| kiki-berlin | 10.11.2014 22:41 |
Win7, Seiten ploppen auf, Weiterleitungen und nervige Werbung in allen Browsern
Hallo Ihr Spezi's!
Mir ists ja schon fast peinlich, aber ich habe da noch so einen "verlausten":piggi: PC von meinem Sohn geschenkt bekommen. Es ist geradezu unmöglich, damit zu arbeiten. Auch hier ploppen Felder auf oder werden plötzlich Fenster geöffnet. Jeweils mit bunt blinkenden Werbebannern, vornehmlich PC orientiert sind Worte farbig fett und verlinkt. Unter Werbebannern steht dann z.B. Ads by RemoveTheAdApp und Ad by AllCheapPrice. Gerne soll ich Java updaten usw. .
Ich konnte mich nicht einmal richtig hier einloggen, weil ich immer vorher umgeleitet wurde. Wie gut, dass mein altes Läppi dank Schraubers Hilfe wieder läuft, so konnte ich meinen alten Tread aufrufen, da war es SuperLyrics.... Habe einfach genau so begonnen, wie damals von Schrauber vorgeschlagen und kann jetzt schon einloggen und diesen Treat beginnen.
Also:
Defogger: Code:
efogger_disable by jpshortstuff (23.02.10.1)
Log created at 20:37 on 10/11/2014 (Kirstin)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
FRST Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 09-11-2014 01
Ran by Kirstin (administrator) on JONI-PC on 10-11-2014 20:42:38
Running from C:\Users\Kirstin\Desktop
Loaded Profile: Kirstin (Available profiles: Joni & Kirstin)
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.22.3\GoogleCrashHandler.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Renesas Electronics Corporation) C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Geek Software GmbH) C:\Program Files\PDF24\pdf24.exe
(ScanSoft, Inc.) C:\Program Files\ScanSoft\OmniPageSE2.0\opwareSE2.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [9288296 2010-06-14] (Realtek Semiconductor)
HKLM\...\Run: [NUSB3MON] => C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-04-27] (Renesas Electronics Corporation)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [974432 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [PDFPrint] => C:\Program Files\PDF24\pdf24.exe [185896 2013-10-28] (Geek Software GmbH)
HKLM\...\Run: [OpwareSE2] => C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe [49152 2003-05-08] (ScanSoft, Inc.)
HKLM\...\Run: [OPSE reminder] => C:\Program Files\ScanSoft\OmniPageSE2.0\EregGer\Ereg.exe [729088 2003-07-07] ()
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
HKU\S-1-5-21-589606989-514392691-3014455518-1004\...\Run: [GMX_GMX MultiMessenger] => "C:\Program Files\GMX\GMX MultiMessenger\MESSENGR.EXE" /hide
HKU\S-1-5-21-589606989-514392691-3014455518-1004\...\Run: [Epson Stylus SX430(Netzwerk)] => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIHAE.EXE /FU "C:\Users\Kirstin\AppData\Local\Temp\E_S4D68.tmp" /EF "HKCU"
HKU\S-1-5-21-589606989-514392691-3014455518-1004\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe /preload
HKU\S-1-5-21-589606989-514392691-3014455518-1004\...\Run: [] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
HKU\S-1-5-21-589606989-514392691-3014455518-1004\...\Run: [VantagePointLite.exe] => "C:\Program Files\Magellan\VantagePoint\VPLite\VantagePoint Lite.exe"
HKU\S-1-5-21-589606989-514392691-3014455518-1004\...\MountPoints2: {7db4f74a-a275-11e0-afc5-806e6f6e6963} - E:\setup.exe
Startup: C:\Users\Joni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sc.lnk
ShortcutTarget: sc.lnk -> C:\Users\Kirstin\AppData\Roaming\Microsoft\Windows\dllcache\sc.exe (No File)
Startup: C:\Users\Kirstin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
SearchScopes: HKLM - DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} URL =
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL = hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms}&crg=3.1010000.10025&barid={FEB69C1F-4B6A-4325-99AE-4F7CBB043A8A}
SearchScopes: HKCU - DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = https://isearch.avg.com/search?cid={B0ED1BE2-0307-42D7-AD06-7E60E69808A8}&mid=8b1d9bd6387f47d0a757bd2b2b6b4665-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=de&ds=od011&pr=sa&d=2012-09-24 18:26:19&v=12.2.5.34&sap=dsp&q={searchTerms}
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = https://isearch.avg.com/search?cid={B0ED1BE2-0307-42D7-AD06-7E60E69808A8}&mid=8b1d9bd6387f47d0a757bd2b2b6b4665-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=de&ds=od011&pr=sa&d=2012-09-24 18:26:19&v=12.2.5.34&sap=dsp&q={searchTerms}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.3
FireFox:
========
FF ProfilePath: C:\Users\Kirstin\AppData\Roaming\Mozilla\Firefox\Profiles\o9evfzgz.default
FF DefaultSearchEngine,S:
FF DefaultSearchUrl:
FF SearchEngineOrder.1: Web Search
FF SearchEngineOrder.1,S:
FF SelectedSearchEngine,S:
FF Homepage: https://www.google.de/
FF Keyword.URL:
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_189.dll ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @MagellanGPS.com/CommunicationPlugin -> C:\Program Files\Magellan\Magellan Communicator\npMgnPlg.dll (Magellan Navigation, Inc.)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @nexon.net/NxGame -> C:\ProgramData\NexonUS\NGM\npNxGameUS.dll No File
FF Plugin: @pandonetworks.com/PandoWebPlugin -> C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Kirstin\AppData\Roaming\Mozilla\Firefox\Profiles\o9evfzgz.default\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\Kirstin\AppData\Roaming\Mozilla\Firefox\Profiles\o9evfzgz.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Kirstin\AppData\Roaming\Mozilla\Firefox\Profiles\o9evfzgz.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Kirstin\AppData\Roaming\Mozilla\Firefox\Profiles\o9evfzgz.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\Kirstin\AppData\Roaming\Mozilla\Firefox\Profiles\o9evfzgz.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: DiGiSAvEr - C:\Users\Kirstin\AppData\Roaming\Mozilla\Firefox\Profiles\o9evfzgz.default\Extensions\aai5ouap@qvlknm.co.uk [2014-07-09]
FF Extension: Isavveeri - C:\Users\Kirstin\AppData\Roaming\Mozilla\Firefox\Profiles\o9evfzgz.default\Extensions\bk.5q@fc-oyi.org [2014-07-15]
FF Extension: SaveNewaAppez - C:\Users\Kirstin\AppData\Roaming\Mozilla\Firefox\Profiles\o9evfzgz.default\Extensions\bvc-u@ofcr-e.net [2014-07-09]
FF Extension: DigiCoouipon - C:\Users\Kirstin\AppData\Roaming\Mozilla\Firefox\Profiles\o9evfzgz.default\Extensions\ilgawieoi@oarr-.co.uk [2014-07-09]
FF Extension: RegulairrDeAlsi - C:\Users\Kirstin\AppData\Roaming\Mozilla\Firefox\Profiles\o9evfzgz.default\Extensions\rammh2e@ay-.com [2014-07-09]
FF Extension: AllCheaapPiRicee - C:\Users\Kirstin\AppData\Roaming\Mozilla\Firefox\Profiles\o9evfzgz.default\Extensions\uevflmj@ov-dwft.org [2014-07-09]
FF Extension: RemoveTihheAdApp - C:\Users\Kirstin\AppData\Roaming\Mozilla\Firefox\Profiles\o9evfzgz.default\Extensions\v8z5@uaajacz.org [2014-07-09]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-11-10]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2014-11-10]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF} [2014-11-10]
Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\Kirstin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Homestuckify) - C:\Users\Kirstin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aecojehamoiekofmdfbdipdnhokbdmoo [2014-07-15]
CHR Extension: (DigiCoouipon) - C:\Users\Kirstin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bllglegfidjdgcceabfchimcgekgaigl [2014-02-28]
CHR Extension: (RemoveTihheAdApp) - C:\Users\Kirstin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bnimbpcjfkeabkkaapjdioafddiphhpg [2014-06-15]
CHR Extension: (Translate This) - C:\Users\Kirstin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bohaeepgdechbpphaodjkjghdeajomaa [2014-06-15]
CHR Extension: (AllCheaapPiRicee) - C:\Users\Kirstin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cgclbdbbppcgfldhhamgnkpgpgljofdn [2014-05-28]
CHR Extension: (RegulairrDeAlsi) - C:\Users\Kirstin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpknianjjbhpgeeomdodahhplkeabibl [2013-12-31]
CHR Extension: (karmacracy) - C:\Users\Kirstin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbccdgjgpiljagoldpcjcgkhancdeiae [2014-06-14]
CHR Extension: (Google Wallet) - C:\Users\Kirstin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-17]
CHR Extension: (SaveNewaAppez) - C:\ProgramData\obipejngdecjedfpdgedpghopakjfgfo\ [2013-09-17]
CHR HKLM\...\Chrome\Extension: [kiplfnciaokpcennlkldkdaeaaomamof] - C:\Users\Joni\AppData\Local\Torch\Plugins\TorchPlugin.crx []
CHR HKLM\...\Chrome\Extension: [ogccgbmabaphcakpiclgcnmcnimhokcj] - C:\Users\Joni\AppData\Local\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847}\SweetNT.crx []
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22192 2014-08-22] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [288120 2014-08-22] (Microsoft Corporation)
S2 SystemStoreService; C:\Program Files\SoftwareUpdater\SystemStore.exe [297984 2014-04-09] () [File not signed]
S2 Web Assistant Updater; C:\Program Files\Web Assistant\ExtensionUpdaterService.exe [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [37344 2013-04-18] () [File not signed]
S3 Mkd2kfNt; C:\Windows\System32\drivers\Mkd2kfNt.sys [133632 2009-10-13] (AhnLab, Inc.) [File not signed]
S3 Mkd2Nadr; C:\Windows\System32\drivers\Mkd2Nadr.sys [79360 2009-07-13] (AhnLab, Inc.) [File not signed]
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [231800 2014-07-17] (Microsoft Corporation)
R1 MpKsl1d6eb338; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3FEC8B4C-9F50-4BB9-8DDC-98724B025189}\MpKsl1d6eb338.sys [39464 2014-11-10] (Microsoft Corporation)
R3 nusb3hub; C:\Windows\System32\DRIVERS\nusb3hub.sys [64904 2010-04-27] (Renesas Electronics Corporation)
R3 nusb3xhc; C:\Windows\System32\DRIVERS\nusb3xhc.sys [146568 2010-04-27] (Renesas Electronics Corporation)
S3 EagleNT; \??\C:\Windows\system32\drivers\EagleNT.sys [X]
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfd.sys [X]
S3 XDva388; \??\C:\Windows\system32\XDva388.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-11-10 20:42 - 2014-11-10 20:42 - 01107968 _____ (Farbar) C:\Users\Kirstin\Desktop\FRST.exe
2014-11-10 20:42 - 2014-11-10 20:42 - 00016240 _____ () C:\Users\Kirstin\Desktop\FRST.txt
2014-11-10 20:40 - 2014-11-10 20:40 - 02116096 _____ (Farbar) C:\Users\Kirstin\Desktop\FRST64.exe
2014-11-10 20:37 - 2014-11-10 20:38 - 00000450 _____ () C:\Users\Kirstin\Desktop\defogger_disable.log
2014-11-10 20:37 - 2014-11-10 20:37 - 00050477 _____ () C:\Users\Kirstin\Desktop\Defogger.exe
2014-11-10 20:37 - 2014-11-10 20:37 - 00000000 _____ () C:\Users\Kirstin\defogger_reenable
2014-11-10 19:58 - 2014-11-10 19:58 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-11-10 19:57 - 2014-11-10 19:57 - 00000000 ____D () C:\Users\Kirstin\AppData\Local\PDF24
2014-11-10 19:19 - 2014-06-27 02:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-11-10 19:04 - 2014-10-10 02:44 - 00396288 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-11-10 19:04 - 2014-10-10 02:44 - 00230912 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-11-10 19:04 - 2014-10-10 02:39 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-11-10 19:04 - 2014-09-29 01:41 - 02379264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-11-10 19:04 - 2014-09-04 06:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-11-10 19:04 - 2014-08-23 02:46 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-11-10 19:03 - 2014-09-25 02:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-11-10 19:03 - 2014-08-01 12:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-11-10 19:03 - 2014-06-18 23:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-11-10 19:03 - 2014-06-18 23:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-11-10 19:03 - 2014-06-18 23:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-11-10 19:02 - 2014-10-07 03:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-11-10 19:02 - 2014-09-25 23:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-11-10 19:02 - 2014-09-25 23:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-11-10 19:02 - 2014-09-25 23:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-11-10 19:02 - 2014-09-25 23:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-11-10 19:02 - 2014-09-25 23:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-11-10 19:02 - 2014-09-19 02:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-11-10 19:02 - 2014-09-19 02:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-11-10 19:02 - 2014-09-19 02:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-11-10 19:02 - 2014-09-19 02:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-11-10 19:02 - 2014-09-19 02:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-11-10 19:02 - 2014-09-19 02:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-11-10 19:02 - 2014-09-19 02:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-11-10 19:02 - 2014-09-19 01:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-11-10 19:02 - 2014-09-19 01:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-11-10 19:02 - 2014-09-19 01:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-11-10 19:02 - 2014-09-19 01:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-11-10 19:02 - 2014-09-19 01:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-11-10 19:02 - 2014-09-19 01:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-11-10 19:02 - 2014-09-19 01:50 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-11-10 19:02 - 2014-09-19 01:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-11-10 19:02 - 2014-09-19 01:44 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-11-10 19:02 - 2014-09-19 01:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-11-10 19:02 - 2014-09-19 01:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-11-10 19:02 - 2014-09-19 01:20 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-11-10 19:02 - 2014-09-19 01:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-11-10 19:02 - 2014-09-19 01:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-11-10 19:02 - 2014-09-19 00:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-11-10 19:02 - 2014-09-19 00:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-11-10 19:02 - 2014-09-19 00:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-11-10 19:02 - 2014-09-18 02:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-11-10 19:02 - 2014-09-13 02:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-11-10 19:02 - 2014-07-17 02:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-11-10 19:02 - 2014-07-17 02:39 - 03221504 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-11-10 19:02 - 2014-07-17 02:39 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-11-10 19:02 - 2014-07-17 02:39 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-11-10 19:02 - 2014-07-17 02:39 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-11-10 19:02 - 2014-07-17 02:39 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2014-11-10 19:02 - 2014-07-17 02:39 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-11-10 19:02 - 2014-07-17 02:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-11-10 19:02 - 2014-07-17 02:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-11-10 19:02 - 2014-07-17 02:03 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-11-10 19:02 - 2014-07-17 02:02 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-11-10 19:02 - 2014-07-07 02:40 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-11-10 19:02 - 2014-07-07 02:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-11-10 19:02 - 2014-06-24 03:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-11-10 19:01 - 2014-09-09 22:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-11-10 18:54 - 2014-05-14 17:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-11-10 18:54 - 2014-05-14 17:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-11-10 18:54 - 2014-05-14 17:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-11-10 18:54 - 2014-05-14 17:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-11-10 18:54 - 2014-05-14 17:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-11-10 18:54 - 2014-05-14 17:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-11-10 18:54 - 2014-05-14 17:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-11-10 18:53 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-11-10 18:53 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-11-10 18:41 - 2014-11-10 18:41 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\Kirstin\Downloads\mbam-setup-2.0.3.1025.exe
2014-11-10 18:37 - 2014-11-10 18:37 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-11-10 18:37 - 2014-09-26 18:36 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-11-10 18:36 - 2014-11-10 18:36 - 00004414 _____ () C:\Windows\system32\jupdate-1.7.0_71-b14.log
2014-11-10 18:36 - 2014-09-26 18:42 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-11-10 18:36 - 2014-09-26 18:36 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-11-10 18:36 - 2014-09-26 18:35 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-11-10 20:42 - 2014-07-15 12:32 - 00000000 ____D () C:\FRST
2014-11-10 20:37 - 2011-09-05 10:51 - 00000000 ____D () C:\Users\Kirstin
2014-11-10 20:35 - 2012-04-26 08:13 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-11-10 20:35 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-11-10 20:30 - 2012-04-24 09:27 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-11-10 20:30 - 2012-04-24 09:27 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-10 20:30 - 2011-07-02 21:41 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-11-10 20:01 - 2013-02-14 15:19 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-11-10 19:56 - 2011-09-22 10:25 - 00000000 ____D () C:\Users\Kirstin\AppData\Local\Adobe
2014-11-10 19:50 - 2011-06-29 10:45 - 01629110 _____ () C:\Windows\WindowsUpdate.log
2014-11-10 19:46 - 2010-08-28 01:49 - 01651044 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-10 19:46 - 2009-07-14 05:34 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-10 19:46 - 2009-07-14 05:34 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-10 19:42 - 2013-02-14 15:19 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-11-10 19:40 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-10 19:40 - 2009-07-14 05:39 - 00205338 _____ () C:\Windows\setupact.log
2014-11-10 19:40 - 2009-07-14 05:33 - 00299584 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-11-10 19:37 - 2014-05-28 10:19 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-11-10 19:37 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-11-10 19:19 - 2013-08-15 01:17 - 00000000 ____D () C:\Windows\system32\MRT
2014-11-10 19:09 - 2013-01-06 01:38 - 00002155 _____ () C:\Windows\epplauncher.mif
2014-11-10 19:09 - 2013-01-06 01:38 - 00002121 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2014-11-10 19:09 - 2013-01-06 01:38 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-11-10 18:37 - 2014-07-15 11:09 - 00000000 ____D () C:\ProgramData\Oracle
2014-11-10 18:36 - 2012-01-17 00:17 - 00000000 ____D () C:\Program Files\Java
2014-11-10 18:11 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-11-10 17:39 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\rescache
Files to move or delete:
====================
C:\ProgramData\libnspr4.dll
Some content of TEMP:
====================
C:\Users\Joni\AppData\Local\Temp\APNSetup.exe
C:\Users\Joni\AppData\Local\Temp\ApnToolbarInstaller.exe
C:\Users\Joni\AppData\Local\Temp\ApnToolbarInstaller[1].exe
C:\Users\Joni\AppData\Local\Temp\AskSLib.dll
C:\Users\Joni\AppData\Local\Temp\avguidx.dll
C:\Users\Joni\AppData\Local\Temp\CmdLineExt02.dll
C:\Users\Joni\AppData\Local\Temp\CommonInstaller.exe
C:\Users\Joni\AppData\Local\Temp\ConduitEngine.dll
C:\Users\Joni\AppData\Local\Temp\contentDATs.exe
C:\Users\Joni\AppData\Local\Temp\FastDownload.exe
C:\Users\Joni\AppData\Local\Temp\GenericWndApi.dll
C:\Users\Joni\AppData\Local\Temp\htmlayout.dll
C:\Users\Joni\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Joni\AppData\Local\Temp\libnspr4.dll
C:\Users\Joni\AppData\Local\Temp\MachineIdCreator.exe
C:\Users\Joni\AppData\Local\Temp\NGM.exe
C:\Users\Joni\AppData\Local\Temp\NGMDll.dll
C:\Users\Joni\AppData\Local\Temp\NGMResource.dll
C:\Users\Joni\AppData\Local\Temp\oi_{95AFB10E-2476-4E10-92E1-AEB26DCB2B10}.exe
C:\Users\Joni\AppData\Local\Temp\SIMEEI2Installer.exe
C:\Users\Joni\AppData\Local\Temp\SIMEEIInstaller.exe
C:\Users\Joni\AppData\Local\Temp\SIntf16.dll
C:\Users\Joni\AppData\Local\Temp\SIntf32.dll
C:\Users\Joni\AppData\Local\Temp\SIntfNT.dll
C:\Users\Joni\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Joni\AppData\Local\Temp\SpotifyUninstall.exe
C:\Users\Joni\AppData\Local\Temp\TB_A555.exe
C:\Users\Joni\AppData\Local\Temp\tmpA710.tmp.exe
C:\Users\Joni\AppData\Local\Temp\ToolbarInstaller.exe
C:\Users\Joni\AppData\Local\Temp\TubeBoxSetup.exe
C:\Users\Joni\AppData\Local\Temp\UNINSTALL.EXE
C:\Users\Kirstin\AppData\Local\Temp\AskSLib.dll
C:\Users\Kirstin\AppData\Local\Temp\contentDATs.exe
C:\Users\Kirstin\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv.exe
C:\Users\Kirstin\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\Kirstin\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe
C:\Users\Kirstin\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe
C:\Users\Kirstin\AppData\Local\Temp\jre-7u60-windows-i586-iftw.exe
C:\Users\Kirstin\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
C:\Users\Kirstin\AppData\Local\Temp\Resource.MG2010.dll
C:\Users\Kirstin\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\Kirstin\AppData\Local\Temp\Setup.exe
C:\Users\Kirstin\AppData\Local\Temp\shelper.dll
C:\Users\Kirstin\AppData\Local\Temp\SkypeSetup.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-11-10 17:31
==================== End Of Log ============================
Addition Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 09-11-2014 01
Ran by Kirstin at 2014-11-10 20:43:11
Running from C:\Users\Kirstin\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (HKLM\...\7-Zip) (Version: - )
Acrobat.com (HKLM\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe AIR (HKLM\...\Adobe AIR) (Version: 2.7.1.19610 - Adobe Systems Incorporated)
Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.189 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (HKLM\...\Adobe Shockwave Player) (Version: 12.0.3.133 - Adobe Systems, Inc.)
ATI Catalyst Install Manager (HKLM\...\{BE4AE3A7-190D-BCB8-A953-A708C9E8E8AA}) (Version: 3.0.778.0 - ATI Technologies, Inc.)
ccc-core-static (Version: 2010.0527.1242.20909 - ATI) Hidden
CorelDRAW Essentials 4 - Content (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Draw (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Filters (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - ICA (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - IPM - No VBA (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang BR (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang DE (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang EN (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang ES (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang FR (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang IT (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang NL (Version: 4.0 - Uw bedrijfsnaam) Hidden
CorelDRAW Essentials 4 - PHOTO-PAINT (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Windows Shell Extension (HKLM\...\_{CF0ADC18-6D8F-4353-8EAA-DF45456B7853}) (Version: - Corel Corporation)
CorelDRAW Essentials 4 - Windows Shell Extension (Version: 1.1 - Corel Corporation) Hidden
CorelDRAW Essentials 4 (HKLM\...\_{C0237AA4-1BFB-46EA-860D-7B0EB365CA13}) (Version: - Corel Corporation)
CorelDRAW Essentials 4 (Version: 4.0 - Corel Corporation) Hidden
ElsterFormular (HKLM\...\ElsterFormular) (Version: 14.4.20130909 - Landesfinanzdirektion Thüringen)
Google Chrome (HKLM\...\Google Chrome) (Version: 31.0.1650.63 - Google Inc.)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.22.3 - Google Inc.) Hidden
Hearthstone (HKLM\...\Hearthstone) (Version: - Blizzard Entertainment)
Intel(R) Rapid Storage Technology (HKLM\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.0.1014 - Intel Corporation)
Internet Explorer Toolbar 4.6 by SweetPacks (HKLM\...\{C3E85EE9-5892-4142-B537-BCEB3DAC4C3D}) (Version: 4.6.0004 - SweetIM Technologies Ltd.) <==== ATTENTION
Java 7 Update 71 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.710 - Oracle)
Java(TM) 6 Update 37 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216033FF}) (Version: 6.0.370 - Oracle)
Junk Mail filter update (Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Magellan Communicator (HKLM\...\InstallShield_{0FD5FD0B-4BA6-47A1-99C3-F8A964C3CCA5}) (Version: 1.15.020 - Magellan Navigation, Inc.)
Magellan Communicator (Version: 1.15.020 - Magellan Navigation, Inc.) Hidden
Microsoft .NET Framework 1.1 (HKLM\...\Microsoft .NET Framework 1.1 (1033)) (Version: - )
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2010 (HKLM\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Starter 2010 - Deutsch (HKLM\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [DEU] (HKLM\...\{BAC80EF3-E106-4AEA-8C57-F217F9BC7358}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 3.1 (HKLM\...\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation)
Mozilla Firefox 31.0 (x86 de) (HKLM\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
MSVCRT (Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
OmniPage SE 2.0 (HKLM\...\{79D5997E-BF79-48BB-8B41-9BE59C15C2D7}) (Version: 2.00.0004 - ScanSoft, Inc.)
OpenOffice.org 3.3 (HKLM\...\{4286716B-1287-48E7-9078-3DC8248DBA96}) (Version: 3.3.9567 - OpenOffice.org)
PDF24 Creator 6.0.1 (HKLM\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
PlayReady PC Runtime x86 (HKLM\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
QuickTime (HKLM\...\{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}) (Version: 7.73.80.64 - Apple Inc.)
Realtek Ethernet Controller Driver For Windows 7 (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.21.531.2010 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6136 - Realtek Semiconductor Corp.)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.0.4.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (Version: 2.0.4.0 - Renesas Electronics Corporation) Hidden
Skype™ 6.16 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)
Spelling Dictionaries Support For Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
sv.net (HKLM\...\sv.net) (Version: 14.1 - ITSG GmbH)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Windows Live Anmelde-Assistent (HKLM\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8117.0416 - Microsoft Corporation)
Windows Live Sync (HKLM\...\{586509F0-350D-48B5-B763-9CC2F8D96C4C}) (Version: 14.0.8117.416 - Microsoft Corporation)
Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-589606989-514392691-3014455518-1001_Classes\CLSID\{1488D9CB-C304-D551-E17D-1D74423564B9}\InprocServer32 -> C:\Windows\system32\ole32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-589606989-514392691-3014455518-1001_Classes\CLSID\{1FD1FE74-9E3C-4C1C-AEEB-AAB592AD770F}\localserver32 -> C:\Users\Joni\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-589606989-514392691-3014455518-1001_Classes\CLSID\{5E71E4F3-E8C7-4906-9626-973E418762B6}\InprocServer32 -> C:\Users\Joni\AppData\Local\Facebook\Update\1.2.205.0\goopdate.dll (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-589606989-514392691-3014455518-1001_Classes\CLSID\{CBE9C57E-FFA9-4123-8354-AD360D6DD3CC}\InprocServer32 -> C:\Users\Joni\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll No File
CustomCLSID: HKU\S-1-5-21-589606989-514392691-3014455518-1004_Classes\CLSID\{1488D9CB-C304-D551-E17D-1D74423564B9}\InprocServer32 -> C:\Windows\system32\ole32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-589606989-514392691-3014455518-1004_Classes\CLSID\{1FD1FE74-9E3C-4C1C-AEEB-AAB592AD770F}\localserver32 -> C:\Users\Joni\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-589606989-514392691-3014455518-1004_Classes\CLSID\{5E71E4F3-E8C7-4906-9626-973E418762B6}\InprocServer32 -> C:\Users\Kirstin\AppData\Local\Facebook\Update\1.2.205.0\goopdate.dll No File
CustomCLSID: HKU\S-1-5-21-589606989-514392691-3014455518-1004_Classes\CLSID\{CBE9C57E-FFA9-4123-8354-AD360D6DD3CC}\InprocServer32 -> C:\Users\Kirstin\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll No File
==================== Restore Points =========================
15-07-2014 19:30:41 Windows Update
25-08-2014 12:35:33 Windows Update
10-11-2014 16:38:38 Geplanter Prüfpunkt
10-11-2014 17:35:47 Installed Java 7 Update 71
10-11-2014 17:53:50 Windows Update
10-11-2014 18:04:27 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {2DA0984D-2697-42BD-B190-9320370EBF31} - System32\Tasks\Software Updater Ui => C:\Program Files\SoftwareUpdater\SoftwareUpdater.Ui.exe [2013-12-18] () <==== ATTENTION
Task: {4082A99B-3CB8-40E2-A736-48C472B8BDED} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-06-29] (Google Inc.)
Task: {56DD6430-9C0F-47A3-94B1-EF2D054C800A} - \DealPlyUpdate No Task File <==== ATTENTION
Task: {70DEAA35-B3FE-400A-BA42-5FAF848ED058} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-10] (Adobe Systems Incorporated)
Task: {78C1FE47-F552-46DD-8FAF-779311108B00} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-06-29] (Google Inc.)
Task: {809DC46B-5B40-4C57-8073-B7A228D287BC} - System32\Tasks\{7C7260A9-E236-4F62-9A08-A16246E1057A} => Chrome.exe hxxp://ui.skype.com/ui/0/6.2.0.106/de/abandoninstall?page=tsMain
Task: {B462F737-9611-4399-A2FE-D7F359E3F806} - System32\Tasks\Software Updater => C:\Program Files\SoftwareUpdater\SoftwareUpdater.Bootstrapper.exe [2013-12-18] () <==== ATTENTION
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2014-05-28 13:26 - 2012-09-18 14:26 - 00169472 _____ () C:\Windows\System32\zlhp1020.dll
2014-05-28 13:26 - 2012-09-18 14:26 - 00059904 _____ () C:\Windows\system32\spool\PRTPROCS\W32X86\pphp1020.dll
2014-05-28 15:29 - 2006-06-27 09:33 - 00434176 _____ () C:\Windows\system32\CNQL3203.DLL
2011-01-17 16:19 - 2012-01-17 00:18 - 00985088 _____ () C:\Program Files\OpenOffice.org 3\program\libxml2.dll
2010-08-30 19:04 - 2010-03-04 04:08 - 00058880 _____ () C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2014-11-10 19:58 - 2014-11-10 19:58 - 03800688 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-11-10 19:56 - 2014-11-10 19:56 - 16832176 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_189.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BsScanner => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\BsScanner => ""="Service"
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\Services: APNMCP => 2
MSCONFIG\Services: McComponentHostService => 3
MSCONFIG\Services: TunngleService => 3
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Joni^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^IMVU.lnk => C:\Windows\pss\IMVU.lnk.Startup
MSCONFIG\startupreg: ApnTBMon => "C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe"
MSCONFIG\startupreg: Epson Stylus SX430(Netzwerk) => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIHAE.EXE /FU "C:\Users\Joni\AppData\Local\Temp\E_SCF02.tmp" /EF "HKCU"
MSCONFIG\startupreg: Spotify => "C:\Users\Joni\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart
MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\Joni\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
========================= Accounts: ==========================
Administrator (S-1-5-21-589606989-514392691-3014455518-500 - Administrator - Disabled)
ASPNET (S-1-5-21-589606989-514392691-3014455518-1006 - Limited - Enabled)
Gast (S-1-5-21-589606989-514392691-3014455518-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-589606989-514392691-3014455518-1002 - Limited - Enabled)
Joni (S-1-5-21-589606989-514392691-3014455518-1001 - Administrator - Enabled) => C:\Users\Joni
Kirstin (S-1-5-21-589606989-514392691-3014455518-1004 - Administrator - Enabled) => C:\Users\Kirstin
==================== Faulty Device Manager Devices =============
Name: MpKsl4bbf61a7
Description: MpKsl4bbf61a7
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: MpKsl4bbf61a7
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
Name: Realtek RTL8191SU Wireless LAN 802.11n USB 2.0 Network Adapter
Description: Realtek RTL8191SU Wireless LAN 802.11n USB 2.0 Network Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Realtek Semiconductor Corp.
Service: RTL8192su
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (11/10/2014 07:45:11 PM) (Source: MsiInstaller) (EventID: 1024) (User: Joni-PC)
Description: Produkt: Adobe Reader XI - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011009}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127
Error: (11/10/2014 04:42:12 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
(Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed:
Error: (11/10/2014 04:18:59 PM) (Source: Software Protection Platform Service) (EventID: 8208) (User: )
Description: Fehler bei der Erfassung des authentischen Tickets (hr=0x80072EE7) für die Vorlagen-ID 66c92734-d682-4d71-983e-d6ec3f16059f.
Error: (11/10/2014 04:18:59 PM) (Source: Software Protection Platform Service) (EventID: 8200) (User: )
Description: Lizenzerwerb-Fehlerdetails.
hr=0x80072EE7
Error: (11/10/2014 04:18:32 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
(Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed:
Error: (08/25/2014 01:07:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Gmer-19357.exe, Version: 2.1.19357.0, Zeitstempel: 0x52e7ea83
Name des fehlerhaften Moduls: Gmer-19357.exe, Version: 2.1.19357.0, Zeitstempel: 0x52e7ea83
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00012298
ID des fehlerhaften Prozesses: 0xb14
Startzeit der fehlerhaften Anwendung: 0xGmer-19357.exe0
Pfad der fehlerhaften Anwendung: Gmer-19357.exe1
Pfad des fehlerhaften Moduls: Gmer-19357.exe2
Berichtskennung: Gmer-19357.exe3
Error: (08/25/2014 00:46:35 PM) (Source: MsiInstaller) (EventID: 1024) (User: Joni-PC)
Description: Produkt: Adobe Reader XI (11.0.07) - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011008}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127
Error: (08/25/2014 00:43:40 PM) (Source: MsiInstaller) (EventID: 1024) (User: Joni-PC)
Description: Produkt: Adobe Reader XI (11.0.07) - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011008}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127
Error: (08/25/2014 11:50:23 AM) (Source: MsiInstaller) (EventID: 1024) (User: Joni-PC)
Description: Produkt: Adobe Reader XI (11.0.07) - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011008}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127
Error: (07/15/2014 07:49:35 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: knlwrap.exe, Version: 3.3.0.497, Zeitstempel: 0x3a81e7eb
Name des fehlerhaften Moduls: knlwrap.exe, Version: 3.3.0.497, Zeitstempel: 0x3a81e7eb
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000011fa
ID des fehlerhaften Prozesses: 0x12c0
Startzeit der fehlerhaften Anwendung: 0xknlwrap.exe0
Pfad der fehlerhaften Anwendung: knlwrap.exe1
Pfad des fehlerhaften Moduls: knlwrap.exe2
Berichtskennung: knlwrap.exe3
System errors:
=============
Error: (11/10/2014 06:55:25 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 1.183.445.0
Aktualisierungsquelle: %NT-AUTORITÄT59
Aktualisierungsphase: 4.5.0216.00
Quellpfad: 4.5.0216.01
Signaturtyp: %NT-AUTORITÄT602
Aktualisierungstyp: %NT-AUTORITÄT604
Benutzer: NT-AUTORITÄT\SYSTEM
Aktuelle Modulversion: %NT-AUTORITÄT605
Vorherige Modulversion: %NT-AUTORITÄT606
Fehlercode: %NT-AUTORITÄT607
Fehlerbeschreibung: %NT-AUTORITÄT608
Error: (11/10/2014 06:55:25 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 1.183.445.0
Aktualisierungsquelle: %NT-AUTORITÄT59
Aktualisierungsphase: 4.5.0216.00
Quellpfad: 4.5.0216.01
Signaturtyp: %NT-AUTORITÄT602
Aktualisierungstyp: %NT-AUTORITÄT604
Benutzer: NT-AUTORITÄT\SYSTEM
Aktuelle Modulversion: %NT-AUTORITÄT605
Vorherige Modulversion: %NT-AUTORITÄT606
Fehlercode: %NT-AUTORITÄT607
Fehlerbeschreibung: %NT-AUTORITÄT608
Error: (11/10/2014 05:07:31 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 112.1.0.0
Aktualisierungsquelle: %NT-AUTORITÄT51
Aktualisierungsphase: 4.5.0216.00
Quellpfad: 4.5.0216.01
Signaturtyp: %NT-AUTORITÄT602
Aktualisierungstyp: %NT-AUTORITÄT604
Benutzer: NT-AUTORITÄT\NETZWERKDIENST
Aktuelle Modulversion: %NT-AUTORITÄT605
Vorherige Modulversion: %NT-AUTORITÄT606
Fehlercode: %NT-AUTORITÄT607
Fehlerbeschreibung: %NT-AUTORITÄT608
Error: (11/10/2014 05:06:48 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 1.183.445.0
Aktualisierungsquelle: %NT-AUTORITÄT51
Aktualisierungsphase: 4.5.0216.00
Quellpfad: 4.5.0216.01
Signaturtyp: %NT-AUTORITÄT602
Aktualisierungstyp: %NT-AUTORITÄT604
Benutzer: NT-AUTORITÄT\NETZWERKDIENST
Aktuelle Modulversion: %NT-AUTORITÄT605
Vorherige Modulversion: %NT-AUTORITÄT606
Fehlercode: %NT-AUTORITÄT607
Fehlerbeschreibung: %NT-AUTORITÄT608
Error: (11/10/2014 05:06:48 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 1.183.445.0
Aktualisierungsquelle: %NT-AUTORITÄT51
Aktualisierungsphase: 4.5.0216.00
Quellpfad: 4.5.0216.01
Signaturtyp: %NT-AUTORITÄT602
Aktualisierungstyp: %NT-AUTORITÄT604
Benutzer: NT-AUTORITÄT\NETZWERKDIENST
Aktuelle Modulversion: %NT-AUTORITÄT605
Vorherige Modulversion: %NT-AUTORITÄT606
Fehlercode: %NT-AUTORITÄT607
Fehlerbeschreibung: %NT-AUTORITÄT608
Error: (11/10/2014 05:06:04 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 1.183.445.0
Aktualisierungsquelle: %NT-AUTORITÄT59
Aktualisierungsphase: 4.5.0216.00
Quellpfad: 4.5.0216.01
Signaturtyp: %NT-AUTORITÄT602
Aktualisierungstyp: %NT-AUTORITÄT604
Benutzer: NT-AUTORITÄT\SYSTEM
Aktuelle Modulversion: %NT-AUTORITÄT605
Vorherige Modulversion: %NT-AUTORITÄT606
Fehlercode: %NT-AUTORITÄT607
Fehlerbeschreibung: %NT-AUTORITÄT608
Error: (11/10/2014 04:41:45 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 112.1.0.0
Aktualisierungsquelle: %NT-AUTORITÄT51
Aktualisierungsphase: 4.5.0216.00
Quellpfad: 4.5.0216.01
Signaturtyp: %NT-AUTORITÄT602
Aktualisierungstyp: %NT-AUTORITÄT604
Benutzer: NT-AUTORITÄT\NETZWERKDIENST
Aktuelle Modulversion: %NT-AUTORITÄT605
Vorherige Modulversion: %NT-AUTORITÄT606
Fehlercode: %NT-AUTORITÄT607
Fehlerbeschreibung: %NT-AUTORITÄT608
Error: (11/10/2014 04:41:44 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 1.183.445.0
Aktualisierungsquelle: %NT-AUTORITÄT51
Aktualisierungsphase: 4.5.0216.00
Quellpfad: 4.5.0216.01
Signaturtyp: %NT-AUTORITÄT602
Aktualisierungstyp: %NT-AUTORITÄT604
Benutzer: NT-AUTORITÄT\NETZWERKDIENST
Aktuelle Modulversion: %NT-AUTORITÄT605
Vorherige Modulversion: %NT-AUTORITÄT606
Fehlercode: %NT-AUTORITÄT607
Fehlerbeschreibung: %NT-AUTORITÄT608
Error: (11/10/2014 04:41:44 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 1.183.445.0
Aktualisierungsquelle: %NT-AUTORITÄT51
Aktualisierungsphase: 4.5.0216.00
Quellpfad: 4.5.0216.01
Signaturtyp: %NT-AUTORITÄT602
Aktualisierungstyp: %NT-AUTORITÄT604
Benutzer: NT-AUTORITÄT\NETZWERKDIENST
Aktuelle Modulversion: %NT-AUTORITÄT605
Vorherige Modulversion: %NT-AUTORITÄT606
Fehlercode: %NT-AUTORITÄT607
Fehlerbeschreibung: %NT-AUTORITÄT608
Error: (11/10/2014 04:41:44 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 1.183.445.0
Aktualisierungsquelle: %NT-AUTORITÄT59
Aktualisierungsphase: 4.5.0216.00
Quellpfad: 4.5.0216.01
Signaturtyp: %NT-AUTORITÄT602
Aktualisierungstyp: %NT-AUTORITÄT604
Benutzer: NT-AUTORITÄT\SYSTEM
Aktuelle Modulversion: %NT-AUTORITÄT605
Vorherige Modulversion: %NT-AUTORITÄT606
Fehlercode: %NT-AUTORITÄT607
Fehlerbeschreibung: %NT-AUTORITÄT608
Microsoft Office Sessions:
=========================
Error: (11/10/2014 07:45:11 PM) (Source: MsiInstaller) (EventID: 1024) (User: Joni-PC)
Description: Adobe Reader XI - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011009}1625(NULL)(NULL)(NULL)
Error: (11/10/2014 04:42:12 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed:
Error: (11/10/2014 04:18:59 PM) (Source: Software Protection Platform Service) (EventID: 8208) (User: )
Description: hr=0x80072EE766c92734-d682-4d71-983e-d6ec3f16059f
Error: (11/10/2014 04:18:59 PM) (Source: Software Protection Platform Service) (EventID: 8200) (User: )
Description: hr=0x80072EE700010001(0x00000000, 16:18:37:387 - hxxp://go.microsoft.com/fwlink/?LinkId=151642)
00020001(0x00000000, 16:18:37:387)
00030001(0x00000000, 16:18:37:387 - hxxp://go.microsoft.com)
00030002(0x00000000, 16:18:37:387 - 0)
00040001(0x00000000, 16:18:37:387 - hxxp://go.microsoft.com)
00040002(0x00000000, 16:18:37:387 - 1, <NULL>, <NULL>, <NULL>)
00040004(0x80072F94, 16:18:47:044 - <NULL>)
00040006(0x00000000, 16:18:47:044 - 1, hxxp://go.microsoft.com, <NULL>, <local>)
00020005(0x00000000, 16:18:47:044 - 0)
00020007(0x80072EE7, 16:18:59:103)
00010002(0x80072EE7, 16:18:59:103 - <NULL>)
00010003(0x80072EE7, 16:18:59:103)
Error: (11/10/2014 04:18:32 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed:
Error: (08/25/2014 01:07:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Gmer-19357.exe2.1.19357.052e7ea83Gmer-19357.exe2.1.19357.052e7ea83c000000500012298b1401cfc05ceed6b9aeC:\Users\Joni\Desktop\Troyanerboard\Gmer-19357.exeC:\Users\Joni\Desktop\Troyanerboard\Gmer-19357.exe5ee572eb-2c50-11e4-b2d4-6c626d8faf96
Error: (08/25/2014 00:46:35 PM) (Source: MsiInstaller) (EventID: 1024) (User: Joni-PC)
Description: Adobe Reader XI (11.0.07) - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011008}1625(NULL)(NULL)(NULL)
Error: (08/25/2014 00:43:40 PM) (Source: MsiInstaller) (EventID: 1024) (User: Joni-PC)
Description: Adobe Reader XI (11.0.07) - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011008}1625(NULL)(NULL)(NULL)
Error: (08/25/2014 11:50:23 AM) (Source: MsiInstaller) (EventID: 1024) (User: Joni-PC)
Description: Adobe Reader XI (11.0.07) - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011008}1625(NULL)(NULL)(NULL)
Error: (07/15/2014 07:49:35 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: knlwrap.exe3.3.0.4973a81e7ebknlwrap.exe3.3.0.4973a81e7ebc0000005000011fa12c001cfa05d84827b31C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\knlwrap.exeC:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\knlwrap.exec3602021-0c50-11e4-84cc-6c626d8faf96
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i3 CPU 550 @ 3.20GHz
Percentage of memory in use: 44%
Total physical RAM: 3063.11 MB
Available physical RAM: 1713.99 MB
Total Pagefile: 6124.52 MB
Available Pagefile: 4512.88 MB
Total Virtual: 2047.88 MB
Available Virtual: 1909.3 MB
==================== Drives ================================
Drive c: (Boot) (Fixed) (Total:1356.17 GB) (Free:1235.77 GB) NTFS
Drive d: (Recover) (Fixed) (Total:40 GB) (Free:20.99 GB) NTFS
Drive e: (CANOSCAN) (CDROM) (Total:0.47 GB) (Free:0 GB) CDFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 1397.3 GB) (Disk ID: 2BD2C32A)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=1356.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=40 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=1 GB) - (Type=12)
==================== End Of Log ============================
GMER Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-11-10 21:04:19
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD15 rev.51.0 1397,27GB
Running: Gmer-19357.exe; Driver: C:\Users\Kirstin\AppData\Local\Temp\pwldypod.sys
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!ZwRollbackEnlistment + 142D 82E77A15 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82EB1212 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text C:\Windows\system32\DRIVERS\atikmdag.sys section is writeable [0x91A1A000, 0x2FBAB4, 0xE8000020]
---- User code sections - GMER 2.1 ----
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[728] USER32.dll!RegisterMessagePumpHook + 2F1 77A08B9E 7 Bytes JMP 5C8444B6 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[728] USER32.dll!IsDialogMessageW + 340 77A14444 7 Bytes JMP 5C844527 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[728] USER32.dll!GetWindowInfo 77A14B5E 5 Bytes JMP 5C84825D C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[728] USER32.dll!ToUnicodeEx + 71 77A22223 7 Bytes JMP 5C841BFA C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4784] ntdll.dll!NtCreateFile 77CA5608 5 Bytes JMP 5C5F3D20 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4784] ntdll.dll!NtFlushBuffersFile 77CA5998 5 Bytes JMP 5C5DC661 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4784] ntdll.dll!NtQueryFullAttributesFile 77CA6028 5 Bytes JMP 5C5F3820 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4784] ntdll.dll!NtReadFile 77CA62F8 5 Bytes JMP 5C5DC750 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4784] ntdll.dll!NtReadFileScatter 77CA6308 5 Bytes JMP 5CE7E1FF C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4784] ntdll.dll!NtWriteFile 77CA6AA8 5 Bytes JMP 5C5F43D0 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4784] ntdll.dll!NtWriteFileGather 77CA6AB8 5 Bytes JMP 5CE7E1AE C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4784] kernel32.dll!K32GetDeviceDriverBaseNameW + 5D 772094E6 7 Bytes JMP 5CE1F55F C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4784] kernel32.dll!QueryPerformanceCounter + 13 7720C4E5 7 Bytes JMP 5CE1F582 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4784] kernel32.dll!LoadAppInitDlls + 355 7720F5A6 7 Bytes JMP 5C5F06F3 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4784] USER32.dll!GetWindowInfo 77A14B5E 5 Bytes JMP 5CD2E5A9 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4784] GDI32.dll!GetViewportOrgEx + 26C 7759884B 1 Byte [E9]
.text C:\Program Files\Mozilla Firefox\firefox.exe[4784] GDI32.dll!GetViewportOrgEx + 26C 7759884B 7 Bytes JMP 5CE1F4E0 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtCreateFile + 6 77CA560E 4 Bytes [28, 28, 17, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtCreateFile + B 77CA5613 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtCreateKey + 6 77CA564E 4 Bytes [68, 29, 17, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtCreateKey + B 77CA5653 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtCreateMutant + 6 77CA568E 4 Bytes [68, 2A, 17, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtCreateMutant + B 77CA5693 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtCreateSection + 6 77CA572E 4 Bytes [A8, 2A, 17, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtCreateSection + B 77CA5733 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtMapViewOfSection + 6 77CA5C6E 4 Bytes CALL 76CA739F C:\Windows\system32\SETUPAPI.dll
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtMapViewOfSection + B 77CA5C73 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtOpenFile + 6 77CA5D1E 4 Bytes [68, 28, 17, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtOpenFile + B 77CA5D23 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtOpenKey + 6 77CA5D4E 4 Bytes [A8, 29, 17, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtOpenKey + B 77CA5D53 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtOpenKeyEx + 6 77CA5D5E 4 Bytes CALL 76CA748C C:\Windows\system32\SETUPAPI.dll
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtOpenKeyEx + B 77CA5D63 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtOpenMutant + 6 77CA5D9E 4 Bytes [28, 2A, 17, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtOpenMutant + B 77CA5DA3 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtOpenProcess + 6 77CA5DCE 4 Bytes [68, 2B, 17, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtOpenProcess + B 77CA5DD3 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtOpenProcessToken + 6 77CA5DDE 4 Bytes [A8, 2B, 17, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtOpenProcessToken + B 77CA5DE3 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtOpenProcessTokenEx + 6 77CA5DEE 4 Bytes [68, 2C, 17, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtOpenProcessTokenEx + B 77CA5DF3 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtOpenSection + 6 77CA5E0E 4 Bytes CALL 76CA753D C:\Windows\system32\SETUPAPI.dll
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtOpenSection + B 77CA5E13 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtOpenThread + 6 77CA5E4E 4 Bytes [28, 2B, 17, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtOpenThread + B 77CA5E53 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtOpenThreadToken + 6 77CA5E5E 4 Bytes [28, 2C, 17, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtOpenThreadToken + B 77CA5E63 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtOpenThreadTokenEx + 6 77CA5E6E 4 Bytes [A8, 2C, 17, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtOpenThreadTokenEx + B 77CA5E73 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtQueryAttributesFile + 6 77CA5F7E 4 Bytes [A8, 28, 17, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtQueryAttributesFile + B 77CA5F83 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtQueryFullAttributesFile + 6 77CA602E 4 Bytes CALL 76CA775B C:\Windows\system32\SETUPAPI.dll
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtQueryFullAttributesFile + B 77CA6033 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtSetInformationFile + 6 77CA667E 4 Bytes [28, 29, 17, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtSetInformationFile + B 77CA6683 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtSetInformationThread + 6 77CA66DE 4 Bytes CALL 76CA7E0E C:\Windows\system32\SETUPAPI.dll
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtSetInformationThread + B 77CA66E3 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtUnmapViewOfSection + 6 77CA69FE 4 Bytes [28, 2D, 17, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ntdll.dll!NtUnmapViewOfSection + B 77CA6A03 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] kernel32.dll!CreateProcessW 771C204D 5 Bytes JMP 00180030
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] kernel32.dll!CreateProcessA 771C2082 5 Bytes JMP 00180070
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] user32.DLL!ActivateKeyboardLayout 77A08203 5 Bytes JMP 001C04F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] user32.DLL!ScreenToClient 77A0A506 7 Bytes JMP 001C0670
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] user32.DLL!RegisterClipboardFormatA 77A0C091 5 Bytes JMP 001C02F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] user32.DLL!RegisterClipboardFormatW 77A0DF8D 5 Bytes JMP 001C02B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] user32.DLL!SetCursor 77A13075 5 Bytes JMP 001C0530
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] user32.DLL!MonitorFromWindow 77A13622 7 Bytes JMP 001C0630
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] user32.DLL!PostMessageW 77A1447B 5 Bytes JMP 001C05F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] user32.DLL!IsWindowVisible 77A14D69 7 Bytes JMP 001C06B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] user32.DLL!GetClientRect 77A154DD 7 Bytes JMP 001C05B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] user32.DLL!MapWindowPoints 77A15CAA 5 Bytes JMP 001C0570
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] user32.DLL!GetParent 77A16029 7 Bytes JMP 001C06F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] user32.DLL!EmptyClipboard 77A2290C 5 Bytes JMP 001C0130
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] user32.DLL!SetClipboardData 77A22962 5 Bytes JMP 001C0170
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] user32.DLL!GetClipboardData 77A22BA7 5 Bytes JMP 001C0030
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] user32.DLL!GetClipboardFormatNameW 77A25FD2 5 Bytes JMP 001C0230
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] user32.DLL!SetClipboardViewer 77A26FF6 5 Bytes JMP 001C04B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] user32.DLL!GetClipboardFormatNameA 77A2700A 5 Bytes JMP 001C0270
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] user32.DLL!ChangeClipboardChain 77A3147C 5 Bytes JMP 001C0430
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] user32.DLL!GetTopWindow 77A324D9 7 Bytes JMP 001C0730
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] user32.DLL!CloseClipboard 77A3446C 5 Bytes JMP 001C00B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] user32.DLL!OpenClipboard 77A3447E 5 Bytes JMP 001C0070
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] user32.DLL!IsClipboardFormatAvailable 77A344FF 5 Bytes JMP 001C00F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] user32.DLL!GetClipboardSequenceNumber 77A34513 5 Bytes JMP 001C0330
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] user32.DLL!GetClipboardOwner 77A34525 5 Bytes JMP 001C0370
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] user32.DLL!CountClipboardFormats 77A3470A 5 Bytes JMP 001C01F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] user32.DLL!EnumClipboardFormats 77A347EC 5 Bytes JMP 001C01B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] user32.DLL!GetOpenClipboardWindow 77A3480B 5 Bytes JMP 001C03F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] user32.DLL!SetCursorPos 77A4C1B0 5 Bytes JMP 001C0770
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] user32.DLL!GetClipboardViewer 77A64AF7 5 Bytes JMP 001C0470
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] user32.DLL!GetPriorityClipboardFormat 77A64BF9 5 Bytes JMP 001C03B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!DeleteObject 77595F14 5 Bytes JMP 001D01B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!SelectObject 77596640 5 Bytes JMP 001D05F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!SetTextColor 77596906 5 Bytes JMP 001D0A30
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!SetBkMode 775969B1 5 Bytes JMP 001D08F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!DeleteDC 77596EAA 5 Bytes JMP 001D0170
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!GetDeviceCaps 77596F7F 5 Bytes JMP 001D03B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!ExtSelectClipRgn 77597114 5 Bytes JMP 001D02F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!SelectClipRgn 77597242 5 Bytes JMP 001D05B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!SetStretchBltMode 77597705 5 Bytes JMP 001D06B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!GetCurrentObject 77597917 5 Bytes JMP 001D0370
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!GetTextMetricsW 77597B8F 5 Bytes JMP 001D0E30
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!GetTextAlign 77597DAF 5 Bytes JMP 001D0D70
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!IntersectClipRect 77597DFE 5 Bytes JMP 001D03F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!ExtTextOutW 77598192 5 Bytes JMP 001D0970
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!SetTextAlign 7759828E 5 Bytes JMP 001D09F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!GetClipBox 77598525 5 Bytes JMP 001D0330
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!MoveToEx 77598C21 5 Bytes JMP 001D0470
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!StretchDIBits 7759A53E 5 Bytes JMP 001D0770
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!RestoreDC 7759A67B 5 Bytes JMP 001D0530
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!SaveDC 7759A74B 5 Bytes JMP 001D0570
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!GetTextExtentPoint32W 7759B4B5 5 Bytes JMP 001D0670
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!GetTextFaceW 7759B73A 2 Bytes JMP 001D0D30
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!GetTextFaceW + 3 7759B73D 2 Bytes [C3, 88]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!GetFontData 7759BCC4 5 Bytes JMP 001D0C70
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!SetWorldTransform 7759C90A 5 Bytes JMP 001D06F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!CreateDCA 7759CCA9 5 Bytes JMP 001D00B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!CreateDCW 7759CF79 5 Bytes JMP 001D00F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!CreateICW 7759CFD0 5 Bytes JMP 001D0130
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!GetTextMetricsA 7759D0F2 5 Bytes JMP 001D0DF0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!Rectangle 7759F1E7 5 Bytes JMP 001D09B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!LineTo 7759F583 5 Bytes JMP 001D0430
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!SetICMMode 7759FA8C 5 Bytes JMP 001D0DB0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!ExtTextOutA 775A0D08 5 Bytes JMP 001D0930
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!GetTextExtentPoint32A 775A1167 5 Bytes JMP 001D0630
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!ExtEscape 775A2D31 5 Bytes JMP 001D02B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!Escape 775A33E8 5 Bytes JMP 001D0270
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!ResetDCW 775A3A83 5 Bytes JMP 001D0AB0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!EndPage 775A40C2 5 Bytes JMP 001D0230
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!SetPolyFillMode 775A67C9 5 Bytes JMP 001D0B30
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!SetMiterLimit 775A6985 5 Bytes JMP 001D0B70
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!GetTextFaceA 775B0D12 5 Bytes JMP 001D0CF0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!GetGlyphOutlineW 775BC32A 5 Bytes JMP 001D0CB0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!CreateScalableFontResourceW 775BE987 5 Bytes JMP 001D0BB0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!AddFontResourceW 775BED83 5 Bytes JMP 001D0BF0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!RemoveFontResourceW 775BF279 5 Bytes JMP 001D0C30
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!AbortDoc 775C4E79 5 Bytes JMP 001D0030
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!EndDoc 775C52C0 5 Bytes JMP 001D01F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!StartPage 775C53AB 5 Bytes JMP 001D0730
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!StartDocW 775C5DC6 5 Bytes JMP 001D07F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!BeginPath 775C656D 5 Bytes JMP 001D0830
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!SelectClipPath 775C65C4 5 Bytes JMP 001D0AF0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!CloseFigure 775C661F 5 Bytes JMP 001D0070
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!EndPath 775C6676 5 Bytes JMP 001D0A70
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!StrokePath 775C68A9 5 Bytes JMP 001D07B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!FillPath 775C6936 5 Bytes JMP 001D0870
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!PolylineTo 775C6DA4 5 Bytes JMP 001D04F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!PolyBezierTo 775C6E35 5 Bytes JMP 001D04B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] GDI32.dll!PolyDraw 775C6EE7 5 Bytes JMP 001D08B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ole32.dll!OleSetClipboard 77310045 5 Bytes JMP 004D0030
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ole32.dll!OleIsCurrentClipboard 773136B2 5 Bytes JMP 004D0070
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe[5888] ole32.dll!OleGetClipboard 7733FDCD 5 Bytes JMP 004D00B0
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Habe dann auch den Revo Uninstaller benutzt und den einen Attention-Eintrag gelöscht.
Jetzt kann ich mich wenigstens einloggen.
Damals ging es jetzt mit Combofix weiter, aber da gehe ich ohne Anweisung nicht ran!
Wenns mir nicht so peinlich wäre, solche verlausten :piggi: Rechner hier vorzustellen, würde ich sagen, dass es fast Spaß macht, mit Euch zu arbeiten.
Danke schon einmal vorab
kiki-berlin |
AdwCleaner auf deinen Desktop.
FRST 32-Bit | FRST 64-Bit
Malwarebytes Anti-Malware 
