| |
| |||||||
Log-Analyse und Auswertung: Unbefugter Zugriff auf meinem Ebay-Account evtl. wegen Polizei Virus/Trojaner?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
07.06.2015, 01:29
| #1 |
| |  Unbefugter Zugriff auf meinem Ebay-Account evtl. wegen Polizei Virus/Trojaner? Hallo miteinander, ich habe leider feststellen müssen ,dass ich gestern per E-mail darüber informiert wurde ,dass ein unbefugter Zugriff oder zumindest der Versuch auf meinen Ebay Account zuzugreifen, stattfand. Ich habe daraufhin das Passwort geändert und als ich mich einloggte fand ich auch dort im Postfach von Ebay diese Information. Es wäre evtl. möglich ,dass meine Login-Daten auf einem Rechner eines guten Freundes noch gespeichert waren und er versehentlich versucht hat sich einzuloggen , leider ist dieser momentan nicht so schnell zu erreichen. Allerdings bin ich vor rund einem Monat beim surfen auf eine Seite gestoßen,die mir suggerieren sollte ,dass ich eine Straftat begangen haben soll und aus diesem Grund so schnell wie möglich einen Betrag X an die "Polizei" überweisen solle. Mir war klar ,dass dies lediglich ein Betrugsversuch war , der PC war aber nicht komplett gesperrt , die Seite war lediglich etwas schwerer zu schließen. Anschließend habe ich Avira durchlaufen lassen, zwei mal gab es Funde , beim dritten Durchlauf wurde allerdings nichts mehr gefunden. Nun wollte ich nochmal auf Nummer sicher gehen und poste hier mal meine Logs (Avira lief voher nochmal durch, wieder ohne Fund) Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 22:54 on 06/06/2015 (Thorsten)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:06-06-2015
Ran by Thorsten (administrator) on THORSTENSPC on 06-06-2015 22:55:26
Running from C:\Users\Thorsten\Desktop
Loaded Profiles: Thorsten (Available Profiles: UpdatusUser & Thorsten)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() C:\Windows\SysWOW64\PnkBstrB.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Akamai Technologies, Inc.) C:\Users\Thorsten\AppData\Local\Akamai\netsession_win.exe
(Akamai Technologies, Inc.) C:\Users\Thorsten\AppData\Local\Akamai\netsession_win.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe
(Aeria Games & Entertainment) C:\Program Files (x86)\Aeria Games\Ignite\aeriaignite.exe
(X-LEGEND Entertaimment) C:\AeriaGames\AuraKingdom-DE\game.bin
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_188.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_188.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12936848 2012-07-13] (Realtek Semiconductor)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.)
HKLM-x32\...\Run: [ASUSWebStorage] => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.9.120\AsusWSPanel.exe [3417984 2012-08-28] (ASUS Cloud Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [728312 2015-05-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Aeria Ignite] => C:\Program Files (x86)\Aeria Games\Ignite\aeriaignite.exe [1925656 2013-06-06] (Aeria Games & Entertainment)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-255962105-985920218-571566852-1002\...\Run: [Akamai NetSession Interface] => C:\Users\Thorsten\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-30] (Akamai Technologies, Inc.)
HKU\S-1-5-21-255962105-985920218-571566852-1002\...\MountPoints2: {134ee290-6475-11e3-824e-806e6f6e6963} - "E:\autoplay.exe"
Startup: C:\Users\Thorsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk [2013-04-26]
ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
ShellIconOverlayIdentifiers: [AsusWSShellExt_B] -> {6D4133E5-0742-4ADC-8A8C-9303440F7190} => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.9.120\ASUSWSShellExt64.dll [2012-03-13] (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [AsusWSShellExt_O] -> {64174815-8D98-4CE6-8646-4C039977D808} => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.9.120\ASUSWSShellExt64.dll [2012-03-13] (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [AsusWSShellExt_U] -> {1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4D} => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.9.120\ASUSWSShellExt64.dll [2012-03-13] (ASUS Cloud Corporation.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-255962105-985920218-571566852-1002\Software\Microsoft\Internet Explorer\Main,Start Page Before = hxxp://asus13.msn.com
SearchScopes: HKLM-x32 -> DefaultScope value is missing
SearchScopes: HKU\S-1-5-21-255962105-985920218-571566852-1002 -> DefaultScope {76983651-C0E3-43FF-BC88-D588898C2B16} URL =
SearchScopes: HKU\S-1-5-21-255962105-985920218-571566852-1002 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-255962105-985920218-571566852-1002 -> {76983651-C0E3-43FF-BC88-D588898C2B16} URL =
BHO: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus64.dll [2014-08-12] (Adblock Plus)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-05-13] (Oracle Corporation)
BHO-x32: ArcPluginIEBHO Class -> {84BFE29A-8139-402a-B2A4-C23AE9E1A75F} -> C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\ArcPluginIE.dll [2013-05-17] (Perfect World Entertainment Inc)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-05-13] (Oracle Corporation)
BHO-x32: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll [2014-08-12] (Adblock Plus)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Thorsten\AppData\Roaming\Mozilla\Firefox\Profiles\3aym6c2c.default-1402245828597
FF Homepage: hxxp://google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-06-03] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-06-03] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-13] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-13] (Oracle Corporation)
FF Plugin-x32: @ngm.nexoneu.com/NxGame -> C:\ProgramData\NexonEU\NGM\npNxGameEU.dll [2013-10-12] (Nexon)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @perfectworld.com/npArcPlayNowPlugin -> C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\npArcPluginFF.dll [2013-05-17] (Perfect World Entertainment Inc)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-19] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-19] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-255962105-985920218-571566852-1002: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Thorsten\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2013-03-24] (Unity Technologies ApS)
FF Extension: YouTube Unblocker - C:\Users\Thorsten\AppData\Roaming\Mozilla\Firefox\Profiles\3aym6c2c.default-1402245828597\Extensions\youtubeunblocker@unblocker.yt [2015-06-05]
FF Extension: CSS Converter - C:\Users\Thorsten\AppData\Roaming\Mozilla\Firefox\Profiles\3aym6c2c.default-1402245828597\Extensions\{8ceba4dc-4c97-46aa-b423-a28c36c58424}.xpi [2014-11-26]
FF Extension: Adblock Plus - C:\Users\Thorsten\AppData\Roaming\Mozilla\Firefox\Profiles\3aym6c2c.default-1402245828597\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-06-08]
FF Extension: {e87dd6a9-3267-4d3a-b907-ca68ba25176f} - C:\Users\Thorsten\AppData\Roaming\Mozilla\Firefox\Profiles\3aym6c2c.default-1402245828597\Extensions\{e87dd6a9-3267-4d3a-b907-ca68ba25176f}.xpi [2014-11-14]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2013-04-26] (Adobe Systems) [File not signed]
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [827640 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [434424 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [434424 2015-05-05] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1185584 2015-05-05] (Avira Operations GmbH & Co. KG)
S3 ArcService; C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcService.exe [88424 2013-05-17] (Perfect World Entertainment Inc)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2451456 2012-07-13] (Realsil Microelectronics Inc.) [File not signed]
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272176 2012-11-15] ()
S3 npggsvc; C:\WINDOWS\SysWOW64\GameMon.des [4868640 2013-08-25] (INCA Internet Co., Ltd.)
R2 PnkBstrA; C:\WINDOWS\SysWOW64\PnkBstrA.exe [75136 2014-05-29] ()
R2 PnkBstrB; C:\WINDOWS\SysWOW64\PnkBstrB.exe [189248 2014-05-29] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [1153840 2012-11-15] (Intel® Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3837440 2013-08-14] (Qualcomm Atheros Communications, Inc.)
R3 ATP; C:\Windows\System32\drivers\AsusTP.sys [61824 2012-10-31] (ASUS Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [152744 2015-05-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132120 2015-05-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43576 2015-02-12] (Avira Operations GmbH & Co. KG)
R2 EkaProt6; C:\Windows\system32\DRIVERS\ekaprot6.sys [27288 2012-03-23] (Ekahau Inc.)
R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [14992 2012-08-02] ( )
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
S3 EagleX64; \??\C:\WINDOWS\system32\drivers\EagleX64.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-06 22:55 - 2015-06-06 22:55 - 00017750 _____ C:\Users\Thorsten\Desktop\FRST.txt
2015-06-06 22:55 - 2015-06-06 22:49 - 02108928 _____ (Farbar) C:\Users\Thorsten\Desktop\FRST64.exe
2015-06-06 22:54 - 2015-06-06 22:54 - 00000478 _____ C:\Users\Thorsten\Desktop\defogger_disable.log
2015-06-06 22:54 - 2015-06-06 22:47 - 00050477 _____ C:\Users\Thorsten\Desktop\Defogger.exe
2015-06-06 22:52 - 2015-06-06 22:53 - 00040822 _____ C:\Users\Thorsten\Downloads\Addition.txt
2015-06-06 22:50 - 2015-06-06 22:55 - 00000000 ____D C:\FRST
2015-06-06 22:50 - 2015-06-06 22:53 - 00034116 _____ C:\Users\Thorsten\Downloads\FRST.txt
2015-06-06 22:49 - 2015-06-06 22:49 - 02108928 _____ (Farbar) C:\Users\Thorsten\Downloads\FRST64.exe
2015-06-06 22:47 - 2015-06-06 22:49 - 00000478 _____ C:\Users\Thorsten\Downloads\defogger_disable.log
2015-06-06 22:47 - 2015-06-06 22:47 - 00050477 _____ C:\Users\Thorsten\Downloads\Defogger.exe
2015-06-06 22:47 - 2015-06-06 22:47 - 00000000 _____ C:\Users\Thorsten\defogger_reenable
2015-06-03 23:06 - 2015-06-03 23:06 - 00000000 ____D C:\Users\Thorsten\AppData\Local\GWX
2015-06-02 22:03 - 2015-06-03 23:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-05-13 08:19 - 2015-04-30 22:35 - 00124112 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 08:19 - 2015-04-30 22:35 - 00102608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 01:06 - 2015-05-01 01:05 - 00429568 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2015-05-13 01:06 - 2015-05-01 00:48 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2015-05-13 01:06 - 2015-04-24 23:32 - 00036864 _____ (Microsoft Corporation) C:\WINDOWS\system32\UtcResources.dll
2015-05-13 01:06 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-05-13 01:06 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-05-13 01:06 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2015-05-13 01:06 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-05-13 01:06 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll
2015-05-13 01:06 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-05-13 01:06 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-05-13 01:06 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-05-13 01:06 - 2015-04-21 18:13 - 00107520 _____ (Microsoft Corporation) C:\WINDOWS\system32\inseng.dll
2015-05-13 01:06 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-05-13 01:06 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2015-05-13 01:06 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2015-05-13 01:06 - 2015-04-21 18:07 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2015-05-13 01:06 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2015-05-13 01:06 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-05-13 01:06 - 2015-04-21 17:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-05-13 01:06 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-05-13 01:06 - 2015-04-21 17:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2015-05-13 01:06 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-05-13 01:06 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2015-05-13 01:06 - 2015-04-21 17:49 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2015-05-13 01:06 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-05-13 01:06 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-05-13 01:06 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2015-05-13 01:06 - 2015-04-21 17:37 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2015-05-13 01:06 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2015-05-13 01:06 - 2015-04-21 17:32 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-05-13 01:06 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-05-13 01:06 - 2015-04-21 17:28 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2015-05-13 01:06 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-05-13 01:06 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-05-13 01:06 - 2015-04-21 17:26 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2015-05-13 01:06 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2015-05-13 01:06 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-05-13 01:06 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-05-13 01:06 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-05-13 01:06 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-05-13 01:06 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-05-13 01:06 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-05-13 01:06 - 2015-04-14 00:48 - 04180480 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-05-13 01:06 - 2015-04-10 03:00 - 01996800 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2015-05-13 01:06 - 2015-04-10 02:50 - 01387008 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2015-05-13 01:06 - 2015-04-10 02:34 - 02256896 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2015-05-13 01:06 - 2015-04-10 02:26 - 01560576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2015-05-13 01:06 - 2015-04-10 02:11 - 01943040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2015-05-13 01:06 - 2015-04-09 00:55 - 00410128 _____ (Microsoft Corporation) C:\WINDOWS\system32\services.exe
2015-05-13 01:06 - 2015-04-03 02:35 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhotoMetadataHandler.dll
2015-05-13 01:06 - 2015-04-03 02:14 - 00364544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhotoMetadataHandler.dll
2015-05-13 01:06 - 2015-04-02 00:22 - 02985984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll
2015-05-13 01:06 - 2015-04-02 00:20 - 04417536 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll
2015-05-13 01:06 - 2015-04-01 05:45 - 01491456 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbghelp.dll
2015-05-13 01:06 - 2015-04-01 04:31 - 01207296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbghelp.dll
2015-05-13 01:06 - 2015-03-30 07:47 - 00561928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2015-05-13 01:06 - 2015-03-27 05:27 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2015-05-13 01:06 - 2015-03-27 04:50 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2015-05-13 01:06 - 2015-03-27 04:48 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2015-05-13 01:06 - 2015-03-20 03:56 - 00080384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys
2015-05-13 01:06 - 2015-03-17 19:26 - 00467776 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2015-05-13 01:06 - 2015-03-13 06:03 - 00239424 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2015-05-13 01:06 - 2015-03-13 06:03 - 00154432 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2015-05-13 01:06 - 2015-03-13 04:02 - 00316416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\udfs.sys
2015-05-13 01:06 - 2015-03-13 03:11 - 02162176 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll
2015-05-13 01:06 - 2015-03-13 02:39 - 01812992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SRH.dll
2015-05-13 01:06 - 2015-03-13 02:29 - 00410017 _____ C:\WINDOWS\system32\ApnDatabase.xml
2015-05-13 01:06 - 2015-03-11 03:49 - 00024576 _____ (Microsoft Corporation) C:\WINDOWS\system32\sdbinst.exe
2015-05-13 01:06 - 2015-03-11 03:09 - 00021504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sdbinst.exe
2015-05-13 01:06 - 2015-03-09 04:02 - 00057856 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthhfenum.sys
2015-05-13 01:06 - 2015-03-06 05:08 - 02067968 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpdshext.dll
2015-05-13 01:06 - 2015-03-06 04:47 - 01696256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
2015-05-13 01:06 - 2015-03-06 04:43 - 01969664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpdshext.dll
2015-05-13 01:06 - 2015-03-05 01:09 - 01429504 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2015-05-13 01:06 - 2015-03-04 03:32 - 00172544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Input.Inking.dll
2015-05-13 01:06 - 2015-03-04 03:12 - 00141824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Input.Inking.dll
2015-05-13 01:06 - 2015-02-18 01:19 - 00186368 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpapisrv.dll
2015-05-13 01:06 - 2015-01-30 02:53 - 02819584 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll
2015-05-13 01:06 - 2014-11-14 08:58 - 00116736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsDatabase.dll
2015-05-08 05:13 - 2015-05-08 05:49 - 00136408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-05-08 05:13 - 2015-05-08 05:13 - 00001112 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-05-08 05:13 - 2015-05-08 05:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-05-08 05:13 - 2015-05-08 05:13 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-05-08 05:13 - 2015-05-08 05:13 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-05-08 05:13 - 2015-04-14 09:38 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-05-08 05:13 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-05-08 05:13 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-05-08 05:12 - 2015-05-08 05:12 - 01203488 _____ C:\Users\Thorsten\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-06 22:47 - 2013-12-14 06:14 - 00000000 ____D C:\Users\Thorsten
2015-06-06 22:36 - 2013-12-14 06:09 - 01743885 _____ C:\WINDOWS\WindowsUpdate.log
2015-06-06 22:27 - 2013-03-14 01:13 - 00001142 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-06 22:01 - 2014-06-01 08:16 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-06-06 22:00 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\sru
2015-06-06 09:15 - 2013-08-22 16:46 - 00375280 _____ C:\WINDOWS\setupact.log
2015-06-06 02:33 - 2012-07-26 09:59 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-06-06 00:27 - 2013-03-14 01:13 - 00001138 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-03 23:08 - 2014-10-17 22:33 - 00000000 ____D C:\Users\Thorsten\AppData\Local\Adobe
2015-06-03 23:08 - 2014-06-01 08:16 - 00003772 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-05-20 12:20 - 2013-09-30 05:18 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-05-20 12:15 - 2013-03-05 23:44 - 140425016 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-05-20 12:13 - 2015-04-05 06:39 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX
2015-05-20 12:13 - 2015-04-05 06:39 - 00000000 ___SD C:\WINDOWS\system32\GWX
2015-05-19 00:22 - 2013-03-14 01:13 - 00004114 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-19 00:22 - 2013-03-14 01:13 - 00003878 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-17 22:40 - 2014-11-04 21:50 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-15 01:47 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\rescache
2015-05-15 01:05 - 2013-03-04 21:39 - 00003594 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-255962105-985920218-571566852-1002
2015-05-14 23:11 - 2013-03-07 23:58 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-13 22:39 - 2014-06-01 08:11 - 00000000 ____D C:\ProgramData\Oracle
2015-05-13 22:39 - 2014-06-01 08:11 - 00000000 ____D C:\Program Files (x86)\Java
2015-05-13 22:38 - 2014-06-01 08:11 - 00097888 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2015-05-13 22:38 - 2014-06-01 08:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-05-13 22:26 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-05-13 22:26 - 2013-08-22 16:44 - 00338072 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-05-13 22:25 - 2013-11-14 00:18 - 01949108 _____ C:\WINDOWS\PFRO.log
2015-05-13 22:21 - 2013-08-22 17:36 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2015-05-13 22:21 - 2013-08-22 15:36 - 00000000 ____D C:\WINDOWS\system32\AdvancedInstallers
2015-05-13 08:06 - 2013-11-14 09:13 - 00000000 ____D C:\Program Files\Windows Journal
2015-05-08 05:48 - 2013-06-18 21:04 - 00000000 ____D C:\WINDOWS\pss
==================== Files in the root of some directories =======
2013-03-28 02:43 - 2013-11-01 03:02 - 0003584 _____ () C:\Users\Thorsten\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-08-16 12:59 - 2012-07-30 08:03 - 0000217 _____ () C:\ProgramData\SetStretch.cmd
2012-08-16 12:59 - 2009-07-22 12:04 - 0024576 _____ () C:\ProgramData\SetStretch.exe
Files to move or delete:
====================
C:\ProgramData\SetStretch.exe
Some files in TEMP:
====================
C:\Users\Thorsten\AppData\Local\Temp\avgnt.exe
C:\Users\Thorsten\AppData\Local\Temp\CmdLineExt02.dll
C:\Users\Thorsten\AppData\Local\Temp\dxwebsetup.exe
C:\Users\Thorsten\AppData\Local\Temp\jre-7u60-windows-i586-iftw.exe
C:\Users\Thorsten\AppData\Local\Temp\jre-8u45-windows-au.exe
C:\Users\Thorsten\AppData\Local\Temp\Quarantine.exe
C:\Users\Thorsten\AppData\Local\Temp\riftuninstall.exe
C:\Users\Thorsten\AppData\Local\Temp\SIntf16.dll
C:\Users\Thorsten\AppData\Local\Temp\SIntf32.dll
C:\Users\Thorsten\AppData\Local\Temp\SIntfNT.dll
C:\Users\Thorsten\AppData\Local\Temp\Uninstaller-3820.exe
C:\Users\Thorsten\AppData\Local\Temp\vcredist_x86.exe
C:\Users\Thorsten\AppData\Local\Temp\war3_Install.exe
C:\Users\Thorsten\AppData\Local\Temp\ZoomIt64.exe
C:\Users\Thorsten\AppData\Local\Temp\_isBE02.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-06-06 05:57
==================== End of log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version:06-06-2015
Ran by Thorsten at 2015-06-06 22:55:58
Running from C:\Users\Thorsten\Desktop
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-255962105-985920218-571566852-500 - Administrator - Disabled)
Gast (S-1-5-21-255962105-985920218-571566852-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-255962105-985920218-571566852-1006 - Limited - Enabled)
Thorsten (S-1-5-21-255962105-985920218-571566852-1002 - Administrator - Enabled) => C:\Users\Thorsten
UpdatusUser (S-1-5-21-255962105-985920218-571566852-1001 - Limited - Enabled) => C:\Users\UpdatusUser
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
21Nova Casino (HKU\S-1-5-21-255962105-985920218-571566852-1002\...\32 Vegas Casino) (Version: - )
Adblock Plus für IE (32-Bit- und 64-Bit) (HKLM\...\{123A22CB-6D84-4135-A71F-886C9119E996}) (Version: 99.9 - Eyeo GmbH)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.188 - Adobe Systems Incorporated)
Adobe Photoshop CS2 (HKLM-x32\...\Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0407-1E257A25E34D}) (Version: 9.0 - Adobe Systems, Inc.)
Adobe Reader XI (11.0.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
Aeria Ignite (HKLM-x32\...\Aeria Ignite 1.13.3296) (Version: 1.13.3296 - Aeria Games & Entertainment)
Aeria Ignite (HKLM-x32\...\Aeria Ignite) (Version: 1.13.3296 - Aeria Games & Entertainment)
Aeria Ignite (x32 Version: 1.13.3296 - Aeria Games & Entertainment) Hidden
Akamai NetSession Interface (HKU\S-1-5-21-255962105-985920218-571566852-1002\...\Akamai) (Version: - Akamai Technologies, Inc)
Arc (HKLM-x32\...\{CED8E25B-122A-4E80-B612-7F99B93284B3}) (Version: 1.0.0.5510 - Perfect World Entertainment)
ASUS LifeFrame3 (HKLM-x32\...\{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}) (Version: 3.1.9 - ASUS)
ASUS Product Demo Movie (HKLM-x32\...\{DC06C90B-C5BE-42F6-B74D-A9503170998C}) (Version: 1.0.3 - ASUS )
ASUS Smart Gesture (HKLM-x32\...\{4D3286A6-F6AB-498A-82A4-E4F040529F3D}) (Version: 1.0.35 - ASUS)
ASUS Tutor (HKLM-x32\...\{58172D66-2F69-4215-9AEC-ED8196023736}) (Version: 1.0.7 - ASUS)
ASUS USB Charger Plus (HKLM-x32\...\{A859E3E5-C62F-4BFA-AF1D-2B95E03166AF}) (Version: 2.1.5 - ASUS)
ASUS WebStorage Sync Agent (HKLM-x32\...\ASUS WebStorage) (Version: 1.1.9.120 - ASUS Cloud Corporation)
ASUSDVD (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.4126.52 - CyberLink Corp.)
ASUSDVD (x32 Version: 10.0.4126.52 - CyberLink Corp.) Hidden
ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0025 - ASUS)
AuraKingdom-DE (HKLM-x32\...\AuraKingdom-DE) (Version: - )
AutoKeyPresser (HKU\S-1-5-21-255962105-985920218-571566852-1002\...\72882b240bbfe40f) (Version: 0.0.0.4 - Microsoft)
Avira (HKLM-x32\...\{b5675cc4-ab8b-4945-8c1d-4c5479556d6a}) (Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.10.434 - Avira Operations GmbH & Co. KG)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
concept/design onlineTV 11 (HKLM-x32\...\{8A4C3184-DA2F-4553-BF61-83F5690C3048}_is1) (Version: 11.2.0.0 - concept/design GmbH)
Core Temp 1.0 RC6 (HKLM\...\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1) (Version: 1.0 - Alcpu)
CPUID CPU-Z 1.69.2 (HKLM\...\CPUID CPU-Z_is1) (Version: - )
Dekaron (HKLM-x32\...\GlobalDK) (Version: - )
Dragon Nest Europe (HKLM-x32\...\Dragon Nest Europe) (Version: - )
DriverTuner 3.5.0.1 (HKLM-x32\...\{520C1D80-935C-42B9-9340-E883849D804F}_is1) (Version: 3.5.0.1 - LionSea Software co., ltd)
EdenEternal-DE (HKLM-x32\...\EdenEternal-DE) (Version: - )
EuroGrand Casino (HKU\S-1-5-21-255962105-985920218-571566852-1002\...\EuroGrand Casino) (Version: - )
Europa Casino (HKU\S-1-5-21-255962105-985920218-571566852-1002\...\Europa Casino) (Version: - )
Flyff (HKLM-x32\...\{7E210E1C-52A1-40E3-817B-D504E9F64DFA}_is1) (Version: Flyff - Gala Networks Europe Limited)
FlyFF (HKLM-x32\...\{B47D87A4-05B5-4AC3-B0D3-6543E1876D0E}_is1) (Version: - Webzen)
Fraps (HKLM-x32\...\Fraps) (Version: - )
Futuremark SystemInfo (HKLM-x32\...\{BEE64C14-BEF1-4610-8A68-A16EAA47B882}) (Version: 4.15.0 - Futuremark Corporation)
GDMO (HKLM-x32\...\DMO) (Version: - )
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3308 - Intel Corporation)
Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (HKLM\...\{F13921D6-AE6D-41BF-807A-17BD99C0A4FD}) (Version: 15.5.5.0480 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel® PROSet/Wireless WiFi-Software (HKLM\...\{962E1735-D2E0-4813-AB9F-C6CBA09E759A}) (Version: 15.05.7000.1709 - Intel Corporation)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
Last Chaos (HKLM-x32\...\Last Chaos) (Version: - )
Left 4 Dead 2 (HKLM-x32\...\Steam App 550) (Version: - Valve)
Loong - Dragonblood (HKLM-x32\...\{5C3A1F0E-DBAB-4475-8CA9-033DF72E29B2}) (Version: 2.04.0 - gamigo AG)
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Microsoft Office (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.6120.5004 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
MotioninJoy Gamepad tool 0.7.1001 (HKLM\...\{330DAC67-5B62-452A-A0E4-6B4A5923940F}_is1) (Version: 0.7.1001 - www.motioninjoy.com)
Mozilla Firefox 38.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.5 (x86 de)) (Version: 38.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.0.2 - Mozilla)
NVIDIA Grafiktreiber 331.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 331.65 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.12.1031 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.1031 - NVIDIA Corporation)
NVIDIA Update 1.12.12 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.12.12 - NVIDIA Corporation)
Origin (HKLM-x32\...\Origin) (Version: 9.4.7.2799 - Electronic Arts, Inc.)
Path of Exile (HKLM-x32\...\{90A4562F-D4A1-4B65-906D-41F236CF6902}) (Version: 1.3.1.39500 - Grinding Gear Games)
Pflanzen gegen Zombies™ (HKLM-x32\...\{5E6536C2-E79A-49CF-83EA-817AD81F9FC8}) (Version: 1.2.0.1093 - Electronic Arts, Inc.)
Project 64 version 2.1.0.1 (HKLM-x32\...\Project 64_is1) (Version: 2.1.0.1 - )
Project64 1.6 (HKLM-x32\...\{9559F7CA-5E34-4237-A2D9-D856464AD727}) (Version: 1.6 - Project64)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.991 - Even Balance, Inc.)
Qualcomm Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Qualcomm Atheros)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.2.612.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6685 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.2.8400.27024 - Realtek Semiconductor Corp.)
Savage: The Battle For Newerth (Version: 1.0 - August 2012) (HKLM-x32\...\{DB508D2E-F284-4D1E-9776-92BB60DE3097}_is1) (Version: - Newerth.com)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Silkroad (HKLM-x32\...\Silkroad) (Version: - )
SilkroadR (HKLM-x32\...\SilkroadR) (Version: - )
Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.27614 - TeamViewer)
TechPowerUp GPU-Z (HKLM-x32\...\TechPowerUp GPU-Z) (Version: - TechPowerUp)
Unity Web Player (HKU\S-1-5-21-255962105-985920218-571566852-1002\...\UnityWebPlayer) (Version: - Unity Technologies ApS)
Warcraft III (HKLM-x32\...\Warcraft III) (Version: - )
Warcraft III: All Products (HKU\S-1-5-21-255962105-985920218-571566852-1002\...\Warcraft III) (Version: - )
Windows Driver Package - ASUS (ATP) Mouse (10/29/2012 1.0.0.148) (HKLM\...\C01F56FBD9B141017E63E2A1A141E59934D4DC67) (Version: 10/29/2012 1.0.0.148 - ASUS)
WinFlash (HKLM-x32\...\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 2.41.1 - ASUS)
WinRAR 4.20 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== Restore Points =========================
20-05-2015 10:21:13 Windows Update
28-05-2015 23:33:18 Geplanter Prüfpunkt
06-06-2015 02:32:17 Windows Update
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {1300D741-8FCB-4F15-B4C6-B173653C781C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-03-14] (Google Inc.)
Task: {15507542-6C04-4E1F-8967-3B344D60B285} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => schtasks
Task: {165791AF-B5B7-4B19-A39C-80CDD531BBB0} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-05-20] (Microsoft Corporation)
Task: {1873DD07-0D90-4257-ACBA-6C5840FDC833} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-06-03] (Adobe Systems Incorporated)
Task: {4E51CBBE-5BD7-4405-815C-9780A5EEFF4B} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {61B25AB2-6D76-44B5-AAB5-A25AE8105385} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\Logon => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {6213C14A-8E8E-4E9A-A0DE-9EF410432FE8} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {8DA66C14-7CA1-47FD-BEE0-2F6986F49FFD} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-03-14] (Google Inc.)
Task: {AC2F6A18-7FB9-4A79-8B26-5478078AB23E} - System32\Tasks\ASUS Touchpad Launcher (x64) => C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2012-10-31] (AsusTek)
Task: {B44B10BF-253B-4B3D-B9EB-E0EF476F9D3B} - System32\Tasks\{645824F4-FFCF-4293-9E19-BCC8967314AD} => pcalua.exe -a C:\ProgramData\Conduit\IE\CT3282698\UninstallerUI.exe -c -ctid=CT3282698 -toolbarName=SweetTunes1 -toolbarEnv=conduit -type=IE
Task: {B493F945-A34B-4557-A42B-6154179E6E5D} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {F03B5FAE-E71F-427E-8FA3-00F1F000B920} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-06] (Microsoft Corporation)
Task: {F4788564-4072-4DF3-84DD-EB971CFA004F} - System32\Tasks\ASUS USB Charger Plus => C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe [2012-09-18] (ASUSTek Computer Inc.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (Whitelisted) ==============
2014-05-29 21:52 - 2014-05-29 21:52 - 00075136 _____ () C:\WINDOWS\SysWOW64\PnkBstrA.exe
2014-05-29 21:52 - 2014-05-29 21:52 - 00189248 _____ () C:\WINDOWS\SysWOW64\PnkBstrB.exe
2013-12-10 09:13 - 2013-12-10 09:13 - 00013088 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2013-12-14 06:09 - 2013-10-23 10:20 - 00102176 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-10-01 14:02 - 2013-10-01 14:02 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2012-12-28 14:39 - 2012-06-25 12:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2013-12-10 09:13 - 2013-12-10 09:13 - 00013088 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
2013-06-06 23:59 - 2013-06-06 23:59 - 00158744 _____ () C:\Program Files (x86)\Aeria Games\Ignite\AGAkamai.dll
2015-01-23 00:52 - 2014-10-17 00:22 - 01857024 _____ () C:\AeriaGames\AuraKingdom-DE\ALAudio.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
IE trusted site: HKU\S-1-5-21-255962105-985920218-571566852-1002\...\aeriagames.com -> hxxps://aeriagames.com
IE trusted site: HKU\S-1-5-21-255962105-985920218-571566852-1002\...\aeriagames.com -> hxxp://aeriagames.com
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-255962105-985920218-571566852-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Thorsten\AppData\Roaming\Mozilla\Firefox\Desktop-Hintergrund.bmp
DNS Servers: 192.168.2.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\Run: => "Logitech Download Assistant"
HKLM\...\StartupApproved\Run32: => "RemoteControl10"
HKLM\...\StartupApproved\Run32: => "Aeria Ignite"
HKU\S-1-5-21-255962105-985920218-571566852-1002\...\StartupApproved\Run: => "Pando Media Booster"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [UDP Query User{4E0045EE-DF10-4613-86D5-F4CC350904B2}C:\users\thorsten\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\thorsten\appdata\local\akamai\netsession_win.exe
FirewallRules: [TCP Query User{BA895891-7667-4864-AB46-59D743038159}C:\users\thorsten\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\thorsten\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{B5FA7912-07A1-4725-AB99-10651FEEEF5B}C:\users\public\sony online entertainment\installed games\everquest ii psg\eq2voiceservice.exe] => (Allow) C:\users\public\sony online entertainment\installed games\everquest ii psg\eq2voiceservice.exe
FirewallRules: [TCP Query User{F5C0E49E-5CAB-4F7B-99C3-1E025E912FD5}C:\users\public\sony online entertainment\installed games\everquest ii psg\eq2voiceservice.exe] => (Allow) C:\users\public\sony online entertainment\installed games\everquest ii psg\eq2voiceservice.exe
FirewallRules: [{213C2A09-4780-4F52-A018-3A535CA31079}] => (Allow) C:\AeriaGames\EdenEternal-DE\_Launcher.exe
FirewallRules: [{7E220727-9B5B-4F41-96FC-880A22C9199A}] => (Allow) C:\AeriaGames\EdenEternal-DE\_Launcher.exe
FirewallRules: [UDP Query User{2B0B0BBF-1460-4139-90B2-0CE8A038A374}C:\users\thorsten\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\thorsten\appdata\local\akamai\netsession_win.exe
FirewallRules: [TCP Query User{A08E1CDE-B34E-4579-B777-A3B99B4ECCA0}C:\users\thorsten\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\thorsten\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{1EDA5FA2-ECF6-4181-8C43-2C1F6D910CE4}C:\users\thorsten\desktop\diablo 2\diablo ii\game.exe] => (Block) C:\users\thorsten\desktop\diablo 2\diablo ii\game.exe
FirewallRules: [TCP Query User{585D437B-1EDD-4541-840B-DD388AAE486F}C:\users\thorsten\desktop\diablo 2\diablo ii\game.exe] => (Block) C:\users\thorsten\desktop\diablo 2\diablo ii\game.exe
FirewallRules: [{16E35FEA-29C1-419E-AA83-E71C8E419983}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{F283AFEE-39E1-403E-81B2-D060CC64FD7A}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{9E6D8147-4448-49B7-BD8E-671A2004F26E}] => (Allow) C:\ProgramData\NexonEU\NGM\NGM.exe
FirewallRules: [{3B3237B2-61C2-4979-8EBD-F2B4D1409978}] => (Allow) C:\ProgramData\NexonEU\NGM\NGM.exe
FirewallRules: [UDP Query User{11E4F551-98A5-41AD-9806-BE20E70A6A46}C:\program files (x86)\savage xr\silverback.exe] => (Allow) C:\program files (x86)\savage xr\silverback.exe
FirewallRules: [TCP Query User{74B15D1E-1D4B-4662-9C1E-4FF3629CC896}C:\program files (x86)\savage xr\silverback.exe] => (Allow) C:\program files (x86)\savage xr\silverback.exe
FirewallRules: [UDP Query User{ACE378CC-A346-4469-8663-9F78E2529735}C:\program files (x86)\dragon's prophet\dp_x64.exe] => (Allow) C:\program files (x86)\dragon's prophet\dp_x64.exe
FirewallRules: [TCP Query User{5148EDF4-F2B9-4CD3-AD4C-5A8D02C6A261}C:\program files (x86)\dragon's prophet\dp_x64.exe] => (Allow) C:\program files (x86)\dragon's prophet\dp_x64.exe
FirewallRules: [UDP Query User{5D3C775F-5D68-4D8C-AED9-E900CB199392}C:\program files (x86)\dragon's prophet\launcher.exe] => (Allow) C:\program files (x86)\dragon's prophet\launcher.exe
FirewallRules: [TCP Query User{031DEE61-AA8C-4D7C-B117-171685717E1C}C:\program files (x86)\dragon's prophet\launcher.exe] => (Allow) C:\program files (x86)\dragon's prophet\launcher.exe
FirewallRules: [{9D311C50-127B-42B7-BE41-2F5B54C45753}] => (Allow) C:\Program Files (x86)\eFusion\Dragon Nest Europe\DragonNest.exe
FirewallRules: [{C94A15D1-0C5B-495B-95FE-F304ABBECAAA}] => (Allow) C:\Program Files (x86)\eFusion\Dragon Nest Europe\DragonNest.exe
FirewallRules: [{43899E5F-F8F2-4FAE-BC7B-C00E2CA5AB73}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1737\Agent.exe
FirewallRules: [{C17CF789-73D7-4A68-A875-DEA8C77DCCAA}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1737\Agent.exe
FirewallRules: [{7C73C929-8824-4F30-978D-271F63DC53EB}] => (Allow) C:\Users\Thorsten\AppData\Roaming\ICQM\icq.exe
FirewallRules: [{1968F1EB-D122-4A07-A030-C2C383F1B75A}] => (Allow) C:\Users\Thorsten\AppData\Roaming\ICQM\icq.exe
FirewallRules: [{D19A8D64-BA07-49A1-B4AD-04D1D5426217}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1675\Agent.exe
FirewallRules: [{31588F53-8C02-4610-83B5-9E0A87EBC93D}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1675\Agent.exe
FirewallRules: [{EDFA468D-7380-4C52-8E93-E214BBEDB7CE}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1544\Agent.exe
FirewallRules: [{D770488D-2AB6-4C6C-9172-37F0DB4AE05B}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1544\Agent.exe
FirewallRules: [{F1BEB0A0-B0A3-4EF8-A050-7CF6A1817E93}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{46F47454-6D9C-48B3-B516-2110D38C3430}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE
FirewallRules: [{91DBBBC6-663C-4E14-B912-7C14400D6DAC}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD Cinema\PowerDVDCinema10.exe
FirewallRules: [{9B66B4C2-A698-467E-9211-929985866071}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{26594280-023A-4E6B-9D5B-21090656C998}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{39B56C67-4137-4249-A73C-4BA2235B318A}] => (Allow) C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe
FirewallRules: [{A2646E18-975E-4633-BF71-ADE44CEEA2ED}] => (Allow) C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe
FirewallRules: [{7514B6AB-7EF4-40A8-992D-4E069A1E5286}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{B3862A41-922C-485D-9096-8CE68CD516B0}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{32285DE2-7CE2-4D5F-898A-7E3D081B6BC9}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Left 4 Dead 2\left4dead2.exe
FirewallRules: [{D9BD81C7-3D19-4067-B473-2505FA6AC2D9}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Left 4 Dead 2\left4dead2.exe
FirewallRules: [{A752BB7F-3064-4711-9446-13545C5898BA}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Left 4 Dead 2\left4dead2.exe
FirewallRules: [{F79F841C-09F4-4A1D-9CA9-191743F7F9A2}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Left 4 Dead 2\left4dead2.exe
FirewallRules: [TCP Query User{0EB6878A-0520-4089-99EC-4FD003908CF7}C:\users\thorsten\appdata\roaming\flyforheroinstaller\flyforheroinstaller.exe] => (Allow) C:\users\thorsten\appdata\roaming\flyforheroinstaller\flyforheroinstaller.exe
FirewallRules: [UDP Query User{0C5506FB-2824-4902-A566-6B8260DA58E4}C:\users\thorsten\appdata\roaming\flyforheroinstaller\flyforheroinstaller.exe] => (Allow) C:\users\thorsten\appdata\roaming\flyforheroinstaller\flyforheroinstaller.exe
FirewallRules: [TCP Query User{5E941447-EF17-497B-B4C6-C3BBE3CE7F3A}C:\users\thorsten\downloads\psror_full_client_downloader_v3.exe] => (Allow) C:\users\thorsten\downloads\psror_full_client_downloader_v3.exe
FirewallRules: [UDP Query User{1E41AB35-788C-4630-BCBA-0234DF0A2307}C:\users\thorsten\downloads\psror_full_client_downloader_v3.exe] => (Allow) C:\users\thorsten\downloads\psror_full_client_downloader_v3.exe
FirewallRules: [TCP Query User{CE3AF928-E631-4A96-85E0-1C9CDCFC2981}C:\program files (x86)\bitcoin\bitcoin-qt.exe] => (Allow) C:\program files (x86)\bitcoin\bitcoin-qt.exe
FirewallRules: [UDP Query User{70330F0C-2D90-4C75-B2F0-985556F34023}C:\program files (x86)\bitcoin\bitcoin-qt.exe] => (Allow) C:\program files (x86)\bitcoin\bitcoin-qt.exe
FirewallRules: [{E0F53AA3-142C-4D46-8DB6-25FACA099772}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2717\Agent.exe
FirewallRules: [{56DA875C-E7DB-4830-ACD8-944A5A8CBD6F}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2717\Agent.exe
FirewallRules: [{8D52D215-F332-4592-A370-E4E195ED3916}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2737\Agent.exe
FirewallRules: [{42B37C41-35A7-493E-BDBF-CBDAF8E86DF8}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2737\Agent.exe
FirewallRules: [{81F19320-0159-4178-A9CA-D84DE081CDC8}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [{DC52E727-E5AA-4A81-9FAE-C2596AFA0A22}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [{546576AE-2AD7-4127-B64F-19E7A297552A}] => (Allow) C:\Program Files (x86)\Hearthstone\Hearthstone.exe
FirewallRules: [{9B17A5BD-9995-4838-B8EB-89C4C38439D5}] => (Allow) C:\Program Files (x86)\Hearthstone\Hearthstone.exe
FirewallRules: [{9B3DA9D6-C495-4617-9DE4-71006AB97020}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2753\Agent.exe
FirewallRules: [{D3320E65-5500-4CA5-B0E9-28AE9F132736}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2753\Agent.exe
FirewallRules: [{B65C86EA-2042-4C27-987F-F27753FCAA9E}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{BC268498-9080-41EC-AE11-C701DE3972AF}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{A0541658-B2B8-4CCD-AA90-36163E9E0959}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{6AAF1DA5-090C-4949-9A82-6B502D23AF51}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{1240ACC9-2014-4B55-A71A-5C46418DA8E5}] => (Allow) C:\Program Files (x86)\Origin Games\Plants vs. Zombies\PlantsVsZombies.exe
FirewallRules: [{08C4B880-30F4-44D4-A58C-902998968C03}] => (Allow) C:\Program Files (x86)\Origin Games\Plants vs. Zombies\PlantsVsZombies.exe
FirewallRules: [{D2BF5499-A093-4752-9BA2-6E59D5311D69}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{3FD00302-CC83-4E87-B512-B0CB709ABC3A}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{86DAB914-71A7-4C30-BE39-B2486C99EDC2}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{C9344AB9-B3EE-40DA-86BA-D976F9005387}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [TCP Query User{A23066F9-995B-4925-94A6-5880079607F4}D:\warcraft iii\war3.exe] => (Allow) D:\warcraft iii\war3.exe
FirewallRules: [UDP Query User{B9F6F3D1-A30C-4F8B-B123-E1AD34116E40}D:\warcraft iii\war3.exe] => (Allow) D:\warcraft iii\war3.exe
FirewallRules: [{6D58F740-E2CF-400F-8761-DA900E2E3C8C}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3334\Agent.exe
FirewallRules: [{3DB7C70F-5EE5-42FB-8E84-75BDBE4D500A}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3334\Agent.exe
FirewallRules: [{E2716866-9D54-4A73-A2D3-AC57043C6D41}] => (Allow) C:\AeriaGames\AuraKingdom-DE\game.bin
FirewallRules: [{72CC2FEB-9A17-4BDD-8FD4-7147BB79C255}] => (Allow) C:\AeriaGames\AuraKingdom-DE\game.bin
FirewallRules: [{0B9FBB99-0135-49FB-9D7A-5DA349328C1A}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{CB548605-44C3-4ACE-8B7D-500F8CBB7EEB}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{D3A60880-205C-4696-B852-0A797976D144}] => (Allow) C:\Program Files (x86)\concept design\onlineTV 11\onlineTV.exe
FirewallRules: [{DBF4FF92-1733-454E-9B0B-C1FA619539A1}] => (Allow) C:\Program Files (x86)\concept design\onlineTV 11\onlineTV.exe
FirewallRules: [TCP Query User{8AA03E67-F2CC-4C9D-BBCD-D23594F0AE81}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{E27394AA-87C6-4B6C-81F8-6629493305AC}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (06/03/2015 11:02:43 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm game.bin, Version 4.1.1.11 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 30f0
Startzeit: 01d09e0815ef8457
Endzeit: 625
Anwendungspfad: C:\AeriaGames\AuraKingdom-DE\game.bin
Berichts-ID: dedd4180-0a33-11e5-bf02-08606e17acd3
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (06/01/2015 05:29:43 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm game.bin, Version 4.1.1.11 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1a08
Startzeit: 01d09a5e9862effb
Endzeit: 340
Anwendungspfad: C:\AeriaGames\AuraKingdom-DE\game.bin
Berichts-ID: 70b14303-080e-11e5-bf02-08606e17acd3
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (05/30/2015 00:26:24 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm game.bin, Version 4.1.1.11 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 2284
Startzeit: 01d098fa73693495
Endzeit: 4294967295
Anwendungspfad: C:\AeriaGames\AuraKingdom-DE\game.bin
Berichts-ID: bbe640d5-0651-11e5-bf02-08606e17acd3
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (05/28/2015 05:57:19 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm game.bin, Version 4.1.1.11 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1588
Startzeit: 01d098e426f4d86c
Endzeit: 1048
Anwendungspfad: C:\AeriaGames\AuraKingdom-DE\game.bin
Berichts-ID: 8532404c-04ed-11e5-bf02-08606e17acd3
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (05/28/2015 03:17:27 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm game.bin, Version 4.1.1.11 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 28a8
Startzeit: 01d098aba76ba11d
Endzeit: 746
Anwendungspfad: C:\AeriaGames\AuraKingdom-DE\game.bin
Berichts-ID: 3494828e-04d7-11e5-bf02-08606e17acd3
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (05/27/2015 02:49:47 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 38.0.1.5611, Zeitstempel: 0x55541a90
Name des fehlerhaften Moduls: mozalloc.dll, Version: 38.0.1.5611, Zeitstempel: 0x55540a1e
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001aa1
ID des fehlerhaften Prozesses: 0x1e4c
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Vollständiger Name des fehlerhaften Pakets: plugin-container.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: plugin-container.exe5
Error: (05/23/2015 10:29:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_17_0_0_169.exe, Version: 17.0.0.169, Zeitstempel: 0x5529da64
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x026c30b0
ID des fehlerhaften Prozesses: 0x13b0
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_17_0_0_169.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_17_0_0_169.exe1
Pfad des fehlerhaften Moduls: FlashPlayerPlugin_17_0_0_169.exe2
Berichtskennung: FlashPlayerPlugin_17_0_0_169.exe3
Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_17_0_0_169.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_17_0_0_169.exe5
Error: (05/22/2015 10:54:06 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm game.bin, Version 4.1.1.11 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 2394
Startzeit: 01d093c1df4a35de
Endzeit: 817
Anwendungspfad: C:\AeriaGames\AuraKingdom-DE\game.bin
Berichts-ID: 9493b702-00c4-11e5-bf02-08606e17acd3
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (05/21/2015 02:29:43 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm game.bin, Version 4.1.1.11 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 14a0
Startzeit: 01d092e442f56fb9
Endzeit: 839
Anwendungspfad: C:\AeriaGames\AuraKingdom-DE\game.bin
Berichts-ID: 0c25dd5e-ffb5-11e4-bf02-08606e17acd3
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (05/17/2015 09:05:53 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm game.bin, Version 4.1.1.11 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 520
Startzeit: 01d08fbd2de4a1d8
Endzeit: 773
Anwendungspfad: C:\AeriaGames\AuraKingdom-DE\game.bin
Berichts-ID: bb8a122a-fcc7-11e4-bf02-08606e17acd3
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
System errors:
=============
Error: (06/06/2015 05:58:25 AM) (Source: DCOM) (EventID: 10010) (User: ThorstensPC)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (06/06/2015 05:57:55 AM) (Source: DCOM) (EventID: 10010) (User: ThorstensPC)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (06/06/2015 02:32:43 AM) (Source: DCOM) (EventID: 10010) (User: ThorstensPC)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (06/04/2015 09:17:13 AM) (Source: DCOM) (EventID: 10010) (User: ThorstensPC)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (06/04/2015 09:16:43 AM) (Source: DCOM) (EventID: 10010) (User: ThorstensPC)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (06/03/2015 11:04:05 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst LanmanServer erreicht.
Error: (06/03/2015 11:03:35 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst iphlpsvc erreicht.
Error: (06/03/2015 11:02:54 PM) (Source: DCOM) (EventID: 10010) (User: ThorstensPC)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Error: (06/03/2015 11:02:54 PM) (Source: DCOM) (EventID: 10010) (User: ThorstensPC)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Error: (06/03/2015 11:02:54 PM) (Source: DCOM) (EventID: 10010) (User: ThorstensPC)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Microsoft Office:
=========================
Error: (06/03/2015 11:02:43 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: game.bin4.1.1.1130f001d09e0815ef8457625C:\AeriaGames\AuraKingdom-DE\game.bindedd4180-0a33-11e5-bf02-08606e17acd3
Error: (06/01/2015 05:29:43 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: game.bin4.1.1.111a0801d09a5e9862effb340C:\AeriaGames\AuraKingdom-DE\game.bin70b14303-080e-11e5-bf02-08606e17acd3
Error: (05/30/2015 00:26:24 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: game.bin4.1.1.11228401d098fa736934954294967295C:\AeriaGames\AuraKingdom-DE\game.binbbe640d5-0651-11e5-bf02-08606e17acd3
Error: (05/28/2015 05:57:19 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: game.bin4.1.1.11158801d098e426f4d86c1048C:\AeriaGames\AuraKingdom-DE\game.bin8532404c-04ed-11e5-bf02-08606e17acd3
Error: (05/28/2015 03:17:27 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: game.bin4.1.1.1128a801d098aba76ba11d746C:\AeriaGames\AuraKingdom-DE\game.bin3494828e-04d7-11e5-bf02-08606e17acd3
Error: (05/27/2015 02:49:47 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe38.0.1.561155541a90mozalloc.dll38.0.1.561155540a1e8000000300001aa11e4c01d096fe8a20b3abC:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll453430ba-040a-11e5-bf02-08606e17acd3
Error: (05/23/2015 10:29:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: FlashPlayerPlugin_17_0_0_169.exe17.0.0.1695529da64unknown0.0.0.000000000c0000005026c30b013b001d090e1c35c0e08C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exeunknown6fcef4ce-018a-11e5-bf02-08606e17acd3
Error: (05/22/2015 10:54:06 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: game.bin4.1.1.11239401d093c1df4a35de817C:\AeriaGames\AuraKingdom-DE\game.bin9493b702-00c4-11e5-bf02-08606e17acd3
Error: (05/21/2015 02:29:43 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: game.bin4.1.1.1114a001d092e442f56fb9839C:\AeriaGames\AuraKingdom-DE\game.bin0c25dd5e-ffb5-11e4-bf02-08606e17acd3
Error: (05/17/2015 09:05:53 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: game.bin4.1.1.1152001d08fbd2de4a1d8773C:\AeriaGames\AuraKingdom-DE\game.binbb8a122a-fcc7-11e4-bf02-08606e17acd3
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-3210M CPU @ 2.50GHz
Percentage of memory in use: 41%
Total physical RAM: 8077.49 MB
Available physical RAM: 4711.96 MB
Total Pagefile: 9357.49 MB
Available Pagefile: 4704.05 MB
Total Virtual: 131072 MB
Available Virtual: 131071.84 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:279.11 GB) (Free:56.29 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (DATA) (Fixed) (Total:397.87 GB) (Free:381.7 GB) NTFS
Drive e: (TheFrozenThrone) (CDROM) (Total:0.62 GB) (Free:0 GB) CDFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 698.6 GB) (Disk ID: A3362226)
Partition: GPT Partition Type.
==================== End of log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-06-06 23:07:37
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000031 HGST_HTS541075A9E680 rev.JA2OA560 698,64GB
Running: y6ii9r2g.exe; Driver: C:\Users\Thorsten\AppData\Local\Temp\fgryrkob.sys
---- User code sections - GMER 2.1 ----
.text C:\WINDOWS\System32\dwm.exe[4392] C:\WINDOWS\system32\KERNEL32.DLL!K32GetModuleInformation 00007fffaa513e10 7 bytes JMP 00008000a7fc02d0
.text C:\WINDOWS\System32\dwm.exe[4392] C:\WINDOWS\system32\KERNEL32.DLL!RegQueryValueExW 00007fffaa513e20 7 bytes JMP 00008000a7fc0308
.text C:\WINDOWS\System32\dwm.exe[4392] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExW 00007fffaa5c39b0 7 bytes JMP 00008000a7fc03b0
.text C:\WINDOWS\System32\dwm.exe[4392] C:\WINDOWS\system32\KERNEL32.DLL!RegDeleteValueW 00007fffaa5c3ef0 7 bytes JMP 00008000a7fc0340
.text C:\WINDOWS\System32\dwm.exe[4392] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExA 00007fffaa5c3fe0 7 bytes JMP 00008000a7fc0378
.text C:\WINDOWS\System32\dwm.exe[4392] C:\WINDOWS\system32\KERNEL32.DLL!K32EnumProcessModulesEx 00007fffaa5f06c0 7 bytes JMP 00008000a7fc0228
.text C:\WINDOWS\System32\dwm.exe[4392] C:\WINDOWS\system32\KERNEL32.DLL!K32GetMappedFileNameW 00007fffaa5f0730 7 bytes JMP 00008000a7fc0298
.text C:\WINDOWS\System32\dwm.exe[4392] C:\WINDOWS\system32\KERNEL32.DLL!K32GetModuleFileNameExW 00007fffaa5f0760 7 bytes JMP 00008000a7fc0260
.text C:\WINDOWS\System32\dwm.exe[4392] C:\WINDOWS\system32\KERNELBASE.dll!FreeLibrary 00007fffa7fd21d0 5 bytes JMP 00008000a7fc0180
.text C:\WINDOWS\System32\dwm.exe[4392] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleW 00007fffa7fd29d0 7 bytes JMP 00008000a7fc00d8
.text C:\WINDOWS\System32\dwm.exe[4392] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleExW 00007fffa7fd4310 5 bytes JMP 00008000a7fc0110
.text C:\WINDOWS\System32\dwm.exe[4392] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW 00007fffa7fd8d80 5 bytes JMP 00008000a7fc0148
.text C:\WINDOWS\System32\dwm.exe[4392] C:\WINDOWS\system32\USER32.dll!CreateWindowExW 00007fffaa1f6d90 10 bytes JMP 00008000a7fc0490
.text C:\WINDOWS\System32\dwm.exe[4392] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesW 00007fffaa2074a0 5 bytes JMP 00008000a7fc0458
.text C:\WINDOWS\System32\dwm.exe[4392] C:\WINDOWS\system32\USER32.dll!DisplayConfigGetDeviceInfo 00007fffaa207560 1 byte JMP 00008000a7fc03e8
.text C:\WINDOWS\System32\dwm.exe[4392] C:\WINDOWS\system32\USER32.dll!DisplayConfigGetDeviceInfo + 2 00007fffaa207562 7 bytes {JMP 0xfffffffffddb8e88}
.text C:\WINDOWS\System32\dwm.exe[4392] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesA 00007fffaa216b10 5 bytes JMP 00008000a7fc0420
.text C:\WINDOWS\System32\dwm.exe[4392] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList 00007fffaa911500 8 bytes JMP 00008000a7fc01b8
.text C:\WINDOWS\System32\dwm.exe[4392] C:\WINDOWS\system32\GDI32.dll!D3DKMTQueryAdapterInfo 00007fffaa911750 8 bytes JMP 00008000a7fc01f0
.text C:\WINDOWS\System32\dwm.exe[4392] C:\WINDOWS\System32\dxgi.dll!CreateDXGIFactory 00007fffa5427750 5 bytes JMP 00008000a54100d8
.text C:\WINDOWS\System32\dwm.exe[4392] C:\WINDOWS\System32\dxgi.dll!CreateDXGIFactory1 00007fffa5428ee0 5 bytes JMP 00008000a5410110
---- Threads - GMER 2.1 ----
Thread C:\WINDOWS\system32\csrss.exe [14668:12924] fffff960008ff2d0
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Fals noch die Logs der Funde bei Avria von vor einem Monat gebraucht werden , einfach nur bescheit geben,danke im vorraus für euren Rat / eure Hilfe. |
| Themen zu Unbefugter Zugriff auf meinem Ebay-Account evtl. wegen Polizei Virus/Trojaner? |
| akamai, antivir, antivirus, avira, bitcoin, browser, browser gesperrt, computer, converter, cpu-z, downloader, e-mail, ebay, firefox, firefox 38.0.5, flash player, gebraucht, hacker angriff?, homepage, installation, launch, mozilla, object, polizei trojaner, programm, realtek, registry, scan, software, svchost.exe, system, windows |
Baum-Darstellung