 - 2013-10-29 12:00 - 0000000 _____ () C:\ProgramData\8zwwlhrq.fvv 2013-10-30 13:48 - 2013-10-30 13:49 - 95025368 ____T () C:\ProgramData\9oj69hf.bxx 2013-10-30 13:48 - 2013-10-30 13:48 - 0000000 _____ () C:\ProgramData\9oj69hf.fvv 2012-06-15 10:17 - 2012-06-15 10:17 - 4503728 ____T () C:\ProgramData\c_0_lpt.pad 2012-08-20 12:29 - 2012-08-20 12:30 - 4503728 ____T () C:\ProgramData\ism_0_llatsni.pad 2013-10-28 13:51 - 2013-10-28 13:53 - 95025368 ____T () C:\ProgramData\lzjb8av.bxx 2013-10-28 13:51 - 2013-10-28 13:51 - 0000000 _____ () C:\ProgramData\lzjb8av.fvv 2012-09-03 08:22 - 2012-09-03 08:23 - 4503728 ____T () C:\ProgramData\nud0repor.pad 2012-08-06 11:13 - 2012-08-06 11:14 - 4503728 ____T () C:\ProgramData\rat_0ybba.pad 2012-01-03 18:00 - 2012-01-03 18:04 - 0000440 ____H () C:\ProgramData\UeBUrRTJiwSDHt 2012-07-24 17:39 - 2012-07-24 17:40 - 4503728 ____T () C:\ProgramData\z7_0ytr.pad 2012-01-03 18:09 - 2012-01-03 18:09 - 0000296 _____ () C:\ProgramData\~UeBUrRTJiwSDHt 2012-01-03 18:09 - 2012-01-03 18:09 - 0000200 _____ () C:\ProgramData\~UeBUrRTJiwSDHtr ZeroAccess: C:\Users\Steffen\AppData\Local\{b3143e40-0149-157c-ba8a-29adcc6cabbe} C:\Users\Steffen\AppData\Local\{b3143e40-0149-157c-ba8a-29adcc6cabbe}\@ C:\Users\Steffen\AppData\Local\{b3143e40-0149-157c-ba8a-29adcc6cabbe}\L\00000004.@ C:\Users\Steffen\AppData\Local\{b3143e40-0149-157c-ba8a-29adcc6cabbe}\L\1afb2d56 C:\Users\Steffen\AppData\Local\{b3143e40-0149-157c-ba8a-29adcc6cabbe}\L\55490ac4 Files to move or delete: ==================== C:\ProgramData\00etadpu.pad C:\ProgramData\8odwoemq.fee C:\ProgramData\8odwoemq.odd C:\ProgramData\8zwwlhrq.bxx C:\ProgramData\8zwwlhrq.fvv C:\ProgramData\9oj69hf.bxx C:\ProgramData\9oj69hf.fvv C:\ProgramData\c_0_lpt.pad C:\ProgramData\ism_0_llatsni.pad C:\ProgramData\lzjb8av.bxx C:\ProgramData\lzjb8av.fvv C:\ProgramData\nud0repor.pad C:\ProgramData\rat_0ybba.pad C:\ProgramData\z7_0ytr.pad ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys [2012-10-20 11:09] - [2010-11-20 14:30] - 0245632 ____A () D41D8CD98F00B204E9800998ECF8427E C:\Windows\system32\Drivers\volsnap.sys No Company Name <===== ATTENTION! LastRegBack: 2015-03-19 11:19 ==================== End Of Log ============================ --- --- --- |
| Themen zu G data blockiert , keine Systemwiederherstellung möglich , Taskmanager funktioniert nicht |
| angeblich, ausführen, blockiert, data, ellung, funktionier, funktioniert, funktioniert nicht, g data, installier, installiert, kurzem, link, mail, neuinstallierung, nicht mehr, ratlos, rechner, retten, rätsel, sperrt, starte, systemwiederherstellung, taskma, taskmanager |
Baum-Darstellung