Controlle nach Massiven Netzwerkstörungen durch Netzwerk Scaner
Moin,
ich habe momentan ein System von den ich denke/hoffe das es sauber ist würde das aber gerne genauer Prüfen.
Grund dafür ist ein (durchaus nicht unberechtigter) Anschiss meiner Hochschul IT...
Ich habe an der Netzwerkinfrastruktur eines Labores etwas geändert und wollte eine Visualisierung der selben machen. Bin dabei auf das Programm The Dude (www.mikrotik.com/thedude) gestossen und dachte mir das währe doch sehr schön das zu Automatisieren...
Dummerweise habe ich dabei (vermutlich durch Fehlbedienung) das gesamte Hochschul Netzwerk lahmgelegt. Nun vermutet die Hochschul IT das ich zusätzlich dazu noch Schadprogramme auf den Rechner habe. Laut deren Logs würde es wohl ein wenig nach einer Tauschbörse aussehen.
Bevor ich jetzt wieder ins Netzwerk gehen darf muss ich mein System sauber kriegen.
The Dude ist wieder deinstaliert und ich habe jetzt schonmal Scans mit Malwarebytes Anti-Malware, Farbar Recovery Scan Tool und Gmer durchgeführt. Dabei wurde ein bischen was gefunden aber in meinen Augen nichts das für diese Probleme verantwortlich gewesen sein könnte. Die Logs sind alle unten angehängt.
Ich würde mich freuen wenn ihr mir sagen könnt ob ich einfach nur zu Doof/Unbedarft an die Sache rangegangen bin oder ob ich mir tatsächlich was ernstes eingefangen haben könnte. Code:
Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 07.05.2014
Scan Time: 21:51:54
Logfile: Malwarebytes.txt
Administrator: Yes
Version: 2.00.1.1004
Malware Database: v2014.03.04.09
Rootkit Database: v2014.02.20.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Chameleon: Disabled
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: 42
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 290675
Time Elapsed: 23 min, 45 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Shuriken: Enabled
PUP: Enabled
PUM: Enabled
Processes: 0
(No malicious items detected)
Modules: 0
(No malicious items detected)
Registry Keys: 0
(No malicious items detected)
Registry Values: 0
(No malicious items detected)
Registry Data: 1
PUP.Optional.Conduit.A, HKU\S-1-5-21-2964411297-4113465080-1101347880-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://search.conduit.com/?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP9997346B-FE10-4EAC-ACF8-590F1D8D1865&SSPV=, Good: (hxxp://www.google.com), Bad: (hxxp://search.conduit.com/?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP9997346B-FE10-4EAC-ACF8-590F1D8D1865&SSPV=),Replaced,[ce7ba15e7efcc670a9020e177292af51]
Folders: 2
PUP.Optional.OpenCandy, C:\Users\42\AppData\Roaming\OpenCandy, Quarantined, [6edb32cdc4b643f3c1ca3f470bf77a86],
PUP.Optional.OpenCandy, C:\Users\42\AppData\Roaming\OpenCandy\8B5C3A364B724F3285E01E59A4B0ACA4, Quarantined, [6edb32cdc4b643f3c1ca3f470bf77a86],
Files: 8
PUP.Optional.Conduit.A, C:\Users\42\AppData\Roaming\OpenCandy\8B5C3A364B724F3285E01E59A4B0ACA4\SSStub_SearchProtect_p1v0.exe, Quarantined, [0e3b12edbbbf70c62b518fcf9968e41c],
PUP.Optional.SearchProtect.A, C:\Users\42\AppData\Local\Temp\nsr59C8.exe, Quarantined, [cd7ca35c7ffba393df75f67536cb718f],
PUP.Optional.SearchProtect.A, C:\Users\42\AppData\Local\Temp\nsw56DA.exe, Quarantined, [361324dbc1b9ee48243003683fc2f10f],
PUP.Optional.SearchProtect.A, C:\Users\42\AppData\Local\Temp\nsw70C2.exe, Quarantined, [8fba26d9700a37ff054fd7945ba63bc5],
PUP.Optional.Somoto, C:\Users\42\AppData\Local\Temp\UpdateCheckerSetup.exe, Quarantined, [1d2c609f90ea72c4f4e3a5cf43bd06fa],
PUP.Optional.ShowPass.A, C:\Users\42\AppData\Local\Temp\Show-Password_1030-8102.exe, Quarantined, [f851d7289edc2f070c8be2b0659c46ba],
PUP.Optional.SearchProtect.A, C:\Users\42\AppData\Local\Temp\nsm430C.exe, Quarantined, [0445c53a74067cbae66ef77423de639d],
PUP.Optional.SearchProtect.A, C:\Users\42\AppData\Local\Temp\nsm7391.exe, Quarantined, [08418f704b2f23131d37cd9efd0408f8],
Physical Sectors: 0
(No malicious items detected)
(end)
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-05-2014
Ran by 42 at 2014-05-07 23:56:18
Running from C:\Users\42\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Sophos Anti-Virus (Enabled - Up to date) {65FBD860-96D8-75EF-C7ED-7BE27E6C498A}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Sophos Anti-Virus (Enabled - Up to date) {DE9A3984-B0E2-7A61-FD5D-409005EB0337}
==================== Installed Programs ======================
3Dconnexion 3DxSoftware (x64 Edition) (HKLM-x32\...\{BAFCA6AC-8B37-405B-B57E-C1D45DE70ACC}) (Version: 3.17.8 - 3Dconnexion)
3Dconnexion 3DxWare (x64) (Version: 6.17.0008 - 3Dconnexion) Hidden
3Dconnexion Add-In for Inventor 11 - 2014 (Version: 1.12.4 - 3Dconnexion) Hidden
3Dconnexion Collage (x32 Version: 1.3.0 - 3Dconnexion) Hidden
3Dconnexion Trainer (x32 Version: 3.2.2 - 3Dconnexion) Hidden
7-PDF Printer 10.0.0.1840 (HKLM\...\7-PDF Printer_is1) (Version: 10.0.0.1840 - 7-PDF, Germany - Th. Hodes)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Age of Empires II: HD Edition (HKLM-x32\...\Steam App 221380) (Version: - Hidden Path Entertainment, Ensemble Studios)
Akamai NetSession Interface (HKCU\...\Akamai) (Version: - Akamai Technologies, Inc)
Anzeige am Bildschirm (HKLM\...\OnScreenDisplay) (Version: 6.71.00 - )
AutoCAD Electrical 2014 - Deutsch (German) (Version: 11.0.57.0 - Autodesk) Hidden
AutoCAD Electrical 2014 Language Pack - Deutsch (German) (Version: 11.0.57.0 - Autodesk) Hidden
Autodesk 360 (HKLM\...\{52B28CAD-F49D-47BA-9FFE-29C2E85F0D0B}) (Version: 4.0.27.1 - Autodesk)
Autodesk App Manager (HKLM-x32\...\{C070121A-C8C5-4D52-9A7D-D240631BD433}) (Version: 1.1.0 - Autodesk)
Autodesk AutoCAD Electrical 2014 - Deutsch (German) (HKLM\...\AutoCAD Electrical 2014 - Deutsch (German)) (Version: 11.0.57.0 - Autodesk)
Autodesk Content Service (HKLM-x32\...\Autodesk Content Service) (Version: 3.1.3.0 - Autodesk)
Autodesk Content Service (x32 Version: 3.1.3.0 - Autodesk) Hidden
Autodesk Content Service Language Pack (x32 Version: 3.1.3.0 - Autodesk) Hidden
Autodesk Design Review 2013 (HKLM-x32\...\Autodesk Design Review 2013) (Version: 13.0.0.82 - Autodesk, Inc.)
Autodesk Design Review 2013 (x32 Version: 13.0.0.82 - Autodesk, Inc.) Hidden
Autodesk Download Manager (HKLM-x32\...\{2F48C80C-3A76-495A-A4B5-C0CC946FEEBD}) (Version: 2.0.6.0 - Autodesk, Inc.)
Autodesk DWG TrueView 2014 (HKLM\...\DWG TrueView 2014) (Version: 19.1.18.0 - Autodesk)
Autodesk Featured Apps (HKLM-x32\...\{F732FEDA-7713-4428-934B-EF83B8DD65D0}) (Version: 1.1.0 - Autodesk)
Autodesk Inventor Content Center Libraries 2014 (Desktop Content) (HKLM\...\{B46DECD1-1864-4EF1-0000-22D71E81877C}) (Version: 18.0.17000.0000 - Autodesk)
Autodesk Inventor Fusion 2013 R1 (HKLM\...\Autodesk Inventor Fusion 2013 R1) (Version: 3.0.0.5 - Autodesk, Inc.)
Autodesk Inventor Fusion 2013 R1 (Version: 3.0.0.5 - Autodesk, Inc.) Hidden
Autodesk Inventor Professional 2014 - Deutsch (German) (HKLM\...\Autodesk Inventor Professional 2014) (Version: 18.0.17000.0000 - Autodesk)
Autodesk Inventor Professional 2014 (Version: 18.0.17000.0000 - Autodesk) Hidden
Autodesk Inventor Professional 2014 Language Pack - Deutsch (German) (Version: 18.0.17000.0000 - Autodesk) Hidden
Autodesk Material Library 2013 (HKLM-x32\...\{117EBEEB-5DB0-43C8-9FD6-DD583DB152DD}) (Version: 3.0.14 - Autodesk)
Autodesk Material Library 2014 (HKLM-x32\...\{644F9B19-A462-499C-BF4D-300ABC2A28B1}) (Version: 4.0.19.0 - Autodesk)
Autodesk Material Library Base Resolution Image Library 2013 (HKLM-x32\...\{606E12B9-641F-4644-A22A-FF38AE980AFD}) (Version: 3.0.14 - Autodesk)
Autodesk Material Library Base Resolution Image Library 2014 (HKLM-x32\...\{51BF3210-B825-4092-8E0D-66D689916E02}) (Version: 4.0.19.0 - Autodesk)
Autodesk Material Library Low Resolution Image Library 2014 (HKLM-x32\...\{5C29CC1F-218F-4C30-948A-11066CAC59FB}) (Version: 4.0.19.0 - Autodesk)
Autodesk ReCap (HKLM\...\Autodesk ReCap) (Version: 1.0.43.27 - Autodesk)
Autodesk ReCap (Version: 1.0.43.27 - Autodesk) Hidden
Autodesk ReCap Language Pack-English (Version: 1.0.43.27 - Autodesk) Hidden
Autodesk Revit Interoperability for Inventor 2014 (HKLM\...\Autodesk Revit Interoperability for Inventor 2014) (Version: 13.02.15161 - Autodesk)
Autodesk Revit Interoperability for Inventor 2014 (Version: 13.02.15161 - Autodesk) Hidden
Autodesk Simulation Mechanical 2014 (HKLM\...\Autodesk Simulation Mechanical 2014) (Version: 2014.00.00.0513 - Autodesk, Inc.)
Autodesk Simulation Mechanical 2014 (Version: 2014.00.00.0513 - Autodesk, Inc.) Hidden
Autodesk Vault Basic 2014 (Client) (HKLM\...\Autodesk Vault Basic 2014 (Client)) (Version: 18.0.86.0 - Autodesk)
Autodesk Vault Basic 2014 (Client) (Version: 18.0.86.0 - Autodesk) Hidden
Autodesk Vault Basic 2014 (Client) German Language Pack (Version: 18.0.86.0 - Autodesk) Hidden
CADE Pro 2.20.3 (HKLM-x32\...\{0D050176-09B9-437C-9E9C-B3E84614D32E}) (Version: 2.20.3 - Weresc)
CIROS Automation Suite Updater (HKLM-x32\...\CIROS Automation Suite Updater5.1) (Version: 5.1 - RIF e.V.)
CIROS Studio (HKLM-x32\...\CIROS Studio5.1) (Version: 5.1 - RIF e.V.)
Citavi 4 (HKLM-x32\...\{CC0A85B2-734A-45B3-B678-05F6A6499AC7}) (Version: 4.2.0.11 - Swiss Academic Software)
Conexant 20672 SmartAudio HD (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.32.23.5 - Conexant)
CrystalDiskInfo 6.0.4 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 6.0.4 - Crystal Dew World)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.48.1.0347 - Disc Soft Ltd)
Dienstprogramm "ThinkPad UltraNav" (HKLM-x32\...\{17CBC505-D1AE-459D-B445-3D2000A85842}) (Version: 2.13.0 - Lenovo)
Dungeon Keeper Gold (HKLM-x32\...\GOGPACKDUNGEONKEEPER_is1) (Version: 2.0.0.4 - GOG.com)
DWG TrueView 2014 (Version: 19.1.18.0 - Autodesk) Hidden
EasyPort ActiveX Control V2.1 (HKLM-x32\...\EasyPort) (Version: - )
Eco Materials Adviser for Autodesk Inventor 2014 (64-bit) (HKLM\...\{530B8614-C5DE-475B-AF6F-71BED461552C}) (Version: 4.4.1.0 - Granta Design Limited)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 14.4.20130909 - Landesfinanzdirektion Thüringen)
Energie-Manager (HKLM-x32\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 6.64.2 - Lenovo Group Limited)
EzOPC V5.4 (HKLM-x32\...\EzOPC 5) (Version: - )
FARO LS 1.1.501.0 (64bit) (HKLM-x32\...\{8A470330-70B2-49AD-86AF-79885EF9898A}) (Version: 5.1.0.30630 - FARO Scanner Production)
Fresco Logic USB3.0 Host Controller (HKLM\...\{3534A6A6-D6CF-415E-B2C5-E97BEE8A6639}) (Version: 3.0.110.12 - Fresco Logic Inc.)
G I - Die Welt der Verurteilten (mit neuen Texturen) (HKLM-x32\...\G I - Die Welt der Verurteilten (mit neuen Texturen)) (Version: 1.03 - Issues (Deadgame Inc.))
GameRanger (HKCU\...\GameRanger) (Version: - GameRanger Technologies)
Gothic (HKLM-x32\...\Steam App 65540) (Version: - Piranha – Bytes )
Gothic II: Gold Edition (HKLM-x32\...\Steam App 39510) (Version: - Piranha – Bytes)
inSSIDer Home (HKLM-x32\...\{9E54E4AE-B67A-4925-8E92-0E1F9817FD73}) (Version: 3.1.2.1 - MetaGeek, LLC)
Integrated Camera Driver Installer Package Ver.1.1.0.1147 (HKLM-x32\...\{B2CA6F37-1602-4823-81B5-0384B6888AA6}) (Version: 1.1.0.1147 - RICOH)
Integrated Camera TWAIN (HKLM-x32\...\{9CA0DEE4-E84B-466F-9B96-FC255F3A929F}) (Version: 1.0.11.1223 - Chicony Electronics Co.,Ltd.)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1010 - Intel Corporation)
Intel(R) Identity Protection Technology 1.2.28.0 (HKLM-x32\...\{A87263E8-26CB-1016-8F2F-C04708B17CE2}) (Version: 1.2.28.0 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.1.70.1205 - Intel Corporation)
Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version: 16.8 - Intel)
Intel(R) PRO/Wireless Driver (Version: 16.01.3000.0512 - Intel Corporation) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2538 - Intel Corporation)
Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (Version: 16.1.1.0084 - Intel Corporation) Hidden
Intel® PROSet/Wireless Software (HKLM-x32\...\{828af006-cb5e-4d60-957a-523098a1b0f8}) (Version: 16.1.3 - Intel Corporation)
Intel® PROSet/Wireless WiFi Software (Version: 16.01.3000.0254 - Intel Corporation) Hidden
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Left 4 Dead 2 (HKLM-x32\...\Steam App 550) (Version: - Valve)
Lenovo Battery Utility 2014 1.2 (HKLM-x32\...\{62D5A67D-E5CC-4D79-8998-DDFDB7750346}_is1) (Version: 1.2 - Lenovo Corp)
Lenovo Patch Utility (x32 Version: 1.4.0.4 - Lenovo Group Limited) Hidden
Lenovo Patch Utility 64 bit (Version: 1.4.0.4 - Lenovo Group Limited) Hidden
Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.04.04 - )
Lenovo System Interface Driver (HKLM\...\LENOVO.SMIIF) (Version: 1.05 - )
Lenovo System Update (HKLM-x32\...\{25C64847-B900-48AD-A164-1B4F9B774650}) (Version: 5.05.0009 - Lenovo)
LOGO!Soft Comfort V7.0 (Demo) (HKLM\...\LOGO!Soft Comfort V7.0 (Demo)) (Version: 7.0.0.0 - Siemens AG)
Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
MATLAB R2013a (HKLM\...\Matlab R2013a) (Version: 8.1 - The MathWorks, Inc.)
Max Payne 2 DE (HKLM-x32\...\Steam App 210410) (Version: - )
Microsoft .NET Framework 4.5 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5 (Version: 4.5.50709 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5 DEU Language Pack (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5 DEU Language Pack (Version: 4.5.50709 - Microsoft Corporation) Hidden
Microsoft Visual Basic for Applications 7.1 (x64) (Version: 7.1.00.00 - Microsoft Corporation) Hidden
Microsoft Visual Basic for Applications 7.1 (x64) German (Version: 7.1.0.0 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 x64 ATL Runtime 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 x64 CRT Runtime 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 x64 MFC Runtime 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 x64 OpenMP Runtime 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 x86 ATL Runtime 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 x86 CRT Runtime 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 x86 MFC Runtime 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 x86 OpenMP Runtime 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
MiKTeX 2.9 (HKCU\...\MiKTeX 2.9) (Version: 2.9 - MiKTeX.org)
Miranda IM 0.10.21 (HKLM-x32\...\Miranda IM) (Version: 0.10.21 - Miranda IM Project)
Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MTpro 3.6 (HKLM-x32\...\MTpro) (Version: 3.6.0.2 - Bosch Rexroth AG)
MTproLight 3.6 (HKLM-x32\...\MTproLight) (Version: 3.6.0.1 - Bosch Rexroth AG)
NETGEAR Print Server Software (HKLM-x32\...\{A3DF5B33-FB8B-43FE-A943-A24CF6030F61}) (Version: 1.0 - NETGEAR)
Network Notepad 4.6.9 (HKLM-x32\...\Netnotep_is1) (Version: - Jason Green)
NVIDIA 3D Vision Treiber 312.69 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 312.69 - NVIDIA Corporation)
NVIDIA Grafiktreiber 312.69 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 312.69 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.24.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.24.2 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.124.810 - NVIDIA Corporation) Hidden
NVIDIA Optimus 1.11.3 (Version: 1.11.3 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1269 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 312.69 (Version: 312.69 - NVIDIA Corporation) Hidden
NVIDIA Update Components (Version: 1.11.3 - NVIDIA Corporation) Hidden
OPC Core Components Redistributable (HKLM-x32\...\{75F9DAD1-792C-44E9-B48B-2E22C76E0CBF}) (Version: 3.00.102 - OPC Foundation)
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
PKZIP Server for Windows 12.40.0008 (HKLM-x32\...\{134A51EB-1BBB-4249-BAF5-494C3D186A06}) (Version: 12.40.0008 - PKWARE, Inc)
Railroad Tycoon 2: Platinum (HKLM-x32\...\Steam App 7620) (Version: - PopTop)
RICOH_Media_Driver_v2.14.18.01 (HKLM-x32\...\{FE041B02-234C-4AAA-9511-80DF6482A458}) (Version: 2.14.18.01 - RICOH)
Rome - Total War - Gold Edition (HKLM-x32\...\{2E97F7E8-ABDE-4E0D-B0AD-B6B4BAD89E24}) (Version: 1.6 - The Creative Assembly)
Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: 1.01.00:04(2013-04-22) - Samsung Electronics Co., Ltd.)
Serious Sam Classic: The First Encounter (HKLM-x32\...\Steam App 41050) (Version: - Croteam)
Sid Meier's Railroad Tycoon (HKLM-x32\...\Sid Meier's Railroad Tycoon) (Version: 1.0 - 2K Games)
Siemens Automation License Manager (Version: 05.01.0100 - Siemens AG) Hidden
Siemens Automation License Manager V5.1 + SP1 (HKLM\...\{8D2E0408-8D61-4A53-B0DB-2AD670A38624}LicenseManager) (Version: 05.01.0100 - Siemens AG)
Silicon Laboratories CP210x VCP Drivers for Windows XP/2003 Server/Vista/7 (HKLM-x32\...\{35002267-F746-4F77-9B97-125305EF65C6}) (Version: 6.2.00 - Silicon Laboratories, Inc.)
SIMATIC STEP 7 (x32 Version: 05.05.0200 - Siemens AG) Hidden
SIMATIC STEP 7 V5.5 + SP2 Professional 2010 SR2 (HKLM-x32\...\{7B427E8E-F76D-4C8C-B155-7F24DF46DB67}STEP7) (Version: 05.05.0200 - Siemens AG)
SIMATIC Device Drivers (Version: 01.00.0200 - Siemens AG) Hidden
SIMATIC NCM FWL 64 (Version: 05.05.0100 - Siemens AG) Hidden
SIMATIC PLCSIM 64 (Version: 01.00.0001 - Siemens AG) Hidden
SIMATIC S7-GRAPH (x32 Version: 05.03.0700 - Siemens AG) Hidden
SIMATIC S7-GRAPH V5.3 + SP7 Professional 2010 SR2 (HKLM-x32\...\{4FF24C45-A4EE-4A99-B287-E3468EC41CBD}S7GRAPH) (Version: 05.03.0700 - Siemens AG)
SIMATIC S7-PCT (x32 Version: 02.03.0000 - Siemens AG) Hidden
SIMATIC S7-PCT V2.3 Professional 2010 SR2 (HKLM-x32\...\{06AF0F82-E926-48A6-8C5F-ECB195DB2CB4}S7PCT) (Version: 02.03.0000 - Siemens AG)
SIMATIC S7-PLCSIM (x32 Version: 5.4.0502 - Siemens AG) Hidden
SIMATIC S7-PLCSIM V5.4 + SP5 + Upd2 Professional 2010 SR2 (HKLM-x32\...\{1CBF27F6-24A4-488D-940A-678F1C691C49}PLCSim) (Version: 5.4.0502 - Siemens AG)
SIMATIC S7-SCL (x32 Version: 5.3.6.0 - Siemens AG) Hidden
SIMATIC S7-SCL V5.3 + SP6 Professional 2010 SR2 (HKLM-x32\...\{5B1B0682-EEC6-4EDD-BAB0-3FEC2E55090D}SCL) (Version: 5.3.6.0 - Siemens AG)
SketchUp Import for AutoCAD 2014 (HKLM-x32\...\{644E9589-F73A-49A4-AC61-A953B9DE5669}) (Version: 1.1.0 - Autodesk)
Sophos Anti-Virus (HKLM-x32\...\{4320988A-7DE0-478D-A38B-CE9509BCE320}) (Version: 10.3.1 - Sophos Limited)
Sophos AutoUpdate (HKLM-x32\...\{15C418EB-7675-42be-B2B3-281952DA014D}) (Version: 2.9.0.344 - Sophos Limited)
Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation)
Stronghold HD (HKLM-x32\...\Steam App 40950) (Version: - FireFly Studios)
System Shock 2 (HKLM-x32\...\Steam App 238210) (Version: - Irrational Games)
ThinkPad FullScreen Magnifier (HKLM\...\ThinkPad FullScreen Magnifier) (Version: 2.40 - )
ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.19.13 - )
ThinkVantage Fingerprint Software (HKLM\...\{F58DA859-016E-492D-A588-317D9BB28002}) (Version: 5.9.9.7282 - Authentec Inc.)
ThinkVantage System für aktiven Festplattenschutz (HKLM\...\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}) (Version: 1.78.0.11 - Lenovo)
Visual C++ 2008 - x64 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{6DA2B636-698A-3294-BF4A-B5E11B238CDD}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x64 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{8CCEA24C-51AE-3B71-9092-7D0C44DDA2DF}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x64 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{C3A57BB3-9AA6-3F6F-9395-6C062BDD5FC4}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x64 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{F6F09DD8-F39B-3A16-ADB9-C9E6B56903F9}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x86 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{04B34E21-5BEE-3D2B-8D3D-E3E80D253F64}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x86 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{14866AAD-1F23-39AC-A62B-7091ED1ADE64}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x86 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{4B90093A-5D9C-3956-8ABB-95848BE6EFAD}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x86 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{B42E259C-E4D4-37F1-A1B2-EB9C4FC5A04D}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Winamp (HKLM-x32\...\Winamp) (Version: 5.666 - Nullsoft, Inc)
WinFACT 7 (HKLM-x32\...\{FE2A7490-32EA-47D1-BCB4-0705F73F4C24}) (Version: 7.1.1 - Ingenieurbüro Dr. Kahlert)
WinMerge 2.14.0 (HKLM-x32\...\WinMerge_is1) (Version: 2.14.0 - Thingamahoochie Software)
WinTrack Demo Version 11.0 3D (HKLM-x32\...\wintrack11demo_is1) (Version: 11.0 3D - Ing.-Büro Schneider)
==================== Restore Points =========================
18-04-2014 07:40:29 Windows Update
20-04-2014 20:30:17 Windows-Sicherung
22-04-2014 07:33:16 Windows Update
25-04-2014 12:20:11 Windows Update
27-04-2014 17:00:10 Windows-Sicherung
29-04-2014 06:33:26 Windows Update
29-04-2014 07:22:23 Installed Silicon Laboratories CP210x VCP Drivers for Windows XPçtõe
03-05-2014 01:00:35 Windows Update
04-05-2014 17:00:16 Windows-Sicherung
06-05-2014 06:27:30 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {20302771-FF20-42A8-911E-CBACEAE02371} - System32\Tasks\{7CD3D0F3-3B01-4A38-BE70-13ACF72B08C9} => G:\SETUP.EXE
Task: {264116B0-5FEA-452B-B328-616B704A4DBF} - System32\Tasks\TVT\TVSUUpdateTask => C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [2014-02-21] ()
Task: {417E5AEE-8300-48BE-B97A-4ACC41E5E25E} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2014-02-13] (Lenovo)
Task: {41B89BB8-5482-468F-BA08-E70AD256BF9F} - System32\Tasks\MATLAB R2013a Startup Accelerator => C:\Program Files\MATLAB\R2013a\bin\win64\MATLABStartupAccelerator.exe [2013-01-16] ()
Task: {53BC6006-F4E8-4B47-A342-C8B4326C9EFB} - System32\Tasks\{4A4FD7AE-BD3F-4ABE-A332-9184D2525CBC} => G:\SETUP.EXE
Task: {AA3710D3-AACA-453B-93E2-D44DAA2FF0CF} - System32\Tasks\{5B5DCE77-D315-4B39-9A9D-747F69CB7657} => G:\SETUP.EXE
Task: {CA215D09-E318-4B3B-8C7B-61F70432D91B} - System32\Tasks\3DconnexionCreateProcess_3DxSRV.EXE => C:\Program Files\3Dconnexion\3Dconnexion 3DxSoftware\3DxWare64\3DxSRV.EXE [2014-01-24] (3Dconnexion, INC)
Task: {DD1FA757-CB08-4457-80C1-A2C8EABAEDA7} - System32\Tasks\{CCACA2F1-B496-447A-A3AA-D1BCE16FE3AD} => G:\SETUP.EXE
Task: {E16447B5-EF15-41A5-A18C-7F807E0088DF} - System32\Tasks\TVT\LenovoWERMonitor => C:\Program Files (x86)\Common Files\lenovo\SUP\sup_wermonitor.exe [2014-01-21] (Microsoft)
Task: {EB0E851A-9648-45E4-BB8A-A6D8E241A540} - System32\Tasks\{83941917-908D-4A22-9F0B-A51889FEF570} => G:\SETUP.EXE
Task: {F8C14A5C-CE14-4568-A8B5-DB4AD92630C5} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: C:\Windows\Tasks\MATLAB R2013a Startup Accelerator.job => C:\Program Files\MATLAB\R2013a\bin\win64\MATLABStartupAccelerator.exe
==================== Loaded Modules (whitelisted) =============
2014-01-24 15:04 - 2013-10-29 02:53 - 00087328 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-07-26 11:42 - 2013-07-26 11:42 - 00034304 _____ () C:\Windows\System32\ssa3mlm.dll
2014-01-24 15:03 - 2013-10-29 09:17 - 00004096 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2014-01-24 15:05 - 2013-12-09 07:04 - 00117248 ____N () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.DLL
2011-03-10 02:43 - 2011-03-10 02:43 - 00774144 _____ () C:\Program Files\Common Files\Siemens\SWS\PlugIns\SCP\Scpwin64.dll
2011-06-14 19:24 - 2011-06-14 19:24 - 00824320 _____ () C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\sn_regbase.dll
2014-01-24 15:03 - 2011-09-26 01:36 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-01-24 15:13 - 2010-10-26 11:40 - 00049056 ____N () C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
2013-02-05 01:21 - 2013-02-05 01:21 - 00056352 _____ () C:\Program Files\Autodesk\Autodesk Sync\qoauth_Ad_1.dll
2013-02-05 01:21 - 2013-02-05 01:21 - 00937504 _____ () C:\Program Files\Autodesk\Autodesk Sync\qca_Ad_2.dll
2013-02-05 01:21 - 2013-02-05 01:21 - 00124448 _____ () C:\Program Files\Autodesk\Autodesk Sync\QJson.dll
2013-02-05 01:21 - 2013-02-05 01:21 - 00045088 _____ () C:\Program Files\Autodesk\Autodesk Sync\QtSolutions_MFCMigrationFramework_Ad_2.dll
2011-06-14 19:24 - 2011-06-14 19:24 - 00749568 _____ () C:\Windows\SysWOW64\sn_regbase.dll
2014-01-16 00:39 - 2014-01-16 00:39 - 00057432 _____ () C:\Program Files (x86)\Miranda IM\zlib.dll
2014-01-16 00:39 - 2014-01-16 00:39 - 00036961 _____ () C:\Program Files (x86)\Miranda IM\Plugins\dbx_mmap.dll
2014-01-16 00:39 - 2014-01-16 00:39 - 00061538 _____ () C:\Program Files (x86)\Miranda IM\Plugins\clist_classic.dll
2014-01-16 00:39 - 2014-01-16 00:39 - 00203357 _____ () C:\Program Files (x86)\Miranda IM\Plugins\aim.dll
2014-01-16 00:39 - 2014-01-16 00:39 - 00245848 _____ () C:\Program Files (x86)\Miranda IM\Plugins\chat.dll
2014-01-16 00:39 - 2014-01-16 00:39 - 00339550 _____ () C:\Program Files (x86)\Miranda IM\Plugins\icq.dll
2014-01-16 00:38 - 2014-01-16 00:38 - 00379993 _____ () C:\Program Files (x86)\Miranda IM\Plugins\irc.dll
2014-01-16 00:41 - 2014-01-16 00:41 - 00090200 _____ () C:\Program Files (x86)\Miranda IM\Plugins\srmm.dll
2014-03-30 18:44 - 2014-03-30 18:44 - 03642480 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-02-13 16:43 - 2013-07-18 00:56 - 00430080 _____ () C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox\components\FirefoxPickerCommunication.dll
2014-02-08 10:40 - 2014-02-08 10:40 - 16287624 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SAVService => ""="service"
==================== EXE Association (whitelisted) =============
==================== Disabled items from MSCONFIG ==============
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (05/07/2014 11:49:28 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/07/2014 11:30:05 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/07/2014 09:53:20 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/05/2014 10:09:23 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: Name der fehlerhaften Anwendung: pdflatex.EXE, Version: 0.0.0.0, Zeitstempel: 0x51c4b8b9
Name des fehlerhaften Moduls: QtGui4.dll, Version: 4.8.4.0, Zeitstempel: 0x50d7557c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0001e30d
ID des fehlerhaften Prozesses: 0x2204
Startzeit der fehlerhaften Anwendung: 0xpdflatex.EXE0
Pfad der fehlerhaften Anwendung: pdflatex.EXE1
Pfad des fehlerhaften Moduls: pdflatex.EXE2
Berichtskennung: pdflatex.EXE3
Error: (05/04/2014 07:39:11 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: Name der fehlerhaften Anwendung: jucheck.exe, Version: 2.1.9.8, Zeitstempel: 0x51d2fcc9
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0x1458
Startzeit der fehlerhaften Anwendung: 0xjucheck.exe0
Pfad der fehlerhaften Anwendung: jucheck.exe1
Pfad des fehlerhaften Moduls: jucheck.exe2
Berichtskennung: jucheck.exe3
Error: (05/02/2014 07:50:30 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7a144
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521eaf24
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000021cfa
ID des fehlerhaften Prozesses: 0x10a4
Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0
Pfad der fehlerhaften Anwendung: explorer.exe1
Pfad des fehlerhaften Moduls: explorer.exe2
Berichtskennung: explorer.exe3
Error: (05/01/2014 03:19:32 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/30/2014 06:16:40 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/30/2014 06:14:58 PM) (Source: Application Error) (User: ) (EventID: 1000)
Description: Name der fehlerhaften Anwendung: prevhost.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce796ac
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00038e19
ID des fehlerhaften Prozesses: 0x28f8
Startzeit der fehlerhaften Anwendung: 0xprevhost.exe0
Pfad der fehlerhaften Anwendung: prevhost.exe1
Pfad des fehlerhaften Moduls: prevhost.exe2
Berichtskennung: prevhost.exe3
Error: (04/30/2014 10:59:38 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: Name der fehlerhaften Anwendung: prevhost.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce796ac
Name des fehlerhaften Moduls: pdfprevhndlr.dll, Version: 11.0.3.37, Zeitstempel: 0x518e10a7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000028dd
ID des fehlerhaften Prozesses: 0x18d8
Startzeit der fehlerhaften Anwendung: 0xprevhost.exe0
Pfad der fehlerhaften Anwendung: prevhost.exe1
Pfad des fehlerhaften Moduls: prevhost.exe2
Berichtskennung: prevhost.exe3
System errors:
=============
Error: (05/07/2014 11:49:29 PM) (Source: NetBT) (User: ) (EventID: 4321)
Description: Der Name "THINKPAD :20" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.1.47
registriert werden. Der Computer mit IP-Adresse 192.168.1.46 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.
Error: (05/07/2014 11:49:29 PM) (Source: Server) (User: ) (EventID: 2505)
Description: Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{BD541619-7B36-4501-98E6-B4F2C4FBA30C} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden.
Error: (05/07/2014 11:49:25 PM) (Source: NetBT) (User: ) (EventID: 4321)
Description: Der Name "THINKPAD :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.1.47
registriert werden. Der Computer mit IP-Adresse 192.168.1.46 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.
Error: (05/07/2014 11:45:17 PM) (Source: NetBT) (User: ) (EventID: 4321)
Description: Der Name "THINKPAD :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.1.47
registriert werden. Der Computer mit IP-Adresse 192.168.1.46 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.
Error: (05/07/2014 11:45:17 PM) (Source: NetBT) (User: ) (EventID: 4321)
Description: Der Name "THINKPAD :20" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.1.47
registriert werden. Der Computer mit IP-Adresse 192.168.1.46 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.
Error: (05/07/2014 11:45:17 PM) (Source: Server) (User: ) (EventID: 2505)
Description: Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{BD541619-7B36-4501-98E6-B4F2C4FBA30C} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden.
Error: (05/07/2014 11:33:33 PM) (Source: SCardSvr) (User: ) (EventID: 610)
Description: Das Handle ist ungültig.Lenovo Integrated Smart Card Reader 0GET_STATEXX XX XX XX
Error: (05/07/2014 11:30:08 PM) (Source: NetBT) (User: ) (EventID: 4321)
Description: Der Name "THINKPAD :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.1.47
registriert werden. Der Computer mit IP-Adresse 192.168.1.46 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.
Error: (05/07/2014 11:30:08 PM) (Source: NetBT) (User: ) (EventID: 4321)
Description: Der Name "THINKPAD :20" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.1.47
registriert werden. Der Computer mit IP-Adresse 192.168.1.46 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.
Error: (05/07/2014 11:30:08 PM) (Source: Server) (User: ) (EventID: 2505)
Description: Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{BD541619-7B36-4501-98E6-B4F2C4FBA30C} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden.
Microsoft Office Sessions:
=========================
Error: (05/07/2014 11:49:28 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/07/2014 11:30:05 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/07/2014 09:53:20 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/05/2014 10:09:23 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: pdflatex.EXE0.0.0.051c4b8b9QtGui4.dll4.8.4.050d7557cc00000050001e30d220401cf68393def472aC:\Program Files (x86)\Neuer Ordner\miktex\bin\pdflatex.EXEC:\Program Files (x86)\Neuer Ordner\miktex\bin\QtGui4.dll911d1c1f-d42c-11e3-91b5-f0def1939b2a
Error: (05/04/2014 07:39:11 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: jucheck.exe2.1.9.851d2fcc9unknown0.0.0.000000000c000000500000000145801cf6540b76bc642C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exeunknown6a910fa8-d34e-11e3-91b5-f0def1939b2a
Error: (05/02/2014 07:50:30 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: explorer.exe6.1.7601.175144ce7a144ntdll.dll6.1.7601.18247521eaf24c00000050000000000021cfa10a401cf654ad6bfadd5C:\Windows\explorer.exeC:\Windows\SYSTEM32\ntdll.dllaa9afcff-d1bd-11e3-91b5-f0def1939b2a
Error: (05/01/2014 03:19:32 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/30/2014 06:16:40 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/30/2014 06:14:58 PM) (Source: Application Error) (User: ) (EventID: 1000)
Description: prevhost.exe6.1.7601.175144ce796acntdll.dll6.1.7601.18247521ea8e7c000000500038e1928f801cf6452869486efC:\Windows\SysWOW64\prevhost.exeC:\Windows\SysWOW64\ntdll.dll929b1deb-d082-11e3-8f20-f0def1939b2a
Error: (04/30/2014 10:59:38 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: prevhost.exe6.1.7601.175144ce796acpdfprevhndlr.dll11.0.3.37518e10a7c0000005000028dd18d801cf63a390713850C:\Windows\SysWOW64\prevhost.exeC:\Program Files (x86)\Adobe\Reader 11.0\Reader\pdfprevhndlr.dllc1c123f9-d045-11e3-8f20-f0def1939b2a
==================== Memory info ===========================
Percentage of memory in use: 40%
Total physical RAM: 8075.23 MB
Available physical RAM: 4802.52 MB
Total Pagefile: 16148.65 MB
Available Pagefile: 12527.96 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB
==================== Drives ================================
Drive c: (System) (Fixed) (Total:232.79 GB) (Free:108.56 GB) NTFS
Drive d: (Daten) (Fixed) (Total:698.63 GB) (Free:256.89 GB) NTFS
Drive e: (VOYAGER) (Removable) (Total:7.5 GB) (Free:4.2 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 776B0AC9)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=233 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 699 GB) (Disk ID: 8F089F77)
Partition 1: (Not Active) - (Size=699 GB) - (Type=07 NTFS)
========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 8 GB) (Disk ID: 04DD5721)
Partition 1: (Active) - (Size=8 GB) - (Type=0B)
==================== End Of Log ============================
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-05-2014
Ran by 42 (administrator) on THINKPAD on 07-05-2014 23:56:00
Running from C:\Users\42\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Authentec Inc.) C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\sws\almsrv\almsrv64x.exe
(Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(SafeNet Inc.) C:\Windows\System32\hasplms.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\Inventor 2014\Moldflow\bin\mitsijm.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(SIEMENS AG) C:\Program Files (x86)\Siemens\Step7\S7BIN\s7hspsvx.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\s7oiehsx64.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceService64x.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\s7epasrv64x.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\pniomgr.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
(SIEMENS AG) C:\Windows\SysWOW64\pniopcac.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlk.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\ZOOM\TpScrex.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Akamai Technologies, Inc.) C:\Users\42\AppData\Local\Akamai\netsession_win.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe
(Miranda IM) C:\Program Files (x86)\Miranda IM\miranda32.exe
(3Dconnexion) C:\Program Files\3Dconnexion\3Dconnexion 3DxSoftware\3DxWare64\3dxsrvlauncher.exe
(Akamai Technologies, Inc.) C:\Users\42\AppData\Local\Akamai\netsession_win.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Ricoh co.,Ltd.) C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe
(Windows (R) Win 7 DDK provider) C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe
(Autodesk, Inc.) C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe
(SIEMENS AG) C:\Program Files (x86)\Common Files\Siemens\S7UBTOOX\S7ubTstx.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(SIEMENS AG) C:\Program Files (x86)\Common Files\Siemens\S7UBTOOX\S7ubtoox.exe
(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE
(iAnywhere Solutions, Inc.) C:\Program Files (x86)\Common Files\Siemens\SQLANY\dbsrv9.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Lenovo) C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [TpShocks] => C:\Windows\system32\TpShocks.exe [384344 2013-11-29] (Lenovo.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2963184 2013-11-15] (Synaptics Incorporated)
HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SAIICpl.exe [316032 2010-12-14] (Conexant systems, Inc.)
HKLM-x32\...\Run: [PWMTRV] => rundll32 "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL",PwrMgrBkGndMonitor
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [113656 2013-01-17] (Intel Corporation)
HKLM-x32\...\Run: [RotateImage] => C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [55808 2008-10-30] (Ricoh co.,Ltd.)
HKLM-x32\...\Run: [Sophos AutoUpdate Monitor] => C:\Program Files (x86)\Sophos\AutoUpdate\almon.exe [929272 2013-01-11] (Sophos Limited)
HKLM-x32\...\Run: [FLxHCIm] => C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe [37888 2010-11-19] (Windows (R) Win 7 DDK provider)
HKLM-x32\...\Run: [ADSK DLMSession] => C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe [1641368 2013-02-01] (Autodesk, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [S7UB Start] => C:\Program Files (x86)\Common Files\Siemens\S7ubtoox\s7ubtstx.exe [102453 2010-06-03] (SIEMENS AG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [DudeServer] => C:\Program Files (x86)\Dude\dude.exe
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (Authentec Inc.)
HKU\.DEFAULT\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1081224 2013-02-05] (Autodesk, Inc.)
HKU\S-1-5-19\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-2964411297-4113465080-1101347880-1000\...\Run: [Akamai NetSession Interface] => C:\Users\42\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2964411297-4113465080-1101347880-1000\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1081224 2013-02-05] (Autodesk, Inc.)
HKU\S-1-5-21-2964411297-4113465080-1101347880-1000\...\Policies\Explorer: []
HKU\S-1-5-21-2964411297-4113465080-1101347880-1000\...\MountPoints2: G - G:\Launch.exe
HKU\S-1-5-21-2964411297-4113465080-1101347880-1000\...\MountPoints2: {d8c62dfd-84f4-11e3-a90e-c38adcc6c8f1} - G:\shelexec.exe -! "start<CN=*Adobe*:!V!>.pdf" -DefaultApp:<base>\adobe\acrobat5\win\Reader\AcroRd32.exe -QueryApp
HKU\S-1-5-21-2964411297-4113465080-1101347880-1003\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [245872 2013-10-29] (NVIDIA Corporation)
AppInit_DLLs: , C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~2.DLL => C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured_x64.dll [217160 2014-02-25] (Sophos Limited)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [201576 2013-10-29] (NVIDIA Corporation)
AppInit_DLLs-x32: , C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~1.DLL => C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured.dll [275352 2014-02-25] (Sophos Limited)
Lsa: [Notification Packages] scecli C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll
Startup: C:\Users\42\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GameRanger.lnk
ShortcutTarget: GameRanger.lnk -> C:\Users\42\AppData\Roaming\GameRanger\GameRanger\GameRanger.exe (GameRanger Technologies)
Startup: C:\Users\42\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\miranda32.exe - Verknüpfung.lnk
ShortcutTarget: miranda32.exe - Verknüpfung.lnk -> C:\Program Files (x86)\Miranda IM\miranda32.exe (Miranda IM)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Start 3DxWare.lnk
ShortcutTarget: Start 3DxWare.lnk -> C:\Program Files\3Dconnexion\3Dconnexion 3DxSoftware\3DxWare64\3dxsrv.exe (3Dconnexion, INC)
==================== Internet (Whitelisted) ====================
SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP9997346B-FE10-4EAC-ACF8-590F1D8D1865&q={searchTerms}&SSPV=
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP9997346B-FE10-4EAC-ACF8-590F1D8D1865&q={searchTerms}&SSPV=
BHO-x32: Citavi Picker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Winsock: Catalog9 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 19 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9-x64 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 19 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 83.169.186.225 83.169.186.161
Tcpip\..\Interfaces\{27AC9502-D313-4684-A030-BA6A87B7E6CC}: [NameServer]192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\42\AppData\Roaming\Mozilla\Firefox\Profiles\cb7kpe2f.default-1390571193923
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_44.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.66 - C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Gmail Watcher - C:\Users\42\AppData\Roaming\Mozilla\Firefox\Profiles\cb7kpe2f.default-1390571193923\Extensions\gmailwatcher@sonthakit.xpi [2014-01-24]
FF Extension: Adblock Plus - C:\Users\42\AppData\Roaming\Mozilla\Firefox\Profiles\cb7kpe2f.default-1390571193923\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-24]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2014-02-13]
==================== Services (Whitelisted) =================
R2 almservice; C:\Program Files\Common Files\Siemens\sws\almsrv\almsrv64x.exe [1542792 2011-10-28] (SIEMENS AG)
R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [12288 2012-12-13] (Autodesk, Inc.)
S3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [320560 2013-12-09] (Lenovo.)
R2 hasplms; C:\Windows\system32\hasplms.exe [4609928 2013-08-01] (SafeNet Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
R2 mitsijm2014; C:\Program Files\Autodesk\Inventor 2014\Moldflow\bin\mitsijm.exe [952608 2013-01-25] (Autodesk, Inc.)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-08-02] ()
R2 s7hspsvx; C:\Program Files (x86)\Siemens\Step7\s7bin\s7hspsvx.exe [61493 2011-10-31] (SIEMENS AG)
R2 s7oiehsx64; C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\s7oiehsx64.exe [139864 2011-11-03] (SIEMENS AG)
R2 S7TraceServiceX; C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceService64x.exe [229976 2011-11-03] (SIEMENS AG)
R2 SAVAdminService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe [290296 2013-09-17] (Sophos Limited)
R2 SAVService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe [206328 2013-09-17] (Sophos Limited)
R2 Sophos AutoUpdate Service; C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe [237048 2013-01-11] (Sophos Limited)
R2 Sophos Web Control Service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe [357400 2013-09-17] (Sophos Limited)
S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [24120 2014-02-21] ()
R2 swi_service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe [3109880 2013-09-17] (Sophos Limited)
S2 swi_update_64; C:\ProgramData\Sophos\Web Intelligence\swi_update_64.exe [2012152 2013-09-17] (Sophos Limited)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3378416 2013-08-02] (Intel® Corporation)
==================== Drivers (Whitelisted) ====================
R3 dpmconv; C:\Windows\System32\DRIVERS\dpmconv.sys [259072 2011-04-19] (SIEMENS AG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-01-24] (Disc Soft Ltd)
R3 FLxHCIh; C:\Windows\System32\DRIVERS\FLxHCIh.sys [49664 2010-11-19] (Fresco Logic)
R2 hardlock; C:\Windows\system32\drivers\hardlock.sys [331328 2013-08-01] (SafeNet Inc.)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-08-02] (Intel Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-05-07] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [284448 2013-10-29] (NVIDIA Corporation)
R3 s7odpx2x64; C:\Windows\System32\DRIVERS\s7odpx2x64.sys [71168 2011-10-20] (SIEMENS AG)
R3 s7oppinx64; C:\Windows\System32\DRIVERS\s7oppinx64.sys [107520 2011-10-20] (SIEMENS AG)
R3 s7oserix64; C:\Windows\System32\Drivers\s7oserix64.sys [121344 2011-05-06] (SIEMENS AG)
R3 s7osmcax64; C:\Windows\System32\DRIVERS\s7osmcax64.sys [195584 2011-09-29] (SIEMENS AG)
R3 s7osobux64; C:\Windows\System32\DRIVERS\s7osobux64.sys [152576 2011-05-06] (SIEMENS AG)
R3 s7otmcd64x; C:\Windows\System32\Drivers\s7otmcd64x.sys [199680 2011-05-06] (SIEMENS AG)
R3 s7otranx64; C:\Windows\System32\DRIVERS\s7otranx64.sys [260096 2011-05-06] (SIEMENS AG)
R3 s7otsadx64; C:\Windows\System32\DRIVERS\s7otsadx64.sys [192000 2011-09-29] (SIEMENS AG)
R2 s7ousbu64x; C:\Windows\System32\DRIVERS\s7ousbu64x.sys [193024 2011-09-29] (SIEMENS AG)
R2 s7sn2srtx; C:\Windows\System32\DRIVERS\s7sn2srtx.sys [83032 2011-06-16] (SIEMENS AG)
R1 SAVOnAccess; C:\Windows\System32\DRIVERS\savonaccess.sys [154952 2013-09-17] (Sophos Limited)
S3 sdcfilter; C:\Windows\System32\DRIVERS\sdcfilter.sys [36640 2013-09-17] (Sophos Limited)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [45296 2013-11-15] (Synaptics Incorporated)
R2 smihlp; C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [13128 2011-05-30] (Authentec Inc.)
R2 SNTIE; C:\Windows\System32\DRIVERS\sntie.sys [179288 2011-10-11] (SIEMENS AG)
S4 SophosBootDriver; C:\Windows\System32\DRIVERS\SophosBootDriver.sys [25608 2013-09-17] (Sophos Plc)
R3 vsnl2ada; C:\Windows\System32\DRIVERS\vsnl2ada.sys [120832 2011-04-19] (SIEMENS AG)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-05-07 23:47 - 2014-05-07 23:47 - 00024320 _____ () C:\Users\42\Desktop\GMER.log
2014-05-07 23:39 - 2014-05-07 23:39 - 00024320 _____ () C:\Users\42\Documents\GMER.log
2014-05-07 23:30 - 2014-05-07 23:56 - 00021252 _____ () C:\Users\42\Desktop\FRST.txt
2014-05-07 23:30 - 2014-05-07 22:22 - 00380416 _____ () C:\Users\42\Desktop\Gmer-19357.exe
2014-05-07 23:30 - 2014-05-07 22:01 - 02063872 _____ (Farbar) C:\Users\42\Desktop\FRST64.exe
2014-05-07 22:53 - 2014-05-07 22:53 - 00000168 _____ () C:\Users\42\defogger_reenable
2014-05-07 22:15 - 2014-05-07 22:15 - 00000000 ____D () C:\Users\42\AppData\Local\Sophos
2014-05-07 22:14 - 2014-05-07 22:14 - 00002817 _____ () C:\Users\42\Desktop\Malwarebytes.txt
2014-05-07 22:03 - 2014-05-07 23:56 - 00000000 ____D () C:\FRST
2014-05-07 22:03 - 2014-05-07 22:04 - 00037698 _____ () C:\Users\42\Desktop\Addition.txt
2014-05-07 21:28 - 2014-05-07 23:49 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-07 21:27 - 2014-05-07 21:27 - 00001112 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-05-07 21:27 - 2014-05-07 21:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-05-07 21:26 - 2014-05-07 21:27 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-05-07 21:26 - 2014-05-07 21:26 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-07 21:26 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-07 21:26 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-07 21:26 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-05 12:23 - 2014-05-07 21:53 - 00000691 _____ () C:\dude.conf
2014-05-03 09:52 - 2014-05-03 09:52 - 00000079 _____ () C:\Users\42\Desktop\ToDo.txt
2014-05-03 03:00 - 2014-04-29 16:01 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-03 03:00 - 2014-04-29 15:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-03 03:00 - 2014-04-29 14:48 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-03 03:00 - 2014-04-29 14:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-29 09:22 - 2014-04-29 09:22 - 00000000 ____D () C:\SiLabs
2014-04-29 09:21 - 2014-04-30 18:15 - 00000000 ____D () C:\Users\42\.LOGOComfort7.0
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ___HD () C:\Users\42\InstallAnywhere
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ___HD () C:\Program Files\Zero G Registry
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\Users\42\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Siemens LOGO!Soft
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\tmp
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\Program Files\Siemens
2014-04-27 15:53 - 2014-04-27 15:53 - 00000000 ____D () C:\Windows\System32\Tasks\Lenovo
2014-04-27 15:53 - 2012-05-30 13:42 - 00569152 _____ (Intel Corporation) C:\Windows\system32\Drivers\iaStor.sys
2014-04-21 12:38 - 2014-04-21 12:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo Battery Utility 2014
2014-04-21 12:38 - 2014-04-21 12:38 - 00000000 ____D () C:\Program Files (x86)\Lenovo Battery Utility 2014
2014-04-15 16:42 - 2014-04-15 16:43 - 00000000 ____D () C:\Program Files (x86)\WinMerge
2014-04-15 16:42 - 2014-04-15 16:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinMerge
2014-04-11 14:21 - 2014-04-08 11:31 - 00009740 _____ () C:\Users\42\Documents\untitled_0.ods
2014-04-11 14:21 - 2014-04-07 21:14 - 00021849 _____ () C:\Users\42\Documents\Anfrake%20Schunk.odt_0.odt
2014-04-11 14:21 - 2014-04-02 14:37 - 00018778 _____ () C:\Users\42\Documents\Schaltkasten%20Verdratung.xls_0.ods
2014-04-10 10:59 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-10 10:59 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-10 10:59 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-10 10:59 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-10 10:58 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-10 10:58 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-10 10:58 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-10 10:58 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-10 10:58 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-10 10:58 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-10 10:58 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-10 10:58 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-10 10:58 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-10 10:58 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-10 10:58 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-10 10:58 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-10 10:58 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-10 10:58 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-10 10:58 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-10 10:58 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-10 10:58 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-10 10:58 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-10 10:58 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-10 10:58 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-10 10:58 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-10 10:58 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-10 10:58 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-10 10:58 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-10 10:58 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-10 10:58 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-10 10:58 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-10 10:58 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-10 10:58 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-10 10:58 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-10 10:58 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-10 10:58 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-10 10:58 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-10 10:58 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-10 10:58 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-10 10:58 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-10 10:58 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-10 10:58 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-10 10:58 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-10 10:58 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-09 09:03 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 09:03 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 09:02 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 09:02 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 09:02 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 09:02 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 09:02 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 09:02 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 09:02 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 09:02 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 09:02 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
==================== One Month Modified Files and Folders =======
2014-05-07 23:56 - 2014-05-07 23:30 - 00021252 _____ () C:\Users\42\Desktop\FRST.txt
2014-05-07 23:56 - 2014-05-07 22:03 - 00000000 ____D () C:\FRST
2014-05-07 23:55 - 2011-04-12 09:43 - 00698926 _____ () C:\Windows\system32\perfh007.dat
2014-05-07 23:55 - 2011-04-12 09:43 - 00149034 _____ () C:\Windows\system32\perfc007.dat
2014-05-07 23:55 - 2009-07-14 07:13 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-07 23:52 - 2014-01-24 14:45 - 01638570 _____ () C:\Windows\WindowsUpdate.log
2014-05-07 23:49 - 2014-05-07 21:28 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-07 23:49 - 2014-01-24 18:09 - 00000540 _____ () C:\Windows\Tasks\MATLAB R2013a Startup Accelerator.job
2014-05-07 23:49 - 2014-01-24 15:04 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-05-07 23:49 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-07 23:49 - 2009-07-14 06:51 - 00066845 _____ () C:\Windows\setupact.log
2014-05-07 23:47 - 2014-05-07 23:47 - 00024320 _____ () C:\Users\42\Desktop\GMER.log
2014-05-07 23:39 - 2014-05-07 23:39 - 00024320 _____ () C:\Users\42\Documents\GMER.log
2014-05-07 23:37 - 2009-07-14 06:45 - 00021680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-07 23:37 - 2009-07-14 06:45 - 00021680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-07 22:53 - 2014-05-07 22:53 - 00000168 _____ () C:\Users\42\defogger_reenable
2014-05-07 22:53 - 2014-01-24 14:45 - 00000000 ____D () C:\Users\42
2014-05-07 22:22 - 2014-05-07 23:30 - 00380416 _____ () C:\Users\42\Desktop\Gmer-19357.exe
2014-05-07 22:15 - 2014-05-07 22:15 - 00000000 ____D () C:\Users\42\AppData\Local\Sophos
2014-05-07 22:14 - 2014-05-07 22:14 - 00002817 _____ () C:\Users\42\Desktop\Malwarebytes.txt
2014-05-07 22:04 - 2014-05-07 22:03 - 00037698 _____ () C:\Users\42\Desktop\Addition.txt
2014-05-07 22:01 - 2014-05-07 23:30 - 02063872 _____ (Farbar) C:\Users\42\Desktop\FRST64.exe
2014-05-07 21:53 - 2014-05-05 12:23 - 00000691 _____ () C:\dude.conf
2014-05-07 21:52 - 2010-11-21 05:47 - 00026106 _____ () C:\Windows\PFRO.log
2014-05-07 21:27 - 2014-05-07 21:27 - 00001112 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-05-07 21:27 - 2014-05-07 21:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-05-07 21:27 - 2014-05-07 21:26 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-05-07 21:26 - 2014-05-07 21:26 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-05 12:21 - 2014-03-09 22:19 - 00000000 ____D () C:\Users\42\AppData\Roaming\WinTrack
2014-05-03 09:52 - 2014-05-03 09:52 - 00000079 _____ () C:\Users\42\Desktop\ToDo.txt
2014-04-30 18:15 - 2014-04-29 09:21 - 00000000 ____D () C:\Users\42\.LOGOComfort7.0
2014-04-29 16:01 - 2014-05-03 03:00 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 15:40 - 2014-05-03 03:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 14:48 - 2014-05-03 03:00 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-29 14:34 - 2014-05-03 03:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-29 09:22 - 2014-04-29 09:22 - 00000000 ____D () C:\SiLabs
2014-04-29 09:22 - 2014-01-24 15:04 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ___HD () C:\Users\42\InstallAnywhere
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ___HD () C:\Program Files\Zero G Registry
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\Users\42\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Siemens LOGO!Soft
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\tmp
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\Program Files\Siemens
2014-04-28 14:45 - 2014-01-24 15:05 - 00000000 ____D () C:\Users\42\AppData\Local\Lenovo
2014-04-27 15:53 - 2014-04-27 15:53 - 00000000 ____D () C:\Windows\System32\Tasks\Lenovo
2014-04-27 15:53 - 2014-01-24 14:49 - 00000000 ___HD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo ThinkVantage Tools
2014-04-27 15:53 - 2014-01-24 14:49 - 00000000 ____D () C:\Windows\System32\Tasks\TVT
2014-04-27 15:53 - 2014-01-24 14:49 - 00000000 ____D () C:\ProgramData\Lenovo
2014-04-27 15:53 - 2014-01-24 14:49 - 00000000 ____D () C:\Program Files (x86)\Lenovo
2014-04-27 15:52 - 2014-02-08 03:04 - 00000000 _____ () C:\Windows\system32\vireng.log
2014-04-24 18:16 - 2014-01-24 23:19 - 00000000 ____D () C:\Users\42\AppData\Local\Akamai
2014-04-23 13:40 - 2014-01-24 23:37 - 00000000 ____D () C:\Users\42\Documents\Inventor
2014-04-23 13:36 - 2014-02-02 23:07 - 00106518 _____ () C:\Windows\system32\webservice4.log
2014-04-21 12:38 - 2014-04-21 12:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo Battery Utility 2014
2014-04-21 12:38 - 2014-04-21 12:38 - 00000000 ____D () C:\Program Files (x86)\Lenovo Battery Utility 2014
2014-04-21 11:29 - 2014-01-24 19:05 - 00000000 ____D () C:\Users\42\Documents\MATLAB
2014-04-17 23:16 - 2014-01-24 17:41 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-04-15 16:43 - 2014-04-15 16:42 - 00000000 ____D () C:\Program Files (x86)\WinMerge
2014-04-15 16:42 - 2014-04-15 16:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinMerge
2014-04-10 18:13 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-10 11:00 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-10 03:02 - 2014-01-24 16:37 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-10 03:01 - 2014-01-24 16:37 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-09 01:10 - 2014-01-24 14:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-08 11:31 - 2014-04-11 14:21 - 00009740 _____ () C:\Users\42\Documents\untitled_0.ods
2014-04-07 21:14 - 2014-04-11 14:21 - 00021849 _____ () C:\Users\42\Documents\Anfrake%20Schunk.odt_0.odt
Some content of TEMP:
====================
C:\Users\42\AppData\Local\Temp\AcDeltree.exe
C:\Users\42\AppData\Local\Temp\Ct64Setup.exe
C:\Users\42\AppData\Local\Temp\DLMGuardian.exe
C:\Users\42\AppData\Local\Temp\exie.exe
C:\Users\42\AppData\Local\Temp\expb.exe
C:\Users\42\AppData\Local\Temp\fp_pl_pfs_installer-1.exe
C:\Users\42\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\42\AppData\Local\Temp\Procmon64.exe
C:\Users\42\AppData\Local\Temp\simaticn.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-04-29 08:59
==================== End Of Log ============================
Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-05-08 00:06:30
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 Samsung_ rev.EXT0 232,89GB
Running: Gmer-19357.exe; Driver: C:\Users\42\AppData\Local\Temp\uwlyipog.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[532] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[532] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe[1384] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe[1384] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\Windows\system32\Dwm.exe[2612] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd8b2db0 5 bytes JMP 000007fffd8a0180
.text C:\Windows\system32\Dwm.exe[2612] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd8b37d0 7 bytes JMP 000007fffd8a00d8
.text C:\Windows\system32\Dwm.exe[2612] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd8b8ef0 6 bytes JMP 000007fffd8a0148
.text C:\Windows\system32\Dwm.exe[2612] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd8caf60 5 bytes JMP 000007fffd8a0110
.text C:\Windows\system32\Dwm.exe[2612] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff2289e0 8 bytes JMP 000007fffd8a01f0
.text C:\Windows\system32\Dwm.exe[2612] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff22be40 8 bytes JMP 000007fffd8a01b8
.text C:\Windows\system32\Dwm.exe[2612] C:\Windows\system32\dxgi.dll!CreateDXGIFactory 000007fef7eedc88 5 bytes JMP 000007fff7ec00d8
.text C:\Windows\system32\Dwm.exe[2612] C:\Windows\system32\dxgi.dll!CreateDXGIFactory1 000007fef7eede10 5 bytes JMP 000007fff7ec0110
.text C:\Windows\Explorer.EXE[2784] C:\Windows\system32\kernel32.dll!CopyFileExW 00000000778e1890 5 bytes JMP 000000016fff00d8
.text C:\Windows\Explorer.EXE[2784] C:\Windows\system32\kernel32.dll!MoveFileWithProgressW 000000007795f490 8 bytes JMP 000000016fff0110
.text C:\Windows\Explorer.EXE[2784] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feff027490 11 bytes JMP 000007fffeff00d8
.text C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe[2920] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe[2920] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\Windows\system32\hasplms.exe[3296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Windows\system32\hasplms.exe[3296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe[3320] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe[3320] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[3348] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[3348] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe[3436] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe[3436] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\Program Files (x86)\Siemens\Step7\s7bin\s7hspsvx.exe[3668] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Program Files (x86)\Siemens\Step7\s7bin\s7hspsvx.exe[3668] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3748] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3748] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\Windows\SysWOW64\SAsrv.exe[3772] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Windows\SysWOW64\SAsrv.exe[3772] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe[4056] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe[4056] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe[2384] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe[2384] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\Windows\SysWOW64\pniopcac.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Windows\SysWOW64\pniopcac.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe[3620] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe[3620] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe[1132] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe[1132] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[4648] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[4648] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[4660] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[4660] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\Users\42\AppData\Local\Akamai\netsession_win.exe[4888] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Users\42\AppData\Local\Akamai\netsession_win.exe[4888] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\SysWOW64\ntdll.dll!KiUserExceptionDispatcher 0000000077be0124 5 bytes JMP 0000000175348620
.text C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 0000000077c0c4dd 5 bytes JMP 0000000175344e10
.text C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\SysWOW64\ntdll.dll!RtlExitUserThread 0000000077c2801c 5 bytes JMP 0000000175344ff0
.text C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!WriteFile 00000000766e1282 5 bytes JMP 0000000175344e70
.text C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!FreeLibrary 00000000766e3488 5 bytes JMP 0000000175345240
.text C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!VirtualProtect 00000000766e4327 5 bytes JMP 0000000175344ed0
.text C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!LoadLibraryExA 00000000766e48db 5 bytes JMP 0000000175344f50
.text C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!LoadLibraryW 00000000766e48f3 5 bytes JMP 0000000175344f10
.text C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!LoadLibraryExW 00000000766e4925 5 bytes JMP 0000000175344f30
.text C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!LoadLibraryA 00000000766e499f 5 bytes JMP 0000000175344f70
.text C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!CreateFileA 00000000766e538e 5 bytes JMP 0000000175345070
.text C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!GlobalAlloc 00000000766e5856 5 bytes JMP 0000000175344f90
.text C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!ExitProcess 00000000766e79d8 5 bytes JMP 0000000175345010
.text C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalA 00000000766fa48f 5 bytes JMP 0000000175345030
.text C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!WriteProcessMemory 00000000766fd9b0 5 bytes JMP 0000000175344e30
.text C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!GetThreadContext 000000007670799c 5 bytes JMP 0000000175344fb0
.text C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!VirtualProtectEx 0000000076764aff 5 bytes JMP 0000000175344eb0
.text C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!WriteFileEx 0000000076764b2f 5 bytes JMP 0000000175344e50
.text C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!SetThreadContext 00000000767658d3 5 bytes JMP 0000000175344ef0
.text C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\Program Files (x86)\Miranda IM\miranda32.exe[5084] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Program Files (x86)\Miranda IM\miranda32.exe[5084] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\Users\42\AppData\Local\Akamai\netsession_win.exe[4376] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Users\42\AppData\Local\Akamai\netsession_win.exe[4376] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe[5456] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe[5456] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Siemens\S7UBTOOX\S7ubTstx.exe[5624] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Program Files (x86)\Common Files\Siemens\S7UBTOOX\S7ubTstx.exe[5624] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5828] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5828] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Siemens\S7UBTOOX\S7ubtoox.exe[1884] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Program Files (x86)\Common Files\Siemens\S7UBTOOX\S7ubtoox.exe[1884] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe[6116] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe[6116] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[7484] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[7484] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[576] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[576] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[1296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[1296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE[3676] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE[3676] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavMain.exe[7544] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavMain.exe[7544] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
.text C:\Users\42\Desktop\Gmer-19357.exe[8160] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077691465 2 bytes [69, 77]
.text C:\Users\42\Desktop\Gmer-19357.exe[8160] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776914bb 2 bytes [69, 77]
.text ... * 2
---- EOF - GMER 2.1 ----
|
AdwCleaner auf deinen Desktop.
SecurityCheck und:
WARNUNG an die MITLESER: 
