| Seppel89 | 22.01.2014 13:35 |
Hallo, danke für die schnelle Antwort.
Als erstes der FRST.txt
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 22-01-2014
Ran by Samsung (administrator) on SAMSUNG-PC on 22-01-2014 13:27:26
Running from C:\Users\Samsung\Downloads
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\WISO Internet Security\sched.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\WISO Internet Security\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\WISO Internet Security\avfwsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\WISO Internet Security\avguard.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\VS7DEBUG\MDM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\WISO Internet Security\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\WISO Internet Security\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\WISO Internet Security\avwebgrd.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [12000984 2013-08-02] (Realtek Semiconductor)
HKLM\...\Run: [avgnt] - C:\Program Files\WISO Internet Security\avgnt.exe [684600 2013-12-18] (Avira Operations GmbH & Co. KG)
HKU\Default\...\Run: [WindowsWelcomeCenter] - C:\Windows\system32\oobefldr.dll [ 2009-04-11] (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x6EBBD4015AF6CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
Winsock: Catalog9 01 C:\Program Files\WISO Internet Security\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\WISO Internet Security\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\WISO Internet Security\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\WISO Internet Security\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\WISO Internet Security\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\WISO Internet Security\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\WISO Internet Security\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\WISO Internet Security\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 19 C:\Program Files\WISO Internet Security\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Samsung\AppData\Roaming\Mozilla\Firefox\Profiles\tn5ukc5j.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.0 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: NoScript - C:\Users\Samsung\AppData\Roaming\Mozilla\Firefox\Profiles\tn5ukc5j.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-01-22]
FF Extension: Adblock Plus - C:\Users\Samsung\AppData\Roaming\Mozilla\Firefox\Profiles\tn5ukc5j.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-22]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
========================== Services (Whitelisted) =================
R2 AntiVirFirewallService; C:\Program Files\WISO Internet Security\avfwsvc.exe [1012280 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirMailService; C:\Program Files\WISO Internet Security\avmailc.exe [896056 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\WISO Internet Security\sched.exe [440376 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\WISO Internet Security\avguard.exe [440376 2013-11-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\WISO Internet Security\AVWEBGRD.EXE [1011768 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 CVPND; C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe [1528616 2010-09-27] (Cisco Systems, Inc.)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S4 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 vpnagent; C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe [544688 2013-01-24] (Cisco Systems, Inc.)
==================== Drivers (Whitelisted) ====================
S3 acsint; C:\Windows\System32\DRIVERS\acsint.sys [39888 2013-01-24] (Cisco Systems, Inc.)
S3 acsmux; C:\Windows\System32\DRIVERS\acsmux.sys [58320 2013-01-24] (Cisco Systems, Inc.)
R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [92448 2013-04-15] (Avira GmbH)
R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [113024 2013-04-15] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-22] (Avira Operations GmbH & Co. KG)
S3 CVirtA; C:\Windows\System32\DRIVERS\CVirtA.sys [5275 2007-01-18] (Cisco Systems, Inc.)
R2 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [308859 2010-09-27] (Cisco Systems, Inc.)
R3 DNE; C:\Windows\System32\DRIVERS\dne2000.sys [131984 2008-11-16] (Deterministic Networks, Inc.)
R2 KMDFMEMIO; C:\Windows\System32\DRIVERS\kmdfmemio.sys [13312 2006-11-14] (SAMSUNG ELECTRONICS CO., LTD.)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\mbamswissarmy.sys [40776 2014-01-22] (Malwarebytes Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-04-15] (Avira GmbH)
R3 VMC302; C:\Windows\System32\Drivers\VMC302.sys [243840 2009-01-23] (Vimicro Corporation)
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-22 13:27 - 2014-01-22 13:27 - 00009334 _____ C:\Users\Samsung\Downloads\FRST.txt
2014-01-22 13:27 - 2014-01-22 13:27 - 00000000 ____D C:\FRST
2014-01-22 13:24 - 2014-01-22 13:24 - 01221632 _____ (Farbar) C:\Users\Samsung\Downloads\FRST.exe
2014-01-22 12:02 - 2014-01-22 12:02 - 00040776 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamswissarmy.sys
2014-01-18 14:56 - 2014-01-18 14:59 - 00000000 ____D C:\Users\Samsung\Desktop\SchwartenbergWinter
2014-01-18 14:10 - 2014-01-18 15:56 - 00000000 ____D C:\Users\Samsung\Desktop\VideoQuatsch
2014-01-18 13:54 - 2014-01-18 17:23 - 00000000 ____D C:\Users\Samsung\Desktop\DaniLeipzig
2014-01-18 13:36 - 2014-01-18 14:12 - 00000000 ____D C:\Users\Samsung\Desktop\Neuer Ordner
2014-01-18 13:32 - 2014-01-18 15:13 - 00000000 ____D C:\Users\Samsung\Desktop\Prag
2014-01-17 23:51 - 2014-01-18 00:35 - 00000000 ____D C:\Users\Samsung\Desktop\dungdung
2014-01-17 22:57 - 2014-01-18 15:28 - 00000000 ____D C:\Users\Samsung\Documents\CardRecovery
2014-01-17 22:57 - 2014-01-17 22:57 - 00000000 ____D C:\Program Files\CardRecovery
2014-01-17 22:56 - 2014-01-17 22:56 - 00851400 _____ (WinRecovery Software ) C:\Users\Samsung\Downloads\cardrecovery_setup_de.exe
2014-01-17 22:54 - 2014-01-17 22:54 - 02346920 _____ (LionSea SoftWare ) C:\Users\Samsung\Downloads\setup.exe
2014-01-16 20:49 - 2014-01-16 20:49 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Samsung\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-16 20:49 - 2014-01-16 20:49 - 00000000 ____D C:\Users\Samsung\AppData\Roaming\Malwarebytes
2014-01-16 20:49 - 2014-01-16 20:49 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-16 20:49 - 2014-01-16 20:49 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2014-01-16 20:49 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-16 20:16 - 2014-01-16 20:18 - 18378752 _____ C:\Users\Samsung\Downloads\ML-191x_252x_PrintD.exe
2014-01-16 10:40 - 2014-01-16 16:00 - 00000000 ____D C:\Users\Samsung\Desktop\Beleg UUF1
2014-01-15 19:07 - 2014-01-15 19:07 - 00000000 ____D C:\Users\Samsung\AppData\Roaming\TuneUp Software
2014-01-15 18:59 - 2014-01-15 19:11 - 00000000 ____D C:\ProgramData\TuneUp Software
2014-01-15 18:58 - 2014-01-15 19:14 - 00000000 __SHD C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-01-15 18:57 - 2014-01-15 18:58 - 35955112 _____ (TuneUp Software) C:\Users\Samsung\Downloads\TuneUpUtilities2014221_de-DE.exe
2014-01-13 12:28 - 2014-01-13 12:27 - 02073654 _____ C:\Users\Samsung\Desktop\Geschenk Dani 2013.bmp
2014-01-10 13:27 - 2014-01-10 13:27 - 00028672 _____ C:\Users\Samsung\Desktop\Zählerstände.xls
2014-01-09 17:32 - 2014-01-09 17:42 - 00000000 ____D C:\Users\Samsung\Desktop\UUF1
2014-01-06 21:49 - 2014-01-06 21:49 - 00957112 _____ (Microsoft Corporation) C:\Users\Samsung\Downloads\SaveAsPDFandXPS.exe
2014-01-06 21:49 - 2014-01-06 21:49 - 00000000 ____D C:\Program Files\MSECache
2014-01-06 21:47 - 2014-01-18 13:12 - 00005120 _____ C:\Users\Samsung\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-01-05 20:22 - 2014-01-05 20:22 - 24097311 _____ C:\Users\Samsung\Downloads\vlc-2.1.2-win32.exe
2014-01-03 18:14 - 2014-01-17 18:50 - 00199680 _____ C:\Users\Samsung\Desktop\Ausgabenbuch Dani.xls
2014-01-03 14:58 - 2014-01-17 18:55 - 00209920 _____ C:\Users\Samsung\Desktop\Ausgabenbuch.xls
2014-01-02 16:10 - 2014-01-02 16:10 - 00000000 ____D C:\Program Files\Mozilla Firefox
==================== One Month Modified Files and Folders =======
2014-01-22 13:27 - 2014-01-22 13:27 - 00009334 _____ C:\Users\Samsung\Downloads\FRST.txt
2014-01-22 13:27 - 2014-01-22 13:27 - 00000000 ____D C:\FRST
2014-01-22 13:24 - 2014-01-22 13:24 - 01221632 _____ (Farbar) C:\Users\Samsung\Downloads\FRST.exe
2014-01-22 13:19 - 2013-10-26 13:42 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-22 12:02 - 2014-01-22 12:02 - 00040776 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamswissarmy.sys
2014-01-22 11:56 - 2009-04-11 13:37 - 01173369 _____ C:\Windows\WindowsUpdate.log
2014-01-22 11:50 - 2006-11-02 14:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-22 11:50 - 2006-11-02 13:47 - 00004928 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-22 11:50 - 2006-11-02 13:47 - 00004928 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-22 11:49 - 2006-11-02 14:01 - 00032560 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-22 11:42 - 2013-10-26 13:03 - 00000000 ____D C:\ProgramData\WISO Internet Security
2014-01-21 09:12 - 2009-04-11 17:55 - 01445224 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-21 09:08 - 2006-11-02 13:52 - 00119039 _____ C:\Windows\setupact.log
2014-01-20 20:32 - 2013-12-02 09:50 - 00000000 ____D C:\Users\Samsung\Desktop\CZ
2014-01-18 17:23 - 2014-01-18 13:54 - 00000000 ____D C:\Users\Samsung\Desktop\DaniLeipzig
2014-01-18 15:56 - 2014-01-18 14:10 - 00000000 ____D C:\Users\Samsung\Desktop\VideoQuatsch
2014-01-18 15:56 - 2013-10-26 13:55 - 00000000 ____D C:\Users\Samsung\AppData\Roaming\vlc
2014-01-18 15:28 - 2014-01-17 22:57 - 00000000 ____D C:\Users\Samsung\Documents\CardRecovery
2014-01-18 15:13 - 2014-01-18 13:32 - 00000000 ____D C:\Users\Samsung\Desktop\Prag
2014-01-18 14:59 - 2014-01-18 14:56 - 00000000 ____D C:\Users\Samsung\Desktop\SchwartenbergWinter
2014-01-18 14:12 - 2014-01-18 13:36 - 00000000 ____D C:\Users\Samsung\Desktop\Neuer Ordner
2014-01-18 13:12 - 2014-01-06 21:47 - 00005120 _____ C:\Users\Samsung\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-01-18 00:35 - 2014-01-17 23:51 - 00000000 ____D C:\Users\Samsung\Desktop\dungdung
2014-01-18 00:35 - 2013-10-21 09:45 - 00000000 ____D C:\Users\Samsung
2014-01-17 22:57 - 2014-01-17 22:57 - 00000000 ____D C:\Program Files\CardRecovery
2014-01-17 22:56 - 2014-01-17 22:56 - 00851400 _____ (WinRecovery Software ) C:\Users\Samsung\Downloads\cardrecovery_setup_de.exe
2014-01-17 22:54 - 2014-01-17 22:54 - 02346920 _____ (LionSea SoftWare ) C:\Users\Samsung\Downloads\setup.exe
2014-01-17 19:03 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\Microsoft.NET
2014-01-17 18:55 - 2014-01-03 14:58 - 00209920 _____ C:\Users\Samsung\Desktop\Ausgabenbuch.xls
2014-01-17 18:50 - 2014-01-03 18:14 - 00199680 _____ C:\Users\Samsung\Desktop\Ausgabenbuch Dani.xls
2014-01-16 22:49 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\system32\de-DE
2014-01-16 22:46 - 2013-10-26 14:02 - 00000000 ____D C:\Program Files\Microsoft.NET
2014-01-16 22:28 - 2008-01-21 03:47 - 00135460 _____ C:\Windows\PFRO.log
2014-01-16 21:26 - 2013-11-24 11:07 - 00000000 ___RD C:\Users\Samsung\Desktop\Dropbox
2014-01-16 21:26 - 2013-11-24 10:50 - 00000000 ____D C:\Users\Samsung\AppData\Roaming\Dropbox
2014-01-16 21:25 - 2013-11-24 11:04 - 00000000 ____D C:\Users\Samsung\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-01-16 21:07 - 2013-10-26 13:03 - 00000000 ____D C:\Program Files\WISO Internet Security
2014-01-16 20:49 - 2014-01-16 20:49 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Samsung\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-16 20:49 - 2014-01-16 20:49 - 00000000 ____D C:\Users\Samsung\AppData\Roaming\Malwarebytes
2014-01-16 20:49 - 2014-01-16 20:49 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-16 20:49 - 2014-01-16 20:49 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2014-01-16 20:18 - 2014-01-16 20:16 - 18378752 _____ C:\Users\Samsung\Downloads\ML-191x_252x_PrintD.exe
2014-01-16 20:16 - 2013-10-21 10:15 - 00000000 ____D C:\ProgramData\SAMSUNG
2014-01-16 16:00 - 2014-01-16 10:40 - 00000000 ____D C:\Users\Samsung\Desktop\Beleg UUF1
2014-01-15 19:14 - 2014-01-15 18:58 - 00000000 __SHD C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-01-15 19:14 - 2013-10-26 16:28 - 00000000 ____D C:\Users\Samsung\AppData\Local\Microsoft Help
2014-01-15 19:11 - 2014-01-15 18:59 - 00000000 ____D C:\ProgramData\TuneUp Software
2014-01-15 19:07 - 2014-01-15 19:07 - 00000000 ____D C:\Users\Samsung\AppData\Roaming\TuneUp Software
2014-01-15 18:58 - 2014-01-15 18:57 - 35955112 _____ (TuneUp Software) C:\Users\Samsung\Downloads\TuneUpUtilities2014221_de-DE.exe
2014-01-14 09:10 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\system32\NDF
2014-01-13 12:27 - 2014-01-13 12:28 - 02073654 _____ C:\Users\Samsung\Desktop\Geschenk Dani 2013.bmp
2014-01-10 13:27 - 2014-01-10 13:27 - 00028672 _____ C:\Users\Samsung\Desktop\Zählerstände.xls
2014-01-09 17:42 - 2014-01-09 17:32 - 00000000 ____D C:\Users\Samsung\Desktop\UUF1
2014-01-06 21:49 - 2014-01-06 21:49 - 00957112 _____ (Microsoft Corporation) C:\Users\Samsung\Downloads\SaveAsPDFandXPS.exe
2014-01-06 21:49 - 2014-01-06 21:49 - 00000000 ____D C:\Program Files\MSECache
2014-01-05 20:22 - 2014-01-05 20:22 - 24097311 _____ C:\Users\Samsung\Downloads\vlc-2.1.2-win32.exe
2014-01-05 11:37 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\rescache
2014-01-05 11:00 - 2009-04-11 17:52 - 00000000 ____D C:\Windows\system32\Drivers\de-DE
2014-01-03 14:16 - 2013-11-27 21:36 - 00000000 ____D C:\Users\Samsung\Desktop\Ebooks
2014-01-03 11:40 - 2013-10-26 19:54 - 00000000 ____D C:\Users\Samsung\AppData\Local\Microsoft Games
2014-01-03 10:35 - 2013-10-26 13:27 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2014-01-02 16:10 - 2014-01-02 16:10 - 00000000 ____D C:\Program Files\Mozilla Firefox
2014-01-02 11:53 - 2013-12-12 17:15 - 00014402 _____ C:\Users\Samsung\Desktop\Hausrat-checkliste.xlsx
Files to move or delete:
====================
C:\ProgramData\firstlsp.reg.dat
Some content of TEMP:
====================
C:\Users\Samsung\AppData\Local\Temp\avgnt.exe
C:\Users\Samsung\AppData\Local\Temp\DelayInst.exe
C:\Users\Samsung\AppData\Local\Temp\DseShExt-x86.dll
C:\Users\Samsung\AppData\Local\Temp\installservice.exe
C:\Users\Samsung\AppData\Local\Temp\ose00000.exe
C:\Users\Samsung\AppData\Local\Temp\SDShelEx-win32.dll
C:\Users\Samsung\AppData\Local\Temp\vpnclient_setup.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-22 11:57
==================== End Of Log ============================
--- --- ---
und dann noch der Addition.txt Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 22-01-2014
Ran by Samsung at 2014-01-22 13:29:55
Running from C:\Users\Samsung\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: WISO Internet Security (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: WISO Internet Security (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: FireWall (Enabled) {CE40CCC0-8ADB-6D67-25A0-C5B6438E4B57}
==================== Installed Programs ======================
Adobe Flash Player 11 Plugin (Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Reader X (10.1.4) - Deutsch (Version: 10.1.4 - Adobe Systems Incorporated)
CardRecovery 6.00 (Version: - WinRecovery Software)
Cisco AnyConnect Secure Mobility Client (Version: 3.1.02040 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (Version: 3.1.02040 - Cisco Systems, Inc.) Hidden
Cisco Systems VPN Client 5.0.07.0410 (Version: 5.0.7 - Cisco Systems, Inc.)
Dropbox (HKCU Version: 2.4.11 - Dropbox, Inc.)
Easy Display Manager (Version: 3.1 - Samsung Electronics Co., Ltd.)
Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300 - Malwarebytes Corporation)
Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 SP1 (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2007 (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Standard Edition 2003 (Version: 11.0.5614.0 - Microsoft Corporation)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 26.0 (x86 de) (Version: 26.0 - Mozilla)
Mozilla Maintenance Service (Version: 26.0 - Mozilla)
Realtek High Definition Audio Driver (Version: 6.0.1.7010 - Realtek Semiconductor Corp.)
Spelling Dictionaries Support For Adobe Reader 9 (Version: 9.0.0 - Adobe Systems Incorporated)
Universal Adb Driver (Version: 1.0.0 - ClockworkMod)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1 - Microsoft Corporation)
VLC media player 2.1.2 (Version: 2.1.2 - VideoLAN)
WISO Internet Security (Version: 14.0.2.286 - Avira)
==================== Restore Points =========================
06-01-2014 10:34:06 Geplanter Prüfpunkt
06-01-2014 20:49:35 Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme wird installiert
07-01-2014 17:30:51 Geplanter Prüfpunkt
08-01-2014 18:17:52 Geplanter Prüfpunkt
09-01-2014 18:46:08 Geplanter Prüfpunkt
10-01-2014 11:19:14 Geplanter Prüfpunkt
13-01-2014 19:11:19 Geplanter Prüfpunkt
15-01-2014 18:00:32 TuneUp Utilities 2014 wird installiert
15-01-2014 20:38:57 TuneUp Utilities 2014 wird entfernt
15-01-2014 20:39:53 TuneUp Utilities 2014 (de-DE) wird entfernt
16-01-2014 19:15:10 Gerätetreiber-Paketinstallation: Samsung Drucker
16-01-2014 21:44:02 Windows Update
17-01-2014 18:25:03 Geplanter Prüfpunkt
19-01-2014 11:46:56 Geplanter Prüfpunkt
20-01-2014 17:57:43 Geplanter Prüfpunkt
21-01-2014 06:56:44 Geplanter Prüfpunkt
==================== Hosts content: ==========================
2006-11-02 11:23 - 2006-09-18 22:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {AA4C51F5-C189-420A-90B1-9DB8CB1B36F1} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {C8FF1972-3001-424E-A364-A962BB3EBA80} - System32\Tasks\EasyDisplayMgr => C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe [2010-04-07] (Samsung Electronics Co., Ltd.)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: {E58D1690-5700-4116-A53A-4C271014C442} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-11] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2013-10-21 10:14 - 2006-08-12 11:48 - 00049152 _____ () C:\Program Files\Samsung\Easy Display Manager\HookDllPS2.dll
2014-01-02 16:10 - 2014-01-02 16:10 - 03559024 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
Name: Cisco Systems VPN Adapter
Description: Cisco Systems VPN Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (01/03/2014 06:10:49 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\SAMSUNG\DESKTOP\AUSGABENBUCH.XLS> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (01/02/2014 05:04:43 PM) (Source: Application Error) (User: )
Description: Fehlerhafte Anwendung MyPhoneExplorer.exe, Version 1.8.0.5, Zeitstempel 0x5224f76d, fehlerhaftes Modul kernel32.dll, Version 6.0.6002.18704, Zeitstempel 0x5065ccb6, Ausnahmecode 0xc000008f, Fehleroffset 0x0003fc16,
Prozess-ID 0x654, Anwendungsstartzeit MyPhoneExplorer.exe0.
Error: (12/14/2013 05:56:11 PM) (Source: Application Hang) (User: )
Description: Programm firefox.exe, Version 25.0.1.5064 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 14b8
Anfangszeit: 01cef8bc59dc9ef0
Zeitpunkt der Beendigung: 357
Error: (12/11/2013 11:56:23 AM) (Source: Application Error) (User: )
Description: Fehlerhafte Anwendung Dropbox.exe, Version 2.4.7.0, Zeitstempel 0x527d91e4, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode 0xc0000005, Fehleroffset 0x1e12cf3c,
Prozess-ID 0x21c, Anwendungsstartzeit Dropbox.exe0.
Error: (12/11/2013 10:57:16 AM) (Source: WISO Internet Security) (User: NT-AUTORITÄT)
Description: AUSNAHMEFEHLER beim Aufruf der Funktion IThread(ProtocolSrvConThread)::run() für die Datei
unknown
[ACCESS_VIOLATION Exception!! EIP = 0xfffc45c7]
Bitte Avira informieren und die obige Datei übersenden!
Error: (12/10/2013 06:54:54 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\SAMSUNG\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\TN5UKC5J.DEFAULT\CACHE\3\D3> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (12/10/2013 06:54:54 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\SAMSUNG\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\TN5UKC5J.DEFAULT\CACHE\3\D3> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (12/10/2013 06:54:54 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\SAMSUNG\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\TN5UKC5J.DEFAULT\CACHE\D\3A> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (12/10/2013 06:54:54 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\SAMSUNG\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\TN5UKC5J.DEFAULT\CACHE\D\3A> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (12/10/2013 06:54:54 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\SAMSUNG\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\TN5UKC5J.DEFAULT\CACHE\D\6E> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
System errors:
=============
Error: (01/22/2014 11:52:18 AM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058
Error: (01/22/2014 11:52:18 AM) (Source: Service Control Manager) (User: )
Description: 30000vpnagent
Error: (01/22/2014 10:39:59 AM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058
Error: (01/22/2014 10:39:59 AM) (Source: Service Control Manager) (User: )
Description: 30000vpnagent
Error: (01/21/2014 06:03:06 PM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058
Error: (01/21/2014 06:03:06 PM) (Source: Service Control Manager) (User: )
Description: 30000vpnagent
Error: (01/21/2014 06:02:37 PM) (Source: Dhcp) (User: )
Description: Die IP-Adresslease 141.46.196.100 für die Netzwerkkarte mit der Netzwerkadresse 0021634B52F0 wurde durch den DHCP-Server 0.0.0.0 abgelehnt (der DHCP-Server hat eine DHCPNACK-Meldung gesendet).
Error: (01/21/2014 09:07:42 AM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058
Error: (01/21/2014 09:07:42 AM) (Source: Service Control Manager) (User: )
Description: 30000vpnagent
Error: (01/21/2014 09:06:11 AM) (Source: Dhcp) (User: )
Description: Die IP-Adresslease 192.168.178.23 für die Netzwerkkarte mit der Netzwerkadresse 0021634B52F0 wurde durch den DHCP-Server 0.0.0.0 abgelehnt (der DHCP-Server hat eine DHCPNACK-Meldung gesendet).
Microsoft Office Sessions:
=========================
CodeIntegrity Errors:
===================================
Date: 2014-01-16 22:17:41.476
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_b38d4a937f96be60\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-16 22:17:41.404
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_b38d4a937f96be60\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-16 22:17:41.328
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_b38d4a937f96be60\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-16 22:17:41.256
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_b38d4a937f96be60\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-16 22:17:41.183
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_b38d4a937f96be60\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-16 22:17:41.111
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_b38d4a937f96be60\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-16 22:17:40.902
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22497_none_b34d67897fc6850f\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-16 22:17:40.830
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22497_none_b34d67897fc6850f\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-16 22:17:40.755
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22497_none_b34d67897fc6850f\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-16 22:17:40.683
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22497_none_b34d67897fc6850f\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 61%
Total physical RAM: 3065.88 MB
Available physical RAM: 1170.07 MB
Total Pagefile: 6364.16 MB
Available Pagefile: 4347.9 MB
Total Virtual: 2047.88 MB
Available Virtual: 1903.37 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:298.09 GB) (Free:188.2 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: 5FB05FAF)
Partition 1: (Active) - (Size=298 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
FRST 32-Bit | FRST 64-Bit