| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: G data blockiert , keine Systemwiederherstellung möglich , Taskmanager funktioniert nichtWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
| |
02.04.2015, 16:39
| #15 |
 |  G data blockiert , keine Systemwiederherstellung möglich , Taskmanager funktioniert nichtCode:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 11-03-2015
Ran by Steffen at 2015-04-02 17:30:48
Running from C:\Users\Steffen\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: G Data InternetSecurity CBE (Enabled - Out of date) {545C8713-0744-B079-87F8-349A6D5C8CF0}
AS: G Data InternetSecurity CBE (Enabled - Out of date) {EF3D66F7-217E-BFF7-BD48-0FE816DBC64D}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: G Data Personal Firewall (Enabled) {6C670636-4D2B-B121-ACA7-9DAF938FCB8B}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
1und1 Desktop Icons (HKLM\...\1&1 Mail & Media GmbH 1und1DesktopIconsInstaller) (Version: 3.0.3.0 - 1&1 Mail & Media GmbH)
1und1 Softwareaktualisierung (HKLM\...\1&1 Mail & Media GmbH 1und1Softwareaktualisierung) (Version: 3.0.0.55 - 1&1 Mail & Media GmbH)
7-Zip 4.65 (HKLM\...\7-Zip) (Version: - )
Adobe Flash Player 17 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 17.0.0.134 - Adobe Systems Incorporated)
Adobe Reader 9.5.4 - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-A95000000001}) (Version: 9.5.4 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKU\S-1-5-21-3764681053-1311214435-963443542-1000\...\Akamai) (Version: - Akamai Technologies, Inc)
AntiBrowserSpy (HKLM\...\{F78B5B4F-075A-4C81-AA27-E707861EB5B7}_is1) (Version: 141 - Abelssoft)
Autodesk Design Review 2013 (HKLM\...\Autodesk Design Review 2013) (Version: 13.0.0.82 - Autodesk, Inc.)
Autodesk Design Review 2013 (Version: 13.0.0.82 - Autodesk, Inc.) Hidden
Autodesk Design Review Browser Add-on v1.2 (HKLM\...\{CD49E43B-88B1-48AD-A3AF-43FAAAB41CB8}) (Version: 1.2.0 - Autodesk)
Autodesk DWG TrueView 2014 (HKLM\...\DWG TrueView 2014) (Version: 19.1.18.0 - Autodesk)
AVM FRITZ!Box Dokumentation (HKLM\...\AVMFBox) (Version: - AVM Berlin)
AVM FRITZ!Box Druckeranschluss (HKLM\...\AVMFBoxPrinter) (Version: - AVM Berlin)
CCleaner (HKLM\...\CCleaner) (Version: 4.12 - Piriform)
Chinese Simplified Fonts Support For Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-2447-0000-900000000003}) (Version: 9.0.0 - Adobe Systems Incorporated)
Dassault Systemes Software VC10 Prerequisites x86 (HKLM\...\{B7066BF6-394F-4DA6-B21E-06DF44684816}) (Version: 10.1.1 - Dassault Systemes)
Dassault Systemes Software VC9 Prerequisites x86 (HKLM\...\{50BFDB3B-9CA8-477E-82FE-D3CD5F58F8C4}) (Version: 9.1.2 - Dassault Systemes)
DesignCAD Light 16.3 (HKLM\...\{B4E6AB20-5DBF-42C3-B67D-5E22C5F51D29}) (Version: 16.3 - IMSI)
DWG TrueView 2013 (HKLM\...\DWG TrueView 2013) (Version: 19.0.55.0 - Autodesk)
DWG TrueView 2013 (Version: 19.0.55.0 - Autodesk) Hidden
DWG TrueView 2014 (Version: 19.1.18.0 - Autodesk) Hidden
eDrawings 2014 (HKLM\...\{81A2E9BB-F9EF-4CF3-84C3-A75E1CE542B6}) (Version: 14.0.5006 - Dassault Systèmes SolidWorks Corp)
ElsterFormular-Upgrade (HKLM\...\ElsterFormular für Unternehmer 12.0.0.5880u) (Version: 15.2.13992 - Landesfinanzdirektion Thüringen)
G Data InternetSecurity CBE (HKLM\...\{85203592-3610-4FB9-AA11-15B2255B5A12}) (Version: 25.0.1.2 - G Data Software AG)
HP USB Disk Storage Format Tool (HKLM\...\{0E0DF90C-D0BA-4C89-9262-AD78D1A3DE51}) (Version: - )
J2SE Runtime Environment 5.0 (HKLM\...\{3248F0A8-6813-11D6-A77B-00B0D0150000}) (Version: 1.5.0 - Sun Microsystems, Inc.)
Java(TM) 6 Update 37 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216037FF}) (Version: 6.0.370 - Oracle)
Malwarebytes Anti-Malware Version 2.1.4.1018 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.4.1018 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.5614.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 24.5.0 - Mozilla)
Mozilla Thunderbird 31.5.0 (x86 de) (HKLM\...\Mozilla Thunderbird 31.5.0 (x86 de)) (Version: 31.5.0 - Mozilla)
NVIDIA 3D Vision Treiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 311.06 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: - )
NVIDIA Grafiktreiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 311.06 - NVIDIA Corporation)
NVIDIA Update 1.11.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.11.3 - NVIDIA Corporation)
OpenSSL 1.0.0l Light (32-bit) (HKLM\...\OpenSSL Light (32-bit)_is1) (Version: - OpenSSL Win32 Installer Team)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 0.9.9 - Frank Heindörfer, Philip Chinery)
Solid Edge 2D Drafting ST6 (HKLM\...\{4DDED18B-9C9C-434B-95FE-CFA9C9EE626F}) (Version: 106.00.02005 - Siemens)
SolidView Lite 2014 (HKLM\...\{7F5CB40E-C3BF-4AAE-A05C-88EC949B9C25}) (Version: 14.0.0131 - Solid Concepts Inc)
STP Viewer 2.3 (HKLM\...\{CECCF8B1-F595-4845-9AA6-1EC57B9BECBA}_is1) (Version: - IdeaMK)
Windows-Treiberpaket - 3D Robotics (usbser) Ports (07/31/2013 2.0.0.3) (HKLM\...\3C34FF4EF99EAC8D565419CDF431F96703771360) (Version: 07/31/2013 2.0.0.3 - 3D Robotics)
Windows-Treiberpaket - Arduino LLC (www.arduino.cc) (usbser) Ports (11/15/2012 5.1.2600.0) (HKLM\...\4414E25DD1DDB3A149E9A6222CA82E070C630A02) (Version: 11/15/2012 5.1.2600.0 - Arduino LLC (www.arduino.cc))
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{08244EE6-92F0-47F2-9FC9-929BAA2E7235}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{36A21736-36C2-4C11-8ACB-D4136F2B57BD}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{3faa4380-a399-11cf-a466-00805fe418f6}\InprocServer32 -> C:\Program Files\Autodesk\DWG TrueView 2013\en-US\dwgviewrficn.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{6A221957-2D85-42A7-8E19-BE33950D1DEB}\localserver32 -> C:\Program Files\Autodesk\DWG TrueView 2013\dwgviewr.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{76D0CB12-7604-4048-B83C-1005C7DDC503}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{A4A1A128-768F-41E0-BF75-E4FDDD701CBA}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{EEFDB0DA-DD97-4F5D-8268-E4C2F6826CE7}\localserver32 -> C:\Program Files\Solid Edge 2D Drafting ST6\Program\PLMVis\Products\JT2Go\VisView.exe (Siemens)
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3764681053-1311214435-963443542-1000_Classes\CLSID\{FFE2A43C-56B9-4BF5-9A79-CC6D4285608A}\InprocServer32 -> No File Path
==================== Restore Points =========================
27-01-2015 16:53:05 Windows Update
03-02-2015 13:13:15 Windows Update
08-02-2015 11:11:28 Windows Update
11-02-2015 17:51:12 Windows Update
12-02-2015 16:36:54 Windows Update
17-02-2015 11:09:06 Windows Update
21-02-2015 15:51:46 Windows Update
25-02-2015 18:39:25 Windows Update
09-03-2015 16:52:35 Geplanter Prüfpunkt
01-04-2015 17:00:24 Windows Update
01-04-2015 18:50:43 Windows Update
02-04-2015 16:56:28 Malwarebytes Anti-Rootkit Restore Point
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:04 - 2013-10-31 11:02 - 00000893 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 www.google-analytics.com
127.0.0.1 google-analytics.com
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {1B441022-AB98-44B1-AF2C-31FC0BC1A1DB} - System32\Tasks\AntiBrowserSpy - BrowserMask => C:\Program Files\AntiBrowserSpy\BrowserMask.exe [2014-01-13] ()
Task: {3A10ACAD-BD9D-48BD-A32E-580D563C4DBA} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-03-18] (Piriform Ltd)
Task: {45B0C38E-87F4-4BE0-A9F2-E5F916340473} - System32\Tasks\{1F61290C-8E0C-4416-AEE5-1CEBB920A1AD} => pcalua.exe -a C:\PROGRA~1\bhv\DRAFTB~1.0\UNWISE32.EXE -c /Z /R C:\PROGRA~1\bhv\DRAFTB~1.0\INSTALL.LOG "DraftBoard Pocket 4.0"
Task: {52994C93-3B9F-45C4-94D6-E7EA53191B89} - System32\Tasks\Registration 1und1 Task => C:\Program Files\1und1Softwareaktualisierung\cdsupdclient.exe [2013-06-18] (1&1 Mail & Media GmbH)
Task: {65D81529-5BD3-4B57-A165-FC90F36CD01F} - System32\Tasks\Norton Internet Security CBE\Norton Error Processor => C:\Program Files\Norton Internet Security CBE\Norton Internet Security CBE\Engine\20.4.0.40\SymErr.exe
Task: {696703F2-9B2C-4E51-B104-D6097FCD4AD9} - System32\Tasks\AntiBrowserSpy - SocialBlock - IE => C:\Program Files\AntiBrowserSpy\AntiBrowserSpy-IE-SocialBlock.exe [2014-01-13] ()
Task: {7C37AA85-98F3-40D9-BE59-EF4EBA7E8931} - System32\Tasks\Norton Internet Security CBE\Norton Error Analyzer => C:\Program Files\Norton Internet Security CBE\Norton Internet Security CBE\Engine\20.4.0.40\SymErr.exe
Task: {B2901578-B14F-404F-A90F-EF3F8A679913} - System32\Tasks\{2750B4D7-494F-428C-8A3C-19B2D344C44C} => C:\Program Files\bhv\DraftBoard Pocket 4.0\DraftBoard.exe [2005-02-28] (Concepts Technology Co., Ltd)
Task: {B8B6A3AE-A707-4734-9541-96D566563C6D} - System32\Tasks\AntiBrowserSpy - SocialBlock - IEProxyCheck => C:\Program Files\AntiBrowserSpy\SocialBlock_ProxyCheck.exe [2014-01-13] ()
Task: {D804DEA6-8DFD-469A-B001-AE7A11787A7C} - System32\Tasks\{B7C30487-AE42-4463-809F-B00DA8DA5F58} => pcalua.exe -a D:\FSetup.exe -d D:\
Task: {FAF08DF0-926A-4597-8AD2-128B0AF1BBF4} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-01] (Adobe Systems Incorporated)
Task: {FCAC9E6F-8017-474A-8237-B4A9CCA74AB7} - System32\Tasks\{E5549D03-68E0-4D25-A30A-ED02F2D126BD} => pcalua.exe -a "C:\Users\Steffen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZNCKPWEY\SE2DDraftV106GERMAN.exe" -d C:\Users\Steffen\Desktop
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) ==============
2012-11-18 17:17 - 2013-01-18 16:20 - 00079648 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax.dll
2010-04-15 15:48 - 2001-10-28 16:42 - 00116224 _____ () C:\Windows\System32\pdfcmnnt.dll
2015-03-27 18:38 - 2014-01-13 11:15 - 00823424 _____ () C:\Program Files\AntiBrowserSpy\BrowserMask.exe
2015-03-27 18:38 - 2014-01-13 11:15 - 00778240 _____ () C:\Program Files\AntiBrowserSpy\SocialBlock_ProxyCheck.exe
2015-03-27 18:38 - 2014-01-13 11:08 - 01136640 _____ () C:\Program Files\AntiBrowserSpy\AntiBrowserSpy-IE-SocialBlock.exe
2013-12-19 04:42 - 2013-12-19 04:42 - 00287864 ____N () C:\Program Files\Common Files\G Data\AVKProxy\PktIcpt2.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Windows\$NtUninstallKB27797$:SummaryInformation
AlternateDataStreams: C:\Users\Steffen\Downloads\Datenblatt für SMC 4100-T2 Schrittmotorcontroller.eml:OECustomProperty
AlternateDataStreams: C:\Users\Steffen\Documents\Angebot.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Steffen\Documents\Angebot.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Steffen\Documents\Centerplatte bemaßt.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Steffen\Documents\Centerplatte bemaßt.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Steffen\Documents\depot.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Steffen\Documents\depot.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Steffen\Documents\Grundsteuer1.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Steffen\Documents\Grundsteuer1.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Steffen\Documents\Grundsteuer2.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Steffen\Documents\Grundsteuer2.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Steffen\Documents\Rente1.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Steffen\Documents\Rente1.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Steffen\Documents\Rente2.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Steffen\Documents\Rente2.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Steffen\Documents\Rente3.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Steffen\Documents\Rente3.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Steffen\Documents\Vertrag Sandra.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Steffen\Documents\Vertrag Sandra.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Steffen\Documents\Vertrag Sandra1.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Steffen\Documents\Vertrag Sandra1.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\15277481.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\16069185.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\15277481.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\16069185.sys => ""="Driver"
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-3764681053-1311214435-963443542-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Steffen\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== Accounts: =============================
Administrator (S-1-5-21-3764681053-1311214435-963443542-500 - Administrator - Disabled)
Gast (S-1-5-21-3764681053-1311214435-963443542-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3764681053-1311214435-963443542-1002 - Limited - Enabled)
Steffen (S-1-5-21-3764681053-1311214435-963443542-1000 - Administrator - Enabled) => C:\Users\Steffen
UpdatusUser (S-1-5-21-3764681053-1311214435-963443542-1003 - Limited - Enabled) => C:\Users\UpdatusUser
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (04/02/2015 04:56:27 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {0e36d2c2-61d9-4a81-97bd-cbf094e4e4cb}
Error: (04/01/2015 04:22:15 PM) (Source: Software Protection Platform Service) (EventID: 1001) (User: )
Description: Fehler beim Starten des Softwareschutzdiensts. 0xD0000022
6.1.7601.17514
Error: (04/01/2015 04:20:20 PM) (Source: GDFwSvc) (EventID: 0) (User: )
Description: Error loading GDPkIcpt (C:\Windows\system32\drivers\PktIcpt.sys): 31
Error: (04/01/2015 04:20:13 PM) (Source: AVKWCtl) (EventID: 0) (User: )
Description: Der Filter Treiber konnte aus dem folgenden Grund nicht gestartet werden: Error loading GDMnIcpt (C:\Windows\system32\drivers\MiniIcpt.sys): 31
Error: (03/31/2015 00:34:35 PM) (Source: Software Protection Platform Service) (EventID: 1001) (User: )
Description: Fehler beim Starten des Softwareschutzdiensts. 0xD0000022
6.1.7601.17514
Error: (03/31/2015 00:32:52 PM) (Source: AVKWCtl) (EventID: 0) (User: )
Description: Der Filter Treiber konnte aus dem folgenden Grund nicht gestartet werden: Error loading GDMnIcpt (C:\Windows\system32\drivers\MiniIcpt.sys): 31
Error: (03/31/2015 00:32:45 PM) (Source: GDFwSvc) (EventID: 0) (User: )
Description: Error loading GDPkIcpt (C:\Windows\system32\drivers\PktIcpt.sys): 31
Error: (03/31/2015 11:23:17 AM) (Source: AVKWCtl) (EventID: 0) (User: )
Description: Der Filter Treiber konnte aus dem folgenden Grund nicht gestartet werden: Error loading GDMnIcpt (C:\Windows\system32\drivers\MiniIcpt.sys): 31
Error: (03/31/2015 11:23:00 AM) (Source: GDFwSvc) (EventID: 0) (User: )
Description: Error loading GDPkIcpt (C:\Windows\system32\drivers\PktIcpt.sys): 31
Error: (03/31/2015 10:47:49 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: EModelViewer.exe, Version: 14.0.0.5006, Zeitstempel: 0x523b68b4
Name des fehlerhaften Moduls: MSVCR100.dll, Version: 10.0.40219.332, Zeitstempel: 0x4e1a9f56
Ausnahmecode: 0x40000015
Fehleroffset: 0x0008d6fd
ID des fehlerhaften Prozesses: 0x3cd8
Startzeit der fehlerhaften Anwendung: 0xEModelViewer.exe0
Pfad der fehlerhaften Anwendung: EModelViewer.exe1
Pfad des fehlerhaften Moduls: EModelViewer.exe2
Berichtskennung: EModelViewer.exe3
System errors:
=============
Error: (04/02/2015 05:02:11 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (04/02/2015 05:02:11 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (04/02/2015 04:23:48 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (04/02/2015 04:23:48 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (04/01/2015 05:19:58 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
Error: (04/01/2015 05:19:58 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
Error: (04/01/2015 05:19:58 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
Error: (04/01/2015 05:19:38 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
Error: (04/01/2015 04:50:49 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (04/01/2015 04:50:49 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Microsoft Office Sessions:
=========================
Error: (04/02/2015 04:56:27 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Zugriff verweigert
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {0e36d2c2-61d9-4a81-97bd-cbf094e4e4cb}
Error: (04/01/2015 04:22:15 PM) (Source: Software Protection Platform Service) (EventID: 1001) (User: )
Description: 0xD00000226.1.7601.17514
Error: (04/01/2015 04:20:20 PM) (Source: GDFwSvc) (EventID: 0) (User: )
Description: Error loading GDPkIcpt (C:\Windows\system32\drivers\PktIcpt.sys): 31
Error: (04/01/2015 04:20:13 PM) (Source: AVKWCtl) (EventID: 0) (User: )
Description: Der Filter Treiber konnte aus dem folgenden Grund nicht gestartet werden: Error loading GDMnIcpt (C:\Windows\system32\drivers\MiniIcpt.sys): 31
Error: (03/31/2015 00:34:35 PM) (Source: Software Protection Platform Service) (EventID: 1001) (User: )
Description: 0xD00000226.1.7601.17514
Error: (03/31/2015 00:32:52 PM) (Source: AVKWCtl) (EventID: 0) (User: )
Description: Der Filter Treiber konnte aus dem folgenden Grund nicht gestartet werden: Error loading GDMnIcpt (C:\Windows\system32\drivers\MiniIcpt.sys): 31
Error: (03/31/2015 00:32:45 PM) (Source: GDFwSvc) (EventID: 0) (User: )
Description: Error loading GDPkIcpt (C:\Windows\system32\drivers\PktIcpt.sys): 31
Error: (03/31/2015 11:23:17 AM) (Source: AVKWCtl) (EventID: 0) (User: )
Description: Der Filter Treiber konnte aus dem folgenden Grund nicht gestartet werden: Error loading GDMnIcpt (C:\Windows\system32\drivers\MiniIcpt.sys): 31
Error: (03/31/2015 11:23:00 AM) (Source: GDFwSvc) (EventID: 0) (User: )
Description: Error loading GDPkIcpt (C:\Windows\system32\drivers\PktIcpt.sys): 31
Error: (03/31/2015 10:47:49 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: EModelViewer.exe14.0.0.5006523b68b4MSVCR100.dll10.0.40219.3324e1a9f56400000150008d6fd3cd801d06b8ed8e77198C:\Program Files\Common Files\eDrawings2014\EModelViewer.exeC:\Windows\system32\MSVCR100.dll9ba24d98-d782-11e4-a0da-00040ec9f7d9
CodeIntegrity Errors:
===================================
Date: 2012-05-06 17:37:55.537
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\wintrust.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-05-06 17:37:55.475
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\wintrust.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-05-06 17:37:55.412
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\wintrust.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-05-06 17:37:55.350
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\wintrust.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-05-06 17:37:55.287
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\wintrust.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-05-06 17:37:55.225
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\wintrust.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-05-06 17:37:55.163
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\wintrust.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-05-06 18:32:59.885
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\wintrust.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-05-06 18:32:59.807
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\wintrust.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-05-06 18:32:59.760
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\wintrust.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: AMD Athlon(tm) 7550 Dual-Core Processor
Percentage of memory in use: 30%
Total physical RAM: 3327.24 MB
Available physical RAM: 2298.55 MB
Total Pagefile: 6652.78 MB
Available Pagefile: 4903.77 MB
Total Virtual: 2047.88 MB
Available Virtual: 1916.27 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:232.79 GB) (Free:188.21 GB) NTFS
Drive e: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 79E5775B)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=232.8 GB) - (Type=07 NTFS)
==================== End Of Log ============================
FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-03-2015 Ran by Steffen (administrator) on STEFFEN-PC on 02-04-2015 17:29:54 Running from C:\Users\Steffen\Downloads Loaded Profiles: Steffen (Available profiles: Steffen & UpdatusUser) Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: IE) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (G Data Software AG) C:\Program Files\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG) C:\Program Files\G Data\InternetSecurity\AVK\AVKWCtl.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (G Data Software AG) C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG) C:\Program Files\G Data\InternetSecurity\AVK\AVKService.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe (G Data Software AG) C:\Program Files\G Data\InternetSecurity\AVKTray\AVKTray.exe () C:\Program Files\AntiBrowserSpy\BrowserMask.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe () C:\Program Files\AntiBrowserSpy\SocialBlock_ProxyCheck.exe () C:\Program Files\AntiBrowserSpy\AntiBrowserSpy-IE-SocialBlock.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (G Data Software AG) C:\Program Files\G Data\InternetSecurity\Firewall\GDFwSvc.exe (AVM Berlin GmbH) C:\Program Files\avmwlanstick\FRITZWLANMini.exe (G Data Software AG) C:\Program Files\G Data\InternetSecurity\DelayLoader\AutorunDelayLoader.exe (Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe (G Data Software AG) C:\Program Files\G Data\InternetSecurity\Firewall\GDFirewallTray.exe (Akamai Technologies, Inc.) C:\Users\Steffen\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.) C:\Users\Steffen\AppData\Local\Akamai\netsession_win.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [AVMWlanClient] => C:\Program Files\avmwlanstick\FRITZWLANMini.exe [323584 2006-04-20] (AVM Berlin GmbH) HKLM\...\Run: [G Data ASM] => C:\Program Files\G Data\InternetSecurity\DelayLoader\AutorunDelayLoader.exe [431224 2013-12-19] (G Data Software AG) HKLM\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [41208 2012-12-19] (Adobe Systems Incorporated) HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [946352 2012-12-03] (Adobe Systems Incorporated) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254696 2011-04-08] (Sun Microsystems, Inc.) HKLM\...\Run: [GDFirewallTray] => C:\Program Files\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1724728 2013-12-19] (G Data Software AG) HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files\G Data\InternetSecurity\AVKTray\AVKTray.exe,c:\program files\g data\internetsecurity\avkkid\avkcks.exe, HKU\S-1-5-19\...\Winlogon: [Shell] C:\Windows\explorer.exe [2616320 2011-02-25] (Microsoft Corporation) <==== ATTENTION HKU\S-1-5-20\...\Winlogon: [Shell] C:\Windows\explorer.exe [2616320 2011-02-25] (Microsoft Corporation) <==== ATTENTION HKU\S-1-5-21-3764681053-1311214435-963443542-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Steffen\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-30] (Akamai Technologies, Inc.) HKU\S-1-5-21-3764681053-1311214435-963443542-1000\...\MountPoints2: G - G:\pushinst.exe HKU\S-1-5-21-3764681053-1311214435-963443542-1000\...\MountPoints2: {27a82824-2466-11df-ad1a-003067031c7a} - G:\pushinst.exe HKU\S-1-5-21-3764681053-1311214435-963443542-1000\...\MountPoints2: {e245abf6-f955-11e3-ab17-003067031c7a} - F:\pushinst.exe HKU\S-1-5-21-3764681053-1311214435-963443542-1000\...\Winlogon: [Shell] C:\Windows\explorer.exe [2616320 2011-02-25] (Microsoft Corporation) <==== ATTENTION HKU\S-1-5-18\...\Winlogon: [Shell] C:\Windows\explorer.exe [2616320 2011-02-25] (Microsoft Corporation) <==== ATTENTION ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll (Autodesk, Inc.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-3764681053-1311214435-963443542-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = HKU\S-1-5-21-3764681053-1311214435-963443542-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-21-3764681053-1311214435-963443542-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp SearchScopes: HKU\S-1-5-21-3764681053-1311214435-963443542-1000 -> {09038620-190C-402B-A92F-18864E6AB22F} URL = hxxp://go.1und1.de/br/ie9_search_web/?su={searchTerms} SearchScopes: HKU\S-1-5-21-3764681053-1311214435-963443542-1000 -> {15A29993-9DCD-469B-8AB5-678C5F72FF3E} URL = SearchScopes: HKU\S-1-5-21-3764681053-1311214435-963443542-1000 -> {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://tbsearch.ask.com/redirect?client=ie&tb=WBG&o=15132&src=crm&q={searchTerms}&locale=de_DE SearchScopes: HKU\S-1-5-21-3764681053-1311214435-963443542-1000 -> {5A817CF6-92D5-4DE5-AC38-82DF8A73EF28} URL = hxxp://go.gmx.net/br/ie9_search_web/?su={searchTerms} SearchScopes: HKU\S-1-5-21-3764681053-1311214435-963443542-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = SearchScopes: HKU\S-1-5-21-3764681053-1311214435-963443542-1000 -> {6B1D1FB7-7233-4F7C-802C-21A1DDB12754} URL = hxxp://go.web.de/br/ie9_search_web/?su={searchTerms} SearchScopes: HKU\S-1-5-21-3764681053-1311214435-963443542-1000 -> {81CE708B-5104-4C62-B333-94B417473B29} URL = hxxp://go.mail.com/br/ie9_search_web/?su={searchTerms} BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-12-18] (Adobe Systems Incorporated) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre6\bin\ssv.dll [2012-11-23] (Sun Microsystems, Inc.) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll [2012-11-23] (Sun Microsystems, Inc.) Toolbar: HKU\S-1-5-21-3764681053-1311214435-963443542-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF Plugin: @java.com/DTPlugin,version=1.6.0_37 -> C:\Windows\system32\npdeployJava1.dll [2012-11-23] (Sun Microsystems, Inc.) FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll [2012-11-23] (Sun Microsystems, Inc.) FF Plugin: @nvidia.com/3DVision -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll [2013-01-18] (NVIDIA Corporation) FF Plugin: @nvidia.com/3DVisionStreaming -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2013-01-18] (NVIDIA Corporation) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll [2013-02-15] (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-3764681053-1311214435-963443542-1000: @autodesk.com/DWF -> C:\Program Files\Autodesk\Autodesk Design Review Browser Add-on v1.2\npADRdwf.dll [2011-01-24] (Autodesk) Chrome: ======= CHR Profile: C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (YouTube) - C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-03-04] CHR Extension: (Google Search) - C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-03-04] CHR Extension: (avast! WebRep) - C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda [2012-03-04] CHR Extension: (Gmail) - C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-03-04] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AVKProxy; C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe [2244728 2014-02-12] (G Data Software AG) R2 AVKService; C:\Program Files\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG) R2 AVKWCtl; C:\Program Files\G Data\InternetSecurity\AVK\AVKWCtl.exe [2159472 2014-03-25] (G Data Software AG) R3 GDFwSvc; C:\Program Files\G Data\InternetSecurity\Firewall\GDFwSvc.exe [2409280 2014-01-30] (G Data Software AG) R3 GDScan; C:\Program Files\Common Files\G Data\GDScan\GDScan.exe [700024 2014-02-03] (G Data Software AG) R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-03-17] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation) R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [264704 2006-04-06] (AVM GmbH) R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [44544 2015-03-27] (G Data Software AG) R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [101504 2015-03-27] (G Data Software AG) R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [56832 2015-03-27] (G Data Software AG) R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd32.sys [53248 2015-03-27] (G Data Software AG) R1 GRD; C:\Windows\system32\drivers\GRD.sys [29528 2015-04-01] (G Data Software) R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [50176 2015-03-27] (G Data Software AG) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-03-17] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2015-04-02] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-03-17] (Malwarebytes Corporation) U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-04-02 16:32 - 2015-04-02 17:29 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2015-04-02 16:30 - 2015-04-02 17:29 - 00000000 ____D () C:\Users\Steffen\Desktop\mbar 2015-04-02 16:28 - 2015-04-02 16:30 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Steffen\Downloads\mbar-1.09.1.1004.exe 2015-04-01 18:54 - 2015-04-01 18:59 - 00000000 ____D () C:\Windows\system32\MRT 2015-04-01 18:25 - 2015-04-01 18:25 - 00001164 _____ () C:\Users\Steffen\Desktop\tdsskiller - Verknüpfung.lnk 2015-04-01 17:08 - 2015-02-13 07:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2015-04-01 17:08 - 2015-02-03 05:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2015-04-01 17:08 - 2015-01-17 04:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll 2015-04-01 17:07 - 2015-02-26 05:11 - 02381312 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-04-01 17:07 - 2015-02-24 04:32 - 00342696 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2015-04-01 17:07 - 2015-02-21 02:41 - 12827648 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-04-01 17:07 - 2015-02-21 02:27 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-04-01 17:07 - 2015-02-21 02:27 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2015-04-01 17:07 - 2015-02-21 02:25 - 19720192 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-04-01 17:07 - 2015-02-21 01:32 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-04-01 17:07 - 2015-02-20 04:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2015-04-01 17:07 - 2015-02-20 04:22 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2015-04-01 17:07 - 2015-02-20 04:09 - 00503296 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-04-01 17:07 - 2015-02-20 04:08 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2015-04-01 17:07 - 2015-02-20 04:08 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2015-04-01 17:07 - 2015-02-20 04:06 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2015-04-01 17:07 - 2015-02-20 04:03 - 02278400 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-04-01 17:07 - 2015-02-20 04:01 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2015-04-01 17:07 - 2015-02-20 04:00 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2015-04-01 17:07 - 2015-02-20 03:58 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2015-04-01 17:07 - 2015-02-20 03:56 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2015-04-01 17:07 - 2015-02-20 03:56 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2015-04-01 17:07 - 2015-02-20 03:56 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2015-04-01 17:07 - 2015-02-20 03:50 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2015-04-01 17:07 - 2015-02-20 03:41 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2015-04-01 17:07 - 2015-02-20 03:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2015-04-01 17:07 - 2015-02-20 03:30 - 04300288 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-04-01 17:07 - 2015-02-20 03:24 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-04-01 17:07 - 2015-02-20 03:24 - 00689152 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-04-01 17:07 - 2015-02-20 03:24 - 00684544 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2015-04-01 17:07 - 2015-02-20 03:23 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2015-04-01 17:07 - 2015-02-20 03:01 - 01888256 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-04-01 17:07 - 2015-02-20 02:57 - 01311232 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-04-01 17:07 - 2015-02-20 02:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2015-04-01 17:06 - 2015-03-06 07:15 - 00137656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2015-04-01 17:06 - 2015-03-06 07:15 - 00067512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2015-04-01 17:06 - 2015-03-06 07:10 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2015-04-01 17:06 - 2015-03-06 07:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2015-04-01 17:06 - 2015-03-06 07:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2015-04-01 17:06 - 2015-03-06 07:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2015-04-01 17:06 - 2015-03-06 07:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2015-04-01 17:06 - 2015-03-06 07:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2015-04-01 17:06 - 2015-03-06 07:10 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2015-04-01 17:06 - 2015-03-06 07:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2015-04-01 17:06 - 2015-03-06 07:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2015-04-01 17:06 - 2015-03-06 07:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2015-04-01 17:06 - 2015-03-06 07:10 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2015-04-01 17:06 - 2015-03-06 07:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe 2015-04-01 17:06 - 2015-03-06 07:09 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2015-04-01 17:06 - 2015-03-06 07:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2015-04-01 17:06 - 2015-03-06 07:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll 2015-04-01 17:06 - 2015-03-06 07:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2015-04-01 17:06 - 2015-02-03 05:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll 2015-04-01 17:05 - 2015-02-20 06:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll 2015-04-01 17:05 - 2015-02-20 06:13 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll 2015-04-01 17:05 - 2015-02-20 06:13 - 00026624 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll 2015-04-01 17:05 - 2015-02-20 06:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll 2015-04-01 17:05 - 2015-02-20 05:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll 2015-04-01 17:05 - 2015-02-04 04:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll 2015-04-01 17:04 - 2015-02-03 05:16 - 03973048 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe 2015-04-01 17:04 - 2015-02-03 05:16 - 03917760 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-04-01 17:04 - 2015-02-03 05:16 - 00078784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys 2015-04-01 17:04 - 2015-02-03 05:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 00475136 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 00157184 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe 2015-04-01 17:04 - 2015-02-03 05:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll 2015-04-01 17:04 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx 2015-04-01 17:04 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll 2015-04-01 17:04 - 2015-02-03 05:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL 2015-04-01 17:04 - 2015-02-03 05:11 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe 2015-04-01 17:04 - 2015-02-03 05:11 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe 2015-04-01 17:04 - 2015-02-03 05:11 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe 2015-04-01 17:04 - 2015-02-03 05:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe 2015-04-01 17:04 - 2015-02-03 05:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe 2015-04-01 17:04 - 2015-02-03 05:11 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe 2015-04-01 17:04 - 2015-02-03 05:11 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe 2015-04-01 17:04 - 2015-02-03 05:11 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe 2015-04-01 17:04 - 2015-02-03 05:10 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll 2015-04-01 17:04 - 2015-02-03 05:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll 2015-04-01 17:04 - 2015-02-03 05:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll 2015-04-01 17:04 - 2015-02-03 05:00 - 00593920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys 2015-04-01 17:04 - 2015-02-03 04:26 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys 2015-04-01 17:04 - 2015-01-31 01:56 - 00370488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2015-04-01 17:04 - 2014-11-01 00:22 - 00521384 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe 2015-04-01 17:04 - 2014-06-28 02:21 - 00455752 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe 2015-04-01 17:04 - 2014-06-28 02:21 - 00409272 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll 2015-04-01 17:03 - 2015-04-01 17:03 - 00015192 _____ (G Data Software) C:\Windows\system32\Drivers\GdPhyMem.sys 2015-04-01 17:02 - 2015-04-01 17:02 - 00029528 _____ (G Data Software) C:\Windows\system32\Drivers\GRD.sys 2015-04-01 16:55 - 2015-01-09 04:48 - 00635904 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll 2015-04-01 16:55 - 2015-01-09 04:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll 2015-04-01 16:55 - 2015-01-09 04:48 - 00027136 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll 2015-04-01 16:46 - 2015-04-01 16:46 - 00000000 ____D () C:\TDSSKiller_Quarantine 2015-04-01 16:31 - 2015-04-01 16:31 - 00048445 _____ () C:\Users\Steffen\Downloads\Shortcut.txt 2015-03-31 12:29 - 2015-03-31 12:30 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Steffen\Downloads\tdsskiller (1).exe 2015-03-31 12:26 - 2015-03-31 12:27 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Steffen\Downloads\tdsskiller.exe 2015-03-31 12:24 - 2015-03-31 12:24 - 00443784 _____ () C:\Users\Steffen\Downloads\Allin1Convert.exe 2015-03-30 13:28 - 2015-04-01 16:31 - 00026359 _____ () C:\Users\Steffen\Downloads\Addition.txt 2015-03-30 13:27 - 2015-03-30 13:27 - 00001106 _____ () C:\Users\Steffen\Desktop\FRST - Verknüpfung.lnk 2015-03-30 13:26 - 2015-04-02 17:30 - 00012050 _____ () C:\Users\Steffen\Downloads\FRST.txt 2015-03-30 13:26 - 2015-04-02 17:29 - 00000000 ____D () C:\FRST 2015-03-30 13:26 - 2015-03-30 13:26 - 01135104 _____ (Farbar) C:\Users\Steffen\Downloads\FRST.exe 2015-03-27 23:42 - 2015-03-27 23:45 - 00000050 _____ () C:\Windows\system32\bridf08b.dat 2015-03-27 23:41 - 2015-03-27 23:41 - 00000000 ____D () C:\ProgramData\Brother 2015-03-27 22:11 - 2015-03-27 22:11 - 311218386 _____ () C:\Windows\MEMORY.DMP 2015-03-27 22:11 - 2015-03-27 22:11 - 00143800 _____ () C:\Windows\Minidump\032715-18798-01.dmp 2015-03-27 21:00 - 2015-04-02 17:02 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-03-27 21:00 - 2015-04-02 17:00 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-03-27 21:00 - 2015-03-27 21:10 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2015-03-27 21:00 - 2015-03-27 21:00 - 00001060 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-03-27 21:00 - 2015-03-27 21:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-03-27 21:00 - 2015-03-27 21:00 - 00000000 ____D () C:\ProgramData\Malwarebytes 2015-03-27 21:00 - 2015-03-17 07:15 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-03-27 21:00 - 2015-03-17 07:15 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-03-27 20:57 - 2015-03-27 21:00 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Steffen\Downloads\mbam-setup-2.1.4.1018 (1).exe 2015-03-27 20:47 - 2015-04-02 16:59 - 00014522 _____ () C:\Windows\PFRO.log 2015-03-27 20:47 - 2015-04-02 16:59 - 00001064 _____ () C:\Windows\setupact.log 2015-03-27 20:47 - 2015-03-27 20:47 - 00000000 _____ () C:\Windows\setuperr.log 2015-03-27 20:03 - 2015-04-02 17:03 - 01052213 _____ () C:\Windows\WindowsUpdate.log 2015-03-27 20:00 - 2015-03-27 20:00 - 00003520 _____ () C:\Users\Steffen\Documents\cc_20150327_190017.reg 2015-03-27 19:36 - 2015-03-27 19:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity CBE 2015-03-27 19:28 - 2015-03-27 19:28 - 00002008 _____ () C:\Users\Public\Desktop\G Data InternetSecurity CBE.lnk 2015-03-27 19:25 - 2015-03-27 19:25 - 00056832 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys 2015-03-27 19:22 - 2015-03-27 19:22 - 00053248 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd32.sys 2015-03-27 19:21 - 2015-03-27 19:21 - 00101504 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys 2015-03-27 19:21 - 2015-03-27 19:21 - 00050176 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys 2015-03-27 19:21 - 2015-03-27 19:21 - 00044544 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys 2015-03-27 19:19 - 2015-03-27 19:19 - 00000000 ____D () C:\Program Files\Common Files\G Data 2015-03-27 18:38 - 2015-03-27 18:38 - 00001037 _____ () C:\Users\Public\Desktop\AntiBrowserSpy.lnk 2015-03-27 18:38 - 2015-03-27 18:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AntiBrowserSpy 2015-03-19 13:43 - 2015-03-19 13:43 - 00000000 ____D () C:\Users\Steffen\AppData\Local\Solid Concepts Inc 2015-03-19 13:42 - 2015-03-19 13:42 - 00002171 _____ () C:\Users\Public\Desktop\SolidView Lite 2014.lnk 2015-03-19 13:42 - 2015-03-19 13:42 - 00000000 ____D () C:\ProgramData\Solid Concepts Inc 2015-03-19 13:42 - 2015-03-19 13:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Solid Concepts Inc 2015-03-19 13:42 - 2015-03-19 13:42 - 00000000 ____D () C:\Program Files\Solid Concepts Inc 2015-03-19 12:55 - 2015-03-19 13:41 - 163663800 _____ (Solid Concepts Inc) C:\Users\Steffen\Downloads\svlite_2014v0_x86.exe 2015-03-09 17:44 - 2015-03-09 17:48 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird 2015-03-09 17:35 - 2015-03-09 17:35 - 00057337 _____ () C:\Users\Steffen\Downloads\Drehteile (2).zip ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-04-02 17:07 - 2010-02-28 14:47 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-04-02 17:07 - 2009-07-14 06:34 - 00022368 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-04-02 17:07 - 2009-07-14 06:34 - 00022368 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-04-02 16:59 - 2012-11-18 17:18 - 00000000 ____D () C:\ProgramData\NVIDIA 2015-04-02 16:59 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-04-02 16:56 - 2009-07-14 04:37 - 00000000 _SHDC () C:\Windows\$NtUninstallKB27797$ 2015-04-02 16:21 - 2009-07-14 06:33 - 00457344 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-04-01 18:59 - 2009-07-14 04:37 - 00000000 ___HD () C:\Windows\tracing 2015-04-01 18:59 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE 2015-04-01 18:54 - 2010-03-08 18:14 - 119837696 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-04-01 17:29 - 2014-06-20 18:40 - 00000000 ____D () C:\Users\Steffen\AppData\Local\Adobe 2015-04-01 17:27 - 2012-07-27 16:04 - 00778928 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2015-04-01 17:27 - 2011-06-08 12:30 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2015-04-01 16:50 - 2014-05-08 19:09 - 00000000 ____D () C:\ProgramData\G Data 2015-03-31 10:48 - 2013-07-20 09:16 - 00000000 ____D () C:\Users\Steffen\AppData\Local\CrashDumps 2015-03-28 16:09 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\LogFiles 2015-03-27 23:45 - 2013-03-08 13:01 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information 2015-03-27 23:45 - 2010-08-07 16:25 - 00000000 ____D () C:\Program Files\Brother 2015-03-27 23:21 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Globalization 2015-03-27 22:33 - 2014-07-22 18:17 - 00000000 ____D () C:\Users\Steffen\Downloads\Neuer Ordner 2015-03-27 22:18 - 2010-11-07 13:25 - 00498176 ___SH () C:\Users\Steffen\Documents\Thumbs.db 2015-03-27 22:11 - 2010-04-07 12:10 - 00000000 ____D () C:\Windows\Minidump 2015-03-27 21:11 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Web 2015-03-27 19:55 - 2012-09-03 08:32 - 00000000 ____D () C:\Program Files\AntiBrowserSpy 2015-03-27 19:21 - 2014-05-08 20:11 - 00001558 _____ () C:\Users\Steffen\AppData\Roaming\gdscan.log 2015-03-27 19:19 - 2014-05-08 20:10 - 00000000 ____D () C:\Program Files\G Data 2015-03-27 18:37 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\spool 2015-03-27 18:34 - 2009-07-14 06:52 - 00000000 ____D () C:\Windows\system32\WinBioPlugIns 2015-03-27 18:34 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\winevt 2015-03-27 18:34 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\SMI 2015-03-27 18:34 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\MUI 2015-03-27 18:34 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\com 2015-03-27 18:12 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\wfp 2015-03-27 18:12 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\registration 2015-03-09 22:23 - 2012-12-17 18:51 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service 2015-03-09 17:48 - 2015-01-20 13:28 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird.bak 2015-03-09 16:54 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache ==================== Files in the root of some directories ======= 2012-05-23 17:35 - 2012-09-03 09:24 - 0000048 _____ () C:\Users\Steffen\AppData\Roaming\AcroIEHelpe.txt 2012-08-26 13:44 - 2012-09-03 10:06 - 0000017 _____ () C:\Users\Steffen\AppData\Roaming\blckdom.res 2014-05-08 20:11 - 2014-05-08 20:11 - 0000000 _____ () C:\Users\Steffen\AppData\Roaming\gdfw.log 2014-05-08 20:11 - 2015-03-27 19:21 - 0001558 _____ () C:\Users\Steffen\AppData\Roaming\gdscan.log 2012-05-23 17:35 - 2012-05-23 17:35 - 0000264 _____ () C:\Users\Steffen\AppData\Roaming\srvblck5.tmp 2014-10-20 17:22 - 2014-10-20 17:22 - 0004096 ____H () C:\Users\Steffen\AppData\Local\keyfile3.drm 2014-05-08 19:55 - 2014-09-13 15:31 - 0007597 _____ () C:\Users\Steffen\AppData\Local\Resmon.ResmonCfg 2012-09-03 08:55 - 2012-09-03 08:55 - 0017408 _____ () C:\Users\Steffen\AppData\Local\WebpageIcons.db 2012-08-11 11:10 - 2012-08-11 11:38 - 4503728 ____T () C:\ProgramData\00etadpu.pad 2013-12-19 17:18 - 2013-12-19 17:20 - 95025368 ____T () C:\ProgramData\8odwoemq.fee 2013-12-19 17:18 - 2013-12-19 17:18 - 0000000 _____ () C:\ProgramData\8odwoemq.odd 2013-10-29 12:00 - 2013-10-29 12:02 - 95025368 ____T () C:\ProgramData\8zwwlhrq.bxx 2013-10-29 12:00 - 2013-10-29 12:00 - 0000000 _____ () C:\ProgramData\8zwwlhrq.fvv 2013-10-30 13:48 - 2013-10-30 13:49 - 95025368 ____T () C:\ProgramData\9oj69hf.bxx 2013-10-30 13:48 - 2013-10-30 13:48 - 0000000 _____ () C:\ProgramData\9oj69hf.fvv 2012-06-15 10:17 - 2012-06-15 10:17 - 4503728 ____T () C:\ProgramData\c_0_lpt.pad 2012-08-20 12:29 - 2012-08-20 12:30 - 4503728 ____T () C:\ProgramData\ism_0_llatsni.pad 2013-10-28 13:51 - 2013-10-28 13:53 - 95025368 ____T () C:\ProgramData\lzjb8av.bxx 2013-10-28 13:51 - 2013-10-28 13:51 - 0000000 _____ () C:\ProgramData\lzjb8av.fvv 2012-09-03 08:22 - 2012-09-03 08:23 - 4503728 ____T () C:\ProgramData\nud0repor.pad 2012-08-06 11:13 - 2012-08-06 11:14 - 4503728 ____T () C:\ProgramData\rat_0ybba.pad 2012-01-03 18:00 - 2012-01-03 18:04 - 0000440 ____H () C:\ProgramData\UeBUrRTJiwSDHt 2012-07-24 17:39 - 2012-07-24 17:40 - 4503728 ____T () C:\ProgramData\z7_0ytr.pad 2012-01-03 18:09 - 2012-01-03 18:09 - 0000296 _____ () C:\ProgramData\~UeBUrRTJiwSDHt 2012-01-03 18:09 - 2012-01-03 18:09 - 0000200 _____ () C:\ProgramData\~UeBUrRTJiwSDHtr ZeroAccess: C:\Users\Steffen\AppData\Local\{b3143e40-0149-157c-ba8a-29adcc6cabbe} C:\Users\Steffen\AppData\Local\{b3143e40-0149-157c-ba8a-29adcc6cabbe}\@ C:\Users\Steffen\AppData\Local\{b3143e40-0149-157c-ba8a-29adcc6cabbe}\L\00000004.@ C:\Users\Steffen\AppData\Local\{b3143e40-0149-157c-ba8a-29adcc6cabbe}\L\1afb2d56 C:\Users\Steffen\AppData\Local\{b3143e40-0149-157c-ba8a-29adcc6cabbe}\L\55490ac4 Files to move or delete: ==================== C:\ProgramData\00etadpu.pad C:\ProgramData\8odwoemq.fee C:\ProgramData\8odwoemq.odd C:\ProgramData\8zwwlhrq.bxx C:\ProgramData\8zwwlhrq.fvv C:\ProgramData\9oj69hf.bxx C:\ProgramData\9oj69hf.fvv C:\ProgramData\c_0_lpt.pad C:\ProgramData\ism_0_llatsni.pad C:\ProgramData\lzjb8av.bxx C:\ProgramData\lzjb8av.fvv C:\ProgramData\nud0repor.pad C:\ProgramData\rat_0ybba.pad C:\ProgramData\z7_0ytr.pad ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-03-19 11:19 ==================== End Of Log ============================ --- --- --- --- --- --- Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.09.1.1004
www.malwarebytes.org
Database version:
main: v2015.04.02.04
rootkit: v2015.03.31.01
Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 11.0.9600.17691
Steffen :: STEFFEN-PC [administrator]
02.04.2015 17:03:20
mbar-log-2015-04-02 (17-03-20).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 342600
Time elapsed: 24 minute(s), 28 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)
|
| Themen zu G data blockiert , keine Systemwiederherstellung möglich , Taskmanager funktioniert nicht |
| angeblich, ausführen, blockiert, data, ellung, funktionier, funktioniert, funktioniert nicht, g data, installier, installiert, kurzem, link, mail, neuinstallierung, nicht mehr, ratlos, rechner, retten, rätsel, sperrt, starte, systemwiederherstellung, taskma, taskmanager |
Baum-Darstellung