| lolofufu | 05.12.2014 02:26 |
Win7 64bit - Spyware.Zbot.ED bzw. HEUR/QVM03.0.Malware.Gen gefunden durch Malwarebytes bzw. 360 Internet Security
Hallo zusammen,
ich hab vor ein paar Stunden mit Malwarebytes etwas gefunden, was sich nicht entfernen lässt.
In der Registry ist ein Eintrag, der sich auf eine exe-Datei in C:\ProgramData\******.exe bezieht. Wenn man den Eintrag und die Datei löscht, werden diese sofort wieder unter einem anderen 6-digit langen Namen erstellt. https://dl.dropboxusercontent.com/u/...alware.Gen.jpg
Anbei die bisherigen Logs: Code:
Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 05.12.2014
Scan Time: 00:57:38
Logfile: mbam_log_20141205_1.txt
Administrator: Yes
Version: 2.00.4.1028
Malware Database: v2014.12.04.11
Rootkit Database: v2014.12.03.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: FUL
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 370671
Time Elapsed: 5 min, 59 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
Processes: 0
(No malicious items detected)
Modules: 0
(No malicious items detected)
Registry Keys: 0
(No malicious items detected)
Registry Values: 1
Spyware.Zbot.ED, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|cjsdbs, C:\ProgramData\cjsdbs.exe, , [cf0cbaa4225ad1655de67d17c73e9d63]
Registry Data: 0
(No malicious items detected)
Folders: 0
(No malicious items detected)
Files: 1
Spyware.Zbot.ED, C:\ProgramData\cjsdbs.exe, , [cf0cbaa4225ad1655de67d17c73e9d63],
Physical Sectors: 0
(No malicious items detected)
(end)
- Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03
-12-2014
Ran by FUL (administrator) on UX32VD on 05-12-2014 01:50:10
Running from C:\Users\FUL\Downloads
Loaded Profiles: FUL & UpdatusUser (Available profiles: FUL &
UpdatusUser)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language:
Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool:
hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-
farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed.
The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D
Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display
\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK
Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device
Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Windows\SysWOW64\DptfParticipantProcessorService.exe
() C:\Windows\SysWOW64\DptfPolicyConfigTDPService.exe
(Diskeeper Corporation) C:\Program Files\Diskeeper Corporation
\ExpressCache\ExpressCache.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client
\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management
Engine Components\DAL\Jhi_service.exe
(Samsung Electronics Co., Ltd.) C:\Windows\System32\RAPID
\SamsungRapidSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search &
Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search &
Destroy 2\SDUpdSvc.exe
(Rocket Division Software) C:\Program Files (x86)\Alcohol Soft\Alcohol
120\StarWind\StarWindServiceAE.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search &
Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK
Hotkey\HControl.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus
\USBChargerPlus.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package
\ATKOSD2\ATKOSD2.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\RAPID
\CacheFilter\SamsungRapidApp.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet
Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet
Services\ApplePhotoStreams.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Canon Inc.) C:\Program Files (x86)\Canon\SELPHY Photo Print
\CIC_SPPhelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0
eXtensible Host Controller Driver\Application\iusb3mon.exe
(Dropbox, Inc.) C:\Users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK
Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey
\HControlUser.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files
\Adobe\ARM\1.0\AdobeARM.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat
10.0\Acrobat\acrotray.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(CANON INC.) C:\Program Files (x86)\Canon\Canon IJ Network Scan
Utility\CNMNSUT.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java
Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search &
Destroy 2\SDTray.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display
\nvtray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter
\x64\AsusTPLoader.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart
Gesture\QuickGesture\x64\QuickGesture64.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart
Gesture\QuickGesture\x86\QuickGesture.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter
\x64\AsusTPCenter.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter
\x64\AsusTPHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management
Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management
Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA
Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management
Engine Components\UNS\UNS.exe
(Qihu 360 Software Co., Ltd.) C:\Program Files\360\360 Internet
Security\deepscan\QHActiveDefense.exe
(Qihu 360 Software Co., Ltd.) C:\Program Files\360\360 Internet
Security\360sd.exe
(Qihu 360 Software Co., Ltd.) C:\Program Files\360\360 Internet
Security\360rp.exe
(Qihu 360 Software Co., Ltd.) C:\Program Files\360\360 Internet
Security\safemon\360Tray.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple
Application Support\APSDaemon.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer
\iexplore.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-
Malware\mbam.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be
restored to default or removed. The file will not be moved.)
HKLM\...\Run: [DptfPolicyLpmServiceHelper] => C:\Windows
\SysWOW64\DptfPolicyLpmServiceHelper.exe
HKLM\...\Run: [SamsungRapidApp] => C:\Program Files (x86)\Samsung
\RAPID\CacheFilter\SamsungRapidApp.exe [109280 2013-07-29] (Samsung
Electronics Co., Ltd.)
HKLM\...\Run: [360sd] => C:\Program Files\360\360 Internet Security
\360sdrun.exe [287560 2014-04-16] (Qihu 360 Software Co., Ltd.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R)
USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
[291648 2012-05-21] (Intel Corporation)
HKLM-x32\...\Run: [ATKOSD2] => C:\Program Files (x86)\ASUS\ATK
Package\ATKOSD2\ATKOSD2.exe [406328 2013-09-09] (ASUSTek Computer
Inc.)
HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK
Package\ATK Media\DMedia.exe [205624 2013-05-30] (ASUSTek Computer
Inc.)
HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK
Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files
\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems
Incorporated)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files
(x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41336 2014-05-08]
(Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files
(x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840568 2014-05-08]
(Adobe Systems Inc.)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX
Update\DivXUpdate.exe [1861968 2014-01-10] ()
HKLM-x32\...\Run: [IJNetworkScanUtility] => C:\Program Files
(x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe [206240 2010-08
-24] (CANON INC.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files
(x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25]
(Oracle Corporation)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes
\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search &
Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\...\RunOnce: [Malwarebytes Anti-Malware (cleanup)] => C:
\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\mbamdor.exe [54072
2014-11-21] (Malwarebytes Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel
Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-965061589-1977914162-274574225-1000\...\Run:
[iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet
Services\iCloudServices.exe [43816 2014-08-07] (Apple Inc.)
HKU\S-1-5-21-965061589-1977914162-274574225-1000\...\Run:
[ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple
\Internet Services\ApplePhotoStreams.exe [43816 2014-08-14] (Apple
Inc.)
HKU\S-1-5-21-965061589-1977914162-274574225-1000\...\Run:
[GoogleDriveSync] => C:\Program Files (x86)\Google\Drive
\googledrivesync.exe [22869088 2014-10-21] (Google)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows
\system32\nvinitx.dll [247144 2012-08-01] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows
\SysWOW64\nvinit.dll [202600 2012-08-01] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
\SELPHY Photo Print Launcher.lnk
ShortcutTarget: SELPHY Photo Print Launcher.lnk -> C:\Program Files
(x86)\Canon\SELPHY Photo Print\CIC_SPPhelper.exe (Canon Inc.)
Startup: C:\Users\FUL\AppData\Roaming\Microsoft\Windows\Start Menu
\Programs\Startup\CC-Bewegungen Europaeische Reisevers
vsnr407019265DEU.pdf - Verknüpfung.lnk
ShortcutTarget: CC-Bewegungen Europaeische Reisevers
vsnr407019265DEU.pdf - Verknüpfung.lnk -> C:\Users\FUL\Desktop\CC-
Bewegungen Europaeische Reisevers vsnr407019265DEU.pdf ()
Startup: C:\Users\FUL\AppData\Roaming\Microsoft\Windows\Start Menu
\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\FUL\AppData\Roaming\Dropbox
\bin\Dropbox.exe (Dropbox, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it
will be removed or restored to default.)
HKU\S-1-5-21-965061589-1977914162-274574225-1000\Software\Microsoft
\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKU\S-1-5-21-965061589-1977914162-274574225-1000\Software\Microsoft
\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com
SearchScopes: HKLM-x32 -> DefaultScope value is missing.
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-
D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle
Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-
42B3008E02FF} -> C:\Program Files\Microsoft Office
\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: SafeMon Class -> {B69F34DD-F0F9-42DC-9EDD-957187DA688D} -> C:
\Program Files\360\360 Internet Security\safemon\safemon64.dll (Qihu
360 Software Co., Ltd.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-
9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle
Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-
D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle
Corporation)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-
8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe
\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-
42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office
\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Free Download Manager -> {CC59E0F9-7E43-44FA-9FAA-
8377850BF205} -> C:\Program Files (x86)\Free Download Manager
\iefdm2.dll (FreeDownloadManager.ORG)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-
9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
(Oracle Corporation)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077}
-> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX
\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93}
- C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX
\AcroIEFavClient.dll (Adobe Systems Incorporated)
Hosts: There are more than one entry in Hosts. See Hosts section of
Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\FUL\AppData\Roaming\Mozilla\Firefox\Profiles
\15j8bd6f.default
FF NetworkProxy: "socks_remote_dns", true
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed
\Flash\NPSWF64_15_0_0_239.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program
Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files
\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files
\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:
\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed
\Flash\NPSWF32_15_0_0_239.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files
(x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program
Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files
(x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42
-> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components
\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:
\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT
\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files
(x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program
Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:
\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:
\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA
Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files
(x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA
Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program
Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program
Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat
10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Avira Browser Safety - C:\Users\FUL\AppData\Roaming
\Mozilla\Firefox\Profiles\15j8bd6f.default\Extensions\abs@avira.com
[2014-11-20]
FF Extension: FoxyProxy Standard - C:\Users\FUL\AppData\Roaming
\Mozilla\Firefox\Profiles\15j8bd6f.default\Extensions
\foxyproxy@eric.h.jung [2014-09-07]
FF Extension: DownloadHelper - C:\Users\FUL\AppData\Roaming\Mozilla
\Firefox\Profiles\15j8bd6f.default\Extensions\{b9db16a4-6edc-47ec-
a1f4-b86292ed211d} [2014-09-07]
FF HKLM-x32\...\Firefox\Extensions:
[web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe
\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files
(x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2014-03-26]
FF Extension: Free Download Manager plugin - C:\ProgramData\Free
Download Manager\Firefox\Extensions\1.6.0.8 [2014-11-23]
FF Extension: No Name - web2pdfextension@web2pdf.adobedotcom [Not
Found]
FF Extension: No Name - fdm_ffext@freedownloadmanager.org [Not Found]
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk]
- No Path
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed
from the registry. The file will not be moved unless listed
separately.)
S2 360rp; C:\Program Files\360\360 Internet Security\360rps.exe
[310352 2014-04-16] (Qihu 360 Software Co., Ltd.)
R2 DptfParticipantProcessorService; C:\Windows
\SysWOW64\DptfParticipantProcessorService.exe [18944 2012-02-20] ()
R2 DptfPolicyConfigTDPService; C:\Windows
\SysWOW64\DptfPolicyConfigTDPService.exe [19968 2012-02-20] ()
R2 ExpressCache; C:\Program Files\Diskeeper Corporation\ExpressCache
\ExpressCache.exe [79664 2012-03-30] (Diskeeper Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R)
Management Engine Components\FWService\IntelMeFWService.exe [129856
2012-06-27] (Intel Corporation)
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin
\iumsvc.exe [174368 2014-02-28] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management
Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel
Corporation)
R2 SamsungRapidSvc; C:\Windows\System32\RAPID\SamsungRapidSvc.exe
[27360 2013-07-29] (Samsung Electronics Co., Ltd.)
S3 scan; C:\Program Files\360\360 Internet Security\scan.dll [420424
2014-04-25] (S.C. BitDefender S.R.L)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy
2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy
2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy
2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 StarWindServiceAE; C:\Program Files (x86)\Alcohol Soft\Alcohol
120\StarWind\StarWindServiceAE.exe [275968 2007-05-28] (Rocket
Division Software) [File not signed]
R2 ZhuDongFangYu; C:\Program Files\360\360 Internet Security\deepscan
\QHActiveDefense.exe [236360 2014-04-23] (Qihu 360 Software Co., Ltd.)
S4 AntiVirWebService; "C:\Program Files (x86)\Avira\AntiVir Desktop
\avwebg7.exe" [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed
from the registry. The file will not be moved unless listed
separately.)
R1 360AntiHacker; C:\Windows\System32\Drivers\360AntiHacker64.sys
[97872 2014-04-21] (Qihu 360 Software Co., Ltd.)
R3 360AvFlt; C:\Windows\System32\DRIVERS\360AvFlt.sys [67664 2014-04-
23] (Qihu 360 Software Co., Ltd.)
R1 360Box64; C:\Windows\System32\DRIVERS\360Box64.sys [305744 2014-04
-29] (Qihu 360 Software Co., Ltd.)
S1 360Camera; C:\Windows\System32\Drivers\360Camera64.sys [41552 2014
-04-29] (Qihu 360 Software Co., Ltd.)
R1 360fsflt; C:\Windows\System32\DRIVERS\360FsFlt.sys [304208 2014-05
-07] (Qihu 360 Software Co., Ltd.)
R3 ATP; C:\Windows\System32\DRIVERS\AsusTP.sys [65784 2013-02-06]
(ASUS Corporation)
S3 AX88772B; C:\Windows\System32\DRIVERS\ax88772b.sys [110592 2012-04
-05] (ASIX Electronics Corp.)
U1 BAPIDRV; C:\Windows\System32\DRIVERS\BAPIDRV64.sys [180816 2014-04
-18] (Qihu 360 Software Co., Ltd.)
R3 DptfDevDram; C:\Windows\System32\DRIVERS\DptfDevDram.sys [107288
2012-02-20] (Intel Corporation)
R3 DptfDevFan; C:\Windows\System32\DRIVERS\DptfDevFan.sys [42776 2012
-02-20] (Intel Corporation)
R3 DptfDevGen; C:\Windows\System32\DRIVERS\DptfDevGen.sys [64792 2012
-02-20] (Intel Corporation)
R3 DptfDevPch; C:\Windows\System32\DRIVERS\DptfDevPch.sys [96024 2012
-02-20] (Intel Corporation)
R3 DptfDevProc; C:\Windows\System32\DRIVERS\DptfDevProc.sys [220952
2012-02-20] (Intel Corporation)
R3 DptfManager; C:\Windows\System32\DRIVERS\DptfManager.sys [357656
2012-02-20] (Intel Corporation)
R1 excfs; C:\Windows\System32\DRIVERS\excfs.sys [23344 2012-03-30]
(Diskeeper Corporation)
R0 excsd; C:\Windows\System32\DRIVERS\excsd.sys [95024 2012-03-30]
(Diskeeper Corporation)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28656 2013-03-25]
(Intel Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys
[129752 2014-12-05] (Malwarebytes Corporation)
U0 oiuexy; C:\Windows\System32\drivers\xppby.sys [79064 2014-12-05]
(Malwarebytes Corporation)
R0 SamsungRapidDiskFltr; C:\Windows\System32\DRIVERS
\SamsungRapidDiskFltr.sys [240864 2013-07-29] (Samsung Electronics
Co., Ltd.)
R0 SamsungRapidFSFltr; C:\Windows\System32\DRIVERS
\SamsungRapidFSFltr.sys [111328 2013-07-29] (Samsung Electronics Co.,
Ltd.)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14]
(Brother Industries Ltd.)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-03-26]
(Duplex Secure Ltd.)
R1 UimBus; C:\Windows\System32\DRIVERS\UimBus.sys [102664 2014-01-23]
()
R1 Uim_DEVIM; C:\Windows\System32\DRIVERS\uim_devim.sys [25992 2014-
01-23] ()
R1 Uim_IM; C:\Windows\System32\DRIVERS\uim_im.sys [700680 2014-01-23]
()
U3 ahkhhxz2; C:\Windows\System32\Drivers\ahkhhxz2.sys [0 ] (Advanced
Micro Devices)
S1 {2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64; system32\drivers
\{2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the
registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be
moved.)
2014-12-05 01:50 - 2014-12-05 01:50 - 00021716 _____ () C:\Users\FUL
\Downloads\FRST.txt
2014-12-05 01:50 - 2014-12-05 01:50 - 00000000 ____D () C:\FRST
2014-12-05 01:49 - 2014-12-05 01:49 - 02117632 _____ (Farbar) C:
\Users\FUL\Downloads\FRST64.exe
2014-12-05 01:49 - 2014-12-05 01:49 - 00000000 ____D () C:\Users\FUL
\Desktop\trojanerboard
2014-12-05 01:11 - 2014-12-05 01:11 - 00143360 _____ (1999-2010 White
Shift HatIt Kream) C:\ProgramData\djsdbs.exe
2014-12-05 01:09 - 2014-12-05 01:09 - 00050477 _____ () C:\Users\FUL
\Downloads\Defogger.exe
2014-12-05 01:04 - 2014-12-05 01:04 - 00079064 _____ (Malwarebytes
Corporation) C:\Windows\system32\Drivers\xppby.sys
2014-12-05 00:57 - 2009-06-10 22:00 - 00000824 _____ () C:\Windows
\system32\Drivers\etc\hosts.20141205-005700.backup
2014-12-05 00:39 - 2014-05-14 10:40 - 00022992 _____ (Qihu 360
Software Co., Ltd.) C:\Windows\system32\Drivers\efimon.sys
2014-12-05 00:38 - 2014-12-05 01:49 - 00000000 ____D () C:\Users\FUL
\AppData\Roaming\360safe
2014-12-05 00:38 - 2014-12-05 00:38 - 00000974 _____ () C:\Users
\Public\Desktop\360 Internet Security.lnk
2014-12-05 00:38 - 2014-12-05 00:38 - 00000000 _RSHD () C:\360SANDBOX
2014-12-05 00:38 - 2014-12-05 00:38 - 00000000 ____D () C:\Users\FUL
\AppData\Roaming\360SD
2014-12-05 00:38 - 2014-12-05 00:38 - 00000000 ____D () C:
\ProgramData\Microsoft\Windows\Start Menu\Programs\360 Internet
Security
2014-12-05 00:38 - 2014-12-05 00:38 - 00000000 ____D () C:
\ProgramData\360SD
2014-12-05 00:38 - 2014-12-05 00:38 - 00000000 ____D () C:\Program
Files\360
2014-12-05 00:38 - 2014-05-07 10:44 - 00304208 _____ (Qihu 360
Software Co., Ltd.) C:\Windows\system32\Drivers\360FsFlt.sys
2014-12-05 00:38 - 2014-04-29 07:20 - 00305744 _____ (Qihu 360
Software Co., Ltd.) C:\Windows\system32\Drivers\360Box64.sys
2014-12-05 00:38 - 2014-04-29 04:50 - 00041552 _____ (Qihu 360
Software Co., Ltd.) C:\Windows\system32\Drivers\360Camera64.sys
2014-12-05 00:38 - 2014-04-23 09:32 - 00067664 _____ (Qihu 360
Software Co., Ltd.) C:\Windows\system32\Drivers\360AvFlt.sys
2014-12-05 00:38 - 2014-04-21 07:38 - 00097872 _____ (Qihu 360
Software Co., Ltd.) C:\Windows\system32\Drivers\360AntiHacker64.sys
2014-12-05 00:38 - 2014-04-18 07:42 - 00180816 _____ (Qihu 360
Software Co., Ltd.) C:\Windows\system32\Drivers\BAPIDRV64.SYS
2014-12-05 00:18 - 2014-12-05 00:18 - 00000753 _____ () C:\Users\FUL
\Desktop\JRT.txt
2014-12-05 00:13 - 2014-12-05 00:13 - 00000000 ____D () C:\Windows
\ERUNT
2014-12-05 00:06 - 2014-12-05 00:13 - 00000000 ____D () C:
\ProgramData\HitmanPro
2014-12-04 23:55 - 2014-12-05 00:03 - 00000000 ____D () C:\AdwCleaner
2014-12-04 22:41 - 2014-12-04 22:41 - 00000000 ____D () C:\OETemp
2014-12-04 22:40 - 2014-12-04 22:40 - 00000000 _____ () C:
\ProgramData\rebootpending.txt
2014-12-04 22:36 - 2014-12-05 00:54 - 00000000 ____D () C:
\ProgramData\Spybot - Search & Destroy
2014-12-04 22:36 - 2014-12-04 22:39 - 00000000 ____D () C:\Program
Files (x86)\Spybot - Search & Destroy 2
2014-12-04 22:36 - 2014-12-04 22:36 - 00001391 _____ () C:
\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start
Center.lnk
2014-12-04 22:36 - 2014-12-04 22:36 - 00001379 _____ () C:\Users
\Public\Desktop\Spybot-S&D Start Center.lnk
2014-12-04 22:36 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking
Limited) C:\Windows\system32\sdnclean64.exe
2014-12-04 22:34 - 2014-12-04 22:38 - 168558440 _____ (Qihu 360
Software Co., Ltd.) C:\Users\FUL\Downloads\360is_4.9.0.4902H.exe
2014-12-04 13:53 - 2014-12-05 00:57 - 00129752 _____ (Malwarebytes
Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-04 13:52 - 2014-12-04 13:52 - 00001102 _____ () C:\Users
\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-12-04 13:52 - 2014-12-04 13:52 - 00000000 ____D () C:
\ProgramData\Malwarebytes
2014-12-04 13:52 - 2014-12-04 13:52 - 00000000 ____D () C:\Program
Files (x86)\Malwarebytes Anti-Malware
2014-12-04 13:52 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes
Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-04 13:52 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes
Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-12-04 13:52 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes
Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-12-04 13:41 - 2014-12-04 13:42 - 46525608 _____ (Safer-Networking
Ltd. ) C:\Users\FUL\Downloads\spybot-2.4.exe
2014-12-04 13:40 - 2014-12-04 13:40 - 20447072 _____ (Malwarebytes
Corporation ) C:\Users\FUL\Downloads\mbam-setup-2.0.4.1028.exe
2014-12-02 23:41 - 2014-12-02 23:43 - 57358008 _____ (ZONER software )
C:\Users\FUL\Downloads\zps16_de_pro_chip.exe
2014-12-02 20:23 - 2014-12-02 20:23 - 00026729 _____ () C:\Users\FUL
\Downloads\Bluewolf495-40.rec[https___truestracker.de].torrent
2014-12-02 20:23 - 2014-12-02 20:23 - 00026729 _____ () C:\Users\FUL
\Downloads\Bluewolf495-39.rec[https___truestracker.de].torrent
2014-12-02 20:23 - 2014-12-02 20:23 - 00026529 _____ () C:\Users\FUL
\Downloads\Bluewolf438-44.rec[https___truestracker.de].torrent
2014-12-02 20:22 - 2014-12-02 20:22 - 00028189 _____ () C:\Users\FUL
\Downloads\Bluewolf596-13.rec[https___truestracker.de].torrent
2014-12-02 20:22 - 2014-12-02 20:22 - 00028168 _____ () C:\Users\FUL
\Downloads\Bluewolf596-7.rec[https___truestracker.de].torrent
2014-12-02 20:22 - 2014-12-02 20:22 - 00028028 _____ () C:\Users\FUL
\Downloads\Bluewolf596-8.rec[https___truestracker.de].torrent
2014-12-02 20:22 - 2014-12-02 20:22 - 00028009 _____ () C:\Users\FUL
\Downloads\Bluewolf596-14.rec[https___truestracker.de].torrent
2014-12-02 20:22 - 2014-12-02 20:22 - 00027950 _____ () C:\Users\FUL
\Downloads\Bluewolf596-8-2.rec[https___truestracker.de].torrent
2014-12-02 20:22 - 2014-12-02 20:22 - 00026669 _____ () C:\Users\FUL
\Downloads\Bluewolf438-42.rec[https___truestracker.de].torrent
2014-12-02 20:22 - 2014-12-02 20:22 - 00026489 _____ () C:\Users\FUL
\Downloads\Bluewolf438-41.rec[https___truestracker.de].torrent
2014-12-02 20:22 - 2014-12-02 20:22 - 00026349 _____ () C:\Users\FUL
\Downloads\Bluewolf438-43.rec[https___truestracker.de].torrent
2014-12-02 16:27 - 2014-12-02 16:27 - 02996728 _____ (Crystal Dew
World ) C:\Users\FUL\Downloads\CrystalDiskInfo6_2_1.exe
2014-12-02 16:27 - 2014-12-02 16:27 - 00001186 _____ () C:\Users\FUL
\Desktop\CrystalDiskInfo.lnk
2014-12-02 16:27 - 2014-12-02 16:27 - 00000000 ____D () C:\Program
Files (x86)\CrystalDiskInfo
2014-12-02 15:14 - 2014-12-02 15:19 - 00000000 ____D () C:\Users\FUL
\Desktop\FireTV
2014-12-01 14:12 - 2014-12-01 14:27 - 00000000 ____D () C:\Users\FUL
\AppData\Local\Amazon_FireTV_Utility_App
2014-12-01 14:11 - 2014-12-01 14:11 - 00000000 ____D () C:\Users\FUL
\.android
2014-11-30 16:19 - 2014-11-30 16:19 - 00000263 _____ () C:\Users\FUL
\Desktop\Musterschreiben%20R%C3%BCckforderung
%20Bearbeitungsentgelt_207294.log
2014-11-26 22:04 - 2014-11-26 22:04 - 00035849 _____ () C:\Users\FUL
\Downloads\Bluewolf494-22.rec[https___truestracker.de].torrent
2014-11-26 22:04 - 2014-11-26 22:04 - 00027048 _____ () C:\Users\FUL
\Downloads\Bluewolf600.rec[https___truestracker.de].torrent
2014-11-24 23:48 - 2014-11-24 23:48 - 00000000 ____D () C:\Program
Files (x86)\Mozilla Firefox
2014-11-08 21:27 - 2014-11-08 21:27 - 00000000 ____D () C:\Users
\Default\AppData\Local\Google
2014-11-08 21:27 - 2014-11-08 21:27 - 00000000 ____D () C:\Users
\Default User\AppData\Local\Google
2014-11-07 08:35 - 2014-11-07 08:35 - 01054912 _____ (Adobe) C:\Users
\FUL\Downloads\install_flashplayer15x32au_mssd_aaa_aih.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be
moved.)
2014-12-05 01:49 - 2014-06-12 10:51 - 00000884 _____ () C:\Windows
\Tasks\Adobe Flash Player Updater.job
2014-12-05 01:10 - 2014-03-24 22:11 - 00000000 ____D () C:\Users\FUL
\AppData\Local\VirtualStore
2014-12-05 01:04 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows
\Registration
2014-12-05 00:51 - 2014-03-28 14:12 - 00001110 _____ () C:\Windows
\Tasks\GoogleUpdateTaskMachineUA.job
2014-12-05 00:44 - 2014-03-25 07:06 - 00709888 _____ () C:\Windows
\system32\perfh007.dat
2014-12-05 00:44 - 2014-03-25 07:06 - 00153014 _____ () C:\Windows
\system32\perfc007.dat
2014-12-05 00:44 - 2009-07-14 06:13 - 01626984 _____ () C:\Windows
\system32\PerfStringBackup.INI
2014-12-05 00:42 - 2009-07-14 05:45 - 00026720 ____H () C:\Windows
\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-
439d-8115-601632D005A0
2014-12-05 00:42 - 2009-07-14 05:45 - 00026720 ____H () C:\Windows
\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-
439d-8115-601632D005A0
2014-12-05 00:40 - 2014-03-25 22:39 - 00000000 ___RD () C:\Users\FUL
\Desktop\Dropbox
2014-12-05 00:40 - 2014-03-25 22:36 - 00000000 ____D () C:\Users\FUL
\AppData\Roaming\Dropbox
2014-12-05 00:39 - 2014-09-23 11:37 - 00000000 ___RD () C:\Users\FUL
\Desktop\Google Drive
2014-12-05 00:38 - 2014-03-24 22:12 - 01293902 _____ () C:\Windows
\WindowsUpdate.log
2014-12-05 00:37 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows
\system32\sysprep
2014-12-05 00:36 - 2014-03-28 14:12 - 00001106 _____ () C:\Windows
\Tasks\GoogleUpdateTaskMachineCore.job
2014-12-05 00:35 - 2014-03-26 12:20 - 00000433 _____ () C:\Windows
\system32\Drivers\etc\hosts.ics
2014-12-05 00:35 - 2014-03-25 09:47 - 00000000 ____D () C:
\ProgramData\NVIDIA
2014-12-05 00:35 - 2010-11-21 04:47 - 00240388 _____ () C:\Windows
\PFRO.log
2014-12-05 00:35 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows
\Tasks\SA.DAT
2014-12-05 00:35 - 2009-07-14 05:51 - 00044551 _____ () C:\Windows
\setupact.log
2014-12-05 00:35 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows
\schemas
2014-12-05 00:05 - 2014-05-25 10:04 - 00000000 ____D () C:\Users\FUL
\Downloads\Malware remover
2014-12-04 23:48 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Vss
2014-12-04 22:41 - 2014-03-25 09:23 - 00000000 ____D () C:\Program
Files (x86)\Avira
2014-12-04 22:36 - 2009-07-14 04:20 - 00000000 ___RD () C:
\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools
2014-12-04 16:48 - 2014-03-24 22:11 - 00000000 ____D () C:\Users\FUL
2014-12-04 15:16 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows
\system
2014-12-04 15:15 - 2014-03-27 16:13 - 00000000 ____D () C:\Users\FUL
\AppData\Roaming\vlc
2014-12-04 12:02 - 2012-08-30 14:04 - 00000000 ____D () C:\Users\FUL
\Documents\Outlook-Dateien
2014-12-04 12:00 - 2014-03-28 23:38 - 00000000 ____D () C:\Users\FUL
\AppData\Local\4610B230-FA09-4F6C-BD9C-AE65706B9057.aplzod
2014-12-02 18:18 - 2014-03-28 10:37 - 00038912 _____ () C:\Users\FUL
\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-12-02 18:18 - 2014-03-28 10:28 - 00000000 ____D () C:\Users\FUL
\AppData\Local\ColdCut
2014-12-02 18:00 - 2014-03-20 11:28 - 00000000 ____D () C:\Users\FUL
\Desktop\UDOO
2014-12-01 14:26 - 2014-04-27 11:57 - 00000000 ____D () C:\Program
Files (x86)\Mozilla Maintenance Service
2014-11-30 16:22 - 2014-04-26 14:20 - 00000000 ____D () C:\Users\FUL
\AppData\Roaming\Free Download Manager
2014-11-25 23:49 - 2014-06-12 10:51 - 00003822 _____ () C:\Windows
\System32\Tasks\Adobe Flash Player Updater
2014-11-25 23:49 - 2014-03-26 12:18 - 00701104 _____ (Adobe Systems
Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-11-25 23:49 - 2014-03-26 12:18 - 00071344 _____ (Adobe Systems
Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-11-24 19:02 - 2014-03-25 22:53 - 00000000 ____D () C:\Users\FUL
\AppData\Roaming\uTorrent
2014-11-18 15:08 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows
\system32\FxsTmp
2014-11-18 10:46 - 2014-03-28 14:12 - 00004106 _____ () C:\Windows
\System32\Tasks\GoogleUpdateTaskMachineUA
2014-11-18 10:46 - 2014-03-28 14:12 - 00003854 _____ () C:\Windows
\System32\Tasks\GoogleUpdateTaskMachineCore
2014-11-13 11:07 - 2014-03-28 09:27 - 00000000 ____D () C:\Users\FUL
\AppData\Local\Apple Computer
2014-11-13 04:48 - 2014-09-23 18:31 - 00000000 ____D () C:\Users\FUL
\Desktop\iPad mini Backup 2014.09.23
2014-11-10 09:59 - 2013-08-23 11:36 - 00000000 ____D () C:\Users\FUL
\Documents\#Vorlagen
2014-11-08 21:28 - 2014-09-23 11:36 - 00000000 ____D () C:
\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
Files to move or delete:
====================
C:\ProgramData\djsdbs.exe
Some content of TEMP:
====================
C:\Users\FUL\AppData\Local\Temp\avgnt.exe
C:\Users\FUL\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-
5766-8f84-3e3e7ecf0d81}.tmpfpurdx.dll
C:\Users\FUL\AppData\Local\Temp\JDSetup130429822500280238.exe
C:\Users\FUL\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\FUL\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe
C:\Users\FUL\AppData\Local\Temp\ose00000.exe
C:\Users\FUL\AppData\Local\Temp\paint.net.4.0.3.install.exe
C:\Users\FUL\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-12-05 01:29
==================== End Of Log ============================
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03
-12-2014
Ran by FUL at 2014-12-05 01:50:41
Running from C:\Users\FUL\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: 360 Internet Security (Enabled - Up to date) {2B66EE1E-E5C8-C2F7-
648F-4E55AC68D37D}
AS: 360 Internet Security (Enabled - Up to date) {90070FFA-C3F2-CD79-
5E3F-7527D7EF99C0}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44
-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-
3CCA-732D-A930-C1CA5F20A4B0}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the
fixlist to unhide them. The adware programs should be uninstalled
manually.)
360 Internet Security (HKLM-x32\...\360 Internet Security) (Version:
4.9.0.4902 - Qihu 360 Software Co., Ltd.)
Adobe Acrobat X Pro - English, Français, Deutsch (HKLM-x32\...
\{AC76BA86-1033-F400-7760-000000000005}) (Version: 10.1.10 - Adobe
Systems)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 13.0.0.111 - Adobe
Systems Incorporated)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player
ActiveX) (Version: 15.0.0.239 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin)
(Version: 15.0.0.239 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-
7C0453561701}) (Version: 3.0.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{B678797F-DF38-4556-8A31-
8B818E261868}) (Version: 8.0.0.23 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-
F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ASUS Smart Gesture (HKLM-x32\...\{4D3286A6-F6AB-498A-82A4-
E4F040529F3D}) (Version: 2.0.1 - ASUS)
ASUS USB Charger Plus (HKLM-x32\...\{A859E3E5-C62F-4BFA-AF1D-
2B95E03166AF}) (Version: 2.1.4 - ASUS)
ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE})
(Version: 1.0.0031 - ASUS)
AX88772B Windows 7 Drivers (HKLM-x32\...\InstallShield_{54A168C9-2250
-4058-80EB-1F4A4192548A}) (Version: 1.0.2.0 - ASIX Electronics
Corporation)
AX88772B Windows 7 Drivers (x32 Version: 1.0.2.0 - ASIX Electronics
Corporation) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version:
3.0.0.10 - Apple Inc.)
Canon IJ Network Scan Utility (HKLM-x32\...
\Canon_IJ_Network_Scan_UTILITY) (Version: - )
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY)
(Version: 3.1.1 - Canon Inc.)
Canon MG6100 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-
FFDB8040B7BF}_Canon_MG6100_series) (Version: - Canon Inc.)
Canon MP Navigator EX 4.0 (HKLM-x32\...\MP Navigator EX 4.0) (Version:
- )
Canon SELPHY CP800 (HKLM\...\Canon SELPHY CP800) (Version: - )
Canon Utilities SELPHY Photo Print (HKLM-x32\...\SELPHY Photo Print)
(Version: 1.2.0.7 - Canon Inc.)
Canon Utilities SELPHY Print Contents 1.1.0 (HKLM-x32\...\SELPHY Print
Contents 110) (Version: 1.1.0.16 - Canon Inc.)
CPUID CPU-Z 1.69 (HKLM\...\CPUID CPU-Z_is1) (Version: - )
CrystalDiskInfo 6.2.1 (HKLM-x32\...\CrystalDiskInfo_is1) (Version:
6.2.1 - Crystal Dew World)
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.100 - DivX, LLC)
Dropbox (HKU\S-1-5-21-965061589-1977914162-274574225-1000\...\Dropbox)
(Version: 2.10.52 - Dropbox, Inc.)
ExpressCache (HKLM\...\{FF607B1F-A78B-4F1D-BC8E-6C2AB3B75405})
(Version: 1.0.87 - Diskeeper Corporation)
ffdshow [rev 2946] [2009-05-15] (HKLM-x32\...\ffdshow_is1) (Version:
1.0 - )
ffdshow x64 v1.3.4500 [2013-01-06] (HKLM\...\ffdshow64_is1) (Version:
1.3.4500.0 - )
Free Download Manager 3.9.3 (HKLM-x32\...\Free Download Manager_is1)
(Version: - FreeDownloadManager.ORG)
Google Calendar Sync (HKLM-x32\...\Google Calendar Sync) (Version: -
)
Google Drive (HKLM-x32\...\{C60F3836-333A-4AE2-B526-CFDBA143A9BA})
(Version: 1.18.7821.2489 - Google, Inc.)
Google Outlook Contact Sync 0.9.1.0 (HKLM-x32\...\{3D6E90E1-602D-48C8
-BBD2-28D1E183AE50}_is1) (Version: - Daniel Polistchuck)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
iCloud (HKLM\...\{6096C0CC-7E19-4355-87F0-627EC5AA146D}) (Version:
4.0.3.56 - Apple Inc.)
Intel(R) Dynamic Platform & Thermal Framework (HKLM-x32\...\FFD10ECE-
F715-4a86-9BD8-F6F47DA5DA1C) (Version: 6.0.1.1067 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-
43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-
B9AC9A5886EA}) (Version: 9.17.10.2828 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...
\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel
Corporation)
Intel(R) Update Manager (HKLM-x32\...\{12914061-EB9B-4AE7-AC7E-
0B8A607C7DF4}) (Version: 2.3.1338 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...
\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.5.235 - Intel
Corporation)
iTunes (HKLM\...\{F46AA0F1-E284-4878-A462-5F11B9166C0E}) (Version:
11.4.0.18 - Apple Inc.)
Java 7 Update 55 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-
2F86417055FF}) (Version: 7.0.550 - Oracle)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF})
(Version: 7.0.670 - Oracle)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...
\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes
Corporation)
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-
45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft
Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-
CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Professional 2010 (HKLM-x32\...\Office14.SingleImage)
(Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-
02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft
Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...
\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 -
Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-
x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 -
Microsoft Corporation)
Mozilla Firefox 33.1.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.1.1
(x86 de)) (Version: 33.1.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService)
(Version: 29.0.1 - Mozilla)
Mp3tag v2.59a (HKLM-x32\...\Mp3tag) (Version: v2.59a - Florian
Heidenreich)
NVIDIA 3D Vision Treiber 305.46 (HKLM\...\{B2FE1952-0186-46C3-BAEC-
A80AA35AC5B8}_Display.3DVision) (Version: 305.46 - NVIDIA Corporation)
NVIDIA Grafiktreiber 305.46 (HKLM\...\{B2FE1952-0186-46C3-BAEC-
A80AA35AC5B8}_Display.Driver) (Version: 305.46 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.12.0613 (HKLM\...\{B2FE1952-0186-46C3-
BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.0613 - NVIDIA
Corporation)
NVIDIA Update 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
_Display.Update) (Version: 1.10.8 - NVIDIA Corporation)
paint.net (HKLM\...\{F509C1F4-0029-49F9-B145-A4C4E8DF481A}) (Version:
4.0.3 - dotPDN LLC)
Paragon Backup & Recovery™ 2014 Free (HKLM\...\{C268B5E1-A5DA-11DF-
A289-005056C00008}) (Version: 90.00.0003 - Paragon Software)
Paragon Partition Manager™ 2014 Free (HKLM-x32\...\{47E5588F-C3A0-
11DE-9857-005056C00008}) (Version: 90.00.0003 - Paragon Software)
Passbild-Generator v4.0a (HKLM-x32\...\Passbild-Generator_is1)
(Version: - Passbild-Generator)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
RAPID Mode (Version: 1.0.1.42 - Samsung Electronics Co., Ltd.) Hidden
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-
1091A8127911}) (Version: 6.1.7601.39025 - Realtek Semiconductor Corp.)
Saal Design Software (HKLM-x32\...\SaalDesignSoftware) (Version:
3.2.30 - Saal Digital Fotoservice GmbH)
Saal Design Software (x32 Version: 3.2.30 - Saal Digital Fotoservice
GmbH) Hidden
Samsung Magician (HKLM-x32\...\{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}
_is1) (Version: 4.3.0 - Samsung Electronics)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition
(HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}
_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B})
(Version: - Microsoft)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-
FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VLC media player 2.1.4 (HKLM\...\VLC media player) (Version: 2.1.4 -
VideoLAN)
Windows-Treiberpaket - ASUS (ATP) Mouse (01/10/2013 1.0.0.170) (HKLM
\...\4A9DE1E9EBC800B7F01739D4DE7363EF6751BDF5) (Version: 01/10/2013
1.0.0.170 - ASUS)
WinRAR 5.01 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 -
win.rar GmbH)
==================== Custom CLSID (selected items):
==========================
(If an entry is included in the fixlist, it will be removed from
registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes
\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:
\Users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes
\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:
\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox,
Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes
\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:
\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox,
Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes
\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:
\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox,
Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes
\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:
\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox,
Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes
\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:
\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox,
Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes
\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:
\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox,
Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes
\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:
\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox,
Inc.)
CustomCLSID: HKU\S-1-5-21-965061589-1977914162-274574225-1000_Classes
\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:
\Users\FUL\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox,
Inc.)
==================== Restore Points =========================
01-12-2014 13:55:28 Geplanter Prüfpunkt
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset
Hosts.)
2009-07-14 03:34 - 2014-12-05 00:57 - 00450771 ____R C:\Windows
\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com
There are 1000 more lines.
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from
registry. Any associated file could be listed separately to be moved.)
Task: {3F51DDB9-03FD-425D-9FBE-9871E08E0609} - System32\Tasks\ATKOSD2
=> C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [2013-
09-09] (ASUSTek Computer Inc.)
Task: {57440847-8931-4450-A8E6-89CA3200B9AD} - System32\Tasks\ASUS USB
Charger Plus => C:\Program Files (x86)\ASUS\USBChargerPlus
\USBChargerPlus.exe [2012-07-24] (ASUSTek Computer Inc.)
Task: {6883AAF1-063F-4CDD-A85C-0B05CD0F9660} - System32\Tasks\IUM-
F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel
\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
Task: {6EE8C071-A3CF-40E9-A891-017AEA220B66} - System32\Tasks
\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update
\GoogleUpdate.exe [2014-03-28] (Google Inc.)
Task: {A28E8D22-1470-49EF-9E80-CE024C8B15E8} - System32\Tasks\ASUS
Touchpad Launcher (x64) => C:\Program Files (x86)\ASUS\ASUS Smart
Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2013-02-06] (AsusTek)
Task: {C87CCA25-AC66-4726-91B6-E93A789FDBD5} - System32\Tasks\Adobe
Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash
\FlashPlayerUpdateService.exe [2014-11-25] (Adobe Systems
Incorporated)
Task: {D816101D-1253-48DA-ACF9-0FF69BD9DA3A} - System32\Tasks\IUM-
F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => C:\Program Files
(x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
Task: {E4B3F530-CCB5-418E-A57E-38547223F637} - System32\Tasks
\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update
\GoogleUpdate.exe [2014-03-28] (Google Inc.)
Task: {ED6F1B18-66E6-4706-9523-979356F19BCE} - System32\Tasks
\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start
osppsvc
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows
\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program
Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program
Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2014-03-25 09:47 - 2012-07-31 17:25 - 00086888 _____ () C:\Program
Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-03-25 09:17 - 2012-02-20 11:31 - 00018944 _____ () C:\Windows
\SysWOW64\DptfParticipantProcessorService.exe
2014-03-25 09:17 - 2012-02-20 11:31 - 00019968 _____ () C:\Windows
\SysWOW64\DptfPolicyConfigTDPService.exe
2014-03-25 09:16 - 2012-08-16 01:52 - 00094208 _____ () C:\Windows
\System32\IccLibDll_x64.dll
2014-01-10 06:26 - 2014-01-10 06:26 - 01861968 _____ () C:\Program
Files (x86)\DivX\DivX Update\DivXUpdate.exe
2014-02-12 20:58 - 2014-02-12 20:58 - 00073544 _____ () C:\Program
Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-12 20:58 - 2014-02-12 20:58 - 01044808 _____ () C:\Program
Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-12-04 22:36 - 2014-05-13 12:04 - 00109400 _____ () C:\Program
Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-12-04 22:36 - 2014-05-13 12:04 - 00416600 _____ () C:\Program
Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-12-04 22:36 - 2014-05-13 12:04 - 00167768 _____ () C:\Program
Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-12-04 22:36 - 2012-08-23 10:38 - 00574840 _____ () C:\Program
Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-12-04 22:36 - 2012-04-03 17:06 - 00565640 _____ () C:\Program
Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2006-10-31 17:53 - 2006-10-31 17:53 - 00270336 _____ () C:\Program
Files (x86)\Canon\SELPHY Photo Print\EnoJPEG4.dll
2014-12-05 00:36 - 2014-12-05 00:36 - 00043008 _____ () c:\users\ful
\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-
3e3e7ecf0d81}.tmpfpurdx.dll
2013-08-23 20:01 - 2013-08-23 20:01 - 25100288 _____ () C:\Users\FUL
\AppData\Roaming\Dropbox\bin\libcef.dll
2014-05-08 12:22 - 2014-05-08 12:22 - 00019968 _____ () C:\Program
Files (x86)\Adobe\Acrobat 10.0\Acrobat\locale\de_de\acrotray.deu
2014-01-10 06:28 - 2014-01-10 06:28 - 00100688 _____ () C:\Program
Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
2014-12-05 00:36 - 2014-12-05 00:36 - 00098816 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32api.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00110080 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\pywintypes27.dll
2014-12-05 00:36 - 2014-12-05 00:36 - 00364544 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\pythoncom27.dll
2014-12-05 00:36 - 2014-12-05 00:36 - 00045568 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\_socket.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 01160704 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\_ssl.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00320512 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32com.shell.shell.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00713216 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\_hashlib.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 01175040 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\wx._core_.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00805888 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\wx._gdi_.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00811008 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\wx._windows_.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 01062400 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\wx._controls_.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00735232 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\wx._misc_.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00128512 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\_elementtree.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00127488 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\pyexpat.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00557056 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\pysqlite2._sqlite.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00087552 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\_ctypes.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00119808 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32file.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00108544 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32security.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00007168 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\hashobjs_ext.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00167936 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32gui.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00018432 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32event.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00038912 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32inet.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00011264 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32crypt.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00070656 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\wx._html2.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00027136 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\_multiprocessing.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00035840 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32process.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00686080 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\unicodedata.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00122368 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\wx._wizard.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00024064 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32pipe.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00025600 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32pdh.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00525640 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\windows._lib_cacheinvalidation.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00010240 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\select.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00017408 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32profile.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00022528 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\win32ts.pyd
2014-12-05 00:36 - 2014-12-05 00:36 - 00078336 _____ () C:\Users\FUL
\AppData\Local\Temp\_MEI40042\wx._animate.pyd
2014-03-25 11:04 - 2012-06-25 10:41 - 01198912 _____ () C:\Program
Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2014-04-26 14:20 - 2013-10-25 20:58 - 00397312 _____ () C:\Program
Files (x86)\Free Download Manager\iefdmdm.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data
Streams will be removed.)
AlternateDataStreams: C:\Users\FUL\Desktop
\Bild.jpg:com.dropbox.attributes
AlternateDataStreams: C:\Users\FUL\Desktop
\IMG_3657.JPG:com.dropbox.attributes
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the
registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored.
None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-965061589-1977914162-274574225-500 -
Administrator - Disabled)
FUL (S-1-5-21-965061589-1977914162-274574225-1000 - Administrator -
Enabled) => C:\Users\FUL
Gast (S-1-5-21-965061589-1977914162-274574225-501 - Limited -
Disabled)
HomeGroupUser$ (S-1-5-21-965061589-1977914162-274574225-1002 - Limited
- Enabled)
UpdatusUser (S-1-5-21-965061589-1977914162-274574225-1003 - Limited -
Enabled) => C:\Users\UpdatusUser
==================== Faulty Device Manager Devices =============
Name: {2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64
Description: {2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: {2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64
Problem: : This device is not present, is not working properly, or
does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be
a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device,
and this error should be resolved.
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update
the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to
start the troubleshooting wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (12/05/2014 00:35:51 AM) (Source: WinMgmt) (EventID: 10) (User:
)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent
WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND
TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (12/05/2014 00:35:51 AM) (Source: Service Control Manager)
(EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist
fehlgeschlagen:
{2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64
Microsoft Office Sessions:
=========================
Error: (12/05/2014 00:35:51 AM) (Source: WinMgmt) (EventID: 10) (User:
)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent
WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND
TargetInstance.LoadPercentage > 990x80041003
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-3317U CPU @ 1.70GHz
Percentage of memory in use: 87%
Total physical RAM: 3981.57 MB
Available physical RAM: 481.2 MB
Total Pagefile: 4796.88 MB
Available Pagefile: 690.65 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:931.29 GB) (Free:184.89 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 059A1B33)
Partition: GPT Partition Type.
========================================================
Disk: 1 (Size: 22.4 GB) (Disk ID: 74F02DEA)
Partition 1: (Not Active) - (Size=22.4 GB) - (Type=73)
==================== End Of Log ============================
Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-12-05 02:52:00
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000079 ATA_____ rev.BB6Q 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\FUL\AppData\Local\Temp\pwldapob.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff80002fef000 45 bytes [00, 10, 00, 00, 00, 00, 00, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575 fffff80002fef02f 30 bytes [00, 00, 00, 00, 00, 00, 00, ...]
---- User code sections - GMER 2.1 ----
.text C:\Program Files\360\360 Internet Security\deepscan\QHActiveDefense.exe[1600] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files\360\360 Internet Security\deepscan\QHActiveDefense.exe[1600] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2324] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2324] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe[3088] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe[3088] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2632] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2632] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[4244] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[4244] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4360] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4360] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
? C:\Windows\system32\mssprxy.dll [4360] entry point in ".rdata" section 00000000731171e6
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[4484] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[4484] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4512] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4512] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe[3628] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe[3628] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Program Files\360\360 Internet Security\360sdUpd.exe[4372] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Program Files\360\360 Internet Security\360sdUpd.exe[4372] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
.text C:\Users\FUL\Downloads\Gmer-19357.exe[5608] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000777a1465 2 bytes [7A, 77]
.text C:\Users\FUL\Downloads\Gmer-19357.exe[5608] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777a14bb 2 bytes [7A, 77]
.text ... * 2
---- Devices - GMER 2.1 ----
Device \Driver\a79j3r5m \Device\Scsi\a79j3r5m1 fffffa8009a362c0
Device \FileSystem\Ntfs \Ntfs fffffa80043362c0
Device \FileSystem\fastfat \Fat fffffa8009df82c0
Device \Driver\iaStorA \Device\0000007a fffffa80043322c0
Device \Driver\usbehci \Device\USBPDO-1 fffffa80099b42c0
Device \Driver\iaStorA \Device\RaidPort0 fffffa80043322c0
Device \Driver\iaStorA \Device\00000079 fffffa80043322c0
Device \Driver\usbehci \Device\USBFDO-0 fffffa80099b42c0
Device \Driver\usbehci \Device\USBFDO-1 fffffa80099b42c0
Device \Driver\NetBT \Device\NetBT_Tcpip_{B659D313-2901-4231-AABD-2C0313B0EFF7} fffffa80094c62c0
Device \Driver\NetBT \Device\NetBt_Wins_Export fffffa80094c62c0
Device \Driver\iaStorA \Device\ScsiPort0 fffffa80043322c0
Device \Driver\usbehci \Device\USBPDO-0 fffffa80099b42c0
Device \Driver\a79j3r5m \Device\ScsiPort1 fffffa8009a362c0
---- Trace I/O - GMER 2.1 ----
Trace ntoskrnl.exe CLASSPNP.SYS disk.sys iaStorF.sys SamsungRapidDiskFltr.sys >>UNKNOWN [0xfffffa80043322c0]<< sptd.sys storport.sys hal.dll iaStorA.sys fffffa80043322c0
Trace 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80071da060] fffffa80071da060
Trace 3 CLASSPNP.SYS[fffff88001f2a43f] -> nt!IofCallDriver -> [0xfffffa80070db9f0] fffffa80070db9f0
Trace 5 iaStorF.sys[fffff88001bf4a2c] -> nt!IofCallDriver -> [0xfffffa80070dbde0] fffffa80070dbde0
Trace 7 SamsungRapidDiskFltr.sys[fffff88000c17ad1] -> nt!IofCallDriver -> \Device\00000079[0xfffffa8006fe29c0] fffffa8006fe29c0
Trace \Driver\iaStorA[0xfffffa80052cd6d0] -> IRP_MJ_CREATE -> 0xfffffa80043322c0 fffffa80043322c0
---- Modules - GMER 2.1 ----
Module \SystemRoot\System32\Drivers\a79j3r5m.SYS fffff8800f657000-fffff8800f69a000 (274432 bytes)
---- Processes - GMER 2.1 ----
Library C:\Users\FUL\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe [3752](2014-11-13 06:49:58) 0000000004060000
Library c:\users\ful\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpw216rf.dll (*** suspicious ***) @ C:\Users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe [3752](2014-12-05 01:49:14) 0000000004750000
Library C:\Users\FUL\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe [3752](2013-08-23 19:01:44) 00000000678b0000
Library C:\Users\FUL\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\FUL\AppData\Roaming\Dropbox\bin\Dropbox.exe [3752] (ICU Data DLL/The ICU Project)(2013-08-23 19:01:42) 0000000066f20000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\python27.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001e000000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32api.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001e8c0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\pywintypes27.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001e7a0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\pythoncom27.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000002c0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\_socket.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000000240000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\_ssl.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000010000000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32com.shell.shell.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001e800000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\_hashlib.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000001f60000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._core_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000002f40000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wxbase294u_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000003070000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wxbase294u_net_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000000280000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wxmsw294u_core_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000003260000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wxmsw294u_adv_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000003700000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._gdi_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000003840000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._windows_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000004150000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wxmsw294u_html_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000004220000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._controls_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000044e0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._misc_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000045f0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\_elementtree.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001d100000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\pyexpat.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000005b0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\pysqlite2._sqlite.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000042c0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\_ctypes.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001d1a0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32file.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001ea10000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32security.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001ec80000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\hashobjs_ext.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000000610000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32gui.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001ea40000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32event.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001e9b0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32inet.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001eaa0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32crypt.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001e980000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._html2.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000002810000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wxmsw294u_webview_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000003910000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\_multiprocessing.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000003930000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32process.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001ebf0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\unicodedata.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 0000000005900000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._wizard.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000058c0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32pipe.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001eb90000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32pdh.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001eb60000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\windows._lib_cacheinvalidation.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000735a0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\select.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000058a0000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32profile.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001ec20000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\win32ts.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 000000001ed40000
Library C:\Users\FUL\AppData\Local\Temp\_MEI37322\wx._animate.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [4496] 00000000059b0000
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Vielen Dank für Eure Hilfe!
lolofufu |
AdwCleaner auf deinen Desktop.
SecurityCheck und:
WARNUNG an die MITLESER: 
