| HtHNightwolf | 16.06.2015 13:12 |
Nach Scan noch immer Bedrohungen, aber wie entfernen?
Hallo liebes Trojaner-Board-Team,
ich habe einen PC hier, der mit dem ESET Bedrohungen meldet, sie aber nicht entfernen kann (oder ich kann es nicht, daher mein Hilfegesuch). Oder sie sind jetzt doch schon alle weg? Wäre auch toll ^.^
Verwendeter "Virenschutz":
Trend Micro (Ist wie immer ein nettes Icon, hat aber nicht angeschlagen)
Aufgefallen ist er mir, weil er vom Gesamttraffic auf meiner Leitung ganz alleine 94% verursacht hat und immer langsamer wurde. Bisher habe ich gescannt mit folgenden Tools:
FRST
MBAM
ESET (findet 5 Bedrohungen, hat aber keinen Button diese zu entfernen, ist das richtig?)
GMER (bitte schaut da doch mal über das LOG, ob das wirklich echte Funde sind)
ADWCleaner
Vielen Dank im Voraus :o Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version:13-06-2015
Ran by Serviceuser at 2015-06-16 13:12:20
Running from C:\Users\Serviceuser\Desktop\AntiVirus Tools
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-3956946520-947690076-1510965958-500 - Administrator - Disabled)
Gast (S-1-5-21-3956946520-947690076-1510965958-501 - Limited - Disabled)
Serviceuser (S-1-5-21-3956946520-947690076-1510965958-1000 - Administrator - Enabled) => C:\Users\Serviceuser
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Trend Micro Security Agent (Disabled - Up to date) {B7599298-8445-728A-A5C7-A26A082C8BDA}
AS: Trend Micro Security Agent (Disabled - Up to date) {0C38737C-A27F-7D04-9F77-991873ABC167}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
ActiveCheck component for HP Active Support Library (x32 Version: 3.0.0.3 - Hewlett-Packard) Hidden
Adobe Flash Player 17 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 17.0.0.188 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.188 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.3.133 - Adobe Systems, Inc.)
Cisco WebEx Meetings for Internet Explorer (HKLM-x32\...\{CA8F0B73-0257-4F22-81E3-652B12BB5145}) (Version: 29.10.1.10115 - Cisco WebEx LLC)
cobra Adress PLUS 2013 (HKLM-x32\...\{7C4475A3-E2D2-4F04-9123-D4CB4FBACB51}) (Version: 16.4.4249 - cobra GmbH)
cobra Geodata 2 (HKLM-x32\...\cobraGeodata2_is1) (Version: 2 - cobra GmbH)
cobra Geodata 5.0 (HKLM-x32\...\cobraGeodata5_is1) (Version: 5.0 - cobra GmbH)
cobra Geodata Karte DACH 2013 (HKLM-x32\...\cobraGeodataKarteDACH2013_is1) (Version: 5.0 - cobra GmbH)
cobra Geodata Karte MEC (HKLM-x32\...\cobraGeodataKarteMEC_is1) (Version: 2 - cobra GmbH)
CorelDRAW Graphics Suite 12 (HKLM-x32\...\{505AFDC0-5E72-4928-8368-5DEA385E3647}) (Version: 12.0.0.458 - Corel Corporation)
DirectX for Managed Code Update (Summer 2004) (x32 Version: 9.02.2904 - Microsoft) Hidden
EAGLE 6.1.0 (HKLM-x32\...\EAGLE 6.1.0) (Version: 6.1.0 - CadSoft Computer GmbH)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
Extended Asian Language font pack for Adobe Reader XI (HKLM-x32\...\{AC76BA86-7AD7-2530-0000-A00000000004}) (Version: 11.0.0 - Adobe Systems Incorporated)
GC-Prevue (HKLM-x32\...\{B5811936-60F6-434A-A9B8-A7673631E72B}) (Version: 19.3.6 - GraphiCode)
GC-Prevue (HKLM-x32\...\{B5812036-60F6-434A-A9B8-A7673631E72B}) (Version: 20.3.6 - GraphiCode)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.124 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
Hercules Webcam Deluxe (HKLM-x32\...\{E6F043EB-FEF5-4C34-95AF-99B3EB68F7D9}) (Version: 3.2.2.5 - Hercules)
HP LaserJet P2030 Series (HKLM\...\HP LaserJet P2030 Series) (Version: - )
HP LaserJet Professional P1100-P1560-P1600 Series (HKLM\...\HP LaserJet Professional P1100-P1560-P1600 Series) (Version: - )
HP Odometer (HKLM-x32\...\{B8AC1A89-FFD1-4F97-8051-E505A160F562}) (Version: 2.10.0000 - Hewlett-Packard)
HP Support Information (HKLM-x32\...\{7F2A11F4-EAE8-4325-83EC-E3E99F85169E}) (Version: 10.1.1000 - Hewlett-Packard)
HPAsset component for HP Active Support Library (x32 Version: 3.0.0.3 - Hewlett-Packard) Hidden
hppusgP2030 (x32 Version: 000.000.00005 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 2.1.1.0000 - Hewlett Packard Development Company L.P.) Hidden
IDA-STEP (HKU\@3\...\IDA-STEP) (Version: 4.0.14 - LKSoftWare GmbH)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Network Connections 15.7.176.0 (HKLM\...\PROSetDX) (Version: 15.7.176.0 - Intel)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2253 - Intel Corporation)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
mapserver 4 COM-Module (HKLM-x32\...\{89EC8757-A934-11D6-8732-00105A376200}) (Version: - )
MapServer 5 COM-Module (HKLM-x32\...\{5C4AE262-DA69-4C68-BF71-7C2C935BE9C2}) (Version: - )
MarketResearch (x32 Version: 100.0.170.000 - Hewlett-Packard) Hidden
maxx PDFMAILER Professional (HKLM-x32\...\{59DF4C0C-8FC1-4874-8888-6BD8A601B32A}) (Version: 3.0.29 - gotomaxx GmbH)
MicroCapture 2.0 (HKLM-x32\...\MicroCapture) (Version: 2.0 - )
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office Home and Business 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005-Abwärtskompatibilität (HKLM\...\{1A3B22D6-4932-4920-B7D3-7D17D36E9BA4}) (Version: 8.05.2309 - Microsoft Corporation)
Microsoft SQL Server 2008 (HKLM-x32\...\Microsoft SQL Server 10 Release) (Version: - Microsoft Corporation)
Microsoft SQL Server 2008 Browser (HKLM-x32\...\{4AF2248C-B3DF-46FB-9596-87F5DB193689}) (Version: 10.3.5500.0 - Microsoft Corporation)
Microsoft SQL Server 2008 Native Client (HKLM\...\{12FE6AA6-65D2-40EE-B925-62193128A0E6}) (Version: 10.3.5500.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Management Objects (HKLM-x32\...\{6B7B7E62-9F56-4C87-8664-0E20F2CAB03B}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Native Client (HKLM\...\{8E4BA1E5-54E8-41F0-919B-CD875B83CFCE}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server Native Client (HKLM\...\{79BF7CB8-1E09-489F-9547-DB3EE8EA3F16}) (Version: 9.00.4035.00 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (HKLM\...\{28D06854-572C-4A65-83E5-F8CAF26B9FDC}) (Version: 10.3.5500.0 - Microsoft Corporation)
Microsoft Sync Framework Runtime v1.0 (x86) de (HKLM-x32\...\{DC39A078-4D4C-4EF2-9CAF-69D342D74125}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Sync Framework Services v1.0 (x86) de (HKLM-x32\...\{E8D33431-67EA-4DC1-B443-EE989DE532BC}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Visio Viewer 2010 (HKLM-x32\...\{95140000-0052-0407-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{86CE1746-9EFF-3C9C-8755-81EA8903AC34}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft_VC90_CRT_x86 (HKLM-x32\...\{DF2035BE-5820-4965-BD97-7FAF8D4A7879}) (Version: 1.0.0 - Microsoft Corporation)
Microsoft-System-CLR-Typen für SQL Server 2012 (HKLM-x32\...\{4C0B27C3-3E8F-4BD2-80FF-6E9E48EBD6D8}) (Version: 11.0.2100.60 - Microsoft Corporation)
Mozilla Firefox 38.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.5 (x86 de)) (Version: 38.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
MrvlUsgTracking64 (Version: 1.0.7 - Marvell Semiconductor Pvt Ltd) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nuance PDF Converter 7 (HKLM-x32\...\{667014DE-A731-4487-9650-BD864C536F4F}) (Version: 7.00.2000 - Nuance Communications, Inc)
Nuance PDF Professional 5 (HKLM\...\{01EE7C23-1993-4AC7-9032-7052E3462EB1}) (Version: 5.00.6400 - Nuance Communications, Inc)
PDF Complete Special Edition (HKLM-x32\...\PDF Complete) (Version: 4.0.14 - PDF Complete, Inc)
Photomizer 2 Bresser Edition (HKLM-x32\...\{41B5224D-F3EC-4EF7-0001-C731B42A67EF}) (Version: 2.0.12.725 - Engelmann Media GmbH)
PROFESSional ERP (HKLM-x32\...\{079C8DAA-7F86-4BB1-95C3-A5B132113ACE}) (Version: 7.0.024 - Software-Schmiede Vogler & Hauke GmbH)
PROFESSional ERP (HKLM-x32\...\{6C77DB24-3601-4D5F-88A7-15293130D4EE}) (Version: 7.0.024 - Software-Schmiede Vogler & Hauke GmbH)
PROFESSional ERP (x32 Version: 6.9.003 - Software-Schmiede Vogler & Hauke GmbH) Hidden
PROFESSional ERP (x32 Version: 7.0.024 - Software-Schmiede Vogler & Hauke GmbH) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6257 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.3621 - CyberLink Corp.) Hidden
Scansoft PDF Professional (x32 Version: - ) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Service Pack 3 für SQL Server 2008 (KB2546951) (HKLM-x32\...\KB2546951) (Version: 10.3.5500.0 - Microsoft Corporation)
Skype™ 7.4 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.4.102 - Skype Technologies S.A.)
SolidWorks eDrawings 2013 (HKLM-x32\...\{2D504804-E9D3-4457-8768-B9AA0ABB69DC}) (Version: 13.3.111 - Dassault Systèmes SolidWorks Corp.)
Sql Server Customer Experience Improvement Program (x32 Version: 10.3.5500.0 - Microsoft Corporation) Hidden
STP Viewer 2.3 (HKLM-x32\...\{CECCF8B1-F595-4845-9AA6-1EC57B9BECBA}_is1) (Version: - IdeaMK)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TeamViewer 6 (HKLM-x32\...\TeamViewer 6) (Version: 6.0.10722 - TeamViewer GmbH)
Trend Micro Worry-Free Business Security Agent (HKLM\...\Wofie) (Version: 7.0.2316 - Trend Micro Deutschland GmbH)
Trend Micro Worry-Free Business Security Agent (x32 Version: 1.0.0 - Trend Micro Inc.) Hidden
Unterstützungsdateien für Microsoft SQL Server 2008-Setup (HKLM-x32\...\{2A231800-A7CF-4223-B8A3-1FD9057BAE96}) (Version: 10.3.5500.0 - Microsoft Corporation)
Update 4.0.3 for Microsoft .NET Framework 4 Client Profile (KB2600211) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2600211) (Version: 1 - Microsoft Corporation)
Update 4.0.3 for Microsoft .NET Framework 4 Extended (KB2600211) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2600211) (Version: 1 - Microsoft Corporation)
ViewMate 11.4 (HKLM-x32\...\{59682093-5797-4AD5-9B57-2A528DF5821A}) (Version: 11.4.24 - PentaLogix)
Webcam videocap (HKLM-x32\...\{58D4FB3A-98E9-4B9B-B01E-7F005AEFE019}) (Version: 1.00.0000 - Webcam videocap)
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
Windows Small Business Server 2011 Standard ClientAgent (HKLM\...\{5C72F8A3-BF39-4733-B41E-0ED7EF622E37}) (Version: 6.1.7900.1 - Microsoft Corporation)
WinRAR 4.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.01.0 - win.rar GmbH)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== Restore Points =========================
07-05-2015 11:09:18 Geplanter Prüfpunkt
18-05-2015 10:01:26 Geplanter Prüfpunkt
27-05-2015 14:26:07 Geplanter Prüfpunkt
04-06-2015 00:00:04 Geplanter Prüfpunkt
11-06-2015 12:41:51 Geplanter Prüfpunkt
16-06-2015 13:08:52 ComboFix created restore point
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {873AE02B-CFAE-413E-9DBC-DA938735B8BF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-04] (Google Inc.)
Task: {C0796A32-04E1-4F83-A08B-9A17EF67AFDB} - System32\Tasks\RMCreator => C:\Program Files (x86)\Hewlett-Packard\Recovery\Reminder.exe [2010-12-22] (CyberLink)
Task: {C84DB85D-0210-4E9F-BB49-7667C5F9B47B} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
Task: {D457D100-954E-425F-A220-C3F5D6F0DF85} - System32\Tasks\HPCeeScheduleForWUNWS01W7$ => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14] (Hewlett-Packard)
Task: {DD00BAC3-C59D-411B-88A2-7DAB6B699A73} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-06-10] (Adobe Systems Incorporated)
Task: {EDDA8644-C56E-4E83-9B49-26AA3C3298F3} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
Task: {FB905FDD-D741-435A-9D30-665FA05F92CD} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-04] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForWUNWS01W7$.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
==================== Loaded Modules (Whitelisted) ==============
2011-08-25 11:18 - 2006-03-22 18:19 - 00014848 _____ () C:\Windows\System32\gengpmon.dll
2015-04-09 09:33 - 2012-08-31 15:03 - 00288768 _____ () C:\Windows\System32\HP1100LM.DLL
2012-02-23 15:41 - 2012-08-31 15:02 - 00074240 _____ () C:\Windows\system32\spool\PRTPROCS\x64\HP1100PP.DLL
2015-06-10 08:46 - 2015-06-05 20:22 - 01281864 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.124\libglesv2.dll
2015-06-10 08:46 - 2015-06-05 20:22 - 00080712 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.124\libegl.dll
2015-06-16 10:52 - 2015-06-16 10:41 - 00380416 _____ () C:\Users\Serviceuser\Desktop\AntiVirus Tools\GMer\1jkqwjh5.exe
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\ProgramData\Temp:D95ACC7D
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver"
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\@1\Control Panel\Desktop\\Wallpaper -> C:\Users\CLA\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\@3\Control Panel\Desktop\\Wallpaper -> C:\Users\fge\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\@4\Control Panel\Desktop\\Wallpaper -> C:\Users\HEH\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\@5\Control Panel\Desktop\\Wallpaper -> C:\Users\iul\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\S-1-5-21-3956946520-947690076-1510965958-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Serviceuser\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.252.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: CorelDRAW Graphics Suite 11b => C:\Program Files (x86)\Corel\Corel Graphics 12\Languages\DE\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=090911 serial=DR12WRX-0551304-QHX lang=DE
MSCONFIG\startupreg: HotKeysCmds => C:\Windows\system32\hkcmd.exe
MSCONFIG\startupreg: hpsysdrv => c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe
MSCONFIG\startupreg: HPUsageTracking => "C:\Program Files (x86)\HP\HP UT\bin\hppusg.exe" "C:\Program Files (x86)\HP\HP UT\"
MSCONFIG\startupreg: IgfxTray => C:\Windows\system32\igfxtray.exe
MSCONFIG\startupreg: IMSS => "C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe"
MSCONFIG\startupreg: ISUSPM => "C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe" -scheduler
MSCONFIG\startupreg: ISUSPM Startup => C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
MSCONFIG\startupreg: ISUSScheduler => "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe" -start
MSCONFIG\startupreg: Nuance PDF Converter 7-reminder => "C:\Program Files (x86)\Nuance\PDF Converter 7\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\PDF Converter 7\Ereg\Ereg.ini"
MSCONFIG\startupreg: Nuance PDF Professional 5-reminder => "C:\Program Files (x86)\Nuance\PDF Professional 5\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\PDF Professional 5\Ereg\Ereg.ini"
MSCONFIG\startupreg: PDF Complete => C:\Program Files (x86)\PDF Complete\pdfsty.exe
MSCONFIG\startupreg: PDF5 Registry Controller => C:\Program Files (x86)\Nuance\PDF Professional 5\RegistryController.exe
MSCONFIG\startupreg: PDF7 Registry Controller => C:\Program Files (x86)\Nuance\PDF Converter 7\RegistryController.exe
MSCONFIG\startupreg: PDFHook => C:\Program Files (x86)\Nuance\PDF Professional 5\pdfpro5hook.exe
MSCONFIG\startupreg: Persistence => C:\Windows\system32\igfxpers.exe
MSCONFIG\startupreg: RtHDVCpl => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
MSCONFIG\startupreg: Snap => C:\Program Files (x86)\Webcam videocap\Camera Snap.exe
MSCONFIG\startupreg: SSBkgdUpdate => "C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{2440AD77-653B-4D93-BFDE-27DE065CA6C3}] => (Allow) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer.exe
FirewallRules: [{99D9BDAF-DB84-4BB1-A8E1-45A12F48C61E}] => (Allow) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer.exe
FirewallRules: [{2E7DE2B4-8D4C-4D23-BA88-749DDE16489F}] => (Allow) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
FirewallRules: [{6475C66C-E1A7-4A1B-B903-76B0893967CC}] => (Allow) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
FirewallRules: [{97DC02D8-9B43-41B3-9E0F-FD4BAF24A5EC}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{27C000A8-95C6-4116-B061-77C80B14AF9D}\\wuns02sql\apps\proferp\menu.exe] => (Allow) \\wuns02sql\apps\proferp\menu.exe
FirewallRules: [UDP Query User{684F50A8-4D2C-4E49-A761-24B27635B38B}\\wuns02sql\apps\proferp\menu.exe] => (Allow) \\wuns02sql\apps\proferp\menu.exe
FirewallRules: [{73207ADC-3C99-4C6E-A3F7-2C93BF43086C}] => (Allow) C:\Users\mfe\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{F9B11684-BBAB-4DD7-888C-62D3FAD2205A}] => (Allow) C:\Users\mfe\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [TCP Query User{2D723DFC-B2DF-412F-BCE4-9EF9BD688313}C:\program files (x86)\sopcast\sopcast.exe] => (Allow) C:\program files (x86)\sopcast\sopcast.exe
FirewallRules: [UDP Query User{7050CD5E-519A-4ACC-B5DF-E37A9F869FA0}C:\program files (x86)\sopcast\sopcast.exe] => (Allow) C:\program files (x86)\sopcast\sopcast.exe
FirewallRules: [TCP Query User{3EF4E8FD-736D-4946-8419-84BD2810A723}C:\program files (x86)\internet explorer\iexplore.exe] => (Block) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [UDP Query User{86E105E1-02B4-4C9F-82DA-195BF83DF4FE}C:\program files (x86)\internet explorer\iexplore.exe] => (Block) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [TCP Query User{D39F5248-833D-4D62-8CD2-A8E24E18908E}\\wuns02sql\apps\proferp\proferp.exe] => (Allow) \\wuns02sql\apps\proferp\proferp.exe
FirewallRules: [UDP Query User{C2C6E825-9FD8-4410-BF2C-D43CE7166884}\\wuns02sql\apps\proferp\proferp.exe] => (Allow) \\wuns02sql\apps\proferp\proferp.exe
FirewallRules: [TCP Query User{876174A2-63D7-411B-A00D-9A6732EA4098}C:\windows\syswow64\rundll32.exe] => (Allow) C:\windows\syswow64\rundll32.exe
FirewallRules: [UDP Query User{FD80DE08-DEC4-423C-8B49-346A29984CD2}C:\windows\syswow64\rundll32.exe] => (Allow) C:\windows\syswow64\rundll32.exe
FirewallRules: [{77FF92EA-8928-44A9-B644-54301AF76747}] => (Allow) LPort=60299
FirewallRules: [{A0A21E44-3DAA-4FFE-91D1-67C7C2F2315A}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{672309D4-B8D2-4D6C-9FC4-22E8E717DB02}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{FE21F35F-4F2D-4D14-99A5-C8ECF29AD376}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (06/16/2015 00:55:43 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (06/16/2015 00:55:41 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (06/16/2015 00:55:03 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/16/2015 00:54:43 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (06/16/2015 00:54:36 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (06/16/2015 00:06:04 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/16/2015 11:02:53 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (06/16/2015 10:54:46 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (06/16/2015 10:53:17 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (06/16/2015 10:51:57 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (06/16/2015 01:03:08 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (06/16/2015 01:03:08 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Users\SERVIC~1\AppData\Local\Temp\ehdrv.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (06/16/2015 01:03:08 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (06/16/2015 01:03:08 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Users\SERVIC~1\AppData\Local\Temp\ehdrv.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (06/16/2015 01:03:08 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (06/16/2015 01:03:08 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Users\SERVIC~1\AppData\Local\Temp\ehdrv.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (06/16/2015 00:57:43 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (06/16/2015 00:57:43 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Users\SERVIC~1\AppData\Local\Temp\ehdrv.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (06/16/2015 00:57:42 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (06/16/2015 00:57:42 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Users\SERVIC~1\AppData\Local\Temp\ehdrv.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Microsoft Office:
=========================
Error: (06/16/2015 00:55:43 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Serviceuser\Desktop\AntiVirus Tools\ESET Online Scanner.exe
Error: (06/16/2015 00:55:41 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Serviceuser\Desktop\AntiVirus Tools\ESET Online Scanner.exe
Error: (06/16/2015 00:55:03 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/16/2015 00:54:43 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Serviceuser\Desktop\AntiVirus Tools\ESET Online Scanner.exe
Error: (06/16/2015 00:54:36 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Serviceuser\Desktop\AntiVirus Tools\ESET Online Scanner.exe
Error: (06/16/2015 00:06:04 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/16/2015 11:02:53 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Serviceuser\Desktop\AntiVirus Tools\ESET Online Scanner.exe
Error: (06/16/2015 10:54:46 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Serviceuser\Desktop\AntiVirus Tools\ESET Online Scanner.exe
Error: (06/16/2015 10:53:17 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Serviceuser\Desktop\AntiVirus Tools\ESET Online Scanner.exe
Error: (06/16/2015 10:51:57 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
CodeIntegrity Errors:
===================================
Date: 2011-12-20 09:53:55.119
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\l3codeca.acm" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-09-06 15:08:18.434
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\l3codeca.acm" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-09-06 14:56:20.215
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\l3codeca.acm" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-08-26 20:07:52.987
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\l3codeca.acm" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-2500 CPU @ 3.30GHz
Percentage of memory in use: 41%
Total physical RAM: 3984.02 MB
Available physical RAM: 2349.61 MB
Total Pagefile: 7966.21 MB
Available Pagefile: 6180.75 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:458.79 GB) (Free:345.11 GB) NTFS
Drive d: (HP_RECOVERY) (Fixed) (Total:6.87 GB) (Free:0.91 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 2B5D01C4)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=458.8 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=6.9 GB) - (Type=07 NTFS)
==================== End of log ============================
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:13-06-2015
Ran by Serviceuser (administrator) on WUNWS01W7 on 16-06-2015 13:10:57
Running from C:\Users\Serviceuser\Desktop\AntiVirus Tools
Loaded Profiles: Serviceuser (Available Profiles: Serviceuser)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe
(HP) C:\Windows\System32\HPSIsvc.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PDF Professional 5\PDFProFiltSrv.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
(Microsoft Corporation) C:\Windows\System32\PrintIsolationHost.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.27.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.27.5\GoogleCrashHandler64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Farbar) C:\Users\Serviceuser\Desktop\AntiVirus Tools\FRST(x64).exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Trend Micro Client Framework] => C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe [219512 2012-11-01] (Trend Micro Inc.)
HKLM-x32\...\Run: [] => [X]
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\@3\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [31280256 2015-04-17] (Skype Technologies S.A.)
Startup: C:\Users\fge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\A Smaller Note 99.lnk [2012-02-07]
ShortcutTarget: A Smaller Note 99.lnk -> \\WUNS03SBS\Public\A smaller note\noted\note.exe (No File)
Startup: C:\Users\fge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\maxx PDFMAILER.lnk [2012-02-07]
ShortcutTarget: maxx PDFMAILER.lnk -> C:\Program Files (x86)\gotomaxx\maxxPDFMAILER\PDFMailerApp.exe ()
Startup: C:\Users\mfe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\A Smaller Note 99.lnk [2011-08-25]
ShortcutTarget: A Smaller Note 99.lnk -> C:\Users\Serviceuser\Desktop\note.exe (No File)
Startup: C:\Users\mfe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\maxx PDFMAILER.lnk [2011-08-26]
ShortcutTarget: maxx PDFMAILER.lnk -> C:\Program Files (x86)\gotomaxx\maxxPDFMAILER\PDFMailerApp.exe ()
Startup: C:\Users\mfe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Outlook 2010.lnk [2011-08-26]
ShortcutTarget: Microsoft Outlook 2010.lnk -> C:\Windows\Installer\{90140000-003D-0000-0000-0000000FF1CE}\outicon.exe ()
Startup: C:\Users\mpe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\A Smaller Note 99.lnk [2014-03-06]
ShortcutTarget: A Smaller Note 99.lnk -> \\WUNS03SBS\Public\A smaller note\noted\note.exe (No File)
Startup: C:\Users\mpe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adress PLUS 12.lnk [2014-03-06]
ShortcutTarget: Adress PLUS 12.lnk -> C:\WINDOWS\Installer\{464DDB17-718C-42A7-BB6C-495FF7481BD6}\NewShortcut9_EE70D6A69A4248E692FA81C5C47C7AE0.exe (No File)
Startup: C:\Users\mpe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2014-03-06]
ShortcutTarget: Dropbox.lnk -> C:\Users\Serviceuser\AppData\Roaming\Dropbox\bin\Dropbox.exe (No File)
Startup: C:\Users\mpe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\maxx PDFMAILER.lnk [2014-03-06]
ShortcutTarget: maxx PDFMAILER.lnk -> C:\Program Files (x86)\gotomaxx\maxxPDFMAILER\PDFMailerApp.exe ()
Startup: C:\Users\mpe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Outlook 2010.lnk [2014-03-06]
ShortcutTarget: Microsoft Outlook 2010.lnk -> C:\Windows\Installer\{90140000-003D-0000-0000-0000000FF1CE}\outicon.exe ()
Startup: C:\Users\Serviceuser.*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\A Smaller Note 99.lnk [2011-08-25]
ShortcutTarget: A Smaller Note 99.lnk -> \\WUNS03SBS\Public\A smaller note\noted\note.exe (No File)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\@1\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\@3\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\@4\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\@5\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\@1\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.uk.msn.com/HPCOM/10
HKU\@1\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://companyweb
HKU\@1\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://companyweb
HKU\@2\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCOM/10
HKU\@2\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.uk.msn.com/HPCOM/10
HKU\@2\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/10
HKU\@3\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://companyweb
HKU\@3\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://companyweb
HKU\@4\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.uk.msn.com/HPCOM/10
HKU\@4\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://companyweb
HKU\@4\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://companyweb
HKU\@5\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://companyweb
HKU\@5\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://companyweb
HKU\@6\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCOM/10
HKU\@6\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.uk.msn.com/HPCOM/10
HKU\@6\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/10
HKU\S-1-5-21-3956946520-947690076-1510965958-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCOM/10
HKU\S-1-5-21-3956946520-947690076-1510965958-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/10
SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMDTDF
SearchScopes: HKLM-x32 -> {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CMDTDF&pc=CMDTDF&src=IE-SearchBox
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\@3 -> DefaultScope {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL =
SearchScopes: HKU\@5 -> DefaultScope {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: TmIEPlugInBHO Class -> {1CA1377B-DC1D-4A52-9585-6E06050FAC53} -> C:\Program Files\Trend Micro\AMSP\Module\20004\1.6.1261\6.6.1089\TmIEPlg.dll [2011-09-28] (Trend Micro Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: TmIEPlugInBHO Class -> {1CA1377B-DC1D-4A52-9585-6E06050FAC53} -> C:\Program Files\Trend Micro\AMSP\Module\20004\1.6.1261\6.6.1089\TmIEPlg32.dll [2010-09-30] (Trend Micro Inc.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll [2014-12-18] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: ZeonIEEventHelper Class -> {DA986D7D-CCAF-47B2-84FE-BFA1549BEBF9} -> C:\Program Files (x86)\Nuance\PDF Professional 5\bin\ZeonIEFavClient.dll [2008-01-25] (Zeon Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-12-18] (Oracle Corporation)
Toolbar: HKLM-x32 - Nuance PDF - {E3286BF1-E654-42FF-B4A6-5E111731DF6B} - C:\Program Files (x86)\Nuance\PDF Professional 5\bin\ZeonIEFavClient.dll [2008-01-25] (Zeon Corporation)
DPF: HKLM-x32 {E06E2E99-0AA1-11D4-ABA6-0060082AA75C}
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.6.1261\6.6.1089\TmIEPlg.dll [2011-09-28] (Trend Micro Inc.)
Handler-x32: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.6.1261\6.6.1089\TmIEPlg32.dll [2010-09-30] (Trend Micro Inc.)
Handler-x32: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Security Agent\UIFramework\ProToolbarIMRatingActiveX.dll [2011-11-10] (Trend Micro Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.252.1
FireFox:
========
FF ProfilePath: C:\Users\Serviceuser\AppData\Roaming\Mozilla\Firefox\Profiles\kl27wzih.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-06-10] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll [2013-09-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-06-10] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll [2013-06-26] (Adobe Systems, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-12-18] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-12-18] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll [2013-09-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-18] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-18] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension
FF Extension: Trend Micro NSC Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension [2014-10-30]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [not found]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 MSSQL$SQLEXPRESS; c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [43028328 2011-09-22] (Microsoft Corporation)
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1121304 2010-10-22] (PDF Complete Inc)
R2 PDFProFiltSrv; C:\Program Files (x86)\Nuance\PDF Professional 5\PDFProFiltSrv.exe [144672 2008-02-02] (Nuance Communications, Inc.)
S4 SQLAgent$SQLEXPRESS; c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [370024 2011-09-22] (Microsoft Corporation)
S3 TmListen; C:\Program Files\Trend Micro\Security Agent\tmlisten.exe [1023448 2012-11-09] (Trend Micro Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 Amsp; "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=qb -dt=60000 [X]
S2 HP Health Check Service; "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe" [X]
S3 hpqwmiex; "C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe" [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 camfilt2; C:\Windows\System32\DRIVERS\camfilt2.sys [139264 2007-08-29] (Guillemot Corporation)
S3 IFCoEMP; C:\Windows\system32\drivers\ifM52x64.sys [339728 2010-08-14] (Intel(R) Corporation)
S3 IFCoEVB; C:\Windows\system32\drivers\ifP52X64.sys [65808 2010-08-14] (Intel(R) Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
S3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [20480 2012-12-24] (Marvell Semiconductor, Inc.)
S3 OM0530; C:\Windows\System32\Drivers\ov530vx.sys [172928 2007-07-13] (OmniVision Technology Inc.)
R2 tmactmon; C:\Windows\System32\DRIVERS\tmactmon.sys [107048 2012-09-24] (Trend Micro Inc.)
R2 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [173504 2012-09-24] (Trend Micro Inc.)
R2 tmevtmgr; C:\Windows\System32\DRIVERS\tmevtmgr.sys [77184 2012-09-24] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [105552 2010-09-30] (Trend Micro Inc.)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-16 13:10 - 2015-06-16 13:10 - 00007604 _____ C:\Users\Serviceuser\AppData\Local\Resmon.ResmonCfg
2015-06-16 13:08 - 2015-06-16 13:09 - 00000000 ___SD C:\ComboFix
2015-06-16 13:08 - 2015-06-16 13:08 - 00000000 ____D C:\Windows\erdnt
2015-06-16 13:08 - 2015-06-16 13:08 - 00000000 ____D C:\Qoobox
2015-06-16 13:08 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2015-06-16 13:08 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2015-06-16 13:08 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-06-16 13:08 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-06-16 13:08 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-06-16 13:08 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2015-06-16 13:08 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2015-06-16 13:08 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2015-06-16 11:03 - 2015-06-16 12:03 - 00000000 ____D C:\AdwCleaner
2015-06-16 11:02 - 2015-06-16 11:02 - 00000000 ____D C:\Program Files (x86)\ESET
2015-06-16 10:55 - 2015-06-16 13:11 - 00000000 ____D C:\FRST
2015-06-16 10:54 - 2015-06-16 12:17 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-06-16 10:53 - 2015-06-16 10:53 - 00001104 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-06-16 10:53 - 2015-06-16 10:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-06-16 10:53 - 2015-06-16 10:53 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-06-16 10:53 - 2015-06-16 10:53 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2015-06-16 10:53 - 2015-06-16 10:53 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-06-16 10:53 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-06-16 10:53 - 2015-04-14 09:37 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-06-16 10:53 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-06-16 10:52 - 2015-06-16 13:11 - 00000000 ____D C:\Users\Serviceuser\Desktop\AntiVirus Tools
2015-06-16 10:52 - 2015-06-16 10:52 - 00000000 ____D C:\Users\Serviceuser\AppData\Local\Google
2015-06-09 09:46 - 2015-06-09 09:46 - 00000000 ____D C:\Users\mfe\Documents\Corel User Files
2015-06-08 11:20 - 2015-06-08 11:20 - 00191218 _____ C:\Users\mfe\Documents\Supplier_8D_report_v06 on 150098.xlsx
2015-06-03 12:27 - 2015-06-05 07:48 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-05-27 13:08 - 2015-05-27 13:08 - 00119808 _____ C:\Users\mfe\Downloads\EQ FOR C39104-A0125-C013-02-B8.xls
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-16 13:08 - 2011-08-16 09:30 - 01966973 _____ C:\Windows\WindowsUpdate.log
2015-06-16 13:00 - 2009-07-14 06:45 - 00027344 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-16 13:00 - 2009-07-14 06:45 - 00027344 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-16 12:59 - 2012-04-13 07:52 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-06-16 12:54 - 2011-07-28 22:08 - 00000000 ____D C:\ProgramData\PDFC
2015-06-16 12:53 - 2013-07-04 15:33 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-16 12:53 - 2010-11-21 05:47 - 00512948 _____ C:\Windows\PFRO.log
2015-06-16 12:53 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-16 12:53 - 2009-07-14 06:51 - 00106494 _____ C:\Windows\setupact.log
2015-06-16 12:43 - 2013-07-04 15:33 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-16 10:52 - 2011-08-16 09:36 - 00001423 _____ C:\Users\Serviceuser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-06-15 11:44 - 2011-08-25 15:20 - 00000000 ____D C:\Users\mfe\AppData\Roaming\Skype
2015-06-15 10:31 - 2011-08-19 15:24 - 00000120 _____ C:\Windows\system32\config\netlogon.ftl
2015-06-15 08:44 - 2011-08-25 17:44 - 00000539 _____ C:\Users\mfe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\A Smaller Note 99.lnk
2015-06-10 09:59 - 2012-04-13 07:52 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-06-10 09:59 - 2012-04-13 07:52 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-06-10 09:59 - 2011-08-16 10:44 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-06-10 08:46 - 2013-07-04 15:33 - 00002177 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-06-08 13:23 - 2014-08-18 14:20 - 00000897 _____ C:\Users\mfe\cobra.xml
2015-06-08 10:51 - 2011-11-15 10:18 - 00000000 ____D C:\Users\mfe\Documents\Privat
2015-06-08 07:46 - 2011-10-27 07:46 - 00003220 _____ C:\Windows\System32\Tasks\HPCeeScheduleForWUNWS01W7$
2015-06-08 07:46 - 2011-10-27 07:46 - 00000344 _____ C:\Windows\Tasks\HPCeeScheduleForWUNWS01W7$.job
2015-06-05 07:48 - 2013-02-28 15:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-06-03 14:42 - 2011-07-28 21:48 - 00774312 _____ C:\Windows\system32\perfh007.dat
2015-06-03 14:42 - 2011-07-28 21:48 - 00177038 _____ C:\Windows\system32\perfc007.dat
2015-06-03 14:42 - 2009-07-14 07:13 - 01830614 _____ C:\Windows\system32\PerfStringBackup.INI
2015-05-28 11:32 - 2014-07-28 10:27 - 00000000 ____D C:\Users\mfe\Desktop\Entpackte Dateien
2015-05-19 16:13 - 2011-08-25 15:20 - 00000000 ____D C:\Users\mfe\Documents\Sonstiges
2015-05-19 08:32 - 2011-08-25 10:37 - 00000000 ____D C:\ProgramData\Skype
2015-05-18 14:37 - 2013-07-04 15:33 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-18 14:37 - 2013-07-04 15:33 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
==================== Files in the root of some directories =======
2011-07-20 16:48 - 2011-07-20 16:48 - 0431888 ____R (Microsoft Corporation) C:\Program Files (x86)\Common Files\riched20.dll
2015-06-16 13:10 - 2015-06-16 13:10 - 0007604 _____ () C:\Users\Serviceuser\AppData\Local\Resmon.ResmonCfg
2012-10-16 10:55 - 2012-10-16 10:55 - 0000009 _____ () C:\ProgramData\WEEKENDS.INI
Some files in TEMP:
====================
C:\Users\mfe\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpn8p22v.dll
C:\Users\mfe\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Serviceuser\AppData\Local\Temp\MSNBF4B.exe
C:\Users\Serviceuser\AppData\Local\Temp\Quarantine.exe
C:\Users\Serviceuser\AppData\Local\Temp\sqlite3.dll
C:\Users\Serviceuser.*****\AppData\Local\Temp\AskSLib.dll
C:\Users\Serviceuser.*****\AppData\Local\Temp\FoxySecurity_6-2_FF_IE_Setup.exe
C:\Users\Serviceuser.*****\AppData\Local\Temp\GoogleChromeInstaller.exe
C:\Users\Serviceuser.*****\AppData\Local\Temp\siinst.exe
C:\Users\Serviceuser.*****\AppData\Local\Temp\strings.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-06-13 00:09
==================== End of log ============================
Code:
# AdwCleaner v4.206 - Bericht erstellt 16/06/2015 um 12:03:56
# Aktualisiert 01/06/2015 von Xplode
# Datenbank : 2015-05-31.5 [Lokal]
# Betriebssystem : Windows 7 Professional Service Pack 1 (x64)
# Benutzername : Serviceuser - WUNWS01W7
# Gestarted von : C:\Users\Serviceuser\Desktop\AntiVirus Tools\AdwCleaner.exe
# Option : Löschen
***** [ Dienste ] *****
[#] Dienst Gelöscht : HubService
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileViewPro
Ordner Gelöscht : C:\Program Files (x86)\Browser Guard
Ordner Gelöscht : C:\Program Files\FileViewPro
Ordner Gelöscht : C:\Users\mfe\AppData\Local\FileViewPro
Ordner Gelöscht : C:\Users\Serviceuser.*****\AppData\LocalLow\Internet Explorer BHO
Ordner Gelöscht : C:\Users\Serviceuser.*****\AppData\Roaming\Hub Timer
Ordner Gelöscht : C:\Users\Serviceuser.*****\AppData\Roaming\Security Systems
Ordner Gelöscht : C:\Users\mfe\AppData\Roaming\Mozilla\Firefox\Profiles\29qide2g.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
Datei Gelöscht : C:\Users\Serviceuser.*****\AppData\Roaming\Mozilla\Firefox\Profiles\lwl69wu4.default\invalidprefs.js
Datei Gelöscht : C:\Users\mpe\AppData\Roaming\Mozilla\Firefox\Profiles\u0ahlga1.default\searchplugins\11-suche.xml
Datei Gelöscht : C:\Users\mfe\AppData\Roaming\Mozilla\Firefox\Profiles\29qide2g.default\user.js
Datei Gelöscht : C:\Users\Serviceuser.*****\AppData\Roaming\Mozilla\Firefox\Profiles\lwl69wu4.default\user.js
***** [ Geplante Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{20d1f7b3-7721-4da0-b6f3-78bb4d7248f4}]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SWS.GUI.Toolbar.CToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SWS.GUI.Toolbar.CToolButton
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SWS.GUI.Toolbar.CToolGroup
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SWS.GUI.Toolbar.CToolPage
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SWS.GUI.Toolbar.CToolPopup
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{20E1481B-E285-4ABC-ADC7-AE24842B81CD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C32F5BF7-6918-4F78-A97A-53CDF7D07C8C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0194532A-A99C-4337-937E-2A452C8957BE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7697BC38-D0FA-454B-AC75-968B4CCABFCE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{92E5039E-FF1E-4AFB-8F24-87592D20C383}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C32F5BF7-6918-4F78-A97A-53CDF7D07C8C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EC29EDF6-AD3C-4E1C-A087-D6CB81400C43}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EC29EDF6-AD3C-4E1C-A087-D6CB81400C43}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Foxy Secure
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Browser Guard
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileViewPro_is1
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.16428
-\\ Mozilla Firefox v38.0.5 (x86 de)
-\\ Google Chrome v43.0.2357.124
*************************
AdwCleaner[R0].txt - [5236 Bytes] - [16/06/2015 11:03:39]
AdwCleaner[S0].txt - [4764 Bytes] - [16/06/2015 12:03:56]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4823 Bytes] ##########
Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-06-16 13:14:14
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD50 rev.16.0 465,76GB
Running: 1jkqwjh5.exe; Driver: C:\Users\SERVIC~1\AppData\Local\Temp\fxdoqpob.sys
---- Threads - GMER 2.1 ----
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:2004] 00000000770e3e85
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:2012] 00000000770e2e65
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:1100] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:1080] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:1108] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:1148] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:1184] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:1196] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:1200] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:1392] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:1432] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:492] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:1476] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:1488] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:1640] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:2084] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:2088] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:2384] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:2388] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:2392] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:2396] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:2400] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:2404] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:2408] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:2528] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:2532] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:2536] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:2540] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:2544] 00000000770e3e85
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:2548] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:2552] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:2564] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:2568] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:2572] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:2576] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:2588] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:2592] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:2596] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:2976] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:3024] 00000000737329e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [1860:3028] 00000000737329e1
---- EOF - GMER 2.1 ----
Code:
Malwarebytes Anti-Malware
www.malwarebytes.org
Suchlauf Datum: 16.06.2015
Suchlauf-Zeit: 12:17:56
Logdatei: MBAM.txt
Administrator: Ja
Version: 2.01.6.1022
Malware Datenbank: v2015.03.09.05
Rootkit Datenbank: v2015.02.25.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert
Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Serviceuser
Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 821682
Verstrichene Zeit: 32 Min, 7 Sek
Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert
Prozesse: 0
(Keine schädliche Elemente gefunden)
Module: 0
(Keine schädliche Elemente gefunden)
Registrierungsschlüssel: 12
PUP.Optional.BrowserGuard.A, HKLM\SOFTWARE\CLASSES\CLSID\{02a0d829-4393-46fc-a37e-126263035883}, In Quarantäne, [c7b25ee58ffbe0569175ab710ff431cf],
PUP.Optional.BrowserGuard.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{02A0D829-4393-46FC-A37E-126263035883}, In Quarantäne, [c7b25ee58ffbe0569175ab710ff431cf],
PUP.Optional.BrowserGuard.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{02A0D829-4393-46FC-A37E-126263035883}, In Quarantäne, [c7b25ee58ffbe0569175ab710ff431cf],
PUP.Optional.BrowserGuard.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{02A0D829-4393-46FC-A37E-126263035883}, In Quarantäne, [c7b25ee58ffbe0569175ab710ff431cf],
PUP.Optional.BrowserGuard.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{02A0D829-4393-46FC-A37E-126263035883}, In Quarantäne, [c7b25ee58ffbe0569175ab710ff431cf],
PUP.Optional.BrowserGuard.A, HKU\S-1-5-21-3095231414-3440436342-3247915639-1156\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{02A0D829-4393-46FC-A37E-126263035883}, In Quarantäne, [c7b25ee58ffbe0569175ab710ff431cf],
PUP.Optional.BrowserGuard.A, HKU\S-1-5-21-3095231414-3440436342-3247915639-1205\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{02A0D829-4393-46FC-A37E-126263035883}, In Quarantäne, [c7b25ee58ffbe0569175ab710ff431cf],
PUP.Optional.BrowserGuard.A, HKU\S-1-5-21-3095231414-3440436342-3247915639-1156\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{02A0D829-4393-46FC-A37E-126263035883}, In Quarantäne, [c7b25ee58ffbe0569175ab710ff431cf],
PUP.Optional.BrowserGuard.A, HKU\S-1-5-21-3095231414-3440436342-3247915639-1205\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{02A0D829-4393-46FC-A37E-126263035883}, In Quarantäne, [c7b25ee58ffbe0569175ab710ff431cf],
PUP.Optional.IEBho.A, HKU\S-1-5-21-3095231414-3440436342-3247915639-1156\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{C32F5BF7-6918-4F78-A97A-53CDF7D07C8C}, In Quarantäne, [fc7de26146446dc93e454bccce35a15f],
PUP.Optional.IEBho.A, HKU\S-1-5-21-3095231414-3440436342-3247915639-1156\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{C32F5BF7-6918-4F78-A97A-53CDF7D07C8C}, In Quarantäne, [fc7de26146446dc93e454bccce35a15f],
PUP.Optional.IEBho.A, HKU\S-1-5-21-3095231414-3440436342-3247915639-1205\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{C32F5BF7-6918-4F78-A97A-53CDF7D07C8C}, In Quarantäne, [fc7de26146446dc93e454bccce35a15f],
Registrierungswerte: 1
Worm.Agent, HKU\S-1-5-21-3095231414-3440436342-3247915639-1205\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|EIYEBD, rundll32 "C:\Users\mfe\AppData\Roaming\pidgenxh.dll",WADFSVOVZU, In Quarantäne, [6c0dd56e1a702b0b533c24d0f01048b8]
Registrierungsdaten: 0
(Keine schädliche Elemente gefunden)
Ordner: 0
(Keine schädliche Elemente gefunden)
Dateien: 3
Worm.Agent, C:\Users\mfe\AppData\Roaming\pidgenxh.dll, In Quarantäne, [6c0dd56e1a702b0b533c24d0f01048b8],
PUP.Optional.BrowserGuard.A, C:\Users\Serviceuser.*****\AppData\Local\Temp\browserguard1_Setup.exe, In Quarantäne, [accd61e263273cfa0398b4a3ac54857b],
PUP.LoadTubes, C:\Users\Serviceuser.*****\AppData\Local\Temp\ltbs.zip, In Quarantäne, [0277281b3159b77f1437efe1ae52ee12],
Physische Sektoren: 0
(Keine schädliche Elemente gefunden)
(end)
ESET: Code:
C:\AdwCleaner\Quarantine\C\Program Files\FileViewPro\FileViewPro.exe.vir Variante von MSIL/Solvusoft.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Serviceuser.*****\AppData\LocalLow\Internet Explorer BHO\bho.dll.vir Win32/Adware.Synatix.B Anwendung
C:\AdwCleaner\Quarantine\C\Users\Serviceuser.*****\AppData\Roaming\Hub Timer\hub.exe.vir Win32/Adware.Synatix.A Anwendung
C:\AdwCleaner\Quarantine\C\Users\Serviceuser.*****\AppData\Roaming\Security Systems\uninstall.exe.vir Variante von Win32/Adware.Synatix.A Anwendung
C:\Users\Serviceuser.*****\AppData\Local\Temp\FoxySecurity_6-2_FF_IE_Setup.exe Variante von Win32/Adware.Synatix.A Anwendung
|
Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
SecurityCheck und:
WARNUNG an die MITLESER: 
