| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Win 8.1 64bit, Firefox & IE: Webadresse wird automatisch weitergeleitet getallmysocks.tk / benaughty.comWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
25.05.2015, 05:05
| #1 |
| |  Win 8.1 64bit, Firefox & IE: Webadresse wird automatisch weitergeleitet getallmysocks.tk / benaughty.com Hallo Trojaner-Board, seit gestern wird bei Eingabe einer bestimmten, aber seriösen Webadresse automatisch nach 1-2 Sekunden auf eine andere Webadresse umgeleitet (getallmysocks.tk / benaughty.com). Dies passiert sowhl im Firefox als auch im IE. Die Suche bei Google hatte einige Einträge bei BeNaughty virus ergeben. Die Scans mit verschiedenen Tools (MBAM, ESET OS, YAC, Spybot, etc.) waren in dieser Hinsicht eher unauffällig. Für jede Hilfe wäre ich dankbar. Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 24-05-2015 01
Ran by a.berndt (administrator) on TSVTM-NB-002 on 25-05-2015 06:02:12
Running from D:\PRG\_HP_Neuinstallation
Loaded Profiles: a.berndt (Available Profiles: Dessau & a.berndt)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\avmike.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\certsrv.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Foxit Software Inc.) C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(arvato digital services llc) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(ATI Technologies Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
(Raptr, Inc) C:\Program Files (x86)\Raptr\raptr.exe
(Raptr, Inc) C:\Program Files (x86)\Raptr\raptr_im.exe
(Raptr Inc.) C:\Program Files (x86)\Raptr\raptr_ep64.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Ritlabs, SRL) C:\Program Files (x86)\The Bat!\TheBat.exe
(Elex do Brasil Participações Ltda) C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe
(Elex do Brasil Participações Ltda) C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc2.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_188.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_188.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916152 2012-08-28] (Synaptics Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2014-11-20] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Raptr] => C:\Program Files (x86)\Raptr\raptrstub.exe [55568 2015-05-15] (Raptr, Inc)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [193568 2014-11-28] (Geek Software GmbH)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled
ProxyServer: [.DEFAULT] => http=127.0.0.1:60796;https=127.0.0.1:60796
HKU\S-1-5-21-1650800468-923342087-4115340913-1004\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-05-06] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-05-06] (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\a.berndt\AppData\Roaming\Mozilla\Firefox\Profiles\996guxg5.default-1432498293392
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-24] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-09-23] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-24] ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2014-09-11] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2014-09-11] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2014-09-11] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2014-09-11] (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-06] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-06] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
FF Extension: Video DownloadHelper - C:\Users\a.berndt\AppData\Roaming\Mozilla\Firefox\Profiles\996guxg5.default-1432498293392\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2015-05-25]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 avmike; C:\Program Files\FRITZ!Fernzugang\avmike.exe [337824 2012-11-28] (AVM Berlin)
R2 certsrv; C:\Program Files\FRITZ!Fernzugang\certsrv.exe [143776 2012-11-28] (AVM Berlin)
R2 FoxitCloudUpdateService; C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [244392 2015-05-11] (Foxit Software Inc.)
S3 hpqwmiex; C:\Users\a.berndt\AppData\Roaming\Hewlett-Packard\hpqwmiex.exe [794112 2015-02-01] (Hewlett-Packard Company) []
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89864 2014-12-11] (Hewlett-Packard Company)
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2451456 2012-07-14] (Realsil Microelectronics Inc.) []
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [319080 2015-01-08] (Intel Corporation)
R2 iSafeService; C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe [118048 2015-05-21] (Elex do Brasil Participações Ltda)
S4 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 nwtsrv; C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe [191328 2013-06-10] (AVM Berlin)
R2 PSI_SVC_2_x64; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [336824 2010-11-30] (arvato digital services llc)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [62152 2014-10-28] (Advanced Micro Devices, Inc.)
R0 hotcore3; C:\Windows\System32\DRIVERS\hotcore3.sys [34056 2013-12-05] (Paragon Software Group)
R1 iSafeKrnl; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnl.sys [260856 2015-05-21] (Elex do Brasil Participações Ltda)
S3 iSafeKrnlBoot; C:\Windows\System32\DRIVERS\iSafeKrnlBoot.sys [53568 2015-05-21] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlKit; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlKit.sys [108616 2015-05-21] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlMon; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys [50944 2015-05-21] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlR3; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlR3.sys [102416 2015-05-21] (Elex do Brasil Participações Ltda)
R1 iSafeNetFilter; C:\Windows\System32\DRIVERS\iSafeNetFilter.sys [52392 2015-04-17] (Elex do Brasil Participações Ltda)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)
R3 NWIM; C:\Windows\system32\DRIVERS\avmnwim.sys [412024 2011-07-05] (AVM Berlin)
S3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [269968 2012-07-04] (Realtek Semiconductor Corp.)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20288 2012-08-03] (Hewlett-Packard Development Company, L.P.)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-05-25 06:02 - 2015-05-25 06:02 - 00000000 ____D () C:\FRST
2015-05-25 05:03 - 2015-05-25 05:03 - 00000000 ____D () C:\Windows\system32\log
2015-05-25 05:03 - 2015-05-21 10:52 - 00053568 _____ (Elex do Brasil Participações Ltda) C:\Windows\system32\Drivers\iSafeKrnlBoot.sys
2015-05-25 05:03 - 2015-04-17 04:43 - 00052392 _____ (Elex do Brasil Participações Ltda) C:\Windows\system32\Drivers\iSafeNetFilter.sys
2015-05-25 05:02 - 2015-05-25 05:02 - 00001930 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\YAC.lnk
2015-05-25 05:02 - 2015-05-25 05:02 - 00001924 _____ () C:\Users\Public\Desktop\YAC.lnk
2015-05-25 05:02 - 2015-05-25 05:02 - 00000000 ____D () C:\Users\a.berndt\AppData\Roaming\Elex-tech
2015-05-25 05:02 - 2015-05-25 05:02 - 00000000 ____D () C:\Users\a.berndt\AppData\Roaming\eCyber
2015-05-25 05:02 - 2015-05-25 05:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YAC
2015-05-25 05:02 - 2015-05-25 05:02 - 00000000 ____D () C:\Program Files (x86)\Elex-tech
2015-05-25 04:49 - 2015-05-25 04:49 - 00000000 ____D () C:\Users\a.berndt\Documents\ProcAlyzer Dumps
2015-05-25 01:56 - 2015-05-25 04:48 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-05-25 01:56 - 2015-05-25 01:58 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-05-25 01:56 - 2015-05-25 01:56 - 00001409 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-05-25 01:56 - 2015-05-25 01:56 - 00001397 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2015-05-25 01:56 - 2015-05-25 01:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-05-25 01:56 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2015-05-24 22:11 - 2015-05-24 22:11 - 00000000 ____D () C:\Users\a.berndt\Desktop\Alte Firefox-Daten
2015-05-24 20:11 - 2015-05-24 20:11 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-05-24 02:46 - 2015-05-24 02:46 - 00000000 ____D () C:\ProgramData\McAfee
2015-05-24 01:54 - 2015-05-25 05:43 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-24 01:54 - 2015-05-24 01:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-05-24 01:54 - 2015-05-24 01:54 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-05-24 01:54 - 2015-05-24 01:54 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-05-24 01:54 - 2015-04-14 09:38 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-05-24 01:54 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-05-24 01:54 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-05-21 07:11 - 2015-05-21 07:11 - 06448912 _____ (Tim Kosse) C:\Users\a.berndt\Downloads\FileZilla_3.11.0_win64-setup.exe
2015-05-18 16:47 - 2015-05-18 16:47 - 00010652 _____ () C:\Users\a.berndt\AppData\Local\recently-used.xbel
2015-05-15 17:31 - 2015-05-15 17:31 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-04-30 06:26 - 2015-04-30 06:26 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2015-04-30 05:10 - 2015-04-30 05:12 - 00000000 ____D () C:\Users\a.berndt\AppData\Local\CAO-FAKTURA
2015-04-30 04:26 - 2015-04-30 04:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CAO-FAKTURA
2015-04-30 04:26 - 2006-03-27 19:59 - 00046080 _____ () C:\Windows\SysWOW64\rbide.fra
2015-04-30 04:26 - 2006-03-27 19:59 - 00046080 _____ () C:\Windows\SysWOW64\rbide.esp
2015-04-30 04:26 - 2006-03-27 19:59 - 00045056 _____ () C:\Windows\SysWOW64\rbide.ita
2015-04-30 04:26 - 2006-03-27 19:59 - 00040448 _____ () C:\Windows\SysWOW64\rbide.eng
2015-04-30 04:26 - 2006-03-27 19:59 - 00040448 _____ () C:\Windows\SysWOW64\rbide.cst
2015-04-30 04:26 - 2006-03-27 19:59 - 00024576 _____ () C:\Windows\SysWOW64\rbprint.fra
2015-04-30 04:26 - 2006-03-27 19:59 - 00023552 _____ () C:\Windows\SysWOW64\rbprint.ita
2015-04-30 04:26 - 2006-03-27 19:59 - 00023552 _____ () C:\Windows\SysWOW64\rbprint.esp
2015-04-30 04:26 - 2006-03-27 19:59 - 00022016 _____ () C:\Windows\SysWOW64\rbprint.eng
2015-04-30 04:26 - 2006-03-27 19:59 - 00022016 _____ () C:\Windows\SysWOW64\rbprint.cst
2015-04-30 04:26 - 2006-03-27 19:59 - 00021504 _____ () C:\Windows\SysWOW64\rbDADE.fra
2015-04-30 04:26 - 2006-03-27 19:59 - 00020992 _____ () C:\Windows\SysWOW64\rbDADE.esp
2015-04-30 04:26 - 2006-03-27 19:59 - 00020480 _____ () C:\Windows\SysWOW64\rbDADE.ita
2015-04-30 04:26 - 2006-03-27 19:59 - 00019968 _____ () C:\Windows\SysWOW64\rbDADE.eng
2015-04-30 04:26 - 2006-03-27 19:59 - 00017920 _____ () C:\Windows\SysWOW64\rbRAP.ita
2015-04-30 04:26 - 2006-03-27 19:59 - 00017920 _____ () C:\Windows\SysWOW64\rbRAP.fra
2015-04-30 04:26 - 2006-03-27 19:59 - 00017920 _____ () C:\Windows\SysWOW64\rbRAP.esp
2015-04-30 04:26 - 2006-03-27 19:59 - 00017408 _____ () C:\Windows\SysWOW64\rbRAP.eng
2015-04-30 04:26 - 2006-03-27 19:59 - 00017408 _____ () C:\Windows\SysWOW64\rbRAP.cst
2015-04-30 04:26 - 2006-03-27 18:59 - 00047616 _____ () C:\Windows\SysWOW64\rbide.deu
2015-04-30 04:26 - 2006-03-27 18:59 - 00023552 _____ () C:\Windows\SysWOW64\rbprint.deu
2015-04-30 04:26 - 2006-03-27 18:59 - 00021504 _____ () C:\Windows\SysWOW64\rbDADE.deu
2015-04-30 04:26 - 2006-03-27 18:59 - 00017920 _____ () C:\Windows\SysWOW64\rbRAP.deu
2015-04-30 04:24 - 2015-04-30 05:12 - 00000000 ____D () C:\Program Files (x86)\CAO-Faktura
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-05-25 06:02 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\sru
2015-05-25 05:31 - 2015-02-12 05:16 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-25 03:57 - 2015-02-01 00:13 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1650800468-923342087-4115340913-1004
2015-05-25 01:38 - 2015-02-04 06:58 - 00003958 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{2E0E0009-6A8B-4D01-A714-C8828DBBDE34}
2015-05-25 01:37 - 2015-01-19 10:00 - 01504364 _____ () C:\Windows\WindowsUpdate.log
2015-05-24 22:36 - 2015-02-01 08:43 - 00000000 ____D () C:\Users\a.berndt\AppData\Roaming\Raptr
2015-05-24 22:34 - 2013-08-22 16:46 - 00032202 _____ () C:\Windows\setupact.log
2015-05-24 22:34 - 2013-08-22 16:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-24 22:33 - 2015-02-15 20:42 - 00000000 ____D () C:\AdwCleaner
2015-05-24 22:17 - 2015-01-30 05:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-24 22:17 - 2014-09-23 23:06 - 00009038 _____ () C:\Windows\PFRO.log
2015-05-24 22:17 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2015-05-24 20:48 - 2015-02-01 00:17 - 00000000 ____D () C:\Users\a.berndt\AppData\Roaming\vlc
2015-05-24 02:46 - 2015-02-12 05:16 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-05-24 02:46 - 2015-02-01 03:51 - 00000000 ____D () C:\Users\a.berndt\AppData\Local\Adobe
2015-05-24 02:34 - 2014-09-24 08:17 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-24 02:34 - 2014-09-24 07:43 - 00765582 _____ () C:\Windows\system32\perfh007.dat
2015-05-24 02:34 - 2014-09-24 07:43 - 00159366 _____ () C:\Windows\system32\perfc007.dat
2015-05-24 02:30 - 2015-02-01 08:43 - 00000000 ____D () C:\Program Files (x86)\Raptr
2015-05-24 02:28 - 2015-04-21 15:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox.bak
2015-05-23 03:51 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\FxsTmp
2015-05-22 00:34 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-05-21 07:29 - 2015-02-01 00:15 - 00000000 ____D () C:\Users\a.berndt\AppData\Roaming\FileZilla
2015-05-20 01:36 - 2013-08-22 17:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-05-14 15:47 - 2015-02-03 11:59 - 00000000 ____D () C:\Users\a.berndt\AppData\Roaming\foobar2000
2015-05-12 02:25 - 2015-02-03 17:39 - 00000000 ____D () C:\Users\a.berndt\AppData\Local\Microsoft Help
2015-05-07 06:40 - 2015-02-15 19:31 - 00000000 ____D () C:\Users\a.berndt\AppData\Roaming\MyPhoneExplorer
2015-05-06 13:51 - 2015-02-01 02:47 - 00000000 ____D () C:\ProgramData\Oracle
2015-05-06 13:51 - 2015-02-01 02:47 - 00000000 ____D () C:\Program Files (x86)\Java
2015-05-06 13:50 - 2015-02-01 02:48 - 00097888 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-04-30 04:24 - 2015-02-01 00:07 - 00000000 ____D () C:\Users\a.berndt\AppData\Local\VirtualStore
2015-04-29 04:24 - 2015-03-21 17:32 - 00000000 ____D () C:\Program Files (x86)\phase5
2015-04-27 04:01 - 2015-04-06 20:59 - 00000000 ____D () C:\Users\a.berndt\AppData\Roaming\avidemux
2015-04-26 00:03 - 2015-02-07 19:44 - 00000000 ____D () C:\Users\a.berndt\AppData\Roaming\dvdcss
==================== Files in the root of some directories =======
2015-05-18 16:47 - 2015-05-18 16:47 - 0010652 _____ () C:\Users\a.berndt\AppData\Local\recently-used.xbel
2015-04-08 02:13 - 2015-04-08 02:13 - 0007597 _____ () C:\Users\a.berndt\AppData\Local\Resmon.ResmonCfg
Some files in TEMP:
====================
C:\Users\a.berndt\AppData\Local\Temp\AutoDetectUtilApp.exe
C:\Users\a.berndt\AppData\Local\Temp\jre-8u45-windows-au.exe
C:\Users\a.berndt\AppData\Local\Temp\Quarantine.exe
C:\Users\a.berndt\AppData\Local\Temp\raptrpatch.exe
C:\Users\a.berndt\AppData\Local\Temp\raptr_stub.exe
C:\Users\a.berndt\AppData\Local\Temp\sdanircmdc.exe
C:\Users\a.berndt\AppData\Local\Temp\sdapskill.exe
C:\Users\a.berndt\AppData\Local\Temp\sdaspwn.exe
C:\Users\a.berndt\AppData\Local\Temp\sqlite3.dll
C:\Users\Dessau\AppData\Local\Temp\gkey.exe
C:\Users\Dessau\AppData\Local\Temp\pkeyui.exe
C:\Users\Dessau\AppData\Local\Temp\wabk.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-05-17 22:11
==================== End of log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-05-2015 01
Ran by a.berndt at 2015-05-25 06:02:46
Running from D:\PRG\_HP_Neuinstallation
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
a.berndt (S-1-5-21-1650800468-923342087-4115340913-1004 - Administrator - Enabled) => C:\Users\a.berndt
Administrator (S-1-5-21-1650800468-923342087-4115340913-500 - Administrator - Disabled)
Dessau (S-1-5-21-1650800468-923342087-4115340913-1001 - Administrator - Enabled) => C:\Users\Dessau
Gast (S-1-5-21-1650800468-923342087-4115340913-501 - Limited - Disabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.188 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{F2A7CE36-57BF-5C86-952D-90DBF3746D82}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
Avidemux 2.6 - 64bits (HKLM-x32\...\Avidemux 2.6 - 64bits (64-bit)) (Version: 2.6.8.9046 - )
Blender (HKLM\...\Blender) (Version: 2.74 - Blender Foundation)
CAO-Faktura 1.4 (HKLM-x32\...\{2121BEF3-F102-4B7F-B5CF-A5299DAADA25}_is1) (Version: 1.4.1.8 - JP-Soft/AVE-Raßmann)
Corel Graphics - Windows Shell Extension (HKLM\...\_{2CDF0D0A-C58C-4136-9978-F029B2723B0D}) (Version: 16.4.0.1280 - Corel Corporation)
Corel Graphics - Windows Shell Extension (Version: 16.4.1280 - Corel Corporation) Hidden
Corel Graphics - Windows Shell Extension 32 Bit (Version: 16.4.1280 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X6 - Capture (x64) (Version: 16.6 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X6 - Common (x64) (Version: 16.6 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X6 - Connect (x64) (Version: 16.6 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X6 - Custom Data (x64) (Version: 16.6 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X6 - DE (x64) (Version: 16.6 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X6 - Draw (x64) (Version: 16.6 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X6 - Filters (x64) (Version: 16.6 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X6 - FontNav (x64) (Version: 16.2 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X6 - IPM (Version: 16.1 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X6 - IPM (Version: 16.6 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X6 - PHOTO-PAINT (x64) (Version: 16.6 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X6 - Photozoom Plugin (x64) (Version: 16.6 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X6 - Redist (x64) (Version: 16.1 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X6 - Setup Files (x64) (Version: 16.6 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X6 - VBA (x64) (Version: 16.6 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X6 - VideoBrowser (x64) (Version: 16.6 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X6 - VSTA (x64) (Version: 16.6 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X6 - Writing Tools (x64) (Version: 16.6 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X6 (64-Bit) (HKLM\...\_{BDBFAC49-8877-472F-876B-75ADB7DBC955}) (Version: 16.4.0.1280 - Corel Corporation)
CorelDRAW Graphics Suite X6 (x64) (Version: 16.6 - Corel Corporation) Hidden
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
FileZilla Client 3.10.1.1 (HKLM-x32\...\FileZilla Client) (Version: 3.10.1.1 - Tim Kosse)
foobar2000 v1.3.7 (HKLM-x32\...\foobar2000) (Version: 1.3.7 - Peter Pawlowski)
Foxit Cloud (HKLM-x32\...\{41914D8B-9D6E-4764-A1F9-BC43FB6782C1}_is1) (Version: 3.4.96.511 - Foxit Software Inc.)
Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 7.0.8.1216 - Foxit Software Inc.)
FRITZ!Box-Fernzugang einrichten (HKLM-x32\...\{EFADD989-D9F2-49F6-A280-675951CC78D3}) (Version: 1.0.3 - AVM Berlin)
FRITZ!Fernzugang (HKLM\...\{DD57CC22-8864-4CCA-94D4-600D024C1207}) (Version: 1.3.1 - AVM Berlin)
Ghostscript GPL 8.64 (Msi Setup) (HKLM-x32\...\_{06CD45E6-FF5E-4D8E-BC01-B276A90DADF2}) (Version: 8.64 - Corel Corporation)
Ghostscript GPL 8.64 (Msi Setup) (x32 Version: 8.64 - Corel Corporation) Hidden
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.15) (Version: 9.15 - Artifex Software Inc.)
HP 3D DriveGuard (HKLM\...\{AB5BCC55-18E2-46C7-9405-FF61CB888F05}) (Version: 4.2.9.1 - Hewlett-Packard Company)
HP Support Solutions Framework (HKLM-x32\...\{96D12EC9-720B-45FB-904C-36D6307A1C76}) (Version: 11.51.0048 - Hewlett-Packard Company)
HP Wireless Button Driver (HKLM-x32\...\{941DE69D-6CEE-4171-8F1F-3D7E352AA498}) (Version: 1.0.5.1 - Hewlett-Packard Company)
Intel(R) C++ Redistributables for Windows* on Intel(R) 64 (HKLM-x32\...\{D2437C5C-2D8C-40D2-8059-689AD7239FA3}) (Version: 11.1.048 - Intel Corporation)
Intel(R) Driver Update Utility 2.0 (x32 Version: 2.0.0.29 - Intel) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4061 - Intel Corporation)
Intel® Driver Update Utility (HKLM-x32\...\{8409c4f7-2340-4933-a304-5d37db4fb48b}) (Version: 2.0.0.29 - Intel)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
Licensing Service (03000201) (x32 Version: 03.00.02.15 - Protexis Inc.) Hidden
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022.218 (HKLM\...\{BBBE35B2-9349-3C48-BD3D-F574B17C7924}) (Version: 9.0.21022.218 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{cb41fc68-4442-4f7f-b22f-8f31c74897ac}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Mozilla Firefox 38.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.1 (x86 de)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 31.4.0 - Mozilla)
Mozilla Thunderbird 31.4.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.4.0 (x86 de)) (Version: 31.4.0 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MyPhoneExplorer (HKLM-x32\...\MPE) (Version: 1.8.6 - F.J. Wechselberger)
Paragon Partition Manager™ 2014 Free (HKLM-x32\...\{47E5588F-C3A0-11DE-9857-005056C00008}) (Version: 90.00.0003 - Paragon Software)
PDF24 Creator 6.9.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
Phase 5 HTML-Editor (HKLM-x32\...\{20B1B020-DEAE-48D1-9960-D4C3185D758B}) (Version: 5.6.2.3 - Systemberatung Schommer)
PL-2303 USB-to-Serial (HKLM-x32\...\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}) (Version: 1.10.0 - Prolific Technology INC)
Raptr (HKLM-x32\...\Raptr) (Version: - )
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.2.8400.29029 - Realtek Semiconductor Corp.)
Scribus 1.4.5 (64bit) (HKLM\...\Scribus 1.4.5) (Version: 1.4.5 - The Scribus Team)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.10.12 - Synaptics Incorporated)
The Bat! Professional v6.7.7 (HKLM-x32\...\{FE9D5865-1F1A-4A1C-B292-AB6ABB5A0DB5}) (Version: 6.7.7 - Ritlabs)
Type201 TWAIN Driver Ver.4 (HKLM-x32\...\{A4B1D547-45A6-4757-8CE9-DF3C440002FD}) (Version: 4.33.02 - )
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
YAC(Yet Another Cleaner!) (HKLM-x32\...\iSafe) (Version: - ELEX DO BRASIL PARTICIPAÇÕES LTDA) <==== ATTENTION
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-1650800468-923342087-4115340913-1004_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-1650800468-923342087-4115340913-1004_Classes\CLSID\{D45F043D-F17F-4e8a-8435-70971D9FA46D}\InprocServer32 -> C:\Program Files\Blender Foundation\Blender\BlendThumb64.dll ()
==================== Restore Points =========================
30-04-2015 06:26:06 MSXML 4.0 SP3 Parser wird installiert
11-05-2015 15:46:40 Geplanter Prüfpunkt
20-05-2015 02:21:07 Geplanter Prüfpunkt
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {D987277F-4CB9-43A0-A4D2-A17E722998CA} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-05-24] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (Whitelisted) ==============
2014-12-08 12:10 - 2014-12-08 12:10 - 00102176 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2010-11-23 00:56 - 2010-11-23 00:56 - 00087040 _____ () C:\Program Files (x86)\Raptr\_ctypes.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00043008 _____ () C:\Program Files (x86)\Raptr\_socket.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00805376 _____ () C:\Program Files (x86)\Raptr\_ssl.pyd
2014-05-14 01:26 - 2014-05-14 01:26 - 05812736 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtGui.pyd
2014-05-14 01:26 - 2014-05-14 01:26 - 00067584 _____ () C:\Program Files (x86)\Raptr\sip.pyd
2014-05-14 01:26 - 2014-05-14 01:26 - 01662464 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtCore.pyd
2014-05-14 01:26 - 2014-05-14 01:26 - 00494592 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtNetwork.pyd
2010-11-23 00:57 - 2010-11-23 00:57 - 00096256 _____ () C:\Program Files (x86)\Raptr\win32api.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00110592 _____ () C:\Program Files (x86)\Raptr\pywintypes26.dll
2010-11-23 00:56 - 2010-11-23 00:56 - 00010240 _____ () C:\Program Files (x86)\Raptr\select.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00356864 _____ () C:\Program Files (x86)\Raptr\_hashlib.pyd
2010-11-23 00:57 - 2010-11-23 00:57 - 00036352 _____ () C:\Program Files (x86)\Raptr\win32process.pyd
2010-11-23 00:57 - 2010-11-23 00:57 - 00111104 _____ () C:\Program Files (x86)\Raptr\win32file.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00044544 _____ () C:\Program Files (x86)\Raptr\_sqlite3.pyd
2011-02-15 20:17 - 2011-02-15 20:17 - 00417501 _____ () C:\Program Files (x86)\Raptr\sqlite3.dll
2010-11-23 00:57 - 2010-11-23 00:57 - 00167936 _____ () C:\Program Files (x86)\Raptr\win32gui.pyd
2014-05-14 01:26 - 2014-05-14 01:26 - 00313856 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtWebKit.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00127488 _____ () C:\Program Files (x86)\Raptr\pyexpat.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00009216 _____ () C:\Program Files (x86)\Raptr\winsound.pyd
2014-08-14 02:37 - 2014-08-14 02:37 - 00113171 _____ () C:\Program Files (x86)\Raptr\libvlc.dll
2014-08-14 02:37 - 2014-08-14 02:37 - 02396691 _____ () C:\Program Files (x86)\Raptr\libvlccore.dll
2010-11-23 00:56 - 2010-11-23 00:56 - 00583680 _____ () C:\Program Files (x86)\Raptr\unicodedata.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00354304 _____ () C:\Program Files (x86)\Raptr\pythoncom26.dll
2010-11-23 00:57 - 2010-11-23 00:57 - 00263168 _____ () C:\Program Files (x86)\Raptr\win32com.shell.shell.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00324608 _____ () C:\Program Files (x86)\Raptr\PIL._imaging.pyd
2013-11-21 02:05 - 2013-11-21 02:05 - 00256000 _____ () C:\Program Files (x86)\Raptr\amd_ags.dll
2010-11-23 00:57 - 2010-11-23 00:57 - 00141312 _____ () C:\Program Files (x86)\Raptr\gobject._gobject.pyd
2014-06-18 02:56 - 2014-06-18 02:56 - 02717595 _____ () C:\Program Files (x86)\Raptr\heliotrope._purple.pyd
2011-02-15 20:17 - 2011-02-15 20:17 - 01213633 _____ () C:\Program Files (x86)\Raptr\libxml2-2.dll
2010-11-23 01:06 - 2010-11-23 01:06 - 00055808 _____ () C:\Program Files (x86)\Raptr\zlib1.dll
2013-05-10 01:52 - 2013-05-10 01:52 - 00495680 _____ () C:\Program Files (x86)\Raptr\plugins\libaim.dll
2013-05-10 01:52 - 2013-05-10 01:52 - 01183699 _____ () C:\Program Files (x86)\Raptr\liboscar.dll
2013-05-10 01:52 - 2013-05-10 01:52 - 00483306 _____ () C:\Program Files (x86)\Raptr\plugins\libicq.dll
2013-05-03 20:57 - 2013-05-03 20:57 - 00655356 _____ () C:\Program Files (x86)\Raptr\plugins\libirc.dll
2013-05-03 20:56 - 2013-05-03 20:56 - 01306387 _____ () C:\Program Files (x86)\Raptr\plugins\libmsn.dll
2013-05-03 20:56 - 2013-05-03 20:56 - 00565461 _____ () C:\Program Files (x86)\Raptr\plugins\libxmpp.dll
2013-05-03 20:57 - 2013-05-03 20:57 - 01640221 _____ () C:\Program Files (x86)\Raptr\libjabber.dll
2013-05-03 20:56 - 2013-05-03 20:56 - 00506276 _____ () C:\Program Files (x86)\Raptr\plugins\libyahoo.dll
2013-05-03 20:57 - 2013-05-03 20:57 - 01053730 _____ () C:\Program Files (x86)\Raptr\libymsg.dll
2013-05-03 20:57 - 2013-05-03 20:57 - 00497782 _____ () C:\Program Files (x86)\Raptr\plugins\libyahoojp.dll
2013-05-03 20:57 - 2013-05-03 20:57 - 00603326 _____ () C:\Program Files (x86)\Raptr\plugins\ssl-nss.dll
2013-05-03 20:57 - 2013-05-03 20:57 - 00474199 _____ () C:\Program Files (x86)\Raptr\plugins\ssl.dll
2015-05-25 01:56 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-05-25 01:56 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-05-25 01:56 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-05-25 01:56 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-05-25 01:56 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2015-05-25 05:02 - 2015-05-21 10:48 - 00065696 _____ () C:\Program Files (x86)\Elex-tech\YAC\zlib1.dll
2015-05-25 05:02 - 2015-04-17 04:43 - 00176976 _____ () C:\Program Files (x86)\Elex-tech\YAC\tws\unrar.dll
2015-05-25 05:02 - 2015-04-17 04:43 - 00087744 _____ () C:\Program Files (x86)\Elex-tech\YAC\tws\unacev2.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1650800468-923342087-4115340913-1004\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 192.168.1.1
==================== MSCONFIG/TASK MANAGER Error getting ==
(Currently there is no automatic fix for this section.)
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{D2123AC1-FBF6-4806-8A71-1570058394E3}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{C2663DA9-ECF8-4D81-B594-3800D3384DDA}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{DDAD2380-416D-4017-AC45-508DD44F7B10}C:\program files (x86)\irfanview\i_view32.exe] => (Allow) C:\program files (x86)\irfanview\i_view32.exe
FirewallRules: [UDP Query User{D3FDF65C-A7C9-4A86-9D1C-26F6CEA74BAE}C:\program files (x86)\irfanview\i_view32.exe] => (Allow) C:\program files (x86)\irfanview\i_view32.exe
FirewallRules: [TCP Query User{74347811-C46B-405E-ABC1-83BFF3F71799}C:\elvis2012\elvis01\elvis.exe] => (Allow) C:\elvis2012\elvis01\elvis.exe
FirewallRules: [UDP Query User{CAD57E1C-B727-41B5-BBFE-E6FB83481EF6}C:\elvis2012\elvis01\elvis.exe] => (Allow) C:\elvis2012\elvis01\elvis.exe
FirewallRules: [TCP Query User{3F8BEE1C-22FF-428F-9100-31C6722A9015}C:\elvis2012\elvis00\elvis.exe] => (Allow) C:\elvis2012\elvis00\elvis.exe
FirewallRules: [UDP Query User{98D21C84-56B0-4728-9D91-B2E9F18C636B}C:\elvis2012\elvis00\elvis.exe] => (Allow) C:\elvis2012\elvis00\elvis.exe
FirewallRules: [TCP Query User{3E6C7DF1-F41A-403E-8DE5-F171862561FA}C:\program files (x86)\myphoneexplorer\myphoneexplorer.exe] => (Allow) C:\program files (x86)\myphoneexplorer\myphoneexplorer.exe
FirewallRules: [UDP Query User{6192451E-195F-40DA-BD22-FE0500DCEE09}C:\program files (x86)\myphoneexplorer\myphoneexplorer.exe] => (Allow) C:\program files (x86)\myphoneexplorer\myphoneexplorer.exe
FirewallRules: [TCP Query User{86923A3E-8A37-4B0B-B557-22814E356477}C:\elvis2012\elvis01\elvis.exe] => (Allow) C:\elvis2012\elvis01\elvis.exe
FirewallRules: [UDP Query User{118F70AD-0A0E-468E-BC6B-D0F9E8667F1F}C:\elvis2012\elvis01\elvis.exe] => (Allow) C:\elvis2012\elvis01\elvis.exe
FirewallRules: [TCP Query User{567038C8-5A6D-4B76-82BF-59ED39DA4307}C:\program files (x86)\myphoneexplorer\myphoneexplorer.exe] => (Allow) C:\program files (x86)\myphoneexplorer\myphoneexplorer.exe
FirewallRules: [UDP Query User{127C3D10-EF5B-46E7-8A10-7AE5EC15A3BF}C:\program files (x86)\myphoneexplorer\myphoneexplorer.exe] => (Allow) C:\program files (x86)\myphoneexplorer\myphoneexplorer.exe
FirewallRules: [TCP Query User{4E077E71-1752-4ACB-9798-5EF3F2661199}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{CD7219BF-9731-44A8-A5AC-C3CF29583AEC}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{992A5C32-B178-4129-AA1E-86EADD276A31}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{CF2414FA-FEB5-42EE-9188-1F193F15D86E}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{F1673ED5-FABB-466B-B00F-13228B1AE8B7}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe
FirewallRules: [{F3A7644F-3204-49B1-AEE8-2A06BB94696A}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (05/25/2015 05:38:40 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.17416, Zeitstempel: 0x5452eed9
Name des fehlerhaften Moduls: Flash.ocx, Version: 16.0.0.305, Zeitstempel: 0x54d010d8
Ausnahmecode: 0xc0000005
Fehleroffset: 0x002c3412
ID des fehlerhaften Prozesses: 0xfec
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3
Vollständiger Name des fehlerhaften Pakets: IEXPLORE.EXE4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: IEXPLORE.EXE5
Error: (05/24/2015 10:17:07 PM) (Source: ATIeRecord) (EventID: 16393) (User: )
Description: ATI EEU failed to create a QNode
Error: (05/24/2015 10:17:07 PM) (Source: ATIeRecord) (EventID: 16393) (User: )
Description: ATI EEU failed to create a QNode
Error: (05/24/2015 10:17:07 PM) (Source: ATIeRecord) (EventID: 16393) (User: )
Description: ATI EEU failed to create a QNode
Error: (05/24/2015 09:29:46 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (05/24/2015 09:29:46 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (05/24/2015 09:17:15 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (05/24/2015 08:11:10 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (05/24/2015 08:11:09 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (05/24/2015 08:11:06 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
System errors:
=============
Error: (05/24/2015 10:33:27 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (05/24/2015 10:33:27 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde unerwartet beendet. Dies ist bereits 2 Mal passiert.
Error: (05/24/2015 10:33:26 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "IconMan_R" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (05/24/2015 10:33:26 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (05/24/2015 10:33:26 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.
Error: (05/24/2015 10:33:26 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Protexis Licensing V2 x64" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (05/24/2015 10:33:26 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Protexis Licensing V2" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (05/24/2015 10:33:25 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "AVM FRITZ!Fernzugang Client" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (05/24/2015 10:33:25 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (05/24/2015 10:33:25 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MBAMScheduler" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Microsoft Office:
=========================
Error: (05/05/2015 08:21:12 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 2021 seconds with 540 seconds of active time. This session ended with a crash.
Error: (05/05/2015 05:37:57 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 9667 seconds with 1620 seconds of active time. This session ended with a crash.
Error: (03/23/2015 06:36:20 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 1806 seconds with 960 seconds of active time. This session ended with a crash.
Error: (03/23/2015 06:06:05 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 1769 seconds with 1560 seconds of active time. This session ended with a crash.
Error: (03/20/2015 09:51:30 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 5167 seconds with 2160 seconds of active time. This session ended with a crash.
Error: (03/20/2015 06:16:33 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 1338 seconds with 1080 seconds of active time. This session ended with a crash.
Error: (03/20/2015 05:31:20 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 898 seconds with 840 seconds of active time. This session ended with a crash.
Error: (03/20/2015 05:16:13 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 7973 seconds with 600 seconds of active time. This session ended with a crash.
Error: (03/20/2015 03:02:53 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 34584 seconds with 2220 seconds of active time. This session ended with a crash.
Error: (03/19/2015 05:26:21 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 1430 seconds with 720 seconds of active time. This session ended with a crash.
CodeIntegrity Errors:
===================================
Date: 2015-02-04 03:26:51.748
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-02-04 03:26:51.665
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-02-04 03:26:51.587
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-02-04 03:26:51.222
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-02-04 03:26:51.039
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-02-04 03:21:18.967
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-02-04 03:21:18.905
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-02-04 03:21:18.827
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-02-04 03:21:18.749
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-02-04 03:21:18.670
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-3210M CPU @ 2.50GHz
Percentage of memory in use: 25%
Total physical RAM: 8084.27 MB
Available physical RAM: 6045.6 MB
Total Pagefile: 9364.27 MB
Available Pagefile: 6850.34 MB
Total Virtual: 131072 MB
Available Virtual: 131071.79 MB
==================== Drives ================================
Drive c: (SYSTEM) (Fixed) (Total:125 GB) (Free:78.27 GB) NTFS
Drive d: (DATEN) (Fixed) (Total:573.12 GB) (Free:349.41 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 698.6 GB) (Disk ID: BCD35106)
Partition: GPT Partition Type.
==================== End of log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-05-25 06:31:00
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000028 ST750LM022_HN-M750MBB rev.2AR10002 698,64GB
Running: Gmer-19357.exe; Driver: C:\Users\AB5DB~1.BER\AppData\Local\Temp\awrirfog.sys
---- User code sections - GMER 2.1 ----
.text C:\Windows\system32\atiesrxx.exe[912] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff8ba97169a 4 bytes [97, BA, F8, 7F]
.text C:\Windows\system32\atiesrxx.exe[912] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff8ba9716a2 4 bytes [97, BA, F8, 7F]
.text C:\Windows\system32\atiesrxx.exe[912] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff8ba97181a 4 bytes [97, BA, F8, 7F]
.text C:\Windows\system32\atiesrxx.exe[912] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff8ba971832 4 bytes [97, BA, F8, 7F]
.text C:\Windows\system32\atieclxx.exe[1068] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff8ba97169a 4 bytes [97, BA, F8, 7F]
.text C:\Windows\system32\atieclxx.exe[1068] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff8ba9716a2 4 bytes [97, BA, F8, 7F]
.text C:\Windows\system32\atieclxx.exe[1068] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff8ba97181a 4 bytes [97, BA, F8, 7F]
.text C:\Windows\system32\atieclxx.exe[1068] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff8ba971832 4 bytes [97, BA, F8, 7F]
.text C:\Program Files\FRITZ!Fernzugang\avmike.exe[1796] C:\Windows\SYSTEM32\WSOCK32.dll!setsockopt + 194 00007ff8b1241f6a 4 bytes [24, B1, F8, 7F]
.text C:\Program Files\FRITZ!Fernzugang\avmike.exe[1796] C:\Windows\SYSTEM32\WSOCK32.dll!setsockopt + 218 00007ff8b1241f82 4 bytes [24, B1, F8, 7F]
.text C:\Program Files\FRITZ!Fernzugang\certsrv.exe[1856] C:\Windows\SYSTEM32\WSOCK32.dll!setsockopt + 194 00007ff8b1241f6a 4 bytes [24, B1, F8, 7F]
.text C:\Program Files\FRITZ!Fernzugang\certsrv.exe[1856] C:\Windows\SYSTEM32\WSOCK32.dll!setsockopt + 218 00007ff8b1241f82 4 bytes [24, B1, F8, 7F]
.text C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe[488] C:\Windows\SYSTEM32\WSOCK32.dll!setsockopt + 194 00007ff8b1241f6a 4 bytes [24, B1, F8, 7F]
.text C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe[488] C:\Windows\SYSTEM32\WSOCK32.dll!setsockopt + 218 00007ff8b1241f82 4 bytes [24, B1, F8, 7F]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[444] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff8ba97169a 4 bytes [97, BA, F8, 7F]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[444] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff8ba9716a2 4 bytes [97, BA, F8, 7F]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[444] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff8ba97181a 4 bytes [97, BA, F8, 7F]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[444] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff8ba971832 4 bytes [97, BA, F8, 7F]
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[2448] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff8ba97169a 4 bytes [97, BA, F8, 7F]
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[2448] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff8ba9716a2 4 bytes [97, BA, F8, 7F]
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[2448] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff8ba97181a 4 bytes [97, BA, F8, 7F]
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[2448] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff8ba971832 4 bytes [97, BA, F8, 7F]
---- User IAT/EAT - GMER 2.1 ----
IAT C:\Windows\Explorer.EXE[2120] @ C:\Windows\Explorer.EXE[USER32.dll!DeferWindowPos] [7ff8ad851da0] C:\Program Files (x86)\Elex-tech\YAC\iDskDllPatch64.dll
IAT C:\Windows\Explorer.EXE[2120] @ C:\Windows\Explorer.EXE[USER32.dll!SetWindowPos] [7ff8ad851bf0] C:\Program Files (x86)\Elex-tech\YAC\iDskDllPatch64.dll
IAT C:\Windows\Explorer.EXE[2120] @ C:\Windows\Explorer.EXE[USER32.dll!EndPaint] [7ff8ad851f40] C:\Program Files (x86)\Elex-tech\YAC\iDskDllPatch64.dll
IAT C:\Windows\Explorer.EXE[2120] @ C:\Windows\Explorer.EXE[USER32.dll!MoveWindow] [7ff8ad851a60] C:\Program Files (x86)\Elex-tech\YAC\iDskDllPatch64.dll
IAT C:\Windows\Explorer.EXE[2120] @ C:\Windows\system32\SHELL32.dll[USER32.dll!DeferWindowPos] [7ff8ad851da0] C:\Program Files (x86)\Elex-tech\YAC\iDskDllPatch64.dll
IAT C:\Windows\Explorer.EXE[2120] @ C:\Windows\system32\SHELL32.dll[USER32.dll!SetWindowPos] [7ff8ad851bf0] C:\Program Files (x86)\Elex-tech\YAC\iDskDllPatch64.dll
IAT C:\Windows\Explorer.EXE[2120] @ C:\Windows\system32\SHELL32.dll[USER32.dll!MoveWindow] [7ff8ad851a60] C:\Program Files (x86)\Elex-tech\YAC\iDskDllPatch64.dll
IAT C:\Windows\Explorer.EXE[2120] @ C:\Windows\system32\SHELL32.dll[USER32.dll!EndPaint] [7ff8ad851f40] C:\Program Files (x86)\Elex-tech\YAC\iDskDllPatch64.dll
IAT C:\Windows\Explorer.EXE[2120] @ C:\Windows\SYSTEM32\UxTheme.dll[USER32.dll!SetWindowPos] [7ff8ad851bf0] C:\Program Files (x86)\Elex-tech\YAC\iDskDllPatch64.dll
IAT C:\Windows\Explorer.EXE[2120] @ C:\Windows\SYSTEM32\TWINAPI.dll[USER32.dll!SetWindowPos] [7ff8ad851bf0] C:\Program Files (x86)\Elex-tech\YAC\iDskDllPatch64.dll
IAT C:\Windows\Explorer.EXE[2120] @ C:\Windows\SYSTEM32\dxgi.dll[USER32.dll!SetWindowPos] [7ff8ad851bf0] C:\Program Files (x86)\Elex-tech\YAC\iDskDllPatch64.dll
IAT C:\Windows\Explorer.EXE[2120] @ C:\Windows\system32\IMM32.DLL[USER32.dll!EndPaint] [7ff8ad851f40] C:\Program Files (x86)\Elex-tech\YAC\iDskDllPatch64.dll
IAT C:\Windows\Explorer.EXE[2120] @ C:\Windows\system32\IMM32.DLL[USER32.dll!SetWindowPos] [7ff8ad851bf0] C:\Program Files (x86)\Elex-tech\YAC\iDskDllPatch64.dll
IAT C:\Windows\Explorer.EXE[2120] @ C:\Windows\system32\MSCTF.dll[USER32.dll!MoveWindow] [7ff8ad851a60] C:\Program Files (x86)\Elex-tech\YAC\iDskDllPatch64.dll
IAT C:\Windows\Explorer.EXE[2120] @ C:\Windows\system32\MSCTF.dll[USER32.dll!EndPaint] [7ff8ad851f40] C:\Program Files (x86)\Elex-tech\YAC\iDskDllPatch64.dll
IAT C:\Windows\Explorer.EXE[2120] @ C:\Windows\system32\MSCTF.dll[USER32.dll!SetWindowPos] [7ff8ad851bf0] C:\Program Files (x86)\Elex-tech\YAC\iDskDllPatch64.dll
IAT C:\Windows\Explorer.EXE[2120] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1\COMCTL32.dll[USER32.dll!DeferWindowPos] [7ff8ad851da0] C:\Program Files (x86)\Elex-tech\YAC\iDskDllPatch64.dll
IAT C:\Windows\Explorer.EXE[2120] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1\COMCTL32.dll[USER32.dll!EndPaint] [7ff8ad851f40] C:\Program Files (x86)\Elex-tech\YAC\iDskDllPatch64.dll
IAT C:\Windows\Explorer.EXE[2120] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1\COMCTL32.dll[USER32.dll!MoveWindow] [7ff8ad851a60] C:\Program Files (x86)\Elex-tech\YAC\iDskDllPatch64.dll
IAT C:\Windows\Explorer.EXE[2120] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1\COMCTL32.dll[USER32.dll!SetWindowPos] [7ff8ad851bf0] C:\Program Files (x86)\Elex-tech\YAC\iDskDllPatch64.dll
---- Threads - GMER 2.1 ----
Thread C:\Windows\system32\csrss.exe [580:604] fffff96000934b90
Thread C:\Windows\system32\svchost.exe [1680:2688] 00007ff8ae181584
Thread C:\Windows\system32\svchost.exe [1680:2696] 00007ff8ae081b40
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 24.05.2015 Suchlauf-Zeit: 01:55:33 Logdatei: Administrator: Ja Version: 2.01.6.1022 Malware Datenbank: v2015.05.23.04 Rootkit Datenbank: v2015.05.16.01 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 8.1 CPU: x64 Dateisystem: NTFS Benutzer: a.berndt Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 393240 Verstrichene Zeit: 11 Min, 0 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente gefunden) Module: 0 (Keine schädliche Elemente gefunden) Registrierungsschlüssel: 0 (Keine schädliche Elemente gefunden) Registrierungswerte: 0 (Keine schädliche Elemente gefunden) Registrierungsdaten: 0 (Keine schädliche Elemente gefunden) Ordner: 0 (Keine schädliche Elemente gefunden) Dateien: 0 (Keine schädliche Elemente gefunden) Physische Sektoren: 0 (Keine schädliche Elemente gefunden) (end) Geändert von BerndtAl (25.05.2015 um 05:43 Uhr) |
|
25.05.2015, 06:06
| #2 |
| /// the machine /// TB-Ausbilder    | Win 8.1 64bit, Firefox & IE: Webadresse wird automatisch weitergeleitet getallmysocks.tk / benaughty.com hi,
__________________Lade Dir bitte von hier  Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ |
|
25.05.2015, 09:38
| #3 |
| | Win 8.1 64bit, Firefox & IE: Webadresse wird automatisch weitergeleitet getallmysocks.tk / benaughty.comCode:
ATTFilter # AdwCleaner v4.205 - Bericht erstellt 25/05/2015 um 10:25:54
# Aktualisiert 21/05/2015 von Xplode
# Datenbank : 2015-05-24.1 [Server]
# Betriebssystem : Windows 8.1 (x64)
# Benutzername : XXXXXXXXXXXXXXXXXXXXX
# Gestarted von : D:\PRG\_HP_Neuinstallation\Malware\adwcleaner_4.205.exe
# Option : Löschen
***** [ Dienste ] *****
Dienst Gelöscht : iSafeKrnl
[#] Dienst Gelöscht : iSafeKrnlBoot
Dienst Gelöscht : iSafeKrnlKit
Dienst Gelöscht : iSafeKrnlMon
Dienst Gelöscht : iSafeKrnlR3
Dienst Gelöscht : iSafeNetFilter
[#] Dienst Gelöscht : iSafeService
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YAC
[!] Ordner Gelöscht : C:\Program Files (x86)\Elex-tech
Ordner Gelöscht : C:\Users\AB5DB~1.BER\AppData\Local\Temp\iSafeRightKeyScan
Ordner Gelöscht : C:\Users\a.berndt\AppData\Roaming\eCyber
[!] Ordner Gelöscht : C:\Users\a.berndt\AppData\Roaming\Elex-tech
Datei Gelöscht : C:\Users\Public\Desktop\YAC.lnk
Datei Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\YAC.lnk
Datei Gelöscht : C:\Windows\System32\log\iSafeKrnlCall.log
Datei Gelöscht : C:\Windows\System32\drivers\iSafeKrnlBoot.sys
Datei Gelöscht : C:\Windows\System32\drivers\iSafeNetFilter.sys
***** [ Geplante Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{5411D116-5A37-47D4-B154-5F7FCD9062F0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Elex-tech
Schlüssel Gelöscht : HKU\.DEFAULT\Software\Elex-tech
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iSafe
Daten Gelöscht : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyServer] - hxxp=127.0.0.1:60796;hxxps=127.0.0.1:60796
Daten Gelöscht : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyEnable] - 1
Daten Gelöscht : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <-loopback>
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.17416
-\\ Mozilla Firefox v38.0.1 (x86 de)
*************************
AdwCleaner[R0].txt - [1385 Bytes] - [15/02/2015 20:43:12]
AdwCleaner[R1].txt - [1508 Bytes] - [24/05/2015 02:15:39]
AdwCleaner[R2].txt - [1567 Bytes] - [24/05/2015 02:25:11]
AdwCleaner[R3].txt - [1769 Bytes] - [24/05/2015 22:29:37]
AdwCleaner[R4].txt - [2951 Bytes] - [25/05/2015 10:23:25]
AdwCleaner[S0].txt - [1251 Bytes] - [15/02/2015 20:48:20]
AdwCleaner[S1].txt - [1396 Bytes] - [24/05/2015 02:26:48]
AdwCleaner[S2].txt - [1547 Bytes] - [24/05/2015 22:33:26]
AdwCleaner[S3].txt - [2653 Bytes] - [25/05/2015 10:25:54]
########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [2712 Bytes] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.7.9 (05.24.2015:1)
OS: Windows 8.1 x64
Ran by a.berndt on 25.05.2015 at 10:39:27,45
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Tasks
Successfully deleted: [Task] C:\Windows\system32\tasks\Optimize Start Menu Cache Files-S-1-5-21-1650800468-923342087-4115340913-1001
Successfully deleted: [Task] C:\Windows\system32\tasks\Optimize Start Menu Cache Files-S-1-5-21-1650800468-923342087-4115340913-1003
Successfully deleted: [Task] C:\Windows\system32\tasks\Optimize Start Menu Cache Files-S-1-5-21-1650800468-923342087-4115340913-1004
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 25.05.2015 at 10:40:41,38
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 24-05-2015 01
Ran by XXXXXXXXXXX (administrator) on XXXXXXXXXXXX on 25-05-2015 10:41:56
Running from D:\PRG\_HP_Neuinstallation\Malware
Loaded Profiles: a.berndt (Available Profiles: Dessau & a.berndt)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Hewlett-Packard Company) C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916152 2012-08-28] (Synaptics Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2014-11-20] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Raptr] => C:\Program Files (x86)\Raptr\raptrstub.exe [55568 2015-05-15] (Raptr, Inc)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [193568 2014-11-28] (Geek Software GmbH)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled
ProxyServer: [.DEFAULT] => http=127.0.0.1:60796;https=127.0.0.1:60796
HKU\S-1-5-21-1650800468-923342087-4115340913-1004\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-05-06] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-05-06] (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\a.berndt\AppData\Roaming\Mozilla\Firefox\Profiles\996guxg5.default-1432498293392
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-24] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-09-23] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-24] ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2014-09-11] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2014-09-11] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2014-09-11] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2014-09-11] (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-06] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-06] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
FF Extension: FireShot - C:\Users\a.berndt\AppData\Roaming\Mozilla\Firefox\Profiles\996guxg5.default-1432498293392\Extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba} [2015-05-25]
FF Extension: Video DownloadHelper - C:\Users\a.berndt\AppData\Roaming\Mozilla\Firefox\Profiles\996guxg5.default-1432498293392\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2015-05-25]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 avmike; C:\Program Files\FRITZ!Fernzugang\avmike.exe [337824 2012-11-28] (AVM Berlin)
S2 certsrv; C:\Program Files\FRITZ!Fernzugang\certsrv.exe [143776 2012-11-28] (AVM Berlin)
S2 FoxitCloudUpdateService; C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [244392 2015-05-11] (Foxit Software Inc.)
S3 hpqwmiex; C:\Users\a.berndt\AppData\Roaming\Hewlett-Packard\hpqwmiex.exe [794112 2015-02-01] (Hewlett-Packard Company) []
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89864 2014-12-11] (Hewlett-Packard Company)
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2451456 2012-07-14] (Realsil Microelectronics Inc.) []
S2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [319080 2015-01-08] (Intel Corporation)
S4 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S2 nwtsrv; C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe [191328 2013-06-10] (AVM Berlin)
S2 PSI_SVC_2_x64; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [336824 2010-11-30] (arvato digital services llc)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [62152 2014-10-28] (Advanced Micro Devices, Inc.)
R0 hotcore3; C:\Windows\System32\DRIVERS\hotcore3.sys [34056 2013-12-05] (Paragon Software Group)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)
R3 NWIM; C:\Windows\system32\DRIVERS\avmnwim.sys [412024 2011-07-05] (AVM Berlin)
S3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [269968 2012-07-04] (Realtek Semiconductor Corp.)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20288 2012-08-03] (Hewlett-Packard Development Company, L.P.)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-05-25 10:40 - 2015-05-25 10:40 - 00000996 _____ () C:\Users\a.berndt\Desktop\JRT.txt
2015-05-25 10:39 - 2015-05-25 10:39 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-TSVTM-NB-002-Windows-8.1-(64-bit).dat
2015-05-25 10:39 - 2015-05-25 10:39 - 00000000 ____D () C:\RegBackup
2015-05-25 10:19 - 2015-05-25 10:19 - 00001286 _____ () C:\Users\a.berndt\Desktop\Revo Uninstaller.lnk
2015-05-25 10:19 - 2015-05-25 10:19 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-05-25 06:14 - 2015-05-25 06:34 - 00000000 ____D () C:\Windows\Minidump
2015-05-25 06:13 - 2015-05-25 06:13 - 703627045 _____ () C:\Windows\MEMORY.DMP
2015-05-25 06:02 - 2015-05-25 10:41 - 00000000 ____D () C:\FRST
2015-05-25 05:03 - 2015-05-25 10:26 - 00000000 ____D () C:\Windows\system32\log
2015-05-25 04:49 - 2015-05-25 04:49 - 00000000 ____D () C:\Users\a.berndt\Documents\ProcAlyzer Dumps
2015-05-25 01:56 - 2015-05-25 04:48 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-05-25 01:56 - 2015-05-25 01:58 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-05-25 01:56 - 2015-05-25 01:56 - 00001409 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-05-25 01:56 - 2015-05-25 01:56 - 00001397 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2015-05-25 01:56 - 2015-05-25 01:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-05-25 01:56 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2015-05-24 22:11 - 2015-05-24 22:11 - 00000000 ____D () C:\Users\a.berndt\Desktop\Alte Firefox-Daten
2015-05-24 20:11 - 2015-05-24 20:11 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-05-24 02:46 - 2015-05-24 02:46 - 00000000 ____D () C:\ProgramData\McAfee
2015-05-24 01:54 - 2015-05-25 06:41 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-24 01:54 - 2015-05-24 01:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-05-24 01:54 - 2015-05-24 01:54 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-05-24 01:54 - 2015-05-24 01:54 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-05-24 01:54 - 2015-04-14 09:38 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-05-24 01:54 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-05-24 01:54 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-05-21 07:11 - 2015-05-21 07:11 - 06448912 _____ (Tim Kosse) C:\Users\a.berndt\Downloads\FileZilla_3.11.0_win64-setup.exe
2015-05-18 16:47 - 2015-05-18 16:47 - 00010652 _____ () C:\Users\a.berndt\AppData\Local\recently-used.xbel
2015-05-15 17:31 - 2015-05-15 17:31 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-04-30 06:26 - 2015-04-30 06:26 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2015-04-30 05:10 - 2015-04-30 05:12 - 00000000 ____D () C:\Users\a.berndt\AppData\Local\CAO-FAKTURA
2015-04-30 04:26 - 2015-04-30 04:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CAO-FAKTURA
2015-04-30 04:26 - 2006-03-27 19:59 - 00046080 _____ () C:\Windows\SysWOW64\rbide.fra
2015-04-30 04:26 - 2006-03-27 19:59 - 00046080 _____ () C:\Windows\SysWOW64\rbide.esp
2015-04-30 04:26 - 2006-03-27 19:59 - 00045056 _____ () C:\Windows\SysWOW64\rbide.ita
2015-04-30 04:26 - 2006-03-27 19:59 - 00040448 _____ () C:\Windows\SysWOW64\rbide.eng
2015-04-30 04:26 - 2006-03-27 19:59 - 00040448 _____ () C:\Windows\SysWOW64\rbide.cst
2015-04-30 04:26 - 2006-03-27 19:59 - 00024576 _____ () C:\Windows\SysWOW64\rbprint.fra
2015-04-30 04:26 - 2006-03-27 19:59 - 00023552 _____ () C:\Windows\SysWOW64\rbprint.ita
2015-04-30 04:26 - 2006-03-27 19:59 - 00023552 _____ () C:\Windows\SysWOW64\rbprint.esp
2015-04-30 04:26 - 2006-03-27 19:59 - 00022016 _____ () C:\Windows\SysWOW64\rbprint.eng
2015-04-30 04:26 - 2006-03-27 19:59 - 00022016 _____ () C:\Windows\SysWOW64\rbprint.cst
2015-04-30 04:26 - 2006-03-27 19:59 - 00021504 _____ () C:\Windows\SysWOW64\rbDADE.fra
2015-04-30 04:26 - 2006-03-27 19:59 - 00020992 _____ () C:\Windows\SysWOW64\rbDADE.esp
2015-04-30 04:26 - 2006-03-27 19:59 - 00020480 _____ () C:\Windows\SysWOW64\rbDADE.ita
2015-04-30 04:26 - 2006-03-27 19:59 - 00019968 _____ () C:\Windows\SysWOW64\rbDADE.eng
2015-04-30 04:26 - 2006-03-27 19:59 - 00017920 _____ () C:\Windows\SysWOW64\rbRAP.ita
2015-04-30 04:26 - 2006-03-27 19:59 - 00017920 _____ () C:\Windows\SysWOW64\rbRAP.fra
2015-04-30 04:26 - 2006-03-27 19:59 - 00017920 _____ () C:\Windows\SysWOW64\rbRAP.esp
2015-04-30 04:26 - 2006-03-27 19:59 - 00017408 _____ () C:\Windows\SysWOW64\rbRAP.eng
2015-04-30 04:26 - 2006-03-27 19:59 - 00017408 _____ () C:\Windows\SysWOW64\rbRAP.cst
2015-04-30 04:26 - 2006-03-27 18:59 - 00047616 _____ () C:\Windows\SysWOW64\rbide.deu
2015-04-30 04:26 - 2006-03-27 18:59 - 00023552 _____ () C:\Windows\SysWOW64\rbprint.deu
2015-04-30 04:26 - 2006-03-27 18:59 - 00021504 _____ () C:\Windows\SysWOW64\rbDADE.deu
2015-04-30 04:26 - 2006-03-27 18:59 - 00017920 _____ () C:\Windows\SysWOW64\rbRAP.deu
2015-04-30 04:24 - 2015-04-30 05:12 - 00000000 ____D () C:\Program Files (x86)\CAO-Faktura
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-05-25 10:36 - 2015-02-15 20:42 - 00000000 ____D () C:\AdwCleaner
2015-05-25 10:31 - 2015-02-12 05:16 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-25 10:31 - 2015-02-01 08:43 - 00000000 ____D () C:\Users\a.berndt\AppData\Roaming\Raptr
2015-05-25 10:30 - 2015-01-19 10:00 - 01536257 _____ () C:\Windows\WindowsUpdate.log
2015-05-25 10:27 - 2013-08-22 16:46 - 00032550 _____ () C:\Windows\setupact.log
2015-05-25 10:27 - 2013-08-22 16:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-25 10:26 - 2014-09-23 23:06 - 00954058 _____ () C:\Windows\PFRO.log
2015-05-25 10:00 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\sru
2015-05-25 08:04 - 2015-02-04 06:58 - 00003958 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{2E0E0009-6A8B-4D01-A714-C8828DBBDE34}
2015-05-25 06:22 - 2015-02-01 00:17 - 00000000 ____D () C:\Users\a.berndt\AppData\Roaming\vlc
2015-05-25 06:15 - 2015-02-01 00:07 - 00000000 ____D () C:\Users\a.berndt
2015-05-24 22:17 - 2015-01-30 05:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-24 22:17 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2015-05-24 02:46 - 2015-02-12 05:16 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-05-24 02:46 - 2015-02-01 03:51 - 00000000 ____D () C:\Users\a.berndt\AppData\Local\Adobe
2015-05-24 02:34 - 2014-09-24 08:17 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-24 02:34 - 2014-09-24 07:43 - 00765582 _____ () C:\Windows\system32\perfh007.dat
2015-05-24 02:34 - 2014-09-24 07:43 - 00159366 _____ () C:\Windows\system32\perfc007.dat
2015-05-24 02:30 - 2015-02-01 08:43 - 00000000 ____D () C:\Program Files (x86)\Raptr
2015-05-24 02:28 - 2015-04-21 15:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox.bak
2015-05-23 03:51 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\FxsTmp
2015-05-22 00:34 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-05-21 07:29 - 2015-02-01 00:15 - 00000000 ____D () C:\Users\a.berndt\AppData\Roaming\FileZilla
2015-05-20 01:36 - 2013-08-22 17:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-05-14 15:47 - 2015-02-03 11:59 - 00000000 ____D () C:\Users\a.berndt\AppData\Roaming\foobar2000
2015-05-12 02:25 - 2015-02-03 17:39 - 00000000 ____D () C:\Users\a.berndt\AppData\Local\Microsoft Help
2015-05-07 06:40 - 2015-02-15 19:31 - 00000000 ____D () C:\Users\a.berndt\AppData\Roaming\MyPhoneExplorer
2015-05-06 13:51 - 2015-02-01 02:47 - 00000000 ____D () C:\ProgramData\Oracle
2015-05-06 13:51 - 2015-02-01 02:47 - 00000000 ____D () C:\Program Files (x86)\Java
2015-05-06 13:50 - 2015-02-01 02:48 - 00097888 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-04-30 04:24 - 2015-02-01 00:07 - 00000000 ____D () C:\Users\a.berndt\AppData\Local\VirtualStore
2015-04-29 04:24 - 2015-03-21 17:32 - 00000000 ____D () C:\Program Files (x86)\phase5
2015-04-27 04:01 - 2015-04-06 20:59 - 00000000 ____D () C:\Users\a.berndt\AppData\Roaming\avidemux
2015-04-26 00:03 - 2015-02-07 19:44 - 00000000 ____D () C:\Users\a.berndt\AppData\Roaming\dvdcss
==================== Files in the root of some directories =======
2015-05-18 16:47 - 2015-05-18 16:47 - 0010652 _____ () C:\Users\a.berndt\AppData\Local\recently-used.xbel
2015-04-08 02:13 - 2015-04-08 02:13 - 0007597 _____ () C:\Users\a.berndt\AppData\Local\Resmon.ResmonCfg
Some files in TEMP:
====================
C:\Users\a.berndt\AppData\Local\Temp\AutoDetectUtilApp.exe
C:\Users\a.berndt\AppData\Local\Temp\jre-8u45-windows-au.exe
C:\Users\a.berndt\AppData\Local\Temp\Quarantine.exe
C:\Users\a.berndt\AppData\Local\Temp\raptrpatch.exe
C:\Users\a.berndt\AppData\Local\Temp\raptr_stub.exe
C:\Users\a.berndt\AppData\Local\Temp\sdanircmdc.exe
C:\Users\a.berndt\AppData\Local\Temp\sdapskill.exe
C:\Users\a.berndt\AppData\Local\Temp\sdaspwn.exe
C:\Users\a.berndt\AppData\Local\Temp\sqlite3.dll
C:\Users\Dessau\AppData\Local\Temp\gkey.exe
C:\Users\Dessau\AppData\Local\Temp\pkeyui.exe
C:\Users\Dessau\AppData\Local\Temp\wabk.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-05-17 22:11
==================== End of log ============================
Vielen Dank für Deine weitere Hilfe! Geändert von BerndtAl (25.05.2015 um 09:47 Uhr) |
|
25.05.2015, 16:16
| #4 |
| /// the machine /// TB-Ausbilder | Win 8.1 64bit, Firefox & IE: Webadresse wird automatisch weitergeleitet getallmysocks.tk / benaughty.comESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
26.05.2015, 03:49
| #5 |
| | Win 8.1 64bit, Firefox & IE: Webadresse wird automatisch weitergeleitet getallmysocks.tk / benaughty.comCode:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=37ac48a65091154d8bc285d41fd261f0
# engine=24020
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2015-05-26 02:33:15
# local_time=2015-05-26 04:33:15 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 8762122 22911914 0 0
# scanned=217160
# found=5
# cleaned=5
# scan_time=3009
sh=BB81439EA817953E9DBE7B7039F29456D4DC64D7 ft=1 fh=3e21a739fcfccdc1 vn="Variante von Win64/NetFilter.A potenziell unsichere Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Windows\System32\drivers\iSafeNetFilter.sys.vir"
sh=9C045BBCA39CA834E8227686446F6B4E15CA98D1 ft=1 fh=eea97bf6c87ca439 vn="Variante von Win32/ELEX.DB evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\a.berndt\AppData\Local\Temp\_@6275.tmp"
sh=321D1654E35A731E4C8AD65A7E2C5AD3EC81B14C ft=1 fh=83d6c08fa46356a5 vn="Variante von Win32/ELEX.BP evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\a.berndt\AppData\Local\Temp\_@6279.tmp"
sh=133C6791FFFAE40F9FD75B85736E26F635AEC5A4 ft=1 fh=e739f070408bf627 vn="Variante von Win32/ELEX.CR evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\a.berndt\AppData\Local\Temp\_@628D.tmp"
sh=5AF0B98E324EB8D81F97EEE2D11E3F996B5C91F5 ft=1 fh=955761e6ce5527b5 vn="Variante von Win32/ELEX.CC evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\a.berndt\AppData\Local\Temp\_@6293.tmp"
Code:
ATTFilter Results of screen317's Security Check version 1.001
x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Defender
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Spybot - Search & Destroy
Java 8 Update 45
Adobe Flash Player 17.0.0.188
Mozilla Firefox (38.0.1)
Mozilla Thunderbird (31.4.0)
````````Process Check: objlist.exe by Laurent````````
Spybot Teatimer.exe is disabled!
_HP_Neuinstallation Malware SecurityCheck.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 25-05-2015
Ran by a.berndt (administrator) on TSVTM-NB-002 on 26-05-2015 04:51:29
Running from D:\PRG\_HP_Neuinstallation\Malware
Loaded Profiles: a.berndt (Available Profiles: Dessau & a.berndt)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Hewlett-Packard Company) C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Ritlabs, SRL) C:\Program Files (x86)\The Bat!\TheBat.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_188.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_188.exe
(Foxit Software Inc.) C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitReader.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916152 2012-08-28] (Synaptics Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2014-11-20] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Raptr] => C:\Program Files (x86)\Raptr\raptrstub.exe [55568 2015-05-15] (Raptr, Inc)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [193568 2014-11-28] (Geek Software GmbH)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled
ProxyServer: [.DEFAULT] => http=127.0.0.1:60796;https=127.0.0.1:60796
HKU\S-1-5-21-1650800468-923342087-4115340913-1004\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-05-06] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-05-06] (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\a.berndt\AppData\Roaming\Mozilla\Firefox\Profiles\996guxg5.default-1432498293392
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-24] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-09-23] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-24] ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2014-09-11] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2014-09-11] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2014-09-11] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2014-09-11] (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-06] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-06] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
FF Extension: FireShot - C:\Users\a.berndt\AppData\Roaming\Mozilla\Firefox\Profiles\996guxg5.default-1432498293392\Extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba} [2015-05-25]
FF Extension: Video DownloadHelper - C:\Users\a.berndt\AppData\Roaming\Mozilla\Firefox\Profiles\996guxg5.default-1432498293392\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2015-05-25]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 avmike; C:\Program Files\FRITZ!Fernzugang\avmike.exe [337824 2012-11-28] (AVM Berlin)
S2 certsrv; C:\Program Files\FRITZ!Fernzugang\certsrv.exe [143776 2012-11-28] (AVM Berlin)
S2 FoxitCloudUpdateService; C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [244392 2015-05-11] (Foxit Software Inc.)
S3 hpqwmiex; C:\Users\a.berndt\AppData\Roaming\Hewlett-Packard\hpqwmiex.exe [794112 2015-02-01] (Hewlett-Packard Company) []
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89864 2014-12-11] (Hewlett-Packard Company)
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2451456 2012-07-14] (Realsil Microelectronics Inc.) []
S2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [319080 2015-01-08] (Intel Corporation)
S4 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S2 nwtsrv; C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe [191328 2013-06-10] (AVM Berlin)
S2 PSI_SVC_2_x64; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [336824 2010-11-30] (arvato digital services llc)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [62152 2014-10-28] (Advanced Micro Devices, Inc.)
R0 hotcore3; C:\Windows\System32\DRIVERS\hotcore3.sys [34056 2013-12-05] (Paragon Software Group)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)
R3 NWIM; C:\Windows\system32\DRIVERS\avmnwim.sys [412024 2011-07-05] (AVM Berlin)
S3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [269968 2012-07-04] (Realtek Semiconductor Corp.)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20288 2012-08-03] (Hewlett-Packard Development Company, L.P.)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-05-25 10:40 - 2015-05-25 10:40 - 00000996 _____ () C:\Users\a.berndt\Desktop\JRT.txt
2015-05-25 10:39 - 2015-05-25 10:39 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-TSVTM-NB-002-Windows-8.1-(64-bit).dat
2015-05-25 10:39 - 2015-05-25 10:39 - 00000000 ____D () C:\RegBackup
2015-05-25 10:19 - 2015-05-25 10:19 - 00001286 _____ () C:\Users\a.berndt\Desktop\Revo Uninstaller.lnk
2015-05-25 10:19 - 2015-05-25 10:19 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-05-25 06:14 - 2015-05-25 06:34 - 00000000 ____D () C:\Windows\Minidump
2015-05-25 06:13 - 2015-05-25 06:13 - 703627045 _____ () C:\Windows\MEMORY.DMP
2015-05-25 06:02 - 2015-05-26 04:51 - 00000000 ____D () C:\FRST
2015-05-25 05:03 - 2015-05-25 10:26 - 00000000 ____D () C:\Windows\system32\log
2015-05-25 04:49 - 2015-05-25 04:49 - 00000000 ____D () C:\Users\a.berndt\Documents\ProcAlyzer Dumps
2015-05-25 01:56 - 2015-05-25 04:48 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-05-25 01:56 - 2015-05-25 01:58 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-05-25 01:56 - 2015-05-25 01:56 - 00001409 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-05-25 01:56 - 2015-05-25 01:56 - 00001397 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2015-05-25 01:56 - 2015-05-25 01:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-05-25 01:56 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2015-05-24 22:11 - 2015-05-24 22:11 - 00000000 ____D () C:\Users\a.berndt\Desktop\Alte Firefox-Daten
2015-05-24 20:11 - 2015-05-24 20:11 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-05-24 02:46 - 2015-05-24 02:46 - 00000000 ____D () C:\ProgramData\McAfee
2015-05-24 01:54 - 2015-05-25 06:41 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-24 01:54 - 2015-05-24 01:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-05-24 01:54 - 2015-05-24 01:54 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-05-24 01:54 - 2015-05-24 01:54 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-05-24 01:54 - 2015-04-14 09:38 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-05-24 01:54 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-05-24 01:54 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-05-21 07:11 - 2015-05-21 07:11 - 06448912 _____ (Tim Kosse) C:\Users\a.berndt\Downloads\FileZilla_3.11.0_win64-setup.exe
2015-05-18 16:47 - 2015-05-18 16:47 - 00010652 _____ () C:\Users\a.berndt\AppData\Local\recently-used.xbel
2015-05-15 17:31 - 2015-05-15 17:31 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-04-30 06:26 - 2015-04-30 06:26 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2015-04-30 05:10 - 2015-04-30 05:12 - 00000000 ____D () C:\Users\a.berndt\AppData\Local\CAO-FAKTURA
2015-04-30 04:26 - 2015-04-30 04:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CAO-FAKTURA
2015-04-30 04:26 - 2006-03-27 19:59 - 00046080 _____ () C:\Windows\SysWOW64\rbide.fra
2015-04-30 04:26 - 2006-03-27 19:59 - 00046080 _____ () C:\Windows\SysWOW64\rbide.esp
2015-04-30 04:26 - 2006-03-27 19:59 - 00045056 _____ () C:\Windows\SysWOW64\rbide.ita
2015-04-30 04:26 - 2006-03-27 19:59 - 00040448 _____ () C:\Windows\SysWOW64\rbide.eng
2015-04-30 04:26 - 2006-03-27 19:59 - 00040448 _____ () C:\Windows\SysWOW64\rbide.cst
2015-04-30 04:26 - 2006-03-27 19:59 - 00024576 _____ () C:\Windows\SysWOW64\rbprint.fra
2015-04-30 04:26 - 2006-03-27 19:59 - 00023552 _____ () C:\Windows\SysWOW64\rbprint.ita
2015-04-30 04:26 - 2006-03-27 19:59 - 00023552 _____ () C:\Windows\SysWOW64\rbprint.esp
2015-04-30 04:26 - 2006-03-27 19:59 - 00022016 _____ () C:\Windows\SysWOW64\rbprint.eng
2015-04-30 04:26 - 2006-03-27 19:59 - 00022016 _____ () C:\Windows\SysWOW64\rbprint.cst
2015-04-30 04:26 - 2006-03-27 19:59 - 00021504 _____ () C:\Windows\SysWOW64\rbDADE.fra
2015-04-30 04:26 - 2006-03-27 19:59 - 00020992 _____ () C:\Windows\SysWOW64\rbDADE.esp
2015-04-30 04:26 - 2006-03-27 19:59 - 00020480 _____ () C:\Windows\SysWOW64\rbDADE.ita
2015-04-30 04:26 - 2006-03-27 19:59 - 00019968 _____ () C:\Windows\SysWOW64\rbDADE.eng
2015-04-30 04:26 - 2006-03-27 19:59 - 00017920 _____ () C:\Windows\SysWOW64\rbRAP.ita
2015-04-30 04:26 - 2006-03-27 19:59 - 00017920 _____ () C:\Windows\SysWOW64\rbRAP.fra
2015-04-30 04:26 - 2006-03-27 19:59 - 00017920 _____ () C:\Windows\SysWOW64\rbRAP.esp
2015-04-30 04:26 - 2006-03-27 19:59 - 00017408 _____ () C:\Windows\SysWOW64\rbRAP.eng
2015-04-30 04:26 - 2006-03-27 19:59 - 00017408 _____ () C:\Windows\SysWOW64\rbRAP.cst
2015-04-30 04:26 - 2006-03-27 18:59 - 00047616 _____ () C:\Windows\SysWOW64\rbide.deu
2015-04-30 04:26 - 2006-03-27 18:59 - 00023552 _____ () C:\Windows\SysWOW64\rbprint.deu
2015-04-30 04:26 - 2006-03-27 18:59 - 00021504 _____ () C:\Windows\SysWOW64\rbDADE.deu
2015-04-30 04:26 - 2006-03-27 18:59 - 00017920 _____ () C:\Windows\SysWOW64\rbRAP.deu
2015-04-30 04:24 - 2015-04-30 05:12 - 00000000 ____D () C:\Program Files (x86)\CAO-Faktura
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-05-26 04:31 - 2015-02-12 05:16 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-26 04:00 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\sru
2015-05-26 03:09 - 2015-01-19 10:00 - 01609482 _____ () C:\Windows\WindowsUpdate.log
2015-05-26 00:48 - 2015-02-04 06:58 - 00003958 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{2E0E0009-6A8B-4D01-A714-C8828DBBDE34}
2015-05-25 10:36 - 2015-02-15 20:42 - 00000000 ____D () C:\AdwCleaner
2015-05-25 10:31 - 2015-02-01 08:43 - 00000000 ____D () C:\Users\a.berndt\AppData\Roaming\Raptr
2015-05-25 10:27 - 2013-08-22 16:46 - 00032550 _____ () C:\Windows\setupact.log
2015-05-25 10:27 - 2013-08-22 16:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-25 10:26 - 2014-09-23 23:06 - 00954058 _____ () C:\Windows\PFRO.log
2015-05-25 06:22 - 2015-02-01 00:17 - 00000000 ____D () C:\Users\a.berndt\AppData\Roaming\vlc
2015-05-25 06:15 - 2015-02-01 00:07 - 00000000 ____D () C:\Users\a.berndt
2015-05-24 22:17 - 2015-01-30 05:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-24 22:17 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2015-05-24 02:46 - 2015-02-12 05:16 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-05-24 02:46 - 2015-02-01 03:51 - 00000000 ____D () C:\Users\a.berndt\AppData\Local\Adobe
2015-05-24 02:34 - 2014-09-24 08:17 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-24 02:34 - 2014-09-24 07:43 - 00765582 _____ () C:\Windows\system32\perfh007.dat
2015-05-24 02:34 - 2014-09-24 07:43 - 00159366 _____ () C:\Windows\system32\perfc007.dat
2015-05-24 02:30 - 2015-02-01 08:43 - 00000000 ____D () C:\Program Files (x86)\Raptr
2015-05-24 02:28 - 2015-04-21 15:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox.bak
2015-05-23 03:51 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\FxsTmp
2015-05-22 00:34 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-05-21 07:29 - 2015-02-01 00:15 - 00000000 ____D () C:\Users\a.berndt\AppData\Roaming\FileZilla
2015-05-20 01:36 - 2013-08-22 17:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-05-14 15:47 - 2015-02-03 11:59 - 00000000 ____D () C:\Users\a.berndt\AppData\Roaming\foobar2000
2015-05-12 02:25 - 2015-02-03 17:39 - 00000000 ____D () C:\Users\a.berndt\AppData\Local\Microsoft Help
2015-05-07 06:40 - 2015-02-15 19:31 - 00000000 ____D () C:\Users\a.berndt\AppData\Roaming\MyPhoneExplorer
2015-05-06 13:51 - 2015-02-01 02:47 - 00000000 ____D () C:\ProgramData\Oracle
2015-05-06 13:51 - 2015-02-01 02:47 - 00000000 ____D () C:\Program Files (x86)\Java
2015-05-06 13:50 - 2015-02-01 02:48 - 00097888 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-04-30 04:24 - 2015-02-01 00:07 - 00000000 ____D () C:\Users\a.berndt\AppData\Local\VirtualStore
2015-04-29 04:24 - 2015-03-21 17:32 - 00000000 ____D () C:\Program Files (x86)\phase5
2015-04-27 04:01 - 2015-04-06 20:59 - 00000000 ____D () C:\Users\a.berndt\AppData\Roaming\avidemux
2015-04-26 00:03 - 2015-02-07 19:44 - 00000000 ____D () C:\Users\a.berndt\AppData\Roaming\dvdcss
==================== Files in the root of some directories =======
2015-05-18 16:47 - 2015-05-18 16:47 - 0010652 _____ () C:\Users\a.berndt\AppData\Local\recently-used.xbel
2015-04-08 02:13 - 2015-04-08 02:13 - 0007597 _____ () C:\Users\a.berndt\AppData\Local\Resmon.ResmonCfg
Some files in TEMP:
====================
C:\Users\a.berndt\AppData\Local\Temp\AutoDetectUtilApp.exe
C:\Users\a.berndt\AppData\Local\Temp\jre-8u45-windows-au.exe
C:\Users\a.berndt\AppData\Local\Temp\Quarantine.exe
C:\Users\a.berndt\AppData\Local\Temp\raptrpatch.exe
C:\Users\a.berndt\AppData\Local\Temp\raptr_stub.exe
C:\Users\a.berndt\AppData\Local\Temp\sdanircmdc.exe
C:\Users\a.berndt\AppData\Local\Temp\sdapskill.exe
C:\Users\a.berndt\AppData\Local\Temp\sdaspwn.exe
C:\Users\a.berndt\AppData\Local\Temp\sqlite3.dll
C:\Users\Dessau\AppData\Local\Temp\gkey.exe
C:\Users\Dessau\AppData\Local\Temp\pkeyui.exe
C:\Users\Dessau\AppData\Local\Temp\wabk.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-05-17 22:11
==================== End of log ============================
Auch nach einem Neustart besteht das Problem weiterhin! Für weitere Hilfe wäre ich dankbar. Geändert von BerndtAl (26.05.2015 um 04:43 Uhr) |
|
26.05.2015, 19:03
| #6 |
| /// the machine /// TB-Ausbilder | Win 8.1 64bit, Firefox & IE: Webadresse wird automatisch weitergeleitet getallmysocks.tk / benaughty.com Revo Uninstaller - Download - Filepony damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren. Dann: https://support.mozilla.org/de/kb/fi...einfach-loesen Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter RemoveProxy:
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Frisches FRST log bitte. Problem weg?
__________________ --> Win 8.1 64bit, Firefox & IE: Webadresse wird automatisch weitergeleitet getallmysocks.tk / benaughty.com |
|
| Themen zu Win 8.1 64bit, Firefox & IE: Webadresse wird automatisch weitergeleitet getallmysocks.tk / benaughty.com |
| 64bit, andere, automatisch, bestimmte, bestimmten, dankbar, device driver, eingabe, einträge, elex-tech, eset, firefox, gestern, google, mbam, safer networking, scans, sekunden, spybot, suche, tools, troja, umgeleitet, verschiedene, verschiedenen, virus, weitergeleitet, win |
dann auf 
und dann auf 
. 
Linear-Darstellung
