| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Könnt ihr mal drüberschauen?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
06.07.2015, 09:00
| #16 |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  Könnt ihr mal drüberschauen? In Programm unter Verlauf.
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
06.07.2015, 11:27
| #17 |
 | Könnt ihr mal drüberschauen? hab den mbam nochmal gemacht, hier das Ergebnis. Wie gehts nun weiter?
__________________Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 06.07.2015 Suchlauf-Zeit: 10:16:47 Logdatei: mbam.txt Administrator: Ja Version: 2.01.6.1022 Malware Datenbank: v2015.07.06.01 Rootkit Datenbank: v2015.07.05.03 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows Vista Service Pack 2 CPU: x86 Dateisystem: NTFS Benutzer: Siggi Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 314252 Verstrichene Zeit: 19 Min, 54 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente gefunden) Module: 0 (Keine schädliche Elemente gefunden) Registrierungsschlüssel: 0 (Keine schädliche Elemente gefunden) Registrierungswerte: 0 (Keine schädliche Elemente gefunden) Registrierungsdaten: 0 (Keine schädliche Elemente gefunden) Ordner: 5 PUP.Optional.MindSpark.A, C:\Users\Siggi\AppData\Roaming\Mozilla\Firefox\Profiles\5uy80lee.default-1398415569638\Allin1Convert_8h, , [f9902ab42e5cfc3aa121738c6b98f50b], PUP.Optional.Mindspark.A, C:\Users\Siggi\AppData\Roaming\Mozilla\Firefox\Profiles\5uy80lee.default-1398415569638\extensions\8hffxtbr@download.allin1convert.com, , [dcadefeffc8e1e1846970292f115ce32], PUP.Optional.Mindspark.A, C:\Users\Siggi\AppData\Roaming\Mozilla\Firefox\Profiles\5uy80lee.default-1398415569638\extensions\8hffxtbr@download.allin1convert.com\chrome, , [dcadefeffc8e1e1846970292f115ce32], PUP.Optional.Mindspark.A, C:\Users\Siggi\AppData\Roaming\Mozilla\Firefox\Profiles\5uy80lee.default-1398415569638\extensions\8hffxtbr@download.allin1convert.com\META-INF, , [dcadefeffc8e1e1846970292f115ce32], PUP.Optional.Mindspark.A, C:\Users\Siggi\AppData\Roaming\Mozilla\Firefox\Profiles\5uy80lee.default-1398415569638\extensions\8hffxtbr@download.allin1convert.com\plugins, , [dcadefeffc8e1e1846970292f115ce32], Dateien: 10 PUP.Optional.MindSpark.A, C:\Users\Siggi\AppData\Roaming\Mozilla\Firefox\Profiles\5uy80lee.default-1398415569638\Allin1Convert_8h\8F88B006-735A-4D7E-BF5B-524403A0A7D3.sqlite, , [f9902ab42e5cfc3aa121738c6b98f50b], PUP.Optional.Mindspark.A, C:\Users\Siggi\AppData\Roaming\Mozilla\Firefox\Profiles\5uy80lee.default-1398415569638\extensions\8hffxtbr@download.allin1convert.com\install.rdf, , [dcadefeffc8e1e1846970292f115ce32], PUP.Optional.Mindspark.A, C:\Users\Siggi\AppData\Roaming\Mozilla\Firefox\Profiles\5uy80lee.default-1398415569638\extensions\8hffxtbr@download.allin1convert.com\bootstrap.js, , [dcadefeffc8e1e1846970292f115ce32], PUP.Optional.Mindspark.A, C:\Users\Siggi\AppData\Roaming\Mozilla\Firefox\Profiles\5uy80lee.default-1398415569638\extensions\8hffxtbr@download.allin1convert.com\chrome.manifest, , [dcadefeffc8e1e1846970292f115ce32], PUP.Optional.Mindspark.A, C:\Users\Siggi\AppData\Roaming\Mozilla\Firefox\Profiles\5uy80lee.default-1398415569638\extensions\8hffxtbr@download.allin1convert.com\install_no_bootstrap.rdf, , [dcadefeffc8e1e1846970292f115ce32], PUP.Optional.Mindspark.A, C:\Users\Siggi\AppData\Roaming\Mozilla\Firefox\Profiles\5uy80lee.default-1398415569638\extensions\8hffxtbr@download.allin1convert.com\chrome\8hffxtbr.jar, , [dcadefeffc8e1e1846970292f115ce32], PUP.Optional.Mindspark.A, C:\Users\Siggi\AppData\Roaming\Mozilla\Firefox\Profiles\5uy80lee.default-1398415569638\extensions\8hffxtbr@download.allin1convert.com\META-INF\manifest.mf, , [dcadefeffc8e1e1846970292f115ce32], PUP.Optional.Mindspark.A, C:\Users\Siggi\AppData\Roaming\Mozilla\Firefox\Profiles\5uy80lee.default-1398415569638\extensions\8hffxtbr@download.allin1convert.com\META-INF\zigbert.rsa, , [dcadefeffc8e1e1846970292f115ce32], PUP.Optional.Mindspark.A, C:\Users\Siggi\AppData\Roaming\Mozilla\Firefox\Profiles\5uy80lee.default-1398415569638\extensions\8hffxtbr@download.allin1convert.com\META-INF\zigbert.sf, , [dcadefeffc8e1e1846970292f115ce32], PUP.Optional.Mindspark.A, C:\Users\Siggi\AppData\Roaming\Mozilla\Firefox\Profiles\5uy80lee.default-1398415569638\extensions\8hffxtbr@download.allin1convert.com\plugins\NativeMessagingDispatcher.dll, , [dcadefeffc8e1e1846970292f115ce32], Physische Sektoren: 0 (Keine schädliche Elemente gefunden) (end) [CODE]Additional FRST Logfile: Code:
ATTFilter scan result of Farbar Recovery Scan Tool (x86) Version: 04-07-2015
Ran by Siggi at 2015-07-06 12:22:57
Running from C:\Users\Siggi\Desktop
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-4239085852-1190954522-594501458-500 - Administrator - Disabled)
ASPNET (S-1-5-21-4239085852-1190954522-594501458-1002 - Limited - Enabled)
Gast (S-1-5-21-4239085852-1190954522-594501458-501 - Limited - Disabled)
Siggi (S-1-5-21-4239085852-1190954522-594501458-1000 - Administrator - Enabled) => C:\Users\Siggi
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: G DATA INTERNET SECURITY (Enabled - Up to date) {545C8713-0744-B079-87F8-349A6D5C8CF0}
AS: G DATA INTERNET SECURITY (Enabled - Up to date) {EF3D66F7-217E-BFF7-BD48-0FE816DBC64D}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: G*DATA Personal Firewall (Enabled) {6C670636-4D2B-B121-ACA7-9DAF938FCB8B}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
ACDSee 8 (HKLM\...\{AA2E6BFE-4351-481C-A720-47CB3506570B}) (Version: 8.0.41 - ACD Systems Ltd.)
Adobe AIR (HKLM\...\Adobe AIR) (Version: 15.0.0.356 - Adobe Systems Incorporated)
Adobe Flash Player 17 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 17.0.0.190 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 18.0.0.194 - Adobe Systems Incorporated)
Adobe Reader X (10.1.14) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.14 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.5 (HKLM\...\Adobe Shockwave Player) (Version: 11.5.8.612 - Adobe Systems, Inc.)
Agere Systems HDA Modem (HKLM\...\Agere Systems Soft Modem) (Version: - Agere Systems)
Apple Software Update (HKLM\...\{6956856F-B6B3-4BE0-BA0B-8F495BE32033}) (Version: 2.1.1.116 - Apple Inc.)
ArcSoft TotalMedia 3 (HKLM\...\{FF68083C-E11E-4A91-B54B-CD72AB5A0CF5}) (Version: - ArcSoft)
Atheros Driver Installation Program (HKLM\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 7.1 - Atheros)
bcTester 4.9 (de) (HKLM\...\{B18D4784-45FF-4787-A81E-012873CA6515}) (Version: 4.9.2 - QS QualitySoft GmbH)
BisonCam (HKLM\...\{4A57592C-FF92-4083-97A9-92783BD5AFB4}) (Version: 6.32.0.07 - Bisont Electrocnics. Inc.)
Bonjour (HKLM\...\{07287123-B8AC-41CE-8346-3D777245C35B}) (Version: 1.0.106 - Apple Inc.)
Canon MX320 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX320_series) (Version: - )
ccc-core-static (Version: 2007.1101.2317.39832 - Ihr Firmenname) Hidden
Defraggler (HKLM\...\Defraggler) (Version: 2.19 - Piriform)
DHTML Editing Component (HKLM\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation)
Dupehunter Professional (HKLM\...\Dupehunter Professional) (Version: 9.6.0.3933 - Carsten Heidtke Software)
ElsterFormular (HKLM\...\ElsterFormular) (Version: 16.0.15910 - Landesfinanzdirektion Thüringen)
G DATA INTERNET SECURITY (HKLM\...\{AC68D2FF-1674-4C16-A536-A69FC11BBD82}) (Version: 25.1.0.4 - G DATA Software AG)
Glary Utilities 5.21 (HKLM\...\Glary Utilities 5) (Version: 5.21.0.40 - Glarysoft Ltd)
Internet Manager (HKLM\...\Internet Manager) (Version: 22.001.18.68.55 - Huawei Technologies Co.,Ltd)
Kindersicherung 2011 (HKLM\...\Kindersicherung_is1) (Version: - Salfeld Computer GmbH)
MAGIX PC Check & Tuning Free 2011 (HKLM\...\MAGIX_MSI_PC_Check_Tuning_Free_2011) (Version: 6.0.403.1050 - MAGIX AG)
MAGIX PC Check & Tuning Free 2011 (Version: 6.0.403.1050 - MAGIX AG) Hidden
MAGIX Screenshare (HKLM\...\{B63DFA23-5C10-44B4-881D-45EFBF4A4761}) (Version: 4.3.6.1987 - MAGIX AG)
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
MediaShow (HKLM\...\{D5A9B7C0-8751-11D8-9D75-000129760D75}) (Version: 3.0.4325 - CyberLink Corporation)
Mediencenter Software Version 6.02.15 31.10.08 (HKLM\...\Mediencenter Software_is1) (Version: - Deutsche Telekom AG)
Microsoft .NET Framework 1.1 (HKLM\...\Microsoft .NET Framework 1.1 (1033)) (Version: - )
Microsoft .NET Framework 1.1 German Language Pack (HKLM\...\{E78BFA60-5393-4C38-82AB-E8019E464EB4}) (Version: 1.1.4322 - Microsoft)
Microsoft .NET Framework 1.1 Security Update (KB2698023) (HKLM\...\M2698023) (Version: - )
Microsoft .NET Framework 1.1 Security Update (KB2833941) (HKLM\...\M2833941) (Version: - )
Microsoft .NET Framework 1.1 Security Update (KB979906) (HKLM\...\M979906) (Version: - )
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Mozilla Firefox 39.0 (x86 de) (HKLM\...\Mozilla Firefox 39.0 (x86 de)) (Version: 39.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
MSXML 4.0 SP2 (KB927978) (HKLM\...\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}) (Version: 4.20.9841.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
office Convert Pdf to Jpg Jpeg Tiff Free 6.4 (HKLM\...\office Convert Pdf to Jpg Jpeg Tiff Free_is1) (Version: - Officeconvert Software, Inc.)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.4.1 - Frank Heindörfer, Philip Chinery)
phonostar-Player Version 2.01.4 (HKLM\...\phonostarRadioPlayer_is1) (Version: - )
PowerDVD (HKLM\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 7.0.3118.0 - CyberLink Corporation)
PowerDVD Copy (HKLM\...\{E3D04529-6EDB-11D8-A372-0050BAE317E1}) (Version: 1.0.3716a - CyberLink Corporation)
PowerProducer (HKLM\...\{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: - )
Presto! Digital Converter (HKLM\...\{EEFD47F3-3122-4A9C-8FFA-199F624378C6}) (Version: 1.09.00 - NewSoft)
Presto! VideoWorks 6 (HKLM\...\{B0C0F5E6-10B1-11D6-9296-0050BA073EEC}) (Version: 6.30.00 - NewSoft)
Primo (Version: 1.00.0000 - Your Company Name) Hidden
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5449 - )
Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01 (HKLM\...\{59F6A514-9813-47A3-948C-8A155460CC2A}) (Version: 3.51.01 - )
Runtime (Version: 1.00.0000 - Your Company Name) Hidden
Safari (HKLM\...\{C5C649A8-1D21-4C83-9B08-7B3752E580F4}) (Version: 4.30.17.0 - Apple Inc.)
Skins (Version: 2007.1101.2317.39832 - ATI) Hidden
Skype™ 7.0 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
System Control Manager (HKLM\...\{ED9C5D25-55DF-48D8-9328-2AC0D75DE5D8}) (Version: 1.0207.0907.G100.30 - )
TomTom HOME (HKLM\...\{0E09BE17-EDEA-42CA-8974-42A587F51510}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME (HKLM\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME (HKLM\...\{BB05590A-6602-43F3-A400-77EA0976BC0A}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
T-Online 6.0 (HKLM\...\{B1275E23-717A-4D52-997A-1AD1E24BC7F3}) (Version: - )
T-Online WLAN-Access Finder (HKLM\...\{295C31E5-3F91-498E-9623-DA24D2FA2B6A}) (Version: - )
Ulead Burn.Now 4.5 (Version: 4.5.0 - InterVideo Digital Technology Corporation) Hidden
Ulead Burn.Now 4.5 SE (HKLM\...\InstallShield_{A3BE3F1E-2472-4211-8735-E8239BE49D9F}) (Version: 4.5.0 - InterVideo Digital Technology Corporation)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
USB Video Device Driver (HKLM\...\{2758691A-2CDE-4942-A4AC-0E8F61FE2067}) (Version: 1.00 - eMPIA)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.1 - VideoLAN)
Winamp (HKLM\...\Winamp) (Version: 5.551 - Nullsoft, Inc)
Windows Media Player Firefox Plugin (HKLM\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
x264vfw - H.264/MPEG-4 AVC codec (remove only) (HKLM\...\x264vfw) (Version: - )
Zattoo 3.3.4 Beta (HKLM\...\Zattoo) (Version: 3.3.4 Beta - Zattoo Inc.)
Zattoo4 4.0.5 (HKLM\...\Zattoo4) (Version: 4.0.5 - Zattoo Inc.)
Zylom Games Player Plugin (HKLM\...\Zylom Games Player Plugin) (Version: - Zylom Games)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-4239085852-1190954522-594501458-1000_Classes\CLSID\{9E385F0A-0BA2-430C-96AA-4399C5E40F6C}\localserver32 -> C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)
==================== Restore Points =========================
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {1AAF2817-A24A-43F9-96D7-D2DF7B679B97} - System32\Tasks\GU5SkipUAC => D:\Glary Utilities 5\Integrator.exe [2015-03-16] (Glarysoft Ltd)
Task: {1B67DC94-BACD-4D58-B05D-5B6D7AB1C9F7} - System32\Tasks\{C44B8DA2-6025-40A6-9DFF-4811ECCF645F} => pcalua.exe -a C:\Users\Siggi\Downloads\wmp11-windowsxp-x86-DE-DE.exe -d C:\Users\Siggi\Downloads
Task: {4370A0A0-DD09-4B2B-90F6-D98AE738473B} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-06-12] (Adobe Systems Incorporated)
Task: {4B8210A4-E843-4E82-8462-B8736358E725} - System32\Tasks\{717A6EC0-A77E-47D8-B6D5-218F1026EB52} => pcalua.exe -a C:\Users\Siggi\Downloads\Authorware_Web_Player_Plugin.exe -d C:\Users\Siggi\Downloads
Task: {662A8FB6-6D5B-42E9-BBD8-42B5B8E1F513} - \GlaryInitialize No Task File <==== ATTENTION
Task: {79EB6516-3EF3-46E8-AED2-CD9EBF701525} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-07-01] (Adobe Systems Incorporated)
Task: {7E1BA93B-92A1-43AC-9167-44C7D693147C} - System32\Tasks\PCCT - MAGIX AG => D:\MAGIX\PC_Check_Tuning_Free_2011\MxTray.exe [2010-11-08] ()
Task: {7EFB16C8-8CE7-4DB6-B1FA-17B18BECAD86} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Siggi => C:\Program Files\Windows Calendar\wincal.exe [2009-04-11] (Microsoft Corporation)
Task: {A9C070FE-8EB0-4E4F-9FE2-96691689961C} - System32\Tasks\GlaryInitialize 5 => D:\Glary Utilities 5\Initialize.exe [2015-03-16] (Glarysoft Ltd)
Task: {AE6AF6D3-E193-4677-9C86-43A73480AB38} - System32\Tasks\{70A4791E-B853-41E4-B81D-FF295EFDD551} => pcalua.exe -a "C:\Users\Siggi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WYHSBRIO\No23Recorder21[1].exe" -d C:\Users\Siggi
Task: {C1AE4C93-00EF-4445-947A-921A81AC2481} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30] (Apple Inc.)
Task: {D2C6F9A0-FCCD-4623-83AB-E01A5FA98570} - \GlaryInitialize 4 No Task File <==== ATTENTION
Task: {DCF84E1F-08A2-4F48-90DD-1B00EC5EB819} - \Microsoft\Windows Defender\MP Scheduled Signature Update No Task File <==== ATTENTION
Task: {E87CB479-1CC2-46BB-B09C-9EA2C39003FF} - System32\Tasks\{55D37320-8274-4E92-A1AF-153BB56260CB} => pcalua.exe -a F:\avm_bluefritz!usb_v20v10_vista_xp_2000_070703.exe -d F:\
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GlaryInitialize 5.job => D:\Glary Utilities 5\Initialize.exe
Task: C:\Windows\Tasks\PCCT - MAGIX AG.job => D:\MAGIX\PC_Check_Tuning_Free_2011\MxTray.exe
==================== Loaded Modules (Whitelisted) ==============
2008-07-29 19:32 - 2005-08-26 11:41 - 00010752 _____ () C:\Program Files\System Control Manager\MGKBHook.dll
2008-07-30 07:06 - 2007-03-15 16:35 - 00024576 _____ () C:\Windows\BisonCam\KBHookDLL.dll
2010-11-08 18:08 - 2010-11-08 18:08 - 02644248 _____ () D:\MAGIX\PC_Check_Tuning_Free_2011\MxTray.exe
2010-11-04 12:21 - 2010-11-04 12:21 - 00635904 _____ () D:\MAGIX\PC_Check_Tuning_Free_2011\MFL_u_VC9.dll
2007-09-05 16:42 - 2007-09-05 16:42 - 00638976 _____ () D:\MAGIX\PC_Check_Tuning_Free_2011\PlayRIpl.dll
2007-11-01 17:09 - 2007-11-01 17:09 - 00159744 _____ () C:\Windows\system32\atitmmxx.dll
2011-03-14 17:27 - 2011-03-14 17:27 - 00271712 _____ () C:\ProgramData\DatacardService\HWDeviceService.exe
2015-03-16 09:28 - 2015-03-16 09:28 - 00080160 _____ () D:\Glary Utilities 5\zlib1.dll
2014-07-03 11:22 - 2011-06-17 13:04 - 00224096 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe
2014-07-03 11:22 - 2009-01-10 12:32 - 00011362 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\mingwm10.dll
2014-07-03 11:22 - 2009-06-22 20:42 - 00043008 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\libgcc_s_dw2-1.dll
2014-07-03 11:22 - 2010-05-05 10:47 - 02415104 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\QtCore4.dll
2014-07-03 11:22 - 2010-02-10 16:10 - 01148416 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\QtNetwork4.dll
2008-07-29 19:32 - 2007-08-23 14:37 - 00061440 _____ () C:\Program Files\System Control Manager\edd.exe
2008-07-31 10:06 - 2006-12-19 17:23 - 00272024 ____N () C:\Program Files\CyberLink\Shared Files\RichVideo.exe
2008-07-29 20:37 - 2008-07-29 21:13 - 01251720 _____ () C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
2008-07-29 20:37 - 2008-07-29 21:13 - 00362376 _____ () C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcnet.dll
2015-02-20 05:42 - 2015-02-20 05:42 - 00317560 ____N () C:\Program Files\Common Files\G Data\AVKProxy\PktIcpt2.dll
2009-03-09 17:49 - 2009-03-09 17:49 - 00037888 _____ () D:\Program Files\Winamp\winampa.exe
2008-07-29 19:32 - 2004-07-06 15:12 - 00290816 _____ () C:\Program Files\System Control Manager\CmSuppX.dll
2008-07-29 19:32 - 2007-09-07 15:52 - 00110592 _____ () C:\Windows\system32\MGHwCtrl.dll
2008-07-30 07:06 - 2007-03-15 16:34 - 00172032 _____ () C:\Windows\BisonCam\BsMnt.exe
2008-07-30 07:06 - 2007-03-15 16:37 - 00032768 _____ () C:\Windows\BisonCam\BisonHK.exe
2014-07-17 12:35 - 2011-06-17 13:04 - 01434464 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\LiveUpd.exe
2014-07-03 11:22 - 2010-02-10 16:43 - 09515520 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\QtGui4.dll
2014-07-17 12:35 - 2012-10-08 03:41 - 00082944 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\plugins\imageformats\qgif4.dll
2014-07-17 12:35 - 2012-10-08 03:41 - 00081920 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\plugins\imageformats\qico4.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ksupmgr => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ksupmgr => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver"
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-4239085852-1190954522-594501458-1000\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\img36.jpg
DNS Servers: 192.168.2.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupfolder: C:^Users^Siggi^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^PMB Medien-Prüfung.lnk => C:\Windows\pss\PMB Medien-Prüfung.lnk.Startup
MSCONFIG\startupreg: Adobe Reader Speed Launcher =>
MSCONFIG\startupreg: gStart =>
MSCONFIG\startupreg: GUDelayStartup => "D:\Glary Utilities 5\StartupManager.exe" -delayrun
MSCONFIG\startupreg: PDFPrint =>
MSCONFIG\startupreg: RemoteControl => "D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
MSCONFIG\startupreg: ToADiMon.exe => D:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe -TOnlineAutodialStart
MSCONFIG\startupreg: TomTomHOME.exe => "D:\TomTom HOME 2\TomTomHOMERunner.exe"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [WinCollab-Out-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-In-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-Out-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-In-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-DFSR-Out-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [WinCollab-DFSR-In-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [TCP Query User{435646A2-87BD-4BCE-B12C-8F77B5B9E167}C:\program files\internet explorer\iexplore.exe] => (Block) C:\program files\internet explorer\iexplore.exe
FirewallRules: [UDP Query User{CEF2E1B1-5A2A-4784-A0D9-31277285BB4E}C:\program files\internet explorer\iexplore.exe] => (Block) C:\program files\internet explorer\iexplore.exe
FirewallRules: [{862E90DC-47A7-45CE-9DA3-F0AEC188192F}] => (Allow) D:\Program Files\CyberLink\PowerDVD\PowerDVD.EXE
FirewallRules: [{5BD63FC5-667E-43CB-9D5F-7F4775111473}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe
FirewallRules: [{40B7FED8-896D-44EC-9F1D-369F0573DDB7}] => (Allow) D:\Program Files\MSI\ArcSoft\TotalMedia\TotalMedia.exe
FirewallRules: [{30822FFF-9222-40B2-B21C-7DF5B579C8BA}] => (Allow) D:\Program Files\MSI\ArcSoft\TotalMedia\TotalMedia.exe
FirewallRules: [{434CF9CC-5E1C-4F17-BEA0-19931473AF4E}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{761EA6FC-9C02-463E-84B0-3FF78B70B401}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{AAAC93D4-ACB9-42B6-AB71-60E3779D23BF}] => (Allow) D:\Adobe\Photoshop Elements 7.0\AdobePhotoshopElementsMediaServer.exe
FirewallRules: [{40AE9DFD-5E87-4D4C-9897-C982E305FFB7}] => (Allow) D:\Adobe\Photoshop Elements 7.0\AdobePhotoshopElementsMediaServer.exe
FirewallRules: [{650A8962-9133-4956-B426-43622836BA21}] => (Allow) LPort=80
FirewallRules: [{000A310B-E026-493E-B1F7-89CEDE8E840A}] => (Allow) LPort=80
FirewallRules: [{8A9A7414-0D99-4D42-AB2A-EE6DDAEB3A67}] => (Allow) LPort=80
FirewallRules: [{D821B09A-27FD-4D52-845E-E3FF04243EC9}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{E003EE87-8BF4-4397-B0F1-F8B6DB9927AF}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{E712949A-C008-422C-A97B-8DDF4AD814F8}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (07/06/2015 09:01:10 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/05/2015 10:21:48 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm avk.exe, Version 25.1.15051.309 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 994
Anfangszeit: 01d0b74ec6dfaf11
Zeitpunkt der Beendigung: 0
Error: (07/05/2015 10:21:48 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm GDSC.exe, Version 25.1.15057.882 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 170c
Anfangszeit: 01d0b74ec0e9ddb1
Zeitpunkt der Beendigung: 0
Error: (07/05/2015 07:46:18 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/05/2015 06:28:13 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\SIGGI\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\5UY80LEE.DEFAULT-1398415569638\CACHE2\ENTRIES> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (07/05/2015 06:28:13 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\SIGGI\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\5UY80LEE.DEFAULT-1398415569638\CACHE2\ENTRIES> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (07/05/2015 06:17:41 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/05/2015 03:35:37 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/05/2015 11:42:47 AM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {5c28d29d-1c45-43e7-9c36-e7f1b4f982c4}
Error: (07/05/2015 10:58:19 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (07/06/2015 10:16:48 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: MBAMService1
Error: (07/06/2015 09:06:57 AM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT)
Description: 0x80070032
Error: (07/06/2015 09:05:51 AM) (Source: netbt) (EventID: 4321) (User: )
Description: Der Name "SIGGI-PC :20" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.2.105
registriert werden. Der Computer mit IP-Adresse 192.168.2.103 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.
Error: (07/06/2015 09:05:51 AM) (Source: netbt) (EventID: 4321) (User: )
Description: Der Name "SIGGI-PC :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.2.105
registriert werden. Der Computer mit IP-Adresse 192.168.2.103 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.
Error: (07/06/2015 09:05:51 AM) (Source: netbt) (EventID: 4321) (User: )
Description: Der Name "SIGGI-PC :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.2.105
registriert werden. Der Computer mit IP-Adresse 192.168.2.103 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.
Error: (07/06/2015 09:05:51 AM) (Source: Server) (EventID: 2505) (User: )
Description: Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{631A12C0-C54D-4042-91BF-3033F9A95258} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden.
Error: (07/06/2015 09:05:47 AM) (Source: Dhcp) (EventID: 1002) (User: )
Description: Die IP-Adresslease 192.168.2.103 für die Netzwerkkarte mit der Netzwerkadresse 0015AFAC6D56 wurde durch den DHCP-Server 192.168.2.1 abgelehnt (der DHCP-Server hat eine DHCPNACK-Meldung gesendet).
Error: (07/06/2015 09:01:13 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Internet Manager. OUC%%1053
Error: (07/06/2015 09:01:13 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000Internet Manager. OUC
Error: (07/05/2015 07:51:02 PM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT)
Description: 0x80070032
Microsoft Office:
=========================
Error: (09/13/2011 10:25:16 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 6351 seconds with 420 seconds of active time. This session ended with a crash.
CodeIntegrity Errors:
===================================
Date: 2015-07-06 12:22:33.004
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\HookCentre.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-07-06 12:22:31.475
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\HookCentre.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-07-06 12:22:28.839
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\HookCentre.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-07-06 12:22:27.497
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\HookCentre.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-07-06 12:22:25.937
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\GDBehave.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-07-06 12:22:23.613
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\GDBehave.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-07-06 12:22:22.099
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\GDBehave.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-07-06 12:22:20.680
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\GDBehave.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-07-06 12:21:38.981
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\HookCentre.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-07-06 12:21:36.984
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\HookCentre.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: AMD Athlon(tm) 64 X2 Dual-Core Processor TK-57
Percentage of memory in use: 43%
Total physical RAM: 3582.45 MB
Available physical RAM: 2041.7 MB
Total Virtual: 9632.18 MB
Available Virtual: 7656.57 MB
==================== Drives ================================
Drive c: (OS_Install) (Fixed) (Total:43.95 GB) (Free:8.57 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Data) (Fixed) (Total:246.33 GB) (Free:162.84 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298.1 GB) (Disk ID: 73154E03)
Partition 1: (Not Active) - (Size=7.8 GB) - (Type=27)
Partition 2: (Active) - (Size=43.9 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=246.3 GB) - (Type=07 NTFS)
==================== End of log ============================
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 04-07-2015 Ran by Siggi (administrator) on SIGGI-PC on 06-07-2015 12:21:11 Running from C:\Users\Siggi\Desktop Loaded Profiles: Siggi (Available Profiles: Siggi) Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 9 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (G Data Software AG) C:\Program Files\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG) C:\Program Files\G Data\InternetSecurity\AVK\AVKWCtl.exe (Microsoft Corporation) C:\Windows\System32\SLsvc.exe () D:\MAGIX\PC_Check_Tuning_Free_2011\MxTray.exe (G Data Software AG) C:\Program Files\G Data\InternetSecurity\AVKTray\AVKTray.exe (G Data Software AG) C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG) C:\Program Files\Common Files\G Data\AVKProxy\GDKBFltExe32.exe (G Data Software AG) C:\Program Files\G Data\InternetSecurity\AVK\AVKService.exe () C:\ProgramData\DatacardService\HWDeviceService.exe (Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe (Glarysoft Ltd) D:\Glary Utilities 5\Integrator.exe () C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe () C:\Program Files\System Control Manager\edd.exe (Salfeld Computer) C:\Windows\System32\cchservice.exe () C:\Program Files\CyberLink\Shared Files\RichVideo.exe () C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (TomTom) D:\TomTom HOME 2\TomTomHOMEService.exe (G Data Software AG) C:\Program Files\G Data\InternetSecurity\Firewall\GDFwSvc.exe (Realtek Semiconductor) C:\Windows\RtHDVCpl.exe () D:\Program Files\Winamp\winampa.exe (MSI) C:\Program Files\System Control Manager\MGSysCtrl.exe () C:\Windows\BisonCam\BsMnt.exe () C:\Windows\BisonCam\BisonHK.exe (Microsoft Corporation) C:\Windows\ehome\ehtray.exe (Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (G DATA Software AG) C:\Program Files\G Data\InternetSecurity\Firewall\GDFirewallTray.exe (phonostar) D:\Program Files\phonostar\ps_timer.exe (TomTom) D:\TomTom HOME 2\TomTomHOMERunner.exe (Microsoft Corporation) C:\Windows\ehome\ehmsas.exe (Microsoft Corporation) C:\Windows\System32\mobsync.exe (Microsoft Corporation) D:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe () C:\ProgramData\Internet Manager\OnlineUpdate\LiveUpd.exe (Microsoft Corporation) C:\Windows\System32\conime.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (Farbar) C:\Users\Siggi\Desktop\FRST(1).exe (Salfeld Computer) C:\Windows\System32\cc32\webtmr.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation) HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [90112 2006-11-10] () HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [4669440 2007-07-06] (Realtek Semiconductor) HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1826816 2007-06-15] (Realtek Semiconductor Corp.) HKLM\...\Run: [ChicoSys] => C:\Windows\system32\cc32\webtmr.exe [5635736 2008-01-21] (Salfeld Computer) HKLM\...\Run: [GDFirewallTray] => C:\Program Files\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1855608 2015-02-20] (G DATA Software AG) HKLM\...\Run: [WinampAgent] => D:\Program Files\Winamp\winampa.exe [37888 2009-03-09] () HKLM\...\Run: [MGSysCtrl] => C:\Program Files\System Control Manager\MGSysCtrl.exe [561152 2007-09-07] (MSI) HKLM\...\Run: [LanguageShortcut] => D:\Program Files\CyberLink\PowerDVD\Language\Language.exe [52256 2007-01-08] () HKLM\...\Run: [BsMnt] => C:\Windows\BisonCam\BsMnt.exe [172032 2007-03-15] () HKLM\...\Run: [BisonHK] => C:\Windows\BisonCam\BisonHK.exe [32768 2007-03-15] () HKLM\...\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] => C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \mbamdor.exe [54072 2015-04-14] (Malwarebytes Corporation) HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files\G Data\InternetSecurity\AVKTray\AVKTray.exe,C:\Program Files\G Data\InternetSecurity\AVKKid\AVKCKS.exe, HKU\S-1-5-21-4239085852-1190954522-594501458-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation) HKU\S-1-5-21-4239085852-1190954522-594501458-1000\...\Run: [CCWinTray] => C:\Windows\tray\wintmr.exe [5975704 2008-01-21] (Salfeld Computer) HKU\S-1-5-21-4239085852-1190954522-594501458-1000\...\Run: [PhonostarTimer] => D:\Program Files\phonostar\ps_timer.exe [126976 2008-07-14] (phonostar) HKU\S-1-5-21-4239085852-1190954522-594501458-1000\...\Run: [TomTomHOME.exe] => D:\TomTom HOME 2\TomTomHOMERunner.exe [248176 2015-04-30] (TomTom) HKU\S-1-5-21-4239085852-1190954522-594501458-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\GdScrSv.scr [2229880 2015-02-20] (G Data Software AG) Startup: C:\Users\Siggi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk [2009-05-13] ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> D:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) BootExecute: autocheck autochk * BootDefrag.exe ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = HKU\S-1-5-21-4239085852-1190954522-594501458-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank SearchScopes: HKLM -> {BE28C22E-F666-424d-B5FD-125C4AFEE34E} URL = hxxp://search.myheritage.com?orig=ds&q={searchTerms} SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 -> {6DFAB371-A8D5-4157-BCE1-0EFFACBE2534} URL = hxxp://suche.web.de/search/web/?su={searchTerms}&mc=searchplugin@suche@msie.suche@web&origin=searchplugin SearchScopes: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 -> {774B8359-0018-4A16-8C95-0713F67F4D6A} URL = hxxp://search.1und1.de/search/web/?su={searchTerms}&mc=searchplugin@suche@msie.suche@web&origin=searchplugin SearchScopes: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 -> {78B67B9E-D578-4F1C-9A27-39B6907FD777} URL = hxxp://go.web.de/suchbox/amazon/?keywords={searchTerms} SearchScopes: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 -> {B7191055-BECA-4ED5-AD57-95CD7A0F0179} URL = hxxp://suche.gmx.net/search/web/?su={searchTerms}&mc=searchplugin@suche@msie.suche@web&origin=searchplugin SearchScopes: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 -> {BE28C22E-F666-424d-B5FD-125C4AFEE34E} URL = hxxp://search.myheritage.com?orig=ds&q={searchTerms} SearchScopes: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 -> {FA784A59-064C-4814-9A15-32BD22856DD9} URL = hxxp://go.web.de/suchbox/smartshopping/?searchText={searchTerms}&mc=searchplugin@suche@msie.suche@preisvergleich SearchScopes: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 -> {FC09AA4A-ED15-4AC1-8983-01F3169C16C3} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=securitascout BHO: No Name -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> No File BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-11-10] (Sun Microsystems, Inc.) Toolbar: HKLM - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File Toolbar: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Winsock: Catalog5 05 C:\Program Files\Bonjour\mdnsNSP.dll [147456 2008-12-12] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 Tcpip\..\Interfaces\{631A12C0-C54D-4042-91BF-3033F9A95258}: [DhcpNameServer] 192.168.2.1 Tcpip\..\Interfaces\{A600EB07-35E8-419C-A5B0-4EEFF01B59A5}: [DhcpNameServer] 10.74.210.210 10.74.210.211 FireFox: ======== FF ProfilePath: C:\Users\Siggi\AppData\Roaming\Mozilla\Firefox\Profiles\5uy80lee.default-1398415569638 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_18_0_0_194.dll [2015-07-01] () FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll [2010-08-18] (Adobe Systems, Inc.) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.) FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.2.1 -> D:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN) FF Plugin: @zylom.com/ZylomGamesPlayer -> C:\Users\Siggi\AppData\Roaming\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll [2009-10-23] (Zylom) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-04-30] (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np32asw.dll [2004-07-02] (Macromedia, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2011-11-10] (Sun Microsystems, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdjvu.dll [2011-09-16] (Caminova, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npLegitCheckPlugin.dll [2009-02-06] (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL [2006-10-26] (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2015-04-30] (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npzylomgamesplayer.dll [2009-10-23] (Zylom) FF Extension: dp Launcher Plugin - C:\Users\Siggi\AppData\Roaming\Mozilla\Firefox\Profiles\5uy80lee.default-1398415569638\Extensions\dplauncher@digitalpublishing.de [2015-01-27] FF Extension: pdfforge Toolbar Plugin - C:\Program Files\Mozilla Firefox\extensions\{B922D405-6D13-4A2B-AE89-08A030DA4402} [2015-07-04] FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-07-07] FF Extension: No Name - C:\Users\Siggi\AppData\Roaming\Mozilla\Firefox\Profiles\5uy80lee.default-1398415569638\extensions\8hffxtbr@download.allin1convert.com [not found] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 AVKProxy; C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe [2528888 2015-04-16] (G Data Software AG) R2 AVKService; C:\Program Files\G Data\InternetSecurity\AVK\AVKService.exe [965240 2015-02-20] (G Data Software AG) R2 AVKWCtl; C:\Program Files\G Data\InternetSecurity\AVK\AVKWCtl.exe [2876888 2015-04-07] (G Data Software AG) R3 GDFwSvc; C:\Program Files\G Data\InternetSecurity\Firewall\GDFwSvc.exe [2539560 2015-02-20] (G Data Software AG) R3 GDScan; C:\Program Files\Common Files\G Data\GDScan\GDScan.exe [789112 2015-03-04] (G Data Software AG) R2 HWDeviceService.exe; C:\ProgramData\DatacardService\HWDeviceService.exe [271712 2011-03-14] () S2 Internet Manager. RunOuc; C:\Program Files\T-Mobile\InternetManager_H\UpdateDog\ouc.exe [224096 2011-06-17] () S2 ksupmgr; C:\Windows\system32\ksupmgr.exe [765592 2010-08-25] (Salfeld Computer) R2 NishService; C:\Program Files\System Control Manager\edd.exe [61440 2007-08-23] () [File not signed] R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2006-12-19] () R2 Symantec Core LC; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe [1251720 2008-07-29] () R2 TomTomHOMEService; D:\TomTom HOME 2\TomTomHOMEService.exe [93040 2015-04-30] (TomTom) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-21] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R0 Achernar; C:\Windows\System32\Drivers\Achernar.sys [18432 2007-02-05] (NewSoft Technology Corporation) [File not signed] S3 AF15BDA; C:\Windows\System32\DRIVERS\AF15BDA.sys [306816 2008-09-28] (AfaTech ) R3 Afc; C:\Windows\System32\drivers\Afc.sys [11776 2005-02-23] (Arcsoft, Inc.) [File not signed] R3 AVMBTPARALLEL; C:\Windows\System32\DRIVERS\avmbtpar.sys [61952 2007-07-03] (AVM GmbH) R3 AVMBTSERIAL; C:\Windows\System32\DRIVERS\avmbtser.sys [60928 2007-07-03] (AVM GmbH) R3 AVMCOWAN; C:\Windows\System32\DRIVERS\AVMCOWAN.sys [64512 2007-07-03] (AVM GmbH) R3 BFHU_CFG; C:\Windows\System32\DRIVERS\bfhu_cfg.sys [6656 2007-07-03] (AVM Berlin) S3 bfubase; C:\Windows\System32\DRIVERS\bfubase.sys [882688 2007-07-03] (AVM Berlin) R0 BootDefragDriver; C:\Windows\System32\drivers\BootDefragDriver.sys [16064 2014-07-18] (Glarysoft Ltd) R3 CAPI_CIP; C:\Windows\System32\DRIVERS\capi_cip.sys [374144 2007-07-03] (AVM Berlin) S3 emAudio; C:\Windows\System32\drivers\emAudio.sys [22912 2007-01-12] (eMPIA Technology, Inc.) R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [108032 2015-06-27] (G Data Software AG) R3 GDKBB; C:\Windows\system32\drivers\GDKBB32.sys [24192 2015-06-27] (G Data Software AG) R1 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt32.sys [20352 2015-06-27] (G Data Software AG) R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [161792 2015-06-27] (G Data Software AG) R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [73216 2015-06-27] (G Data Software AG) R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd32.sys [53248 2015-06-27] (G Data Software AG) R1 GRD; C:\Windows\system32\drivers\GRD.sys [29528 2015-07-02] (G Data Software) S3 grmnusb; C:\Windows\System32\drivers\grmnusb.sys [9344 2009-04-17] (GARMIN Corp.) R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [17344 2014-10-17] (Glarysoft Ltd) R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [87040 2015-06-27] (G Data Software AG) S3 huawei_cdcacm; C:\Windows\System32\DRIVERS\ew_jucdcacm.sys [95616 2012-04-23] (Huawei Technologies Co., Ltd.) S3 huawei_cdcecm; C:\Windows\System32\DRIVERS\ew_jucdcecm.sys [70016 2012-04-23] (Huawei Technologies Co., Ltd.) S3 huawei_ext_ctrl; C:\Windows\System32\DRIVERS\ew_juextctrl.sys [27520 2012-04-23] (Huawei Technologies Co., Ltd.) S3 KMWDFILTER; C:\Windows\System32\DRIVERS\KMWDFILTER.sys [17408 2008-10-09] (Windows (R) Codename Longhorn DDK provider) R3 MGHwCtrl; C:\Windows\system32\drivers\MGHwCtrl.sys [19456 2006-12-22] (Windows (R) Codename Longhorn DDK provider) [File not signed] S3 MTOnlPktAlyX; D:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\MTOnlPktAlyX.SYS [17536 2006-10-09] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) [File not signed] U0 rihnxtqt; C:\Windows\System32\drivers\rhjeaj.sys [52440 2015-07-06] (Malwarebytes Corporation) R2 thomedav; C:\Windows\system32\drivers\thomedav.sys [83072 2008-08-07] () [File not signed] S3 USB28xxBGA; C:\Windows\System32\DRIVERS\emBDA.sys [361728 2007-01-29] (eMPIA Technology, Inc.) S3 USB28xxOEM; C:\Windows\System32\DRIVERS\emOEM.sys [39680 2007-01-29] (eMPIA Technology, Inc.) U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation) S3 catchme; \??\C:\Users\Siggi\AppData\Local\Temp\catchme.sys [X] R3 cpuz132; \??\C:\Users\Siggi\AppData\Local\Temp\cpuz132\cpuz132_x32.sys [X] U5 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [249472 2012-04-20] (Huawei Technologies Co., Ltd.) S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] S3 RTHDMIAzAudService; system32\drivers\RtHDMIV.sys [X] S3 SymIMMP; system32\DRIVERS\SymIM.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-07-06 12:21 - 2015-07-06 12:21 - 00017869 _____ C:\Users\Siggi\Desktop\FRST.txt 2015-07-06 12:19 - 2015-07-06 12:19 - 00052440 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\rhjeaj.sys 2015-07-06 12:19 - 2015-07-06 12:19 - 00004522 _____ C:\Windows\system\duyx 2015-07-06 12:15 - 2015-07-06 12:15 - 00004349 _____ C:\Users\Siggi\Desktop\mbam.txt 2015-07-05 16:39 - 2015-07-05 16:39 - 00000954 _____ C:\Users\Siggi\Desktop\Windows Media Player.lnk 2015-07-05 12:24 - 2015-07-05 12:24 - 00000727 _____ C:\Users\Public\Desktop\VLC media player.lnk 2015-07-05 12:21 - 2015-07-05 12:22 - 28849904 _____ C:\Users\Siggi\Downloads\vlc-2.2.1-win32.exe 2015-07-04 17:17 - 2015-07-04 17:17 - 01636352 _____ (Farbar) C:\Users\Siggi\Desktop\FRST(1).exe 2015-07-04 17:15 - 2015-07-04 17:15 - 00001211 _____ C:\Users\Siggi\Desktop\JRT.txt 2015-07-04 17:07 - 2015-07-04 17:07 - 00000207 _____ C:\Windows\tweaking.com-regbackup-SIGGI-PC-Windows-Vista-(TM)-Home-Premium-(32-bit).dat 2015-07-04 17:07 - 2015-07-04 17:07 - 00000000 ____D C:\RegBackup 2015-07-04 17:05 - 2015-07-04 17:06 - 02952814 _____ (Malwarebytes Corporation) C:\Users\Siggi\Desktop\JRT.exe 2015-07-04 16:02 - 2015-07-04 16:09 - 00000000 ____D C:\AdwCleaner 2015-07-04 16:00 - 2015-07-04 16:00 - 02244096 _____ C:\Users\Siggi\Desktop\AdwCleaner_4.207.exe 2015-07-04 15:54 - 2015-07-04 15:54 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Siggi\Downloads\mbam-setup-2.1.6.1022.exe 2015-07-04 14:50 - 2015-07-04 15:38 - 00000000 ___SD C:\ComboFix 2015-07-04 14:43 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe 2015-07-04 14:43 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe 2015-07-04 14:43 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2015-07-04 14:43 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2015-07-04 14:43 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2015-07-04 14:43 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe 2015-07-04 14:43 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe 2015-07-04 14:43 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe 2015-07-04 14:42 - 2015-07-04 14:43 - 00000000 ____D C:\Qoobox 2015-07-04 14:41 - 2015-07-04 14:50 - 00000000 ___SD C:\32788R22FWJFW 2015-07-04 14:41 - 2015-07-04 14:41 - 00000000 ____D C:\Windows\erdnt 2015-07-04 14:40 - 2015-07-04 14:41 - 05631262 ____R (Swearware) C:\Users\Siggi\Downloads\ComboFix.exe 2015-07-04 11:19 - 2015-07-04 11:19 - 00000731 _____ C:\Users\Siggi\Desktop\Revo Uninstaller.lnk 2015-07-04 11:18 - 2015-07-04 11:18 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Siggi\Downloads\revosetup95.exe 2015-07-04 11:16 - 2015-07-04 11:16 - 04798152 _____ (WinZip International LLC ) C:\Users\Siggi\Downloads\wzmp_10.exe 2015-07-04 11:16 - 2015-07-04 11:16 - 00000000 ____D C:\Users\Siggi\AppData\Roaming\Nico Mak Computing 2015-07-04 11:16 - 2015-07-04 11:16 - 00000000 ____D C:\ProgramData\Nico Mak Computing 2015-07-04 11:16 - 2013-03-15 17:01 - 00016384 _____ C:\Windows\system32\wsusnative32.exe 2015-07-04 11:05 - 2015-07-04 14:12 - 00000000 ____D C:\Program Files\Mozilla Firefox 2015-07-02 11:04 - 2015-07-02 11:09 - 00032189 _____ C:\Users\Siggi\Downloads\Addition.txt 2015-07-02 10:59 - 2015-07-04 14:29 - 00031566 _____ C:\Users\Siggi\Downloads\FRST.txt 2015-07-02 10:47 - 2015-07-06 12:21 - 00000000 ____D C:\FRST 2015-07-02 10:46 - 2015-07-02 10:46 - 01636352 _____ (Farbar) C:\Users\Siggi\Downloads\FRST.exe 2015-07-02 10:26 - 2015-07-02 10:26 - 00572456 _____ (F-Secure Corporation) C:\Users\Siggi\Downloads\F-SecureOnlineScanner.exe 2015-07-02 10:26 - 2015-07-02 10:26 - 00000000 ____D C:\Users\Siggi\AppData\Local\F-Secure 2015-07-02 10:26 - 2015-07-02 10:26 - 00000000 ____D C:\ProgramData\F-Secure 2015-07-01 22:20 - 2015-07-01 22:20 - 01125056 _____ (Adobe Systems Incorporated) C:\Users\Siggi\Downloads\flashplayer18_ha_install.exe 2015-06-28 16:30 - 2015-06-28 16:31 - 04532776 _____ (Piriform Ltd) C:\Users\Siggi\Downloads\dfsetup219.exe 2015-06-27 22:51 - 2015-06-27 22:51 - 00024192 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBB32.sys 2015-06-27 22:51 - 2015-06-27 22:51 - 00000657 _____ C:\Windows\setupact.log 2015-06-27 22:51 - 2015-06-27 22:51 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_GDKBB32_01007.Wdf 2015-06-27 22:51 - 2015-06-27 22:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G DATA INTERNET SECURITY 2015-06-27 22:51 - 2015-06-27 22:51 - 00000000 _____ C:\Windows\setuperr.log 2015-06-27 22:49 - 2015-06-27 22:49 - 00002078 _____ C:\Windows\DPINST.LOG 2015-06-23 15:47 - 2015-06-23 15:47 - 00000588 _____ C:\Users\Public\Desktop\Ev. Gesangbuch 3.0.lnk 2015-06-23 15:47 - 2015-06-23 15:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\bibel digital 2015-06-23 15:46 - 2015-06-25 22:07 - 00000000 ____D C:\Users\Siggi\Documents\bibel digital 2015-06-23 15:46 - 2015-06-23 15:46 - 00000000 ____D C:\Users\Siggi\AppData\Roaming\c-software 2015-06-10 17:13 - 2015-04-24 17:54 - 00532480 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll 2015-06-10 17:12 - 2015-05-21 16:22 - 02066432 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-06-10 17:12 - 2015-05-09 01:08 - 00894464 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll 2015-06-10 17:01 - 2015-05-05 00:51 - 10628608 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll 2015-06-10 17:01 - 2015-05-05 00:50 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll 2015-06-10 17:01 - 2015-05-05 00:50 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx 2015-06-10 17:01 - 2015-05-05 00:50 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll 2015-06-10 17:01 - 2015-05-04 23:21 - 08147456 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL 2015-06-10 08:32 - 2015-05-31 01:54 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2015-06-10 08:32 - 2015-05-31 01:53 - 09750528 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-06-10 08:32 - 2015-05-31 01:50 - 01139712 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-06-10 08:32 - 2015-05-31 01:49 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-06-10 08:32 - 2015-05-31 01:49 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-06-10 08:32 - 2015-05-31 01:49 - 00718336 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2015-06-10 08:32 - 2015-05-31 01:49 - 00421888 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-06-10 08:32 - 2015-05-31 01:48 - 01804288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-06-10 08:32 - 2015-05-31 01:48 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-06-10 08:32 - 2015-05-31 01:48 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-06-10 08:32 - 2015-05-31 01:48 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2015-06-10 08:32 - 2015-05-31 01:48 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2015-06-10 08:32 - 2015-05-31 01:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2015-06-10 08:32 - 2015-05-31 01:48 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2015-06-10 08:32 - 2015-05-31 01:48 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2015-06-10 08:32 - 2015-05-31 01:47 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2015-06-10 08:32 - 2015-05-31 01:47 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2015-06-10 08:32 - 2015-05-31 01:47 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-06-10 08:32 - 2015-05-31 01:47 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2015-06-10 08:32 - 2015-05-31 01:47 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2015-06-10 08:31 - 2015-05-31 02:03 - 12385280 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-06-10 08:31 - 2015-05-31 01:55 - 01809920 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-07-06 12:22 - 2011-11-12 10:24 - 00000109 _____ C:\Windows\system32\SWCTL.DLL 2015-07-06 12:19 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system 2015-07-06 12:05 - 2008-01-21 03:35 - 01984602 _____ C:\Windows\WindowsUpdate.log 2015-07-06 12:03 - 2014-12-11 19:33 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-07-06 11:00 - 2006-11-02 14:47 - 00003712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2015-07-06 11:00 - 2006-11-02 14:47 - 00003712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2015-07-06 09:38 - 2015-03-21 18:35 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-07-06 09:04 - 2011-11-13 19:49 - 00017420 _____ C:\Windows\system32\cchservice.err 2015-07-06 09:02 - 2008-07-31 11:30 - 00000000 ____D C:\Users\Siggi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite 2015-07-06 09:01 - 2014-08-21 20:51 - 00000294 _____ C:\Windows\Tasks\GlaryInitialize 5.job 2015-07-06 09:00 - 2012-06-30 10:24 - 00000360 _____ C:\Windows\Tasks\PCCT - MAGIX AG.job 2015-07-06 09:00 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2015-07-05 22:23 - 2006-11-02 15:01 - 00032530 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2015-07-05 16:57 - 2008-07-29 21:31 - 00027136 _____ C:\Users\Siggi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2015-07-05 16:19 - 2008-07-31 12:07 - 00000000 ____D C:\Users\Siggi\AppData\Roaming\vlc 2015-07-05 12:24 - 2008-07-31 12:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN 2015-07-05 11:51 - 2014-12-08 11:48 - 00000000 ____D C:\Users\Siggi\AppData\Roaming\com.dansl.QRreader 2015-07-04 18:41 - 2008-12-14 17:47 - 00002469 _____ C:\Users\Siggi\Desktop\Microsoft Office Word 2007.lnk 2015-07-04 16:11 - 2015-05-16 14:36 - 00001898 _____ C:\Windows\PFRO.log 2015-07-04 15:55 - 2015-03-21 18:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-07-04 14:12 - 2012-05-05 21:48 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service 2015-07-02 10:29 - 2012-09-22 08:56 - 00015192 _____ (G Data Software) C:\Windows\system32\Drivers\GdPhyMem.sys 2015-07-02 10:29 - 2011-11-14 18:15 - 00029528 _____ (G Data Software) C:\Windows\system32\Drivers\GRD.sys 2015-07-01 22:21 - 2013-04-02 08:49 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2015-07-01 22:21 - 2011-05-31 15:17 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2015-07-01 22:20 - 2008-07-29 19:38 - 00000000 ____D C:\Users\Siggi\AppData\Local\Adobe 2015-07-01 06:17 - 2014-08-21 20:51 - 00000000 ____D C:\Users\Siggi\AppData\Roaming\DiskDefrag 2015-06-28 16:32 - 2012-01-29 11:49 - 00001672 _____ C:\Users\Public\Desktop\Defraggler.lnk 2015-06-28 16:32 - 2012-01-29 11:49 - 00000000 ____D C:\Program Files\Defraggler 2015-06-27 22:56 - 2008-10-14 19:56 - 00073216 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys 2015-06-27 22:51 - 2014-10-11 07:18 - 00001809 _____ C:\Users\Public\Desktop\G DATA INTERNET SECURITY.lnk 2015-06-27 22:51 - 2014-05-04 16:06 - 00020352 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBFlt32.sys 2015-06-27 22:50 - 2011-11-14 17:56 - 00161792 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys 2015-06-27 22:50 - 2011-11-14 17:56 - 00108032 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys 2015-06-27 22:50 - 2011-11-14 17:56 - 00087040 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys 2015-06-27 22:50 - 2011-11-14 17:56 - 00053248 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd32.sys 2015-06-27 22:49 - 2011-11-14 17:55 - 00000000 ____D C:\Program Files\Common Files\G Data 2015-06-10 19:01 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\rescache 2015-06-10 18:44 - 2014-03-04 10:28 - 00275144 _____ C:\Windows\system32\FNTCACHE.DAT 2015-06-10 17:13 - 2008-12-14 17:37 - 00000000 ____D C:\ProgramData\Microsoft Help 2015-06-10 17:12 - 2013-07-23 17:00 - 00000000 ____D C:\Windows\system32\MRT 2015-06-10 17:03 - 2006-11-02 12:24 - 136900096 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe 2015-06-10 17:02 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\de-DE ==================== Files in the root of some directories ======= 2008-07-29 18:53 - 2012-07-16 19:57 - 0001356 _____ () C:\Users\Siggi\AppData\Local\d3d9caps.dat 2008-07-29 21:31 - 2015-07-05 16:57 - 0027136 _____ () C:\Users\Siggi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2008-08-31 12:18 - 2008-08-31 12:18 - 0000093 _____ () C:\Users\Siggi\AppData\Local\fusioncache.dat 2010-06-06 11:50 - 2010-12-29 23:27 - 0017408 _____ () C:\Users\Siggi\AppData\Local\WebpageIcons.db 2009-06-03 17:34 - 2009-12-21 20:39 - 0000088 __RSH () C:\ProgramData\8677DC198C.sys 2009-06-03 17:34 - 2009-12-21 20:39 - 0002828 ___SH () C:\ProgramData\KGyGaAvL.sys ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-07-06 09:07 ==================== End of log ============================ |
|
06.07.2015, 12:04
| #18 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Könnt ihr mal drüberschauen? FRST-Fix
__________________Virenscanner jetzt bitte komplett deaktivieren, damit sichergestellt ist, dass der Fix sauber durchläuft! Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter Toolbar: HKLM - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
FF Extension: No Name - C:\Users\Siggi\AppData\Roaming\Mozilla\Firefox\Profiles\5uy80lee.default-1398415569638\extensions\8hffxtbr@download.allin1convert.com [not found]
SearchScopes: HKLM -> {BE28C22E-F666-424d-B5FD-125C4AFEE34E} URL = http://search.myheritage.com?orig=ds&q={searchTerms}
Task: {662A8FB6-6D5B-42E9-BBD8-42B5B8E1F513} - \GlaryInitialize No Task File <==== ATTENTION
Task: {D2C6F9A0-FCCD-4623-83AB-E01A5FA98570} - \GlaryInitialize 4 No Task File <==== ATTENTION
Task: {DCF84E1F-08A2-4F48-90DD-1B00EC5EB819} - \Microsoft\Windows Defender\MP Scheduled Signature Update No Task File <==== ATTENTION
EmptyTemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ |
|
06.07.2015, 13:31
| #19 |
| | Könnt ihr mal drüberschauen?Code:
ATTFilter Fix result of Farbar Recovery Scan Tool (x86) Version: 04-07-2015
Ran by Siggi at 2015-07-06 14:16:54 Run:2
Running from C:\Users\Siggi\Desktop
Loaded Profiles: Siggi (Available Profiles: Siggi)
Boot Mode: Normal
==============================================
fixlist content:
*****************
Toolbar: HKLM - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
FF Extension: No Name - C:\Users\Siggi\AppData\Roaming\Mozilla\Firefox\Profiles\5uy80lee.default-1398415569638\extensions\8hffxtbr@download.allin1convert.com [not found]
SearchScopes: HKLM -> {BE28C22E-F666-424d-B5FD-125C4AFEE34E} URL = hxxp://search.myheritage.com?orig=ds&q={searchTerms}
Task: {662A8FB6-6D5B-42E9-BBD8-42B5B8E1F513} - \GlaryInitialize No Task File <==== ATTENTION
Task: {D2C6F9A0-FCCD-4623-83AB-E01A5FA98570} - \GlaryInitialize 4 No Task File <==== ATTENTION
Task: {DCF84E1F-08A2-4F48-90DD-1B00EC5EB819} - \Microsoft\Windows Defender\MP Scheduled Signature Update No Task File <==== ATTENTION
EmptyTemp:
*****************
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => value not found.
HKCR\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => key not found.
HKU\S-1-5-21-4239085852-1190954522-594501458-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => value not found.
HKCR\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => key not found.
C:\Users\Siggi\AppData\Roaming\Mozilla\Firefox\Profiles\5uy80lee.default-1398415569638\extensions\8hffxtbr@download.allin1convert.com => not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BE28C22E-F666-424d-B5FD-125C4AFEE34E} => key not found.
HKCR\CLSID\{BE28C22E-F666-424d-B5FD-125C4AFEE34E} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{662A8FB6-6D5B-42E9-BBD8-42B5B8E1F513} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GlaryInitialize => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D2C6F9A0-FCCD-4623-83AB-E01A5FA98570} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GlaryInitialize 4 => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DCF84E1F-08A2-4F48-90DD-1B00EC5EB819} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows Defender\MP Scheduled Signature Update => key not found.
EmptyTemp: => 163.7 MB temporary data Removed.
The system needed a reboot.
==== End of Fixlog 14:22:15 ====
|
|
06.07.2015, 13:36
| #20 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Könnt ihr mal drüberschauen? Okay, dann Kontrollscans mit ESET und SC bitte: ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
06.07.2015, 14:26
| #21 |
| | Könnt ihr mal drüberschauen? Eset läuft, hat schon 10 gefunden, soll ich dir erst den log schicken und noch mit Löschen warten? |
|
06.07.2015, 14:42
| #22 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Könnt ihr mal drüberschauen? Das steht alles in der Anleitung. Mit ESET soll nichts automatisch entfernt werden. Das machen wir ggf alles manuell.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
06.07.2015, 15:12
| #23 |
| | Könnt ihr mal drüberschauen? habs noch net kapiert, also ich lass das jetzt erstmal fertig durchlaufen, das ESET und poste dann das logfil. Eset lass ich noch drauf? |
|
06.07.2015, 15:17
| #24 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Könnt ihr mal drüberschauen? Dann schau doch mal auf den Screenshot, der in der Anleitung verlinkt wurde. Der wurde extra da mit in die Anleitung aufgenommen, damit alle sehen wo ein Haken rein soll und wo nicht. Bei "Entdeckte Bedrohungen entfernen" ist wie man sieht kein Haken drin. 
__________________ Logfiles bitte immer in CODE-Tags posten |
|
06.07.2015, 15:43
| #25 |
| | Könnt ihr mal drüberschauen? hab ich gemacht, logfile kommt auch bald da isses: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=792eb18621b68544a6ab28c6ec3803db
# end=init
# utc_time=2015-07-06 12:39:40
# local_time=2015-07-06 02:39:40 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.0.6002 NT Service Pack 2
Update Init
Update Download
Update Finalize
Updated modules version: 24662
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=792eb18621b68544a6ab28c6ec3803db
# end=updated
# utc_time=2015-07-06 12:42:10
# local_time=2015-07-06 02:42:10 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.0.6002 NT Service Pack 2
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=792eb18621b68544a6ab28c6ec3803db
# engine=24662
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-07-06 02:23:18
# local_time=2015-07-06 04:23:18 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode_1='G DATA INTERNET SECURITY'
# compatibility_mode=4112 16777213 100 100 7121 11794870 0 0
# compatibility_mode_1=''
# compatibility_mode=5892 16776574 100 95 192655 273725326 0 0
# scanned=172929
# found=10
# cleaned=0
# scan_time=6067
sh=687D2D398391D64DF64E65EA597D0D03D564B005 ft=1 fh=e478b250dc3f217d vn="Variante von MSIL/AdvancedSystemProtector.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\WinZip Malware Protector\AppManager.exe.vir"
sh=A3C3D09F8D98AF8FD4D288D5AE33273D2FA14189 ft=1 fh=636ab12284cdc8a9 vn="Variante von MSIL/AdvancedSystemProtector.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\WinZip Malware Protector\scandll.dll.vir"
sh=E97FDBFE8FA9B7513273E9DE2CBB044646D4E8FD ft=1 fh=940afc50e4391aa7 vn="Variante von MSIL/AdvancedSystemProtector.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\WinZip Malware Protector\WinZipMalwareProtector.exe.vir"
sh=89D6E6E8FCE38E4C87CBDCD16DFFA6BF23AA67A3 ft=1 fh=a967289658e125c6 vn="Variante von Win32/Systweak.Q evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\WinZip Malware Protector\WMPUninstall.exe.vir"
sh=73098BBBA6CBC76BF206226FBDC659758EAC7F0B ft=1 fh=6c165ff8a046d46e vn="Win32/Adware.Synatix.B Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Siggi\AppData\Roaming\Security System 2\data\ie\ie.dll.vir"
sh=185A63C6A7CFD85E6D2F72BBECFBE9B38F4D448C ft=1 fh=c71c001172d4bfae vn="Variante von Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\Mozilla Firefox\extensions\{B922D405-6D13-4A2B-AE89-08A030DA4402}\components\pdfforgeToolbarFF.dll"
sh=BA6226961FC15A3D0EBE1EAC2F2E1DFCC5792D9C ft=1 fh=71b9d2967a72b532 vn="Win32/InstallMonetizer.AN evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Siggi\Downloads\SchoenerFernsehen_0.0.0.1.exe"
sh=2D44DFDC38A6DDE1D93656451D5996F29F9DCD27 ft=1 fh=7c272d3303659065 vn="Variante von MSIL/AdvancedSystemProtector.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Siggi\Downloads\wzmp_10.exe"
sh=A358499414E128904CF502E14C0650F78694C4C5 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\3fc4fa.msi"
sh=63DE59D85D899F0259B6BE0EB32C49DDC17CB1FE ft=1 fh=882a03f515c36180 vn="Variante von MSIL/Toolbar.Linkury.C evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\MSI4DF3.tmp-\Smartbar.Resources.SetBrowsersSettings.dll"
Code:
ATTFilter Results of screen317's Security Check version 1.004
Windows Vista Service Pack 2 x86 (UAC is enabled)
Internet Explorer 9
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
G DATA INTERNET SECURITY
Antivirus out of date!
`````````Anti-malware/Other Utilities Check:`````````
Java version 32-bit out of Date!
Adobe Flash Player 18.0.0.194
Adobe Reader 10.1.14 Adobe Reader out of Date!
Mozilla Firefox (39.0)
Google Chrome 4.0.249.89 Google Chrome out of date!
````````Process Check: objlist.exe by Laurent````````
G Data InternetSecurity Firewall GDFwSvc.exe
G Data InternetSecurity Firewall GDFirewallTray.exe
Internet Manager OnlineUpdate ouc.exe
Internet Manager OnlineUpdate LiveUpd.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````
|
|
06.07.2015, 19:15
| #26 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Könnt ihr mal drüberschauen? FRST-Fix Virenscanner jetzt bitte komplett deaktivieren, damit sichergestellt ist, dass der Fix sauber durchläuft! Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Users\Siggi\Downloads\SchoenerFernsehen_0.0.0.1.exe
C:\Users\Siggi\Downloads\wzmp_10.exe
C:\Windows\Installer\3fc4fa.msi
C:\Windows\Installer\MSI4DF3.tmp-
C:\Program Files\Java
C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
EmptyTemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ Logfiles bitte immer in CODE-Tags posten |
|
06.07.2015, 19:37
| #27 |
| | Könnt ihr mal drüberschauen? nach dem erstellen des fix-logs hat er meinen rechner runtergefahren, im anschluss bekam ich etlich warnungen vom erstellen der fixlist bis zum neustart ausgeschalteten g-data. hier nun der frst-log: Code:
ATTFilter Fix result of Farbar Recovery Scan Tool (x86) Version: 04-07-2015
Ran by Siggi at 2015-07-06 20:26:21 Run:3
Running from C:\Users\Siggi\Desktop
Loaded Profiles: Siggi (Available Profiles: Siggi)
Boot Mode: Normal
==============================================
fixlist content:
*****************
C:\Users\Siggi\Downloads\SchoenerFernsehen_0.0.0.1.exe
C:\Users\Siggi\Downloads\wzmp_10.exe
C:\Windows\Installer\3fc4fa.msi
C:\Windows\Installer\MSI4DF3.tmp-
C:\Program Files\Java
C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
EmptyTemp:
*****************
C:\Users\Siggi\Downloads\SchoenerFernsehen_0.0.0.1.exe => moved successfully.
C:\Users\Siggi\Downloads\wzmp_10.exe => moved successfully.
C:\Windows\Installer\3fc4fa.msi => moved successfully.
C:\Windows\Installer\MSI4DF3.tmp- => moved successfully.
C:\Program Files\Java => moved successfully.
C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll => moved successfully.
EmptyTemp: => 101.6 MB temporary data Removed.
The system needed a reboot.
==== End of Fixlog 20:26:50 ====
|
|
06.07.2015, 19:50
| #28 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Könnt ihr mal drüberschauen? Lief aber alles sauber durch. Sieht soweit ok aus  Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) empfehle ich die Erweiterung Ghostery, diese verhindert weitgehend Usertracking bzw. das Anzeigen von Werbebannern. Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie ) Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird. Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
06.07.2015, 19:54
| #29 |
| | Könnt ihr mal drüberschauen? naja, er ist halt ziemlich schnell sehr warm und manche seiten (z.b. Facebook) dauern oft recht lang zum laden aber ansonsten ist momentan alles tippitoppi, dank deiner Hilfe. Vielen Dank naja, und er braucht halt bissel länger als früher, um hochzufahren |
|
06.07.2015, 19:57
| #30 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Könnt ihr mal drüberschauen?Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Könnt ihr mal drüberschauen? |
| auswertung, drüberschauen, gdata, troja, trojaner, warnung |
Linear-Darstellung
