|
Plagegeister aller Art und deren Bekämpfung: Könnt ihr mal drüberschauen?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
02.07.2015, 10:18 | #1 |
| Könnt ihr mal drüberschauen? Hallo, ich hatte mir, nachdem ich von Gdata die Trojaner Warnung bekam, das FRST runtergeladen. Könnt ihr mal über die Auswertung schauen? Anhang 74853 Anhang 74854 |
02.07.2015, 10:25 | #2 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Könnt ihr mal drüberschauen? Ist ein Fehlalarm. Liest du http://www.trojaner-board.de/168390-...ml#post1484147
__________________
__________________ |
02.07.2015, 10:28 | #3 |
| Könnt ihr mal drüberschauen? Weis ich, könnte ja aber sein, dass sich noch was Anderes breitgemacht hat. Deshalb bitte mal drüberschauen
__________________ |
02.07.2015, 10:35 | #4 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Könnt ihr mal drüberschauen? Dann auch anders posten. Und nicht als Anhang oder Verlinkung. Lesestoff: Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit. Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ Logfiles bitte immer in CODE-Tags posten |
02.07.2015, 10:42 | #5 |
| Könnt ihr mal drüberschauen? [CODE]Additional FRST Logfile: Code:
ATTFilter scan result of Farbar Recovery Scan Tool (x86) Version: 28-06-2015 01 Ran by Siggi at 2015-07-02 11:04:21 Running from C:\Users\Siggi\Downloads Boot Mode: Normal ========================================================== ==================== Accounts: ============================= Administrator (S-1-5-21-4239085852-1190954522-594501458-500 - Administrator - Disabled) ASPNET (S-1-5-21-4239085852-1190954522-594501458-1002 - Limited - Enabled) Gast (S-1-5-21-4239085852-1190954522-594501458-501 - Limited - Disabled) Siggi (S-1-5-21-4239085852-1190954522-594501458-1000 - Administrator - Enabled) => C:\Users\Siggi ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: G DATA INTERNET SECURITY (Disabled - Out of date) {545C8713-0744-B079-87F8-349A6D5C8CF0} AS: G DATA INTERNET SECURITY (Disabled - Out of date) {EF3D66F7-217E-BFF7-BD48-0FE816DBC64D} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: G*DATA Personal Firewall (Enabled) {6C670636-4D2B-B121-ACA7-9DAF938FCB8B} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) ACDSee 8 (HKLM\...\{AA2E6BFE-4351-481C-A720-47CB3506570B}) (Version: 8.0.41 - ACD Systems Ltd.) Adobe AIR (HKLM\...\Adobe AIR) (Version: 15.0.0.356 - Adobe Systems Incorporated) Adobe Flash Player 17 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 17.0.0.190 - Adobe Systems Incorporated) Adobe Flash Player 18 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 18.0.0.194 - Adobe Systems Incorporated) Adobe Reader X (10.1.14) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.14 - Adobe Systems Incorporated) Adobe Shockwave Player 11.5 (HKLM\...\Adobe Shockwave Player) (Version: 11.5.8.612 - Adobe Systems, Inc.) Agere Systems HDA Modem (HKLM\...\Agere Systems Soft Modem) (Version: - Agere Systems) Apple Software Update (HKLM\...\{6956856F-B6B3-4BE0-BA0B-8F495BE32033}) (Version: 2.1.1.116 - Apple Inc.) ArcSoft TotalMedia 3 (HKLM\...\{FF68083C-E11E-4A91-B54B-CD72AB5A0CF5}) (Version: - ArcSoft) Atheros Driver Installation Program (HKLM\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 7.1 - Atheros) bcTester 4.9 (de) (HKLM\...\{B18D4784-45FF-4787-A81E-012873CA6515}) (Version: 4.9.2 - QS QualitySoft GmbH) BisonCam (HKLM\...\{4A57592C-FF92-4083-97A9-92783BD5AFB4}) (Version: 6.32.0.07 - Bisont Electrocnics. Inc.) Bonjour (HKLM\...\{07287123-B8AC-41CE-8346-3D777245C35B}) (Version: 1.0.106 - Apple Inc.) Canon MX320 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX320_series) (Version: - ) ccc-core-static (Version: 2007.1101.2317.39832 - Ihr Firmenname) Hidden Defraggler (HKLM\...\Defraggler) (Version: 2.19 - Piriform) DHTML Editing Component (HKLM\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation) Dupehunter Professional (HKLM\...\Dupehunter Professional) (Version: 9.6.0.3933 - Carsten Heidtke Software) ElsterFormular (HKLM\...\ElsterFormular) (Version: 16.0.15910 - Landesfinanzdirektion Thüringen) G DATA INTERNET SECURITY (HKLM\...\{AC68D2FF-1674-4C16-A536-A69FC11BBD82}) (Version: 25.1.0.4 - G DATA Software AG) Glary Utilities 5.21 (HKLM\...\Glary Utilities 5) (Version: 5.21.0.40 - Glarysoft Ltd) Internet Manager (HKLM\...\Internet Manager) (Version: 22.001.18.68.55 - Huawei Technologies Co.,Ltd) Kindersicherung 2011 (HKLM\...\Kindersicherung_is1) (Version: - Salfeld Computer GmbH) MAGIX PC Check & Tuning Free 2011 (HKLM\...\MAGIX_MSI_PC_Check_Tuning_Free_2011) (Version: 6.0.403.1050 - MAGIX AG) MAGIX PC Check & Tuning Free 2011 (Version: 6.0.403.1050 - MAGIX AG) Hidden MAGIX Screenshare (HKLM\...\{B63DFA23-5C10-44B4-881D-45EFBF4A4761}) (Version: 4.3.6.1987 - MAGIX AG) Malwarebytes Anti-Malware Version 2.1.4.1018 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.4.1018 - Malwarebytes Corporation) MediaShow (HKLM\...\{D5A9B7C0-8751-11D8-9D75-000129760D75}) (Version: 3.0.4325 - CyberLink Corporation) Mediencenter Software Version 6.02.15 31.10.08 (HKLM\...\Mediencenter Software_is1) (Version: - Deutsche Telekom AG) Microsoft .NET Framework 1.1 (HKLM\...\Microsoft .NET Framework 1.1 (1033)) (Version: - ) Microsoft .NET Framework 1.1 German Language Pack (HKLM\...\{E78BFA60-5393-4C38-82AB-E8019E464EB4}) (Version: 1.1.4322 - Microsoft) Microsoft .NET Framework 1.1 Security Update (KB2698023) (HKLM\...\M2698023) (Version: - ) Microsoft .NET Framework 1.1 Security Update (KB2833941) (HKLM\...\M2833941) (Version: - ) Microsoft .NET Framework 1.1 Security Update (KB979906) (HKLM\...\M979906) (Version: - ) Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation) Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft) Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation) Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation) Mozilla Firefox 38.0.5 (x86 de) (HKLM\...\Mozilla Firefox 38.0.5 (x86 de)) (Version: 38.0.5 - Mozilla) Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla) MSXML 4.0 SP2 (KB927978) (HKLM\...\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}) (Version: 4.20.9841.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) office Convert Pdf to Jpg Jpeg Tiff Free 6.4 (HKLM\...\office Convert Pdf to Jpg Jpeg Tiff Free_is1) (Version: - Officeconvert Software, Inc.) PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.4.1 - Frank Heindörfer, Philip Chinery) pdfforge Toolbar v1.0 (HKLM\...\{B8B0FC8B-E69B-4215-AF1A-4BDFF20D794B}) (Version: 1.00.0000 - GreenTree Applications, Inc.) <==== ATTENTION phonostar-Player Version 2.01.4 (HKLM\...\phonostarRadioPlayer_is1) (Version: - ) PowerDVD (HKLM\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 7.0.3118.0 - CyberLink Corporation) PowerDVD Copy (HKLM\...\{E3D04529-6EDB-11D8-A372-0050BAE317E1}) (Version: 1.0.3716a - CyberLink Corporation) PowerProducer (HKLM\...\{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: - ) Presto! Digital Converter (HKLM\...\{EEFD47F3-3122-4A9C-8FFA-199F624378C6}) (Version: 1.09.00 - NewSoft) Presto! VideoWorks 6 (HKLM\...\{B0C0F5E6-10B1-11D6-9296-0050BA073EEC}) (Version: 6.30.00 - NewSoft) Primo (Version: 1.00.0000 - Your Company Name) Hidden QRreader (HKLM\...\com.dansl.QRreader) (Version: 1.5 - UNKNOWN) QRreader (Version: 1.5 - UNKNOWN) Hidden Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5449 - ) RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01 (HKLM\...\{59F6A514-9813-47A3-948C-8A155460CC2A}) (Version: 3.51.01 - ) Runtime (Version: 1.00.0000 - Your Company Name) Hidden Safari (HKLM\...\{C5C649A8-1D21-4C83-9B08-7B3752E580F4}) (Version: 4.30.17.0 - Apple Inc.) Skins (Version: 2007.1101.2317.39832 - ATI) Hidden Skype™ 7.0 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.) System Control Manager (HKLM\...\{ED9C5D25-55DF-48D8-9328-2AC0D75DE5D8}) (Version: 1.0207.0907.G100.30 - ) TomTom HOME (HKLM\...\{0E09BE17-EDEA-42CA-8974-42A587F51510}) (Version: 2.9.8 - Ihr Firmenname) TomTom HOME (HKLM\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname) TomTom HOME (HKLM\...\{BB05590A-6602-43F3-A400-77EA0976BC0A}) (Version: 2.9.8 - Ihr Firmenname) TomTom HOME Visual Studio Merge Modules (HKLM\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.) T-Online 6.0 (HKLM\...\{B1275E23-717A-4D52-997A-1AD1E24BC7F3}) (Version: - ) T-Online WLAN-Access Finder (HKLM\...\{295C31E5-3F91-498E-9623-DA24D2FA2B6A}) (Version: - ) Ulead Burn.Now 4.5 (Version: 4.5.0 - InterVideo Digital Technology Corporation) Hidden Ulead Burn.Now 4.5 SE (HKLM\...\InstallShield_{A3BE3F1E-2472-4211-8735-E8239BE49D9F}) (Version: 4.5.0 - InterVideo Digital Technology Corporation) Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft) Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft) Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft) Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft) USB Video Device Driver (HKLM\...\{2758691A-2CDE-4942-A4AC-0E8F61FE2067}) (Version: 1.00 - eMPIA) VideoLAN VLC media player 0.8.6i (HKLM\...\VLC media player) (Version: 0.8.6i - VideoLAN Team) Winamp (HKLM\...\Winamp) (Version: 5.551 - Nullsoft, Inc) Winamp Toolbar (HKLM\...\Winamp Toolbar) (Version: - ) <==== ATTENTION Windows Media Player Firefox Plugin (HKLM\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp) x264vfw - H.264/MPEG-4 AVC codec (remove only) (HKLM\...\x264vfw) (Version: - ) Zattoo 3.3.4 Beta (HKLM\...\Zattoo) (Version: 3.3.4 Beta - Zattoo Inc.) Zattoo4 4.0.5 (HKLM\...\Zattoo4) (Version: 4.0.5 - Zattoo Inc.) Zylom Games Player Plugin (HKLM\...\Zylom Games Player Plugin) (Version: - Zylom Games) ==================== Custom CLSID (Whitelisted): ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) CustomCLSID: HKU\S-1-5-21-4239085852-1190954522-594501458-1000_Classes\CLSID\{9E385F0A-0BA2-430C-96AA-4399C5E40F6C}\localserver32 -> C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.) ==================== Restore Points ========================= 01-07-2015 06:32:43 Windows Update ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 localhost ::1 localhost ==================== Scheduled Tasks (Whitelisted) ============= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) Task: {01B7A51D-24D3-45A4-8052-DC7A32592EAE} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Siggi => C:\Program Files\Windows Calendar\wincal.exe [2009-04-11] (Microsoft Corporation) Task: {1AAF2817-A24A-43F9-96D7-D2DF7B679B97} - System32\Tasks\GU5SkipUAC => D:\Glary Utilities 5\Integrator.exe [2015-03-16] (Glarysoft Ltd) Task: {1B67DC94-BACD-4D58-B05D-5B6D7AB1C9F7} - System32\Tasks\{C44B8DA2-6025-40A6-9DFF-4811ECCF645F} => pcalua.exe -a C:\Users\Siggi\Downloads\wmp11-windowsxp-x86-DE-DE.exe -d C:\Users\Siggi\Downloads Task: {4370A0A0-DD09-4B2B-90F6-D98AE738473B} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-06-12] (Adobe Systems Incorporated) Task: {4B8210A4-E843-4E82-8462-B8736358E725} - System32\Tasks\{717A6EC0-A77E-47D8-B6D5-218F1026EB52} => pcalua.exe -a C:\Users\Siggi\Downloads\Authorware_Web_Player_Plugin.exe -d C:\Users\Siggi\Downloads Task: {662A8FB6-6D5B-42E9-BBD8-42B5B8E1F513} - \GlaryInitialize No Task File <==== ATTENTION Task: {79EB6516-3EF3-46E8-AED2-CD9EBF701525} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-07-01] (Adobe Systems Incorporated) Task: {7E1BA93B-92A1-43AC-9167-44C7D693147C} - System32\Tasks\PCCT - MAGIX AG => D:\MAGIX\PC_Check_Tuning_Free_2011\MxTray.exe [2010-11-08] () Task: {A9C070FE-8EB0-4E4F-9FE2-96691689961C} - System32\Tasks\GlaryInitialize 5 => D:\Glary Utilities 5\Initialize.exe [2015-03-16] (Glarysoft Ltd) Task: {AE6AF6D3-E193-4677-9C86-43A73480AB38} - System32\Tasks\{70A4791E-B853-41E4-B81D-FF295EFDD551} => pcalua.exe -a "C:\Users\Siggi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WYHSBRIO\No23Recorder21[1].exe" -d C:\Users\Siggi Task: {C1AE4C93-00EF-4445-947A-921A81AC2481} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30] (Apple Inc.) Task: {D2C6F9A0-FCCD-4623-83AB-E01A5FA98570} - \GlaryInitialize 4 No Task File <==== ATTENTION Task: {DCF84E1F-08A2-4F48-90DD-1B00EC5EB819} - \Microsoft\Windows Defender\MP Scheduled Signature Update No Task File <==== ATTENTION Task: {E87CB479-1CC2-46BB-B09C-9EA2C39003FF} - System32\Tasks\{55D37320-8274-4E92-A1AF-153BB56260CB} => pcalua.exe -a F:\avm_bluefritz!usb_v20v10_vista_xp_2000_070703.exe -d F:\ (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GlaryInitialize 5.job => D:\Glary Utilities 5\Initialize.exe Task: C:\Windows\Tasks\PCCT - MAGIX AG.job => D:\MAGIX\PC_Check_Tuning_Free_2011\MxTray.exe ==================== Loaded Modules (Whitelisted) ============== 2010-11-08 18:08 - 2010-11-08 18:08 - 02644248 _____ () D:\MAGIX\PC_Check_Tuning_Free_2011\MxTray.exe 2010-11-04 12:21 - 2010-11-04 12:21 - 00635904 _____ () D:\MAGIX\PC_Check_Tuning_Free_2011\MFL_u_VC9.dll 2007-09-05 16:42 - 2007-09-05 16:42 - 00638976 _____ () D:\MAGIX\PC_Check_Tuning_Free_2011\PlayRIpl.dll 2007-11-01 17:09 - 2007-11-01 17:09 - 00159744 _____ () C:\Windows\system32\atitmmxx.dll 2011-03-14 17:27 - 2011-03-14 17:27 - 00271712 _____ () C:\ProgramData\DatacardService\HWDeviceService.exe 2014-07-03 11:22 - 2011-06-17 13:04 - 00224096 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe 2014-07-03 11:22 - 2009-01-10 12:32 - 00011362 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\mingwm10.dll 2014-07-03 11:22 - 2009-06-22 20:42 - 00043008 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\libgcc_s_dw2-1.dll 2014-07-03 11:22 - 2010-05-05 10:47 - 02415104 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\QtCore4.dll 2014-07-03 11:22 - 2010-02-10 16:10 - 01148416 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\QtNetwork4.dll 2015-03-16 09:28 - 2015-03-16 09:28 - 00080160 _____ () D:\Glary Utilities 5\zlib1.dll 2008-07-29 19:32 - 2007-08-23 14:37 - 00061440 _____ () C:\Program Files\System Control Manager\edd.exe 2008-07-31 10:06 - 2006-12-19 17:23 - 00272024 ____N () C:\Program Files\CyberLink\Shared Files\RichVideo.exe 2008-07-29 20:37 - 2008-07-29 21:13 - 01251720 _____ () C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe 2008-07-29 20:37 - 2008-07-29 21:13 - 00362376 _____ () C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcnet.dll 2015-02-20 05:42 - 2015-02-20 05:42 - 00317560 ____N () C:\Program Files\Common Files\G Data\AVKProxy\PktIcpt2.dll 2014-07-17 12:35 - 2011-06-17 13:04 - 01434464 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\LiveUpd.exe 2014-07-03 11:22 - 2010-02-10 16:43 - 09515520 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\QtGui4.dll 2014-07-17 12:35 - 2012-10-08 03:41 - 00082944 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\plugins\imageformats\qgif4.dll 2014-07-17 12:35 - 2012-10-08 03:41 - 00081920 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\plugins\imageformats\qico4.dll 2009-03-09 17:49 - 2009-03-09 17:49 - 00037888 _____ () D:\Program Files\Winamp\winampa.exe 2008-07-29 19:32 - 2004-07-06 15:12 - 00290816 _____ () C:\Program Files\System Control Manager\CmSuppX.dll 2008-07-29 19:32 - 2007-09-07 15:52 - 00110592 _____ () C:\Windows\system32\MGHwCtrl.dll 2008-07-29 19:32 - 2005-08-26 11:41 - 00010752 _____ () C:\Program Files\System Control Manager\MGKBHook.dll 2008-07-30 07:06 - 2007-03-15 16:34 - 00172032 _____ () C:\Windows\BisonCam\BsMnt.exe 2008-07-30 07:06 - 2007-03-15 16:37 - 00032768 _____ () C:\Windows\BisonCam\BisonHK.exe 2008-07-30 07:06 - 2007-03-15 16:35 - 00024576 _____ () C:\Windows\BisonCam\KBHookDLL.dll ==================== Alternate Data Streams (Whitelisted) ========= (If an entry is included in the fixlist, only the ADS will be removed.) ==================== Safe Mode (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ksupmgr => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ksupmgr => ""="Service" ==================== EXE Association (Whitelisted) =============== (If an entry is included in the fixlist, the registry item will be restored to default or removed.) ==================== Internet Explorer trusted/restricted =============== (If an entry is included in the fixlist, it will be removed from the registry.) ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-4239085852-1190954522-594501458-1000\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\img36.jpg DNS Servers: 192.168.2.1 ==================== MSCONFIG/TASK MANAGER disabled items == (Currently there is no automatic fix for this section.) MSCONFIG\startupfolder: C:^Users^Siggi^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^PMB Medien-Prüfung.lnk => C:\Windows\pss\PMB Medien-Prüfung.lnk.Startup MSCONFIG\startupreg: Adobe Reader Speed Launcher => MSCONFIG\startupreg: gStart => MSCONFIG\startupreg: GUDelayStartup => "D:\Glary Utilities 5\StartupManager.exe" -delayrun MSCONFIG\startupreg: PDFPrint => MSCONFIG\startupreg: RemoteControl => "D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized MSCONFIG\startupreg: ToADiMon.exe => D:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe -TOnlineAutodialStart MSCONFIG\startupreg: TomTomHOME.exe => "D:\TomTom HOME 2\TomTomHOMERunner.exe" ==================== FirewallRules (Whitelisted) =============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [WinCollab-Out-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe FirewallRules: [WinCollab-In-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe FirewallRules: [WinCollab-Out-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe FirewallRules: [WinCollab-In-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe FirewallRules: [WinCollab-DFSR-Out-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe FirewallRules: [WinCollab-DFSR-In-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe FirewallRules: [TCP Query User{435646A2-87BD-4BCE-B12C-8F77B5B9E167}C:\program files\internet explorer\iexplore.exe] => (Block) C:\program files\internet explorer\iexplore.exe FirewallRules: [UDP Query User{CEF2E1B1-5A2A-4784-A0D9-31277285BB4E}C:\program files\internet explorer\iexplore.exe] => (Block) C:\program files\internet explorer\iexplore.exe FirewallRules: [{862E90DC-47A7-45CE-9DA3-F0AEC188192F}] => (Allow) D:\Program Files\CyberLink\PowerDVD\PowerDVD.EXE FirewallRules: [{5BD63FC5-667E-43CB-9D5F-7F4775111473}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe FirewallRules: [{40B7FED8-896D-44EC-9F1D-369F0573DDB7}] => (Allow) D:\Program Files\MSI\ArcSoft\TotalMedia\TotalMedia.exe FirewallRules: [{30822FFF-9222-40B2-B21C-7DF5B579C8BA}] => (Allow) D:\Program Files\MSI\ArcSoft\TotalMedia\TotalMedia.exe FirewallRules: [{434CF9CC-5E1C-4F17-BEA0-19931473AF4E}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{761EA6FC-9C02-463E-84B0-3FF78B70B401}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{AAAC93D4-ACB9-42B6-AB71-60E3779D23BF}] => (Allow) D:\Adobe\Photoshop Elements 7.0\AdobePhotoshopElementsMediaServer.exe FirewallRules: [{40AE9DFD-5E87-4D4C-9897-C982E305FFB7}] => (Allow) D:\Adobe\Photoshop Elements 7.0\AdobePhotoshopElementsMediaServer.exe FirewallRules: [{650A8962-9133-4956-B426-43622836BA21}] => (Allow) LPort=80 FirewallRules: [{000A310B-E026-493E-B1F7-89CEDE8E840A}] => (Allow) LPort=80 FirewallRules: [{8A9A7414-0D99-4D42-AB2A-EE6DDAEB3A67}] => (Allow) LPort=80 FirewallRules: [{D821B09A-27FD-4D52-845E-E3FF04243EC9}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe FirewallRules: [{E003EE87-8BF4-4397-B0F1-F8B6DB9927AF}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe FirewallRules: [{E712949A-C008-422C-A97B-8DDF4AD814F8}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (07/02/2015 10:54:41 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/02/2015 09:03:52 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/01/2015 10:21:32 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Fehlerhafte Anwendung explorer.exe, Version 6.0.6002.18005, Zeitstempel 0x49e01da5, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode 0xc0000005, Fehleroffset 0x0015fbe9, Prozess-ID 0x3794, Anwendungsstartzeit explorer.exe0. Error: (07/01/2015 08:47:57 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/01/2015 06:37:45 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/01/2015 05:22:08 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/01/2015 04:05:26 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/01/2015 03:24:13 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/01/2015 01:41:39 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/01/2015 00:25:10 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 System errors: ============= Error: (07/02/2015 11:08:16 AM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT) Description: 0x80070032 Error: (07/02/2015 10:57:04 AM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: UPnP-GerätehostSSDP-Suche%%1058 Error: (07/02/2015 10:57:04 AM) (Source: DCOM) (EventID: 10005) (User: ) Description: 1068upnphost{204810B9-73B2-11D4-BF42-00B0D0118B56} Error: (07/02/2015 10:54:44 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Internet Manager. OUC%%1053 Error: (07/02/2015 10:54:44 AM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: 30000Internet Manager. OUC Error: (07/02/2015 10:53:39 AM) (Source: netbt) (EventID: 4321) (User: ) Description: Der Name "SIGGI-PC :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.2.103 registriert werden. Der Computer mit IP-Adresse 192.168.2.102 hat nicht zugelassen, dass dieser Computer diesen Namen verwendet. Error: (07/02/2015 10:53:39 AM) (Source: netbt) (EventID: 4321) (User: ) Description: Der Name "SIGGI-PC :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.2.103 registriert werden. Der Computer mit IP-Adresse 192.168.2.102 hat nicht zugelassen, dass dieser Computer diesen Namen verwendet. Error: (07/02/2015 09:11:43 AM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT) Description: 0x80070032 Error: (07/02/2015 09:05:09 AM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: UPnP-GerätehostSSDP-Suche%%1058 Error: (07/02/2015 09:05:09 AM) (Source: DCOM) (EventID: 10005) (User: ) Description: 1068upnphost{204810B9-73B2-11D4-BF42-00B0D0118B56} Microsoft Office: ========================= Error: (09/13/2011 10:25:16 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: ) Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 6351 seconds with 420 seconds of active time. This session ended with a crash. CodeIntegrity Errors: =================================== Date: 2015-07-02 11:03:42.905 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\GDBehave.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2015-07-02 11:03:41.206 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\GDBehave.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2015-07-02 11:03:39.818 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\GDBehave.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2015-07-02 11:03:37.477 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\GDBehave.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2015-07-02 11:02:31.017 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2015-07-02 11:02:29.188 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2015-07-02 11:02:27.570 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2015-07-02 11:02:25.674 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2015-07-02 11:02:16.787 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\GDBehave.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2015-07-02 11:02:14.821 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\GDBehave.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. ==================== Memory info =========================== Processor: AMD Athlon(tm) 64 X2 Dual-Core Processor TK-57 Percentage of memory in use: 43% Total physical RAM: 3582.45 MB Available physical RAM: 2037.1 MB Total Virtual: 9632.18 MB Available Virtual: 7607.52 MB ==================== Drives ================================ Drive c: (OS_Install) (Fixed) (Total:43.95 GB) (Free:7.73 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Drive d: (Data) (Fixed) (Total:246.33 GB) (Free:164.17 GB) NTFS Drive f: () (Removable) (Total:1.86 GB) (Free:1.76 GB) FAT ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298.1 GB) (Disk ID: 73154E03) Partition 1: (Not Active) - (Size=7.8 GB) - (Type=27) Partition 2: (Active) - (Size=43.9 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=246.3 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (Size: 1.9 GB) (Disk ID: 00000000) Partition: GPT Partition Type. ==================== End of log ============================ FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 28-06-2015 01 Ran by Siggi (administrator) on SIGGI-PC on 02-07-2015 10:59:25 Running from C:\Users\Siggi\Downloads Loaded Profiles: Siggi (Available Profiles: Siggi) Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 9 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (G Data Software AG) C:\Program Files\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG) C:\Program Files\G Data\InternetSecurity\AVK\AVKWCtl.exe (Microsoft Corporation) C:\Windows\System32\SLsvc.exe (Microsoft Corporation) C:\Windows\System32\lpksetup.exe () D:\MAGIX\PC_Check_Tuning_Free_2011\MxTray.exe (G Data Software AG) C:\Program Files\G Data\InternetSecurity\AVKTray\AVKTray.exe (G Data Software AG) C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG) C:\Program Files\Common Files\G Data\AVKProxy\GDKBFltExe32.exe (G Data Software AG) C:\Program Files\G Data\InternetSecurity\AVK\AVKService.exe () C:\ProgramData\DatacardService\HWDeviceService.exe (Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe () C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe (Glarysoft Ltd) D:\Glary Utilities 5\Integrator.exe (Salfeld Computer) C:\Windows\System32\cchservice.exe () C:\Program Files\System Control Manager\edd.exe () C:\Program Files\CyberLink\Shared Files\RichVideo.exe () C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (TomTom) D:\TomTom HOME 2\TomTomHOMEService.exe (G Data Software AG) C:\Program Files\G Data\InternetSecurity\Firewall\GDFwSvc.exe () C:\ProgramData\Internet Manager\OnlineUpdate\LiveUpd.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe (Realtek Semiconductor) C:\Windows\RtHDVCpl.exe () D:\Program Files\Winamp\winampa.exe (MSI) C:\Program Files\System Control Manager\MGSysCtrl.exe () C:\Windows\BisonCam\BsMnt.exe () C:\Windows\BisonCam\BisonHK.exe (Microsoft Corporation) C:\Windows\ehome\ehtray.exe (Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe (G DATA Software AG) C:\Program Files\G Data\InternetSecurity\Firewall\GDFirewallTray.exe (Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (phonostar) D:\Program Files\phonostar\ps_timer.exe (TomTom) D:\TomTom HOME 2\TomTomHOMERunner.exe (Microsoft Corporation) D:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) C:\Windows\ehome\ehmsas.exe (Microsoft Corporation) C:\Windows\System32\mobsync.exe (ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Salfeld Computer) C:\Windows\System32\cc32\webtmr.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation) HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [90112 2006-11-10] () HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [4669440 2007-07-06] (Realtek Semiconductor) HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1826816 2007-06-15] (Realtek Semiconductor Corp.) HKLM\...\Run: [ChicoSys] => C:\Windows\system32\cc32\webtmr.exe [5635736 2008-01-21] (Salfeld Computer) HKLM\...\Run: [GDFirewallTray] => C:\Program Files\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1855608 2015-02-20] (G DATA Software AG) HKLM\...\Run: [WinampAgent] => D:\Program Files\Winamp\winampa.exe [37888 2009-03-09] () HKLM\...\Run: [MGSysCtrl] => C:\Program Files\System Control Manager\MGSysCtrl.exe [561152 2007-09-07] (MSI) HKLM\...\Run: [LanguageShortcut] => D:\Program Files\CyberLink\PowerDVD\Language\Language.exe [52256 2007-01-08] () HKLM\...\Run: [BsMnt] => C:\Windows\BisonCam\BsMnt.exe [172032 2007-03-15] () HKLM\...\Run: [BisonHK] => C:\Windows\BisonCam\BisonHK.exe [32768 2007-03-15] () HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files\G Data\InternetSecurity\AVKTray\AVKTray.exe,c:\program files\g data\internetsecurity\avkkid\avkcks.exe, HKU\S-1-5-21-4239085852-1190954522-594501458-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation) HKU\S-1-5-21-4239085852-1190954522-594501458-1000\...\Run: [CCWinTray] => C:\Windows\tray\wintmr.exe [5975704 2008-01-21] (Salfeld Computer) HKU\S-1-5-21-4239085852-1190954522-594501458-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation) HKU\S-1-5-21-4239085852-1190954522-594501458-1000\...\Run: [PhonostarTimer] => D:\Program Files\phonostar\ps_timer.exe [126976 2008-07-14] (phonostar) HKU\S-1-5-21-4239085852-1190954522-594501458-1000\...\Run: [TomTomHOME.exe] => D:\TomTom HOME 2\TomTomHOMERunner.exe [248176 2015-04-30] (TomTom) HKU\S-1-5-21-4239085852-1190954522-594501458-1000\...\MountPoints2: {1b1c2251-0290-11e4-a605-806e6f6e6963} - G:\AutoRun.exe HKU\S-1-5-21-4239085852-1190954522-594501458-1000\...\MountPoints2: {1b1c22b0-0290-11e4-a605-404e57434401} - F:\AutoRun.exe HKU\S-1-5-21-4239085852-1190954522-594501458-1000\...\MountPoints2: {b4cd255c-e6bb-11df-ae51-001d9258f93e} - G:\InstallTomTomHOME.exe HKU\S-1-5-21-4239085852-1190954522-594501458-1000\...\MountPoints2: {bb228150-9713-11e3-814d-404e57434401} - F:\setup.exe HKU\S-1-5-21-4239085852-1190954522-594501458-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\GdScrSv.scr [2229880 2015-02-20] (G Data Software AG) Startup: C:\Users\Siggi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk [2009-05-13] ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> D:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) BootExecute: autocheck autochk * BootDefrag.exe ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = HKU\S-1-5-21-4239085852-1190954522-594501458-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank URLSearchHook: HKLM - Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.) URLSearchHook: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 - (No Name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - No File SearchScopes: HKLM -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = SearchScopes: HKLM -> {BE28C22E-F666-424d-B5FD-125C4AFEE34E} URL = hxxp://search.myheritage.com?orig=ds&q={searchTerms} SearchScopes: HKLM -> {EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&query={searchTerms}&invocationType=tb50winampie7 SearchScopes: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 -> DefaultScope {FC09AA4A-ED15-4AC1-8983-01F3169C16C3} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=securitascout SearchScopes: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 -> {6DFAB371-A8D5-4157-BCE1-0EFFACBE2534} URL = hxxp://suche.web.de/search/web/?su={searchTerms}&mc=searchplugin@suche@msie.suche@web&origin=searchplugin SearchScopes: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 -> {774B8359-0018-4A16-8C95-0713F67F4D6A} URL = hxxp://search.1und1.de/search/web/?su={searchTerms}&mc=searchplugin@suche@msie.suche@web&origin=searchplugin SearchScopes: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 -> {78B67B9E-D578-4F1C-9A27-39B6907FD777} URL = hxxp://go.web.de/suchbox/amazon/?keywords={searchTerms} SearchScopes: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = https://isearch.avg.com/search?cid={A588F55F-0378-436F-8973-6FC4058DC93E}&mid=ba5c59f7eac047d0864e910711a7adf2-ffdf2b2309074f949113bb882d3fcaad5d0f03f1&lang=de&ds=od011&pr=sa&d=2012-06-12 21:05:09&v=12.2.5.32&sap=dsp&q={searchTerms} SearchScopes: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 -> {B7191055-BECA-4ED5-AD57-95CD7A0F0179} URL = hxxp://suche.gmx.net/search/web/?su={searchTerms}&mc=searchplugin@suche@msie.suche@web&origin=searchplugin SearchScopes: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 -> {BE28C22E-F666-424d-B5FD-125C4AFEE34E} URL = hxxp://search.myheritage.com?orig=ds&q={searchTerms} SearchScopes: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 -> {FA784A59-064C-4814-9A15-32BD22856DD9} URL = hxxp://go.web.de/suchbox/smartshopping/?searchText={searchTerms}&mc=searchplugin@suche@msie.suche@preisvergleich SearchScopes: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 -> {FC09AA4A-ED15-4AC1-8983-01F3169C16C3} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=securitascout BHO: Winamp Toolbar Loader -> {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} -> C:\Program Files\Winamp Toolbar\winamptb.dll [2009-02-19] (AOL LLC.) BHO: No Name -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> No File BHO: No Name -> {B922D405-6D13-4A2B-AE89-08A030DA4402} -> No File BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-11-10] (Sun Microsystems, Inc.) BHO: No Name -> {E312764E-7706-43F1-8DAB-FCDD2B1E416D} -> No File Toolbar: HKLM - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File Toolbar: HKLM - Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll [2009-02-19] (AOL LLC.) Toolbar: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File Toolbar: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 -> Winamp Toolbar - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll [2009-02-19] (AOL LLC.) Toolbar: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 -> No Name - {FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - No File DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Winsock: Catalog5 05 C:\Program Files\Bonjour\mdnsNSP.dll [147456 2008-12-12] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 Tcpip\..\Interfaces\{631A12C0-C54D-4042-91BF-3033F9A95258}: [DhcpNameServer] 192.168.2.1 Tcpip\..\Interfaces\{A600EB07-35E8-419C-A5B0-4EEFF01B59A5}: [DhcpNameServer] 10.74.210.210 10.74.210.211 FireFox: ======== FF ProfilePath: C:\Users\Siggi\AppData\Roaming\Mozilla\Firefox\Profiles\5uy80lee.default-1398415569638 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_18_0_0_194.dll [2015-07-01] () FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll [2010-08-18] (Adobe Systems, Inc.) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.) FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation) FF Plugin: @zylom.com/ZylomGamesPlayer -> C:\Users\Siggi\AppData\Roaming\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll [2009-10-23] (Zylom) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-04-30] (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np32asw.dll [2004-07-02] (Macromedia, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2011-11-10] (Sun Microsystems, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdjvu.dll [2011-09-16] (Caminova, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npLegitCheckPlugin.dll [2009-02-06] (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL [2006-10-26] (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2015-04-30] (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npzylomgamesplayer.dll [2009-10-23] (Zylom) FF Extension: Allin1Convert - C:\Users\Siggi\AppData\Roaming\Mozilla\Firefox\Profiles\5uy80lee.default-1398415569638\Extensions\8hffxtbr@download.allin1convert.com [2015-06-07] FF Extension: dp Launcher Plugin - C:\Users\Siggi\AppData\Roaming\Mozilla\Firefox\Profiles\5uy80lee.default-1398415569638\Extensions\dplauncher@digitalpublishing.de [2015-01-27] FF Extension: Securita Scout - C:\Users\Siggi\AppData\Roaming\Mozilla\Firefox\Profiles\5uy80lee.default-1398415569638\Extensions\isec@securitascout.com [2014-04-25] FF Extension: Search Settings Plugin - C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com [2015-06-02] FF Extension: pdfforge Toolbar Plugin - C:\Program Files\Mozilla Firefox\extensions\{B922D405-6D13-4A2B-AE89-08A030DA4402} [2015-06-02] FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-07-07] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 AVKProxy; C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe [2528888 2015-04-16] (G Data Software AG) R2 AVKService; C:\Program Files\G Data\InternetSecurity\AVK\AVKService.exe [965240 2015-02-20] (G Data Software AG) R2 AVKWCtl; C:\Program Files\G Data\InternetSecurity\AVK\AVKWCtl.exe [2876888 2015-04-07] (G Data Software AG) R3 GDFwSvc; C:\Program Files\G Data\InternetSecurity\Firewall\GDFwSvc.exe [2539560 2015-02-20] (G Data Software AG) R3 GDScan; C:\Program Files\Common Files\G Data\GDScan\GDScan.exe [789112 2015-03-04] (G Data Software AG) R2 HWDeviceService.exe; C:\ProgramData\DatacardService\HWDeviceService.exe [271712 2011-03-14] () S2 Internet Manager. RunOuc; C:\Program Files\T-Mobile\InternetManager_H\UpdateDog\ouc.exe [224096 2011-06-17] () S2 ksupmgr; C:\Windows\system32\ksupmgr.exe [765592 2010-08-25] (Salfeld Computer) S2 MBAMService; D:\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation) R2 NishService; C:\Program Files\System Control Manager\edd.exe [61440 2007-08-23] () [File not signed] R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2006-12-19] () R2 Symantec Core LC; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe [1251720 2008-07-29] () R2 TomTomHOMEService; D:\TomTom HOME 2\TomTomHOMEService.exe [93040 2015-04-30] (TomTom) R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-21] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R0 Achernar; C:\Windows\System32\Drivers\Achernar.sys [18432 2007-02-05] (NewSoft Technology Corporation) [File not signed] S3 AF15BDA; C:\Windows\System32\DRIVERS\AF15BDA.sys [306816 2008-09-28] (AfaTech ) R3 Afc; C:\Windows\System32\drivers\Afc.sys [11776 2005-02-23] (Arcsoft, Inc.) [File not signed] R3 AVMBTPARALLEL; C:\Windows\System32\DRIVERS\avmbtpar.sys [61952 2007-07-03] (AVM GmbH) R3 AVMBTSERIAL; C:\Windows\System32\DRIVERS\avmbtser.sys [60928 2007-07-03] (AVM GmbH) R3 AVMCOWAN; C:\Windows\System32\DRIVERS\AVMCOWAN.sys [64512 2007-07-03] (AVM GmbH) R3 BFHU_CFG; C:\Windows\System32\DRIVERS\bfhu_cfg.sys [6656 2007-07-03] (AVM Berlin) S3 bfubase; C:\Windows\System32\DRIVERS\bfubase.sys [882688 2007-07-03] (AVM Berlin) R0 BootDefragDriver; C:\Windows\System32\drivers\BootDefragDriver.sys [16064 2014-07-18] (Glarysoft Ltd) R3 CAPI_CIP; C:\Windows\System32\DRIVERS\capi_cip.sys [374144 2007-07-03] (AVM Berlin) S3 emAudio; C:\Windows\System32\drivers\emAudio.sys [22912 2007-01-12] (eMPIA Technology, Inc.) R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [108032 2015-06-27] (G Data Software AG) R3 GDKBB; C:\Windows\system32\drivers\GDKBB32.sys [24192 2015-06-27] (G Data Software AG) R1 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt32.sys [20352 2015-06-27] (G Data Software AG) R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [161792 2015-06-27] (G Data Software AG) R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [73216 2015-06-27] (G Data Software AG) R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd32.sys [53248 2015-06-27] (G Data Software AG) R1 GRD; C:\Windows\system32\drivers\GRD.sys [29528 2015-07-02] (G Data Software) S3 grmnusb; C:\Windows\System32\drivers\grmnusb.sys [9344 2009-04-17] (GARMIN Corp.) R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [17344 2014-10-17] (Glarysoft Ltd) R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [87040 2015-06-27] (G Data Software AG) S3 huawei_cdcacm; C:\Windows\System32\DRIVERS\ew_jucdcacm.sys [95616 2012-04-23] (Huawei Technologies Co., Ltd.) S3 huawei_cdcecm; C:\Windows\System32\DRIVERS\ew_jucdcecm.sys [70016 2012-04-23] (Huawei Technologies Co., Ltd.) S3 huawei_ext_ctrl; C:\Windows\System32\DRIVERS\ew_juextctrl.sys [27520 2012-04-23] (Huawei Technologies Co., Ltd.) S3 KMWDFILTER; C:\Windows\System32\DRIVERS\KMWDFILTER.sys [17408 2008-10-09] (Windows (R) Codename Longhorn DDK provider) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-03-17] (Malwarebytes Corporation) S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2015-03-21] (Malwarebytes Corporation) S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-03-17] (Malwarebytes Corporation) R3 MGHwCtrl; C:\Windows\system32\drivers\MGHwCtrl.sys [19456 2006-12-22] (Windows (R) Codename Longhorn DDK provider) [File not signed] S3 MTOnlPktAlyX; D:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\MTOnlPktAlyX.SYS [17536 2006-10-09] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) [File not signed] R2 thomedav; C:\Windows\system32\drivers\thomedav.sys [83072 2008-08-07] () [File not signed] S3 USB28xxBGA; C:\Windows\System32\DRIVERS\emBDA.sys [361728 2007-01-29] (eMPIA Technology, Inc.) S3 USB28xxOEM; C:\Windows\System32\DRIVERS\emOEM.sys [39680 2007-01-29] (eMPIA Technology, Inc.) R3 cpuz132; \??\C:\Users\Siggi\AppData\Local\Temp\cpuz132\cpuz132_x32.sys [X] U5 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [249472 2012-04-20] (Huawei Technologies Co., Ltd.) S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] S3 RTHDMIAzAudService; system32\drivers\RtHDMIV.sys [X] S3 SymIMMP; system32\DRIVERS\SymIM.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-07-02 10:59 - 2015-07-02 11:03 - 00020430 _____ C:\Users\Siggi\Downloads\FRST.txt 2015-07-02 10:47 - 2015-07-02 10:59 - 00000000 ____D C:\FRST 2015-07-02 10:46 - 2015-07-02 10:46 - 01636352 _____ (Farbar) C:\Users\Siggi\Downloads\FRST.exe 2015-07-02 10:26 - 2015-07-02 10:26 - 00572456 _____ (F-Secure Corporation) C:\Users\Siggi\Downloads\F-SecureOnlineScanner.exe 2015-07-02 10:26 - 2015-07-02 10:26 - 00000000 ____D C:\Users\Siggi\AppData\Local\F-Secure 2015-07-02 10:26 - 2015-07-02 10:26 - 00000000 ____D C:\ProgramData\F-Secure 2015-07-01 22:20 - 2015-07-01 22:20 - 01125056 _____ (Adobe Systems Incorporated) C:\Users\Siggi\Downloads\flashplayer18_ha_install.exe 2015-06-28 16:30 - 2015-06-28 16:31 - 04532776 _____ (Piriform Ltd) C:\Users\Siggi\Downloads\dfsetup219.exe 2015-06-27 22:51 - 2015-06-27 22:51 - 00024192 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBB32.sys 2015-06-27 22:51 - 2015-06-27 22:51 - 00000657 _____ C:\Windows\setupact.log 2015-06-27 22:51 - 2015-06-27 22:51 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_GDKBB32_01007.Wdf 2015-06-27 22:51 - 2015-06-27 22:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G DATA INTERNET SECURITY 2015-06-27 22:51 - 2015-06-27 22:51 - 00000000 _____ C:\Windows\setuperr.log 2015-06-27 22:49 - 2015-06-27 22:49 - 00002078 _____ C:\Windows\DPINST.LOG 2015-06-23 15:47 - 2015-06-23 15:47 - 00000588 _____ C:\Users\Public\Desktop\Ev. Gesangbuch 3.0.lnk 2015-06-23 15:47 - 2015-06-23 15:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\bibel digital 2015-06-23 15:46 - 2015-06-25 22:07 - 00000000 ____D C:\Users\Siggi\Documents\bibel digital 2015-06-23 15:46 - 2015-06-23 15:46 - 00000000 ____D C:\Users\Siggi\AppData\Roaming\c-software 2015-06-10 17:13 - 2015-04-24 17:54 - 00532480 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll 2015-06-10 17:12 - 2015-05-21 16:22 - 02066432 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-06-10 17:12 - 2015-05-09 01:08 - 00894464 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll 2015-06-10 17:01 - 2015-05-05 00:51 - 10628608 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll 2015-06-10 17:01 - 2015-05-05 00:50 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll 2015-06-10 17:01 - 2015-05-05 00:50 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx 2015-06-10 17:01 - 2015-05-05 00:50 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll 2015-06-10 17:01 - 2015-05-04 23:21 - 08147456 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL 2015-06-10 08:32 - 2015-05-31 01:54 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2015-06-10 08:32 - 2015-05-31 01:53 - 09750528 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-06-10 08:32 - 2015-05-31 01:50 - 01139712 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-06-10 08:32 - 2015-05-31 01:49 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-06-10 08:32 - 2015-05-31 01:49 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-06-10 08:32 - 2015-05-31 01:49 - 00718336 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2015-06-10 08:32 - 2015-05-31 01:49 - 00421888 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-06-10 08:32 - 2015-05-31 01:48 - 01804288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-06-10 08:32 - 2015-05-31 01:48 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-06-10 08:32 - 2015-05-31 01:48 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-06-10 08:32 - 2015-05-31 01:48 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2015-06-10 08:32 - 2015-05-31 01:48 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2015-06-10 08:32 - 2015-05-31 01:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2015-06-10 08:32 - 2015-05-31 01:48 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2015-06-10 08:32 - 2015-05-31 01:48 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2015-06-10 08:32 - 2015-05-31 01:47 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2015-06-10 08:32 - 2015-05-31 01:47 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2015-06-10 08:32 - 2015-05-31 01:47 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-06-10 08:32 - 2015-05-31 01:47 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2015-06-10 08:32 - 2015-05-31 01:47 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2015-06-10 08:31 - 2015-05-31 02:03 - 12385280 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-06-10 08:31 - 2015-05-31 01:55 - 01809920 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-06-02 21:59 - 2015-06-03 14:11 - 00000000 ____D C:\Program Files\Mozilla Firefox ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-07-02 11:03 - 2014-12-11 19:33 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-07-02 11:03 - 2011-11-12 10:24 - 00000109 _____ C:\Windows\system32\SWCTL.DLL 2015-07-02 11:02 - 2008-01-21 03:35 - 01725796 _____ C:\Windows\WindowsUpdate.log 2015-07-02 10:55 - 2008-07-31 11:30 - 00000000 ____D C:\Users\Siggi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite 2015-07-02 10:54 - 2014-08-21 20:51 - 00000294 _____ C:\Windows\Tasks\GlaryInitialize 5.job 2015-07-02 10:54 - 2006-11-02 14:47 - 00003712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2015-07-02 10:54 - 2006-11-02 14:47 - 00003712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2015-07-02 10:53 - 2012-06-30 10:24 - 00000360 _____ C:\Windows\Tasks\PCCT - MAGIX AG.job 2015-07-02 10:53 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2015-07-02 10:52 - 2015-05-16 14:36 - 00000996 _____ C:\Windows\PFRO.log 2015-07-02 10:48 - 2006-11-02 15:01 - 00032530 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2015-07-02 10:29 - 2012-09-22 08:56 - 00015192 _____ (G Data Software) C:\Windows\system32\Drivers\GdPhyMem.sys 2015-07-02 10:29 - 2011-11-14 18:15 - 00029528 _____ (G Data Software) C:\Windows\system32\Drivers\GRD.sys 2015-07-01 22:21 - 2013-04-02 08:49 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2015-07-01 22:21 - 2011-05-31 15:17 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2015-07-01 22:20 - 2008-07-29 19:38 - 00000000 ____D C:\Users\Siggi\AppData\Local\Adobe 2015-07-01 17:24 - 2011-11-13 19:49 - 00016586 _____ C:\Windows\system32\cchservice.err 2015-07-01 06:17 - 2014-08-21 20:51 - 00000000 ____D C:\Users\Siggi\AppData\Roaming\DiskDefrag 2015-06-29 17:50 - 2008-12-14 17:47 - 00002469 _____ C:\Users\Siggi\Desktop\Microsoft Office Word 2007.lnk 2015-06-28 16:32 - 2012-01-29 11:49 - 00001672 _____ C:\Users\Public\Desktop\Defraggler.lnk 2015-06-28 16:32 - 2012-01-29 11:49 - 00000000 ____D C:\Program Files\Defraggler 2015-06-27 22:56 - 2008-10-14 19:56 - 00073216 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys 2015-06-27 22:51 - 2014-10-11 07:18 - 00001809 _____ C:\Users\Public\Desktop\G DATA INTERNET SECURITY.lnk 2015-06-27 22:51 - 2014-05-04 16:06 - 00020352 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBFlt32.sys 2015-06-27 22:50 - 2011-11-14 17:56 - 00161792 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys 2015-06-27 22:50 - 2011-11-14 17:56 - 00108032 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys 2015-06-27 22:50 - 2011-11-14 17:56 - 00087040 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys 2015-06-27 22:50 - 2011-11-14 17:56 - 00053248 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd32.sys 2015-06-27 22:49 - 2011-11-14 17:55 - 00000000 ____D C:\Program Files\Common Files\G Data 2015-06-10 19:01 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\rescache 2015-06-10 18:44 - 2014-03-04 10:28 - 00275144 _____ C:\Windows\system32\FNTCACHE.DAT 2015-06-10 17:13 - 2008-12-14 17:37 - 00000000 ____D C:\ProgramData\Microsoft Help 2015-06-10 17:12 - 2013-07-23 17:00 - 00000000 ____D C:\Windows\system32\MRT 2015-06-10 17:03 - 2006-11-02 12:24 - 136900096 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe 2015-06-10 17:02 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\de-DE 2015-06-03 14:11 - 2012-05-05 21:48 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service 2015-06-02 22:54 - 2008-12-14 17:48 - 00002475 _____ C:\Users\Siggi\Desktop\Microsoft Office Excel 2007.lnk ==================== Files in the root of some directories ======= 2008-07-29 18:53 - 2012-07-16 19:57 - 0001356 _____ () C:\Users\Siggi\AppData\Local\d3d9caps.dat 2008-07-29 21:31 - 2014-05-19 15:18 - 0027136 _____ () C:\Users\Siggi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2008-08-31 12:18 - 2008-08-31 12:18 - 0000093 _____ () C:\Users\Siggi\AppData\Local\fusioncache.dat 2010-06-06 11:50 - 2010-12-29 23:27 - 0017408 _____ () C:\Users\Siggi\AppData\Local\WebpageIcons.db 2009-06-03 17:34 - 2009-12-21 20:39 - 0000088 __RSH () C:\ProgramData\8677DC198C.sys 2009-06-03 17:34 - 2009-12-21 20:39 - 0002828 ___SH () C:\ProgramData\KGyGaAvL.sys ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-07-02 11:08 ==================== End of log ============================ |
02.07.2015, 12:34 | #6 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Könnt ihr mal drüberschauen? Du hast Adware im System. Das steht jetzt aber in keinem Zusammenhang mit dem Fehlalarm von GDATA. Lade Dir bitte von hier Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
__________________ --> Könnt ihr mal drüberschauen? |
04.07.2015, 13:31 | #7 |
| Könnt ihr mal drüberschauen? habe es gerade erledigt, wie nun weiter? g-data zeigt mir nun permanent das an: Virus: Gen:Variant.Graftor.82533 (Engine A) Datei: ima4dcmp.x32_635716065888092869 Verzeichnis: C:\Users\Siggi\AppData\Local\Temp\wstemp Prozess: clamscan.exe nun hab ich ja noch das problem, dass er recht langsam läuft und läd. kann man da sonst noch was machen? er ist auch immer sehr schnell sehr warm |
04.07.2015, 14:45 | #8 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Könnt ihr mal drüberschauen? Das ist das Problem wenn man mehrere Virenscanner verwendet. Hast du während der Beireinigung ohne Absprache einfach ClamAV installiert? Oder hast du das in der Vergangenheit gemacht bevor du dich hier im Forum gemeldet hast?
__________________ Logfiles bitte immer in CODE-Tags posten |
04.07.2015, 14:48 | #9 |
| Könnt ihr mal drüberschauen? Wüsste nicht, dass ich es drauf habe, ich weis eben nur vom gdata, und der ist schon seit beginn drauf kann ich es irgendwo deinstallieren und vor allem erstmal ausfindig machen? |
04.07.2015, 14:52 | #10 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Könnt ihr mal drüberschauen? Ignorier die Meldung erstmal. Adware/Junkware/Toolbars entfernen 1. Schritt: Malwarebytes Downloade Dir bitte Malwarebytes Anti-Malware
(alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!) 2. Schritt: adwCleaner Downloade Dir bitte AdwCleaner auf deinen Desktop.
3. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
4. Schritt: Frisches Log mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ Logfiles bitte immer in CODE-Tags posten |
04.07.2015, 14:57 | #11 |
| Könnt ihr mal drüberschauen? 1. Problem: Malwarebytes hatte ich vor 3-4 Monaten schon runtergeladen. Ich kann es nun nicht mehr kostenlos nutzen. Was kann ich tun? |
04.07.2015, 15:05 | #12 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Könnt ihr mal drüberschauen? Das ist doch Quatsch. Natürlich kannst du es nutzen.
__________________ Logfiles bitte immer in CODE-Tags posten |
05.07.2015, 10:06 | #13 |
| Könnt ihr mal drüberschauen? das ist die adw-Textdatei: Code:
ATTFilter ***** [ Dienste ] ***** ***** [ Dateien / Ordner ] ***** Ordner Gelöscht : C:\ProgramData\Babylon Ordner Gelöscht : C:\ProgramData\SweetIM Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector Ordner Gelöscht : C:\Program Files\Delta Ordner Gelöscht : C:\Program Files\pdfforge Toolbar Ordner Gelöscht : C:\Program Files\RegClean Pro Ordner Gelöscht : C:\Program Files\SweetIM Ordner Gelöscht : C:\Program Files\WinZip Malware Protector Ordner Gelöscht : C:\Users\Siggi\AppData\Local\PackageAware Ordner Gelöscht : C:\Users\Siggi\AppData\LocalLow\pdfforge Ordner Gelöscht : C:\Users\Siggi\AppData\Roaming\BabSolution Ordner Gelöscht : C:\Users\Siggi\AppData\Roaming\Babylon Ordner Gelöscht : C:\Users\Siggi\AppData\Roaming\pdfforge Ordner Gelöscht : C:\Users\Siggi\AppData\Roaming\Security System 2 Ordner Gelöscht : C:\Users\Siggi\AppData\Roaming\Systweak Ordner Gelöscht : C:\Users\Siggi\AppData\Roaming\Mozilla\Firefox\Profiles\5uy80lee.default-1398415569638\Extensions\isec@securitascout.com ***** [ Geplante Tasks ] ***** Task Gelöscht : WinZip Malware Protector_startup ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Search Settings Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\NCTAudioCDGrabber2.DLL Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Applications\ilividsetup.exe Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ComObject.DeskbarEnabler Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ComObject.DeskbarEnabler.1 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5EB0259D-AB79-4AE6-A6E6-24FFE21C3DA4} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CADAF6BE-BF50-4669-8BFD-C27BD4E6181B} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2BEF239C-752E-4001-8048-F256E0D8CD93} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{57BCA5FA-5DBB-45A2-B558-1755C3F6253B} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B922D405-6D13-4A2B-AE89-08A030DA4402} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B922D405-6D13-4A2B-AE89-08A030DA4402} Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{FD2FD708-1F6F-4B68-B141-C5778F0C19BB}] Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{E312764E-7706-43F1-8DAB-FCDD2B1E416D}] Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} Schlüssel Gelöscht : HKCU\Software\Search Settings Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar Schlüssel Gelöscht : HKLM\SOFTWARE\pdfforge Schlüssel Gelöscht : HKLM\SOFTWARE\Search Settings Schlüssel Gelöscht : HKU\.DEFAULT\Software\AVG Secure Search Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinZip Malware Protector_is1 Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Winamp Toolbar Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\WinZip Malware Protector_is1 Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Securita Scout Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{B8B0FC8B-E69B-4215-AF1A-4BDFF20D794B} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467 Daten Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local;<local> ***** [ Internetbrowser ] ***** -\\ Internet Explorer v9.0.8112.16659 -\\ Mozilla Firefox v39.0 (x86 de) [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.BUTTON_STRUCTURE", "[{\"b\":224608205,\"c\":\"mindspark.magnify\",\"p\":\"L.0\"},{\"b\":224608206,\"c\":\"mindspark.entersearchterms\",\"p\":\"L.0.0[...] [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.browser.version.last", "39.0"); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.firstKnownVersion", "6.83.5.59603"); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.homepage", "hxxp://home.tb.ask.com/index.jhtml?ptb=8F88B006-735A-4D7E-BF5B-524403A0A7D3&n=781aa8ef&p2=^AYY^xdm070^LADEDE^de&si=flvrunner"); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.initialized", true); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installKeysSource", "LocalStorage"); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installType", "XPI"); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installation.contextKey", ""); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installation.dlpCountryCode", "DE"); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installation.installDate", "2015013103"); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installation.partnerId", "^AYY^xdm070^LADEDE^de"); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installation.partnerSubId", "flvrunner"); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installation.pixelUrl", "hxxp://download.allin1convert.com/install_pixels.jhtml?partner=^AYY^xdm070^LADEDE^de&sub_id=flvrunner&coId=6b4656dfed094a5a[...] [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installation.success", true); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installation.toolbarId", "8F88B006-735A-4D7E-BF5B-524403A0A7D3"); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.isCompliantUninstallImplementation", true); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.lastActivePing", "1436017191567"); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.lastKnownVersion", "7.18.7.22083"); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.options.defaultSearch", false); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.options.homePageEnabled", false); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.options.keywordEnabled", false); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.options.tabEnabled", false); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.partnerPixelFired", true); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.searchHistory", "ulead video studio 7 download"); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.successUrl", "hxxp://flvrunner.com/thankyou.php"); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.toolbar.versionChanged", false); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.toolbarCollapsed", true); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.weather.location", "10001"); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark.lastInstalled", "allin1convert@mindspark.com"); -\\ Google Chrome v ************************* AdwCleaner[R0].txt - [10185 Bytes] - [04/07/2015 16:02:27] AdwCleaner[S0].txt - [10365 Bytes] - [04/07/2015 16:09:05] ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [10425 Bytes] ########## malwarebytes-Ergebnis: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Update, 04.07.2015 15:56:38, SYSTEM, SIGGI-PC, Manual, Remediation Database, 2015.3.9.1, 2015.7.1.2, Update, 04.07.2015 15:56:38, SYSTEM, SIGGI-PC, Manual, IP Database, 0.0.0.0, 2015.6.12.1, Update, 04.07.2015 15:56:38, SYSTEM, SIGGI-PC, Manual, Domain Database, 0.0.0.0, 2015.6.12.1, Update, 04.07.2015 15:56:38, SYSTEM, SIGGI-PC, Manual, Rootkit Database, 2015.2.25.1, 2015.7.3.1, Update, 04.07.2015 15:56:45, SYSTEM, SIGGI-PC, Manual, Malware Database, 2015.3.9.5, 2015.7.4.2, Scan, 04.07.2015 16:58:45, SYSTEM, SIGGI-PC, Manual, Start: 04.07.2015 16:33:34, Dauer: 25 Minuten 10 Sekunden, Bedrohungs-Suchlauf, Abgeschlossen, 0 Malwareerkennung, "0" nicht-Malwareerkennung, Scan, 04.07.2015 17:00:54, SYSTEM, SIGGI-PC, Manual, Start: 04.07.2015 17:00:03, Dauer: 0 Minuten 50 Sekunden, Bedrohungs-Suchlauf, Abgebrochen, 0 Malwareerkennung, "0" nicht-Malwareerkennung, (end) Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Malwarebytes Version: 7.2.9 (07.04.2015:1) OS: Windows Vista (TM) Home Premium x86 Ran by Siggi on 04.07.2015 at 17:07:21,76 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Tasks ~~~ Registry Values Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\\SearchAssistant ~~~ Registry Keys ~~~ Files ~~~ Folders ~~~ FireFox ~~~ Chrome [C:\Users\Siggi\appdata\local\Google\Chrome\User Data\Default\Preferences] - default search provider reset [C:\Users\Siggi\appdata\local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted: [C:\Users\Siggi\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset [C:\Users\Siggi\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 04.07.2015 at 17:15:10,45 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Code:
ATTFilter LastRegBack: 2015-07-04 16:22 ==================== End of log ============================ Code:
ATTFilter odeIntegrity Errors: =================================== Date: 2015-07-04 17:20:11.935 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\HookCentre.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2015-07-04 17:20:10.203 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\HookCentre.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2015-07-04 17:20:08.924 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\HookCentre.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2015-07-04 17:20:07.614 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\HookCentre.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2015-07-04 17:20:04.962 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\GDBehave.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2015-07-04 17:20:02.762 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\GDBehave.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2015-07-04 17:20:01.499 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\GDBehave.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2015-07-04 17:20:00.219 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\GDBehave.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2015-07-04 17:19:22.452 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2015-07-04 17:19:21.188 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. ==================== Memory info =========================== Processor: AMD Athlon(tm) 64 X2 Dual-Core Processor TK-57 Percentage of memory in use: 39% Total physical RAM: 3582.45 MB Available physical RAM: 2184.17 MB Total Virtual: 9628.18 MB Available Virtual: 7873.79 MB ==================== Drives ================================ Drive c: (OS_Install) (Fixed) (Total:43.95 GB) (Free:5.79 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Drive d: (Data) (Fixed) (Total:246.33 GB) (Free:163.76 GB) NTFS Drive f: () (Removable) (Total:1.86 GB) (Free:1.74 GB) FAT ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298.1 GB) (Disk ID: 73154E03) Partition 1: (Not Active) - (Size=7.8 GB) - (Type=27) Partition 2: (Active) - (Size=43.9 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=246.3 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (Size: 1.9 GB) (Disk ID: 00000000) Partition: GPT Partition Type. ==================== End of log ============================ Könntet ihr mir evtl noch wegen dem Ladethema helfen? Wegen Autostart und co? Wie gesagt, absoluter Laie muss ich jetzt abschliessend noch was machen? |
05.07.2015, 22:16 | #14 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Könnt ihr mal drüberschauen? adwcleaner und addition.txt Logs sind unvollständig. Von MBAM hast du das falsche Log gepostet. Und die FRST.txt fehlt.
__________________ Logfiles bitte immer in CODE-Tags posten |
06.07.2015, 08:37 | #15 |
| Könnt ihr mal drüberschauen? Hier nochmal: ADW cleaner: Code:
ATTFilter # AdwCleaner v4.207 - Bericht erstellt 04/07/2015 um 16:09:05 # Aktualisiert 21/06/2015 von Xplode # Datenbank : 2015-06-21.1 [Lokal] # Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (x86) # Benutzername : Siggi - SIGGI-PC # Gestarted von : C:\Users\Siggi\Desktop\AdwCleaner_4.207.exe # Option : Löschen ***** [ Dienste ] ***** ***** [ Dateien / Ordner ] ***** Ordner Gelöscht : C:\ProgramData\Babylon Ordner Gelöscht : C:\ProgramData\SweetIM Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector Ordner Gelöscht : C:\Program Files\Delta Ordner Gelöscht : C:\Program Files\pdfforge Toolbar Ordner Gelöscht : C:\Program Files\RegClean Pro Ordner Gelöscht : C:\Program Files\SweetIM Ordner Gelöscht : C:\Program Files\WinZip Malware Protector Ordner Gelöscht : C:\Users\Siggi\AppData\Local\PackageAware Ordner Gelöscht : C:\Users\Siggi\AppData\LocalLow\pdfforge Ordner Gelöscht : C:\Users\Siggi\AppData\Roaming\BabSolution Ordner Gelöscht : C:\Users\Siggi\AppData\Roaming\Babylon Ordner Gelöscht : C:\Users\Siggi\AppData\Roaming\pdfforge Ordner Gelöscht : C:\Users\Siggi\AppData\Roaming\Security System 2 Ordner Gelöscht : C:\Users\Siggi\AppData\Roaming\Systweak Ordner Gelöscht : C:\Users\Siggi\AppData\Roaming\Mozilla\Firefox\Profiles\5uy80lee.default-1398415569638\Extensions\isec@securitascout.com ***** [ Geplante Tasks ] ***** Task Gelöscht : WinZip Malware Protector_startup ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Search Settings Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\NCTAudioCDGrabber2.DLL Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Applications\ilividsetup.exe Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ComObject.DeskbarEnabler Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ComObject.DeskbarEnabler.1 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5EB0259D-AB79-4AE6-A6E6-24FFE21C3DA4} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CADAF6BE-BF50-4669-8BFD-C27BD4E6181B} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2BEF239C-752E-4001-8048-F256E0D8CD93} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{57BCA5FA-5DBB-45A2-B558-1755C3F6253B} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B922D405-6D13-4A2B-AE89-08A030DA4402} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B922D405-6D13-4A2B-AE89-08A030DA4402} Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{FD2FD708-1F6F-4B68-B141-C5778F0C19BB}] Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{E312764E-7706-43F1-8DAB-FCDD2B1E416D}] Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} Schlüssel Gelöscht : HKCU\Software\Search Settings Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar Schlüssel Gelöscht : HKLM\SOFTWARE\pdfforge Schlüssel Gelöscht : HKLM\SOFTWARE\Search Settings Schlüssel Gelöscht : HKU\.DEFAULT\Software\AVG Secure Search Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinZip Malware Protector_is1 Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Winamp Toolbar Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\WinZip Malware Protector_is1 Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Securita Scout Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{B8B0FC8B-E69B-4215-AF1A-4BDFF20D794B} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467 Daten Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local;<local> ***** [ Internetbrowser ] ***** -\\ Internet Explorer v9.0.8112.16659 -\\ Mozilla Firefox v39.0 (x86 de) [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.BUTTON_STRUCTURE", "[{\"b\":224608205,\"c\":\"mindspark.magnify\",\"p\":\"L.0\"},{\"b\":224608206,\"c\":\"mindspark.entersearchterms\",\"p\":\"L.0.0[...] [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.browser.version.last", "39.0"); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.firstKnownVersion", "6.83.5.59603"); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.homepage", "hxxp://home.tb.ask.com/index.jhtml?ptb=8F88B006-735A-4D7E-BF5B-524403A0A7D3&n=781aa8ef&p2=^AYY^xdm070^LADEDE^de&si=flvrunner"); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.initialized", true); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installKeysSource", "LocalStorage"); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installType", "XPI"); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installation.contextKey", ""); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installation.dlpCountryCode", "DE"); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installation.installDate", "2015013103"); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installation.partnerId", "^AYY^xdm070^LADEDE^de"); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installation.partnerSubId", "flvrunner"); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installation.pixelUrl", "hxxp://download.allin1convert.com/install_pixels.jhtml?partner=^AYY^xdm070^LADEDE^de&sub_id=flvrunner&coId=6b4656dfed094a5a[...] [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installation.success", true); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installation.toolbarId", "8F88B006-735A-4D7E-BF5B-524403A0A7D3"); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.isCompliantUninstallImplementation", true); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.lastActivePing", "1436017191567"); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.lastKnownVersion", "7.18.7.22083"); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.options.defaultSearch", false); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.options.homePageEnabled", false); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.options.keywordEnabled", false); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.options.tabEnabled", false); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.partnerPixelFired", true); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.searchHistory", "ulead video studio 7 download"); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.successUrl", "hxxp://flvrunner.com/thankyou.php"); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.toolbar.versionChanged", false); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.toolbarCollapsed", true); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.weather.location", "10001"); [5uy80lee.default-1398415569638\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark.lastInstalled", "allin1convert@mindspark.com"); -\\ Google Chrome v ************************* AdwCleaner[R0].txt - [10185 Bytes] - [04/07/2015 16:02:27] AdwCleaner[S0].txt - [10365 Bytes] - [04/07/2015 16:09:05] ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [10425 Bytes] ########## [CODE]Additional FRST Logfile: Code:
ATTFilter scan result of Farbar Recovery Scan Tool (x86) Version: 04-07-2015 Ran by Siggi at 2015-07-06 09:27:46 Running from C:\Users\Siggi\Desktop Boot Mode: Normal ========================================================== ==================== Accounts: ============================= Administrator (S-1-5-21-4239085852-1190954522-594501458-500 - Administrator - Disabled) ASPNET (S-1-5-21-4239085852-1190954522-594501458-1002 - Limited - Enabled) Gast (S-1-5-21-4239085852-1190954522-594501458-501 - Limited - Disabled) Siggi (S-1-5-21-4239085852-1190954522-594501458-1000 - Administrator - Enabled) => C:\Users\Siggi ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: G DATA INTERNET SECURITY (Enabled - Up to date) {545C8713-0744-B079-87F8-349A6D5C8CF0} AS: G DATA INTERNET SECURITY (Enabled - Up to date) {EF3D66F7-217E-BFF7-BD48-0FE816DBC64D} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: G*DATA Personal Firewall (Enabled) {6C670636-4D2B-B121-ACA7-9DAF938FCB8B} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) ACDSee 8 (HKLM\...\{AA2E6BFE-4351-481C-A720-47CB3506570B}) (Version: 8.0.41 - ACD Systems Ltd.) Adobe AIR (HKLM\...\Adobe AIR) (Version: 15.0.0.356 - Adobe Systems Incorporated) Adobe Flash Player 17 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 17.0.0.190 - Adobe Systems Incorporated) Adobe Flash Player 18 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 18.0.0.194 - Adobe Systems Incorporated) Adobe Reader X (10.1.14) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.14 - Adobe Systems Incorporated) Adobe Shockwave Player 11.5 (HKLM\...\Adobe Shockwave Player) (Version: 11.5.8.612 - Adobe Systems, Inc.) Agere Systems HDA Modem (HKLM\...\Agere Systems Soft Modem) (Version: - Agere Systems) Apple Software Update (HKLM\...\{6956856F-B6B3-4BE0-BA0B-8F495BE32033}) (Version: 2.1.1.116 - Apple Inc.) ArcSoft TotalMedia 3 (HKLM\...\{FF68083C-E11E-4A91-B54B-CD72AB5A0CF5}) (Version: - ArcSoft) Atheros Driver Installation Program (HKLM\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 7.1 - Atheros) bcTester 4.9 (de) (HKLM\...\{B18D4784-45FF-4787-A81E-012873CA6515}) (Version: 4.9.2 - QS QualitySoft GmbH) BisonCam (HKLM\...\{4A57592C-FF92-4083-97A9-92783BD5AFB4}) (Version: 6.32.0.07 - Bisont Electrocnics. Inc.) Bonjour (HKLM\...\{07287123-B8AC-41CE-8346-3D777245C35B}) (Version: 1.0.106 - Apple Inc.) Canon MX320 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX320_series) (Version: - ) ccc-core-static (Version: 2007.1101.2317.39832 - Ihr Firmenname) Hidden Defraggler (HKLM\...\Defraggler) (Version: 2.19 - Piriform) DHTML Editing Component (HKLM\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation) Dupehunter Professional (HKLM\...\Dupehunter Professional) (Version: 9.6.0.3933 - Carsten Heidtke Software) ElsterFormular (HKLM\...\ElsterFormular) (Version: 16.0.15910 - Landesfinanzdirektion Thüringen) G DATA INTERNET SECURITY (HKLM\...\{AC68D2FF-1674-4C16-A536-A69FC11BBD82}) (Version: 25.1.0.4 - G DATA Software AG) Glary Utilities 5.21 (HKLM\...\Glary Utilities 5) (Version: 5.21.0.40 - Glarysoft Ltd) Internet Manager (HKLM\...\Internet Manager) (Version: 22.001.18.68.55 - Huawei Technologies Co.,Ltd) Kindersicherung 2011 (HKLM\...\Kindersicherung_is1) (Version: - Salfeld Computer GmbH) MAGIX PC Check & Tuning Free 2011 (HKLM\...\MAGIX_MSI_PC_Check_Tuning_Free_2011) (Version: 6.0.403.1050 - MAGIX AG) MAGIX PC Check & Tuning Free 2011 (Version: 6.0.403.1050 - MAGIX AG) Hidden MAGIX Screenshare (HKLM\...\{B63DFA23-5C10-44B4-881D-45EFBF4A4761}) (Version: 4.3.6.1987 - MAGIX AG) Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation) MediaShow (HKLM\...\{D5A9B7C0-8751-11D8-9D75-000129760D75}) (Version: 3.0.4325 - CyberLink Corporation) Mediencenter Software Version 6.02.15 31.10.08 (HKLM\...\Mediencenter Software_is1) (Version: - Deutsche Telekom AG) Microsoft .NET Framework 1.1 (HKLM\...\Microsoft .NET Framework 1.1 (1033)) (Version: - ) Microsoft .NET Framework 1.1 German Language Pack (HKLM\...\{E78BFA60-5393-4C38-82AB-E8019E464EB4}) (Version: 1.1.4322 - Microsoft) Microsoft .NET Framework 1.1 Security Update (KB2698023) (HKLM\...\M2698023) (Version: - ) Microsoft .NET Framework 1.1 Security Update (KB2833941) (HKLM\...\M2833941) (Version: - ) Microsoft .NET Framework 1.1 Security Update (KB979906) (HKLM\...\M979906) (Version: - ) Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation) Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft) Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation) Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation) Mozilla Firefox 39.0 (x86 de) (HKLM\...\Mozilla Firefox 39.0 (x86 de)) (Version: 39.0 - Mozilla) Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla) MSXML 4.0 SP2 (KB927978) (HKLM\...\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}) (Version: 4.20.9841.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) office Convert Pdf to Jpg Jpeg Tiff Free 6.4 (HKLM\...\office Convert Pdf to Jpg Jpeg Tiff Free_is1) (Version: - Officeconvert Software, Inc.) PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.4.1 - Frank Heindörfer, Philip Chinery) phonostar-Player Version 2.01.4 (HKLM\...\phonostarRadioPlayer_is1) (Version: - ) PowerDVD (HKLM\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 7.0.3118.0 - CyberLink Corporation) PowerDVD Copy (HKLM\...\{E3D04529-6EDB-11D8-A372-0050BAE317E1}) (Version: 1.0.3716a - CyberLink Corporation) PowerProducer (HKLM\...\{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: - ) Presto! Digital Converter (HKLM\...\{EEFD47F3-3122-4A9C-8FFA-199F624378C6}) (Version: 1.09.00 - NewSoft) Presto! VideoWorks 6 (HKLM\...\{B0C0F5E6-10B1-11D6-9296-0050BA073EEC}) (Version: 6.30.00 - NewSoft) Primo (Version: 1.00.0000 - Your Company Name) Hidden Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5449 - ) Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group) RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01 (HKLM\...\{59F6A514-9813-47A3-948C-8A155460CC2A}) (Version: 3.51.01 - ) Runtime (Version: 1.00.0000 - Your Company Name) Hidden Safari (HKLM\...\{C5C649A8-1D21-4C83-9B08-7B3752E580F4}) (Version: 4.30.17.0 - Apple Inc.) Skins (Version: 2007.1101.2317.39832 - ATI) Hidden Skype™ 7.0 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.) System Control Manager (HKLM\...\{ED9C5D25-55DF-48D8-9328-2AC0D75DE5D8}) (Version: 1.0207.0907.G100.30 - ) TomTom HOME (HKLM\...\{0E09BE17-EDEA-42CA-8974-42A587F51510}) (Version: 2.9.8 - Ihr Firmenname) TomTom HOME (HKLM\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname) TomTom HOME (HKLM\...\{BB05590A-6602-43F3-A400-77EA0976BC0A}) (Version: 2.9.8 - Ihr Firmenname) TomTom HOME Visual Studio Merge Modules (HKLM\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.) T-Online 6.0 (HKLM\...\{B1275E23-717A-4D52-997A-1AD1E24BC7F3}) (Version: - ) T-Online WLAN-Access Finder (HKLM\...\{295C31E5-3F91-498E-9623-DA24D2FA2B6A}) (Version: - ) Ulead Burn.Now 4.5 (Version: 4.5.0 - InterVideo Digital Technology Corporation) Hidden Ulead Burn.Now 4.5 SE (HKLM\...\InstallShield_{A3BE3F1E-2472-4211-8735-E8239BE49D9F}) (Version: 4.5.0 - InterVideo Digital Technology Corporation) Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft) Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft) Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft) Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft) USB Video Device Driver (HKLM\...\{2758691A-2CDE-4942-A4AC-0E8F61FE2067}) (Version: 1.00 - eMPIA) VLC media player (HKLM\...\VLC media player) (Version: 2.2.1 - VideoLAN) Winamp (HKLM\...\Winamp) (Version: 5.551 - Nullsoft, Inc) Windows Media Player Firefox Plugin (HKLM\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp) x264vfw - H.264/MPEG-4 AVC codec (remove only) (HKLM\...\x264vfw) (Version: - ) Zattoo 3.3.4 Beta (HKLM\...\Zattoo) (Version: 3.3.4 Beta - Zattoo Inc.) Zattoo4 4.0.5 (HKLM\...\Zattoo4) (Version: 4.0.5 - Zattoo Inc.) Zylom Games Player Plugin (HKLM\...\Zylom Games Player Plugin) (Version: - Zylom Games) ==================== Custom CLSID (Whitelisted): ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) CustomCLSID: HKU\S-1-5-21-4239085852-1190954522-594501458-1000_Classes\CLSID\{9E385F0A-0BA2-430C-96AA-4399C5E40F6C}\localserver32 -> C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.) ==================== Restore Points ========================= ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 localhost ::1 localhost ==================== Scheduled Tasks (Whitelisted) ============= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) Task: {1AAF2817-A24A-43F9-96D7-D2DF7B679B97} - System32\Tasks\GU5SkipUAC => D:\Glary Utilities 5\Integrator.exe [2015-03-16] (Glarysoft Ltd) Task: {1B67DC94-BACD-4D58-B05D-5B6D7AB1C9F7} - System32\Tasks\{C44B8DA2-6025-40A6-9DFF-4811ECCF645F} => pcalua.exe -a C:\Users\Siggi\Downloads\wmp11-windowsxp-x86-DE-DE.exe -d C:\Users\Siggi\Downloads Task: {4370A0A0-DD09-4B2B-90F6-D98AE738473B} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-06-12] (Adobe Systems Incorporated) Task: {4B8210A4-E843-4E82-8462-B8736358E725} - System32\Tasks\{717A6EC0-A77E-47D8-B6D5-218F1026EB52} => pcalua.exe -a C:\Users\Siggi\Downloads\Authorware_Web_Player_Plugin.exe -d C:\Users\Siggi\Downloads Task: {662A8FB6-6D5B-42E9-BBD8-42B5B8E1F513} - \GlaryInitialize No Task File <==== ATTENTION Task: {79EB6516-3EF3-46E8-AED2-CD9EBF701525} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-07-01] (Adobe Systems Incorporated) Task: {7E1BA93B-92A1-43AC-9167-44C7D693147C} - System32\Tasks\PCCT - MAGIX AG => D:\MAGIX\PC_Check_Tuning_Free_2011\MxTray.exe [2010-11-08] () Task: {7EFB16C8-8CE7-4DB6-B1FA-17B18BECAD86} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Siggi => C:\Program Files\Windows Calendar\wincal.exe [2009-04-11] (Microsoft Corporation) Task: {A9C070FE-8EB0-4E4F-9FE2-96691689961C} - System32\Tasks\GlaryInitialize 5 => D:\Glary Utilities 5\Initialize.exe [2015-03-16] (Glarysoft Ltd) Task: {AE6AF6D3-E193-4677-9C86-43A73480AB38} - System32\Tasks\{70A4791E-B853-41E4-B81D-FF295EFDD551} => pcalua.exe -a "C:\Users\Siggi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WYHSBRIO\No23Recorder21[1].exe" -d C:\Users\Siggi Task: {C1AE4C93-00EF-4445-947A-921A81AC2481} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30] (Apple Inc.) Task: {D2C6F9A0-FCCD-4623-83AB-E01A5FA98570} - \GlaryInitialize 4 No Task File <==== ATTENTION Task: {DCF84E1F-08A2-4F48-90DD-1B00EC5EB819} - \Microsoft\Windows Defender\MP Scheduled Signature Update No Task File <==== ATTENTION Task: {E87CB479-1CC2-46BB-B09C-9EA2C39003FF} - System32\Tasks\{55D37320-8274-4E92-A1AF-153BB56260CB} => pcalua.exe -a F:\avm_bluefritz!usb_v20v10_vista_xp_2000_070703.exe -d F:\ (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GlaryInitialize 5.job => D:\Glary Utilities 5\Initialize.exe Task: C:\Windows\Tasks\PCCT - MAGIX AG.job => D:\MAGIX\PC_Check_Tuning_Free_2011\MxTray.exe ==================== Loaded Modules (Whitelisted) ============== 2010-11-08 18:08 - 2010-11-08 18:08 - 02644248 _____ () D:\MAGIX\PC_Check_Tuning_Free_2011\MxTray.exe 2010-11-04 12:21 - 2010-11-04 12:21 - 00635904 _____ () D:\MAGIX\PC_Check_Tuning_Free_2011\MFL_u_VC9.dll 2007-09-05 16:42 - 2007-09-05 16:42 - 00638976 _____ () D:\MAGIX\PC_Check_Tuning_Free_2011\PlayRIpl.dll 2007-11-01 17:09 - 2007-11-01 17:09 - 00159744 _____ () C:\Windows\system32\atitmmxx.dll 2011-03-14 17:27 - 2011-03-14 17:27 - 00271712 _____ () C:\ProgramData\DatacardService\HWDeviceService.exe 2015-03-16 09:28 - 2015-03-16 09:28 - 00080160 _____ () D:\Glary Utilities 5\zlib1.dll 2014-07-03 11:22 - 2011-06-17 13:04 - 00224096 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe 2014-07-03 11:22 - 2009-01-10 12:32 - 00011362 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\mingwm10.dll 2014-07-03 11:22 - 2009-06-22 20:42 - 00043008 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\libgcc_s_dw2-1.dll 2014-07-03 11:22 - 2010-05-05 10:47 - 02415104 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\QtCore4.dll 2014-07-03 11:22 - 2010-02-10 16:10 - 01148416 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\QtNetwork4.dll 2008-07-29 19:32 - 2007-08-23 14:37 - 00061440 _____ () C:\Program Files\System Control Manager\edd.exe 2008-07-31 10:06 - 2006-12-19 17:23 - 00272024 ____N () C:\Program Files\CyberLink\Shared Files\RichVideo.exe 2008-07-29 20:37 - 2008-07-29 21:13 - 01251720 _____ () C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe 2008-07-29 20:37 - 2008-07-29 21:13 - 00362376 _____ () C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcnet.dll 2015-02-20 05:42 - 2015-02-20 05:42 - 00317560 ____N () C:\Program Files\Common Files\G Data\AVKProxy\PktIcpt2.dll 2009-03-09 17:49 - 2009-03-09 17:49 - 00037888 _____ () D:\Program Files\Winamp\winampa.exe 2008-07-29 19:32 - 2004-07-06 15:12 - 00290816 _____ () C:\Program Files\System Control Manager\CmSuppX.dll 2008-07-29 19:32 - 2007-09-07 15:52 - 00110592 _____ () C:\Windows\system32\MGHwCtrl.dll 2008-07-29 19:32 - 2005-08-26 11:41 - 00010752 _____ () C:\Program Files\System Control Manager\MGKBHook.dll 2008-07-30 07:06 - 2007-03-15 16:34 - 00172032 _____ () C:\Windows\BisonCam\BsMnt.exe 2008-07-30 07:06 - 2007-03-15 16:37 - 00032768 _____ () C:\Windows\BisonCam\BisonHK.exe 2008-07-30 07:06 - 2007-03-15 16:35 - 00024576 _____ () C:\Windows\BisonCam\KBHookDLL.dll 2014-07-17 12:35 - 2011-06-17 13:04 - 01434464 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\LiveUpd.exe 2014-07-03 11:22 - 2010-02-10 16:43 - 09515520 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\QtGui4.dll 2014-07-17 12:35 - 2012-10-08 03:41 - 00082944 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\plugins\imageformats\qgif4.dll 2014-07-17 12:35 - 2012-10-08 03:41 - 00081920 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\plugins\imageformats\qico4.dll ==================== Alternate Data Streams (Whitelisted) ========= (If an entry is included in the fixlist, only the ADS will be removed.) ==================== Safe Mode (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ksupmgr => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ksupmgr => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver" ==================== EXE Association (Whitelisted) =============== (If an entry is included in the fixlist, the registry item will be restored to default or removed.) ==================== Internet Explorer trusted/restricted =============== (If an entry is included in the fixlist, it will be removed from the registry.) ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-4239085852-1190954522-594501458-1000\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\img36.jpg DNS Servers: 192.168.2.1 ==================== MSCONFIG/TASK MANAGER disabled items == (Currently there is no automatic fix for this section.) MSCONFIG\startupfolder: C:^Users^Siggi^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^PMB Medien-Prüfung.lnk => C:\Windows\pss\PMB Medien-Prüfung.lnk.Startup MSCONFIG\startupreg: Adobe Reader Speed Launcher => MSCONFIG\startupreg: gStart => MSCONFIG\startupreg: GUDelayStartup => "D:\Glary Utilities 5\StartupManager.exe" -delayrun MSCONFIG\startupreg: PDFPrint => MSCONFIG\startupreg: RemoteControl => "D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized MSCONFIG\startupreg: ToADiMon.exe => D:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe -TOnlineAutodialStart MSCONFIG\startupreg: TomTomHOME.exe => "D:\TomTom HOME 2\TomTomHOMERunner.exe" ==================== FirewallRules (Whitelisted) =============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [WinCollab-Out-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe FirewallRules: [WinCollab-In-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe FirewallRules: [WinCollab-Out-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe FirewallRules: [WinCollab-In-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe FirewallRules: [WinCollab-DFSR-Out-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe FirewallRules: [WinCollab-DFSR-In-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe FirewallRules: [TCP Query User{435646A2-87BD-4BCE-B12C-8F77B5B9E167}C:\program files\internet explorer\iexplore.exe] => (Block) C:\program files\internet explorer\iexplore.exe FirewallRules: [UDP Query User{CEF2E1B1-5A2A-4784-A0D9-31277285BB4E}C:\program files\internet explorer\iexplore.exe] => (Block) C:\program files\internet explorer\iexplore.exe FirewallRules: [{862E90DC-47A7-45CE-9DA3-F0AEC188192F}] => (Allow) D:\Program Files\CyberLink\PowerDVD\PowerDVD.EXE FirewallRules: [{5BD63FC5-667E-43CB-9D5F-7F4775111473}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe FirewallRules: [{40B7FED8-896D-44EC-9F1D-369F0573DDB7}] => (Allow) D:\Program Files\MSI\ArcSoft\TotalMedia\TotalMedia.exe FirewallRules: [{30822FFF-9222-40B2-B21C-7DF5B579C8BA}] => (Allow) D:\Program Files\MSI\ArcSoft\TotalMedia\TotalMedia.exe FirewallRules: [{434CF9CC-5E1C-4F17-BEA0-19931473AF4E}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{761EA6FC-9C02-463E-84B0-3FF78B70B401}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{AAAC93D4-ACB9-42B6-AB71-60E3779D23BF}] => (Allow) D:\Adobe\Photoshop Elements 7.0\AdobePhotoshopElementsMediaServer.exe FirewallRules: [{40AE9DFD-5E87-4D4C-9897-C982E305FFB7}] => (Allow) D:\Adobe\Photoshop Elements 7.0\AdobePhotoshopElementsMediaServer.exe FirewallRules: [{650A8962-9133-4956-B426-43622836BA21}] => (Allow) LPort=80 FirewallRules: [{000A310B-E026-493E-B1F7-89CEDE8E840A}] => (Allow) LPort=80 FirewallRules: [{8A9A7414-0D99-4D42-AB2A-EE6DDAEB3A67}] => (Allow) LPort=80 FirewallRules: [{D821B09A-27FD-4D52-845E-E3FF04243EC9}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe FirewallRules: [{E003EE87-8BF4-4397-B0F1-F8B6DB9927AF}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe FirewallRules: [{E712949A-C008-422C-A97B-8DDF4AD814F8}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (07/06/2015 09:01:10 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/05/2015 10:21:48 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Programm avk.exe, Version 25.1.15051.309 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen. Prozess-ID: 994 Anfangszeit: 01d0b74ec6dfaf11 Zeitpunkt der Beendigung: 0 Error: (07/05/2015 10:21:48 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Programm GDSC.exe, Version 25.1.15057.882 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen. Prozess-ID: 170c Anfangszeit: 01d0b74ec0e9ddb1 Zeitpunkt der Beendigung: 0 Error: (07/05/2015 07:46:18 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/05/2015 06:28:13 PM) (Source: Windows Search Service) (EventID: 3013) (User: ) Description: Eintrag <C:\USERS\SIGGI\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\5UY80LEE.DEFAULT-1398415569638\CACHE2\ENTRIES> in der Hash-Zuordnung kann nicht aktualisiert werden. Kontext: Anwendung, SystemIndex Katalog Details: Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f) Error: (07/05/2015 06:28:13 PM) (Source: Windows Search Service) (EventID: 3013) (User: ) Description: Eintrag <C:\USERS\SIGGI\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\5UY80LEE.DEFAULT-1398415569638\CACHE2\ENTRIES> in der Hash-Zuordnung kann nicht aktualisiert werden. Kontext: Anwendung, SystemIndex Katalog Details: Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f) Error: (07/05/2015 06:17:41 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/05/2015 03:35:37 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/05/2015 11:42:47 AM) (Source: VSS) (EventID: 8194) (User: ) Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005. Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess. Vorgang: Generatordaten werden gesammelt Kontext: Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220} Generatorname: System Writer Generatorinstanz-ID: {5c28d29d-1c45-43e7-9c36-e7f1b4f982c4} Error: (07/05/2015 10:58:19 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 System errors: ============= Error: (07/06/2015 09:06:57 AM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT) Description: 0x80070032 Error: (07/06/2015 09:05:51 AM) (Source: netbt) (EventID: 4321) (User: ) Description: Der Name "SIGGI-PC :20" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.2.105 registriert werden. Der Computer mit IP-Adresse 192.168.2.103 hat nicht zugelassen, dass dieser Computer diesen Namen verwendet. Error: (07/06/2015 09:05:51 AM) (Source: netbt) (EventID: 4321) (User: ) Description: Der Name "SIGGI-PC :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.2.105 registriert werden. Der Computer mit IP-Adresse 192.168.2.103 hat nicht zugelassen, dass dieser Computer diesen Namen verwendet. Error: (07/06/2015 09:05:51 AM) (Source: netbt) (EventID: 4321) (User: ) Description: Der Name "SIGGI-PC :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.2.105 registriert werden. Der Computer mit IP-Adresse 192.168.2.103 hat nicht zugelassen, dass dieser Computer diesen Namen verwendet. Error: (07/06/2015 09:05:51 AM) (Source: Server) (EventID: 2505) (User: ) Description: Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{631A12C0-C54D-4042-91BF-3033F9A95258} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden. Error: (07/06/2015 09:05:47 AM) (Source: Dhcp) (EventID: 1002) (User: ) Description: Die IP-Adresslease 192.168.2.103 für die Netzwerkkarte mit der Netzwerkadresse 0015AFAC6D56 wurde durch den DHCP-Server 192.168.2.1 abgelehnt (der DHCP-Server hat eine DHCPNACK-Meldung gesendet). Error: (07/06/2015 09:01:13 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Internet Manager. OUC%%1053 Error: (07/06/2015 09:01:13 AM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: 30000Internet Manager. OUC Error: (07/05/2015 07:51:02 PM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT) Description: 0x80070032 Error: (07/05/2015 07:46:20 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Internet Manager. OUC%%1053 Microsoft Office: ========================= Error: (09/13/2011 10:25:16 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: ) Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 6351 seconds with 420 seconds of active time. This session ended with a crash. CodeIntegrity Errors: =================================== Date: 2015-07-06 09:26:54.824 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\HookCentre.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2015-07-06 09:26:52.827 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\HookCentre.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2015-07-06 09:26:51.548 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\HookCentre.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2015-07-06 09:26:50.019 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\HookCentre.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2015-07-06 09:26:47.461 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\GDBehave.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2015-07-06 09:26:46.119 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\GDBehave.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2015-07-06 09:26:44.731 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\GDBehave.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2015-07-06 09:26:43.046 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\GDBehave.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2015-07-06 09:26:05.388 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2015-07-06 09:26:03.999 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. ==================== Memory info =========================== Processor: AMD Athlon(tm) 64 X2 Dual-Core Processor TK-57 Percentage of memory in use: 38% Total physical RAM: 3582.45 MB Available physical RAM: 2197.32 MB Total Virtual: 9632.18 MB Available Virtual: 7782.74 MB ==================== Drives ================================ Drive c: (OS_Install) (Fixed) (Total:43.95 GB) (Free:8.57 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Drive d: (Data) (Fixed) (Total:246.33 GB) (Free:162.84 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298.1 GB) (Disk ID: 73154E03) Partition 1: (Not Active) - (Size=7.8 GB) - (Type=27) Partition 2: (Active) - (Size=43.9 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=246.3 GB) - (Type=07 NTFS) ==================== End of log ============================ FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 04-07-2015 Ran by Siggi (administrator) on SIGGI-PC on 06-07-2015 09:24:32 Running from C:\Users\Siggi\Desktop Loaded Profiles: Siggi (Available Profiles: Siggi) Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 9 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (G Data Software AG) C:\Program Files\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG) C:\Program Files\G Data\InternetSecurity\AVK\AVKWCtl.exe (Microsoft Corporation) C:\Windows\System32\SLsvc.exe () D:\MAGIX\PC_Check_Tuning_Free_2011\MxTray.exe (G Data Software AG) C:\Program Files\G Data\InternetSecurity\AVKTray\AVKTray.exe (G Data Software AG) C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG) C:\Program Files\Common Files\G Data\AVKProxy\GDKBFltExe32.exe (G Data Software AG) C:\Program Files\G Data\InternetSecurity\AVK\AVKService.exe () C:\ProgramData\DatacardService\HWDeviceService.exe (Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe (Glarysoft Ltd) D:\Glary Utilities 5\Integrator.exe () C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe () C:\Program Files\System Control Manager\edd.exe (Salfeld Computer) C:\Windows\System32\cchservice.exe () C:\Program Files\CyberLink\Shared Files\RichVideo.exe () C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (TomTom) D:\TomTom HOME 2\TomTomHOMEService.exe (G Data Software AG) C:\Program Files\G Data\InternetSecurity\Firewall\GDFwSvc.exe (Realtek Semiconductor) C:\Windows\RtHDVCpl.exe () D:\Program Files\Winamp\winampa.exe (MSI) C:\Program Files\System Control Manager\MGSysCtrl.exe () C:\Windows\BisonCam\BsMnt.exe () C:\Windows\BisonCam\BisonHK.exe (Microsoft Corporation) C:\Windows\ehome\ehtray.exe (Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (G DATA Software AG) C:\Program Files\G Data\InternetSecurity\Firewall\GDFirewallTray.exe (phonostar) D:\Program Files\phonostar\ps_timer.exe (TomTom) D:\TomTom HOME 2\TomTomHOMERunner.exe (Microsoft Corporation) C:\Windows\ehome\ehmsas.exe (Microsoft Corporation) C:\Windows\System32\mobsync.exe (Microsoft Corporation) D:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe () C:\ProgramData\Internet Manager\OnlineUpdate\LiveUpd.exe (Farbar) C:\Users\Siggi\Desktop\FRST(1).exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation) HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [90112 2006-11-10] () HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [4669440 2007-07-06] (Realtek Semiconductor) HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1826816 2007-06-15] (Realtek Semiconductor Corp.) HKLM\...\Run: [ChicoSys] => C:\Windows\system32\cc32\webtmr.exe [5635736 2008-01-21] (Salfeld Computer) HKLM\...\Run: [GDFirewallTray] => C:\Program Files\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1855608 2015-02-20] (G DATA Software AG) HKLM\...\Run: [WinampAgent] => D:\Program Files\Winamp\winampa.exe [37888 2009-03-09] () HKLM\...\Run: [MGSysCtrl] => C:\Program Files\System Control Manager\MGSysCtrl.exe [561152 2007-09-07] (MSI) HKLM\...\Run: [LanguageShortcut] => D:\Program Files\CyberLink\PowerDVD\Language\Language.exe [52256 2007-01-08] () HKLM\...\Run: [BsMnt] => C:\Windows\BisonCam\BsMnt.exe [172032 2007-03-15] () HKLM\...\Run: [BisonHK] => C:\Windows\BisonCam\BisonHK.exe [32768 2007-03-15] () HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files\G Data\InternetSecurity\AVKTray\AVKTray.exe,C:\Program Files\G Data\InternetSecurity\AVKKid\AVKCKS.exe, HKU\S-1-5-21-4239085852-1190954522-594501458-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation) HKU\S-1-5-21-4239085852-1190954522-594501458-1000\...\Run: [CCWinTray] => C:\Windows\tray\wintmr.exe [5975704 2008-01-21] (Salfeld Computer) HKU\S-1-5-21-4239085852-1190954522-594501458-1000\...\Run: [PhonostarTimer] => D:\Program Files\phonostar\ps_timer.exe [126976 2008-07-14] (phonostar) HKU\S-1-5-21-4239085852-1190954522-594501458-1000\...\Run: [TomTomHOME.exe] => D:\TomTom HOME 2\TomTomHOMERunner.exe [248176 2015-04-30] (TomTom) HKU\S-1-5-21-4239085852-1190954522-594501458-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\GdScrSv.scr [2229880 2015-02-20] (G Data Software AG) Startup: C:\Users\Siggi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk [2009-05-13] ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> D:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) BootExecute: autocheck autochk * BootDefrag.exe ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = HKU\S-1-5-21-4239085852-1190954522-594501458-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank SearchScopes: HKLM -> {BE28C22E-F666-424d-B5FD-125C4AFEE34E} URL = hxxp://search.myheritage.com?orig=ds&q={searchTerms} SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 -> {6DFAB371-A8D5-4157-BCE1-0EFFACBE2534} URL = hxxp://suche.web.de/search/web/?su={searchTerms}&mc=searchplugin@suche@msie.suche@web&origin=searchplugin SearchScopes: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 -> {774B8359-0018-4A16-8C95-0713F67F4D6A} URL = hxxp://search.1und1.de/search/web/?su={searchTerms}&mc=searchplugin@suche@msie.suche@web&origin=searchplugin SearchScopes: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 -> {78B67B9E-D578-4F1C-9A27-39B6907FD777} URL = hxxp://go.web.de/suchbox/amazon/?keywords={searchTerms} SearchScopes: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 -> {B7191055-BECA-4ED5-AD57-95CD7A0F0179} URL = hxxp://suche.gmx.net/search/web/?su={searchTerms}&mc=searchplugin@suche@msie.suche@web&origin=searchplugin SearchScopes: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 -> {BE28C22E-F666-424d-B5FD-125C4AFEE34E} URL = hxxp://search.myheritage.com?orig=ds&q={searchTerms} SearchScopes: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 -> {FA784A59-064C-4814-9A15-32BD22856DD9} URL = hxxp://go.web.de/suchbox/smartshopping/?searchText={searchTerms}&mc=searchplugin@suche@msie.suche@preisvergleich SearchScopes: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 -> {FC09AA4A-ED15-4AC1-8983-01F3169C16C3} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=securitascout BHO: No Name -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> No File BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-11-10] (Sun Microsystems, Inc.) Toolbar: HKLM - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File Toolbar: HKU\S-1-5-21-4239085852-1190954522-594501458-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Winsock: Catalog5 05 C:\Program Files\Bonjour\mdnsNSP.dll [147456 2008-12-12] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 Tcpip\..\Interfaces\{631A12C0-C54D-4042-91BF-3033F9A95258}: [DhcpNameServer] 192.168.2.1 Tcpip\..\Interfaces\{A600EB07-35E8-419C-A5B0-4EEFF01B59A5}: [DhcpNameServer] 10.74.210.210 10.74.210.211 FireFox: ======== FF ProfilePath: C:\Users\Siggi\AppData\Roaming\Mozilla\Firefox\Profiles\5uy80lee.default-1398415569638 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_18_0_0_194.dll [2015-07-01] () FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll [2010-08-18] (Adobe Systems, Inc.) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.) FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.2.1 -> D:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN) FF Plugin: @zylom.com/ZylomGamesPlayer -> C:\Users\Siggi\AppData\Roaming\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll [2009-10-23] (Zylom) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-04-30] (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np32asw.dll [2004-07-02] (Macromedia, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2011-11-10] (Sun Microsystems, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdjvu.dll [2011-09-16] (Caminova, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npLegitCheckPlugin.dll [2009-02-06] (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL [2006-10-26] (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2015-04-30] (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npzylomgamesplayer.dll [2009-10-23] (Zylom) FF Extension: Allin1Convert - C:\Users\Siggi\AppData\Roaming\Mozilla\Firefox\Profiles\5uy80lee.default-1398415569638\Extensions\8hffxtbr@download.allin1convert.com [2015-06-07] FF Extension: dp Launcher Plugin - C:\Users\Siggi\AppData\Roaming\Mozilla\Firefox\Profiles\5uy80lee.default-1398415569638\Extensions\dplauncher@digitalpublishing.de [2015-01-27] FF Extension: pdfforge Toolbar Plugin - C:\Program Files\Mozilla Firefox\extensions\{B922D405-6D13-4A2B-AE89-08A030DA4402} [2015-07-04] FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-07-07] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 AVKProxy; C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe [2528888 2015-04-16] (G Data Software AG) R2 AVKService; C:\Program Files\G Data\InternetSecurity\AVK\AVKService.exe [965240 2015-02-20] (G Data Software AG) R2 AVKWCtl; C:\Program Files\G Data\InternetSecurity\AVK\AVKWCtl.exe [2876888 2015-04-07] (G Data Software AG) R3 GDFwSvc; C:\Program Files\G Data\InternetSecurity\Firewall\GDFwSvc.exe [2539560 2015-02-20] (G Data Software AG) R3 GDScan; C:\Program Files\Common Files\G Data\GDScan\GDScan.exe [789112 2015-03-04] (G Data Software AG) R2 HWDeviceService.exe; C:\ProgramData\DatacardService\HWDeviceService.exe [271712 2011-03-14] () S2 Internet Manager. RunOuc; C:\Program Files\T-Mobile\InternetManager_H\UpdateDog\ouc.exe [224096 2011-06-17] () S2 ksupmgr; C:\Windows\system32\ksupmgr.exe [765592 2010-08-25] (Salfeld Computer) S2 MBAMService; D:\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation) R2 NishService; C:\Program Files\System Control Manager\edd.exe [61440 2007-08-23] () [File not signed] R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2006-12-19] () R2 Symantec Core LC; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe [1251720 2008-07-29] () R2 TomTomHOMEService; D:\TomTom HOME 2\TomTomHOMEService.exe [93040 2015-04-30] (TomTom) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-21] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R0 Achernar; C:\Windows\System32\Drivers\Achernar.sys [18432 2007-02-05] (NewSoft Technology Corporation) [File not signed] S3 AF15BDA; C:\Windows\System32\DRIVERS\AF15BDA.sys [306816 2008-09-28] (AfaTech ) R3 Afc; C:\Windows\System32\drivers\Afc.sys [11776 2005-02-23] (Arcsoft, Inc.) [File not signed] R3 AVMBTPARALLEL; C:\Windows\System32\DRIVERS\avmbtpar.sys [61952 2007-07-03] (AVM GmbH) R3 AVMBTSERIAL; C:\Windows\System32\DRIVERS\avmbtser.sys [60928 2007-07-03] (AVM GmbH) R3 AVMCOWAN; C:\Windows\System32\DRIVERS\AVMCOWAN.sys [64512 2007-07-03] (AVM GmbH) R3 BFHU_CFG; C:\Windows\System32\DRIVERS\bfhu_cfg.sys [6656 2007-07-03] (AVM Berlin) S3 bfubase; C:\Windows\System32\DRIVERS\bfubase.sys [882688 2007-07-03] (AVM Berlin) R0 BootDefragDriver; C:\Windows\System32\drivers\BootDefragDriver.sys [16064 2014-07-18] (Glarysoft Ltd) R3 CAPI_CIP; C:\Windows\System32\DRIVERS\capi_cip.sys [374144 2007-07-03] (AVM Berlin) S3 emAudio; C:\Windows\System32\drivers\emAudio.sys [22912 2007-01-12] (eMPIA Technology, Inc.) R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [108032 2015-06-27] (G Data Software AG) R3 GDKBB; C:\Windows\system32\drivers\GDKBB32.sys [24192 2015-06-27] (G Data Software AG) R1 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt32.sys [20352 2015-06-27] (G Data Software AG) R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [161792 2015-06-27] (G Data Software AG) R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [73216 2015-06-27] (G Data Software AG) R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd32.sys [53248 2015-06-27] (G Data Software AG) R1 GRD; C:\Windows\system32\drivers\GRD.sys [29528 2015-07-02] (G Data Software) S3 grmnusb; C:\Windows\System32\drivers\grmnusb.sys [9344 2009-04-17] (GARMIN Corp.) R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [17344 2014-10-17] (Glarysoft Ltd) R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [87040 2015-06-27] (G Data Software AG) S3 huawei_cdcacm; C:\Windows\System32\DRIVERS\ew_jucdcacm.sys [95616 2012-04-23] (Huawei Technologies Co., Ltd.) S3 huawei_cdcecm; C:\Windows\System32\DRIVERS\ew_jucdcecm.sys [70016 2012-04-23] (Huawei Technologies Co., Ltd.) S3 huawei_ext_ctrl; C:\Windows\System32\DRIVERS\ew_juextctrl.sys [27520 2012-04-23] (Huawei Technologies Co., Ltd.) S3 KMWDFILTER; C:\Windows\System32\DRIVERS\KMWDFILTER.sys [17408 2008-10-09] (Windows (R) Codename Longhorn DDK provider) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-04-14] (Malwarebytes Corporation) S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2015-07-04] (Malwarebytes Corporation) S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-04-14] (Malwarebytes Corporation) R3 MGHwCtrl; C:\Windows\system32\drivers\MGHwCtrl.sys [19456 2006-12-22] (Windows (R) Codename Longhorn DDK provider) [File not signed] S3 MTOnlPktAlyX; D:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\MTOnlPktAlyX.SYS [17536 2006-10-09] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) [File not signed] R2 thomedav; C:\Windows\system32\drivers\thomedav.sys [83072 2008-08-07] () [File not signed] S3 USB28xxBGA; C:\Windows\System32\DRIVERS\emBDA.sys [361728 2007-01-29] (eMPIA Technology, Inc.) S3 USB28xxOEM; C:\Windows\System32\DRIVERS\emOEM.sys [39680 2007-01-29] (eMPIA Technology, Inc.) U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation) S3 catchme; \??\C:\Users\Siggi\AppData\Local\Temp\catchme.sys [X] R3 cpuz132; \??\C:\Users\Siggi\AppData\Local\Temp\cpuz132\cpuz132_x32.sys [X] U5 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [249472 2012-04-20] (Huawei Technologies Co., Ltd.) S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] S3 RTHDMIAzAudService; system32\drivers\RtHDMIV.sys [X] S3 SymIMMP; system32\DRIVERS\SymIM.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-07-06 09:24 - 2015-07-06 09:26 - 00017926 _____ C:\Users\Siggi\Desktop\FRST.txt 2015-07-05 16:39 - 2015-07-05 16:39 - 00000954 _____ C:\Users\Siggi\Desktop\Windows Media Player.lnk 2015-07-05 12:24 - 2015-07-05 12:24 - 00000727 _____ C:\Users\Public\Desktop\VLC media player.lnk 2015-07-05 12:21 - 2015-07-05 12:22 - 28849904 _____ C:\Users\Siggi\Downloads\vlc-2.2.1-win32.exe 2015-07-04 17:17 - 2015-07-04 17:17 - 01636352 _____ (Farbar) C:\Users\Siggi\Desktop\FRST(1).exe 2015-07-04 17:15 - 2015-07-04 17:15 - 00001211 _____ C:\Users\Siggi\Desktop\JRT.txt 2015-07-04 17:07 - 2015-07-04 17:07 - 00000207 _____ C:\Windows\tweaking.com-regbackup-SIGGI-PC-Windows-Vista-(TM)-Home-Premium-(32-bit).dat 2015-07-04 17:07 - 2015-07-04 17:07 - 00000000 ____D C:\RegBackup 2015-07-04 17:05 - 2015-07-04 17:06 - 02952814 _____ (Malwarebytes Corporation) C:\Users\Siggi\Desktop\JRT.exe 2015-07-04 17:02 - 2015-07-04 17:02 - 00000943 _____ C:\Users\Siggi\Desktop\mbam.txt 2015-07-04 16:02 - 2015-07-04 16:09 - 00000000 ____D C:\AdwCleaner 2015-07-04 16:00 - 2015-07-04 16:00 - 02244096 _____ C:\Users\Siggi\Desktop\AdwCleaner_4.207.exe 2015-07-04 15:54 - 2015-07-04 15:54 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Siggi\Downloads\mbam-setup-2.1.6.1022.exe 2015-07-04 14:50 - 2015-07-04 15:38 - 00000000 ___SD C:\ComboFix 2015-07-04 14:43 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe 2015-07-04 14:43 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe 2015-07-04 14:43 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2015-07-04 14:43 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2015-07-04 14:43 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2015-07-04 14:43 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe 2015-07-04 14:43 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe 2015-07-04 14:43 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe 2015-07-04 14:42 - 2015-07-04 14:43 - 00000000 ____D C:\Qoobox 2015-07-04 14:41 - 2015-07-04 14:50 - 00000000 ___SD C:\32788R22FWJFW 2015-07-04 14:41 - 2015-07-04 14:41 - 00000000 ____D C:\Windows\erdnt 2015-07-04 14:40 - 2015-07-04 14:41 - 05631262 ____R (Swearware) C:\Users\Siggi\Downloads\ComboFix.exe 2015-07-04 11:19 - 2015-07-04 11:19 - 00000731 _____ C:\Users\Siggi\Desktop\Revo Uninstaller.lnk 2015-07-04 11:18 - 2015-07-04 11:18 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Siggi\Downloads\revosetup95.exe 2015-07-04 11:16 - 2015-07-04 11:16 - 04798152 _____ (WinZip International LLC ) C:\Users\Siggi\Downloads\wzmp_10.exe 2015-07-04 11:16 - 2015-07-04 11:16 - 00000000 ____D C:\Users\Siggi\AppData\Roaming\Nico Mak Computing 2015-07-04 11:16 - 2015-07-04 11:16 - 00000000 ____D C:\ProgramData\Nico Mak Computing 2015-07-04 11:16 - 2013-03-15 17:01 - 00016384 _____ C:\Windows\system32\wsusnative32.exe 2015-07-04 11:05 - 2015-07-04 14:12 - 00000000 ____D C:\Program Files\Mozilla Firefox 2015-07-02 11:04 - 2015-07-02 11:09 - 00032189 _____ C:\Users\Siggi\Downloads\Addition.txt 2015-07-02 10:59 - 2015-07-04 14:29 - 00031566 _____ C:\Users\Siggi\Downloads\FRST.txt 2015-07-02 10:47 - 2015-07-06 09:24 - 00000000 ____D C:\FRST 2015-07-02 10:46 - 2015-07-02 10:46 - 01636352 _____ (Farbar) C:\Users\Siggi\Downloads\FRST.exe 2015-07-02 10:26 - 2015-07-02 10:26 - 00572456 _____ (F-Secure Corporation) C:\Users\Siggi\Downloads\F-SecureOnlineScanner.exe 2015-07-02 10:26 - 2015-07-02 10:26 - 00000000 ____D C:\Users\Siggi\AppData\Local\F-Secure 2015-07-02 10:26 - 2015-07-02 10:26 - 00000000 ____D C:\ProgramData\F-Secure 2015-07-01 22:20 - 2015-07-01 22:20 - 01125056 _____ (Adobe Systems Incorporated) C:\Users\Siggi\Downloads\flashplayer18_ha_install.exe 2015-06-28 16:30 - 2015-06-28 16:31 - 04532776 _____ (Piriform Ltd) C:\Users\Siggi\Downloads\dfsetup219.exe 2015-06-27 22:51 - 2015-06-27 22:51 - 00024192 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBB32.sys 2015-06-27 22:51 - 2015-06-27 22:51 - 00000657 _____ C:\Windows\setupact.log 2015-06-27 22:51 - 2015-06-27 22:51 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_GDKBB32_01007.Wdf 2015-06-27 22:51 - 2015-06-27 22:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G DATA INTERNET SECURITY 2015-06-27 22:51 - 2015-06-27 22:51 - 00000000 _____ C:\Windows\setuperr.log 2015-06-27 22:49 - 2015-06-27 22:49 - 00002078 _____ C:\Windows\DPINST.LOG 2015-06-23 15:47 - 2015-06-23 15:47 - 00000588 _____ C:\Users\Public\Desktop\Ev. Gesangbuch 3.0.lnk 2015-06-23 15:47 - 2015-06-23 15:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\bibel digital 2015-06-23 15:46 - 2015-06-25 22:07 - 00000000 ____D C:\Users\Siggi\Documents\bibel digital 2015-06-23 15:46 - 2015-06-23 15:46 - 00000000 ____D C:\Users\Siggi\AppData\Roaming\c-software 2015-06-10 17:13 - 2015-04-24 17:54 - 00532480 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll 2015-06-10 17:12 - 2015-05-21 16:22 - 02066432 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-06-10 17:12 - 2015-05-09 01:08 - 00894464 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll 2015-06-10 17:01 - 2015-05-05 00:51 - 10628608 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll 2015-06-10 17:01 - 2015-05-05 00:50 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll 2015-06-10 17:01 - 2015-05-05 00:50 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx 2015-06-10 17:01 - 2015-05-05 00:50 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll 2015-06-10 17:01 - 2015-05-04 23:21 - 08147456 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL 2015-06-10 08:32 - 2015-05-31 01:54 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2015-06-10 08:32 - 2015-05-31 01:53 - 09750528 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-06-10 08:32 - 2015-05-31 01:50 - 01139712 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-06-10 08:32 - 2015-05-31 01:49 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-06-10 08:32 - 2015-05-31 01:49 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-06-10 08:32 - 2015-05-31 01:49 - 00718336 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2015-06-10 08:32 - 2015-05-31 01:49 - 00421888 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-06-10 08:32 - 2015-05-31 01:48 - 01804288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-06-10 08:32 - 2015-05-31 01:48 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-06-10 08:32 - 2015-05-31 01:48 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-06-10 08:32 - 2015-05-31 01:48 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2015-06-10 08:32 - 2015-05-31 01:48 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2015-06-10 08:32 - 2015-05-31 01:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2015-06-10 08:32 - 2015-05-31 01:48 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2015-06-10 08:32 - 2015-05-31 01:48 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2015-06-10 08:32 - 2015-05-31 01:47 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2015-06-10 08:32 - 2015-05-31 01:47 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2015-06-10 08:32 - 2015-05-31 01:47 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-06-10 08:32 - 2015-05-31 01:47 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2015-06-10 08:32 - 2015-05-31 01:47 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2015-06-10 08:31 - 2015-05-31 02:03 - 12385280 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-06-10 08:31 - 2015-05-31 01:55 - 01809920 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-07-06 09:26 - 2011-11-12 10:24 - 00000109 _____ C:\Windows\system32\SWCTL.DLL 2015-07-06 09:12 - 2008-01-21 03:35 - 01976336 _____ C:\Windows\WindowsUpdate.log 2015-07-06 09:04 - 2011-11-13 19:49 - 00017420 _____ C:\Windows\system32\cchservice.err 2015-07-06 09:03 - 2014-12-11 19:33 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-07-06 09:02 - 2008-07-31 11:30 - 00000000 ____D C:\Users\Siggi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite 2015-07-06 09:01 - 2014-08-21 20:51 - 00000294 _____ C:\Windows\Tasks\GlaryInitialize 5.job 2015-07-06 09:00 - 2012-06-30 10:24 - 00000360 _____ C:\Windows\Tasks\PCCT - MAGIX AG.job 2015-07-06 09:00 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2015-07-06 09:00 - 2006-11-02 14:47 - 00003712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2015-07-06 09:00 - 2006-11-02 14:47 - 00003712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2015-07-05 22:23 - 2006-11-02 15:01 - 00032530 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2015-07-05 16:57 - 2008-07-29 21:31 - 00027136 _____ C:\Users\Siggi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2015-07-05 16:19 - 2008-07-31 12:07 - 00000000 ____D C:\Users\Siggi\AppData\Roaming\vlc 2015-07-05 12:24 - 2008-07-31 12:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN 2015-07-05 11:51 - 2014-12-08 11:48 - 00000000 ____D C:\Users\Siggi\AppData\Roaming\com.dansl.QRreader 2015-07-04 18:41 - 2008-12-14 17:47 - 00002469 _____ C:\Users\Siggi\Desktop\Microsoft Office Word 2007.lnk 2015-07-04 16:29 - 2015-03-21 18:35 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-07-04 16:11 - 2015-05-16 14:36 - 00001898 _____ C:\Windows\PFRO.log 2015-07-04 15:55 - 2015-03-21 18:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-07-04 14:12 - 2012-05-05 21:48 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service 2015-07-02 10:29 - 2012-09-22 08:56 - 00015192 _____ (G Data Software) C:\Windows\system32\Drivers\GdPhyMem.sys 2015-07-02 10:29 - 2011-11-14 18:15 - 00029528 _____ (G Data Software) C:\Windows\system32\Drivers\GRD.sys 2015-07-01 22:21 - 2013-04-02 08:49 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2015-07-01 22:21 - 2011-05-31 15:17 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2015-07-01 22:20 - 2008-07-29 19:38 - 00000000 ____D C:\Users\Siggi\AppData\Local\Adobe 2015-07-01 06:17 - 2014-08-21 20:51 - 00000000 ____D C:\Users\Siggi\AppData\Roaming\DiskDefrag 2015-06-28 16:32 - 2012-01-29 11:49 - 00001672 _____ C:\Users\Public\Desktop\Defraggler.lnk 2015-06-28 16:32 - 2012-01-29 11:49 - 00000000 ____D C:\Program Files\Defraggler 2015-06-27 22:56 - 2008-10-14 19:56 - 00073216 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys 2015-06-27 22:51 - 2014-10-11 07:18 - 00001809 _____ C:\Users\Public\Desktop\G DATA INTERNET SECURITY.lnk 2015-06-27 22:51 - 2014-05-04 16:06 - 00020352 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBFlt32.sys 2015-06-27 22:50 - 2011-11-14 17:56 - 00161792 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys 2015-06-27 22:50 - 2011-11-14 17:56 - 00108032 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys 2015-06-27 22:50 - 2011-11-14 17:56 - 00087040 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys 2015-06-27 22:50 - 2011-11-14 17:56 - 00053248 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd32.sys 2015-06-27 22:49 - 2011-11-14 17:55 - 00000000 ____D C:\Program Files\Common Files\G Data 2015-06-10 19:01 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\rescache 2015-06-10 18:44 - 2014-03-04 10:28 - 00275144 _____ C:\Windows\system32\FNTCACHE.DAT 2015-06-10 17:13 - 2008-12-14 17:37 - 00000000 ____D C:\ProgramData\Microsoft Help 2015-06-10 17:12 - 2013-07-23 17:00 - 00000000 ____D C:\Windows\system32\MRT 2015-06-10 17:03 - 2006-11-02 12:24 - 136900096 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe 2015-06-10 17:02 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\de-DE ==================== Files in the root of some directories ======= 2008-07-29 18:53 - 2012-07-16 19:57 - 0001356 _____ () C:\Users\Siggi\AppData\Local\d3d9caps.dat 2008-07-29 21:31 - 2015-07-05 16:57 - 0027136 _____ () C:\Users\Siggi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2008-08-31 12:18 - 2008-08-31 12:18 - 0000093 _____ () C:\Users\Siggi\AppData\Local\fusioncache.dat 2010-06-06 11:50 - 2010-12-29 23:27 - 0017408 _____ () C:\Users\Siggi\AppData\Local\WebpageIcons.db 2009-06-03 17:34 - 2009-12-21 20:39 - 0000088 __RSH () C:\ProgramData\8677DC198C.sys 2009-06-03 17:34 - 2009-12-21 20:39 - 0002828 ___SH () C:\ProgramData\KGyGaAvL.sys ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-07-06 09:07 ==================== End of log ============================ wie komme ich rückwirkend an den mbam - log? |
Themen zu Könnt ihr mal drüberschauen? |
auswertung, drüberschauen, gdata, troja, trojaner, warnung |