Hier ist das Addition.txt. File
[CODE]Additional
FRST Logfile: Code:
scan result of Farbar Recovery Scan Tool (x64) Version:20-07-2015
Ran by Baris at 2015-07-23 19:40:24
Running from C:\Users\Baris\Desktop
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-2752069299-2962197746-3765214069-500 - Administrator - Disabled)
Baris (S-1-5-21-2752069299-2962197746-3765214069-1001 - Administrator - Enabled) => C:\Users\Baris
Gast (S-1-5-21-2752069299-2962197746-3765214069-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2752069299-2962197746-3765214069-1003 - Limited - Enabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: McAfee Anti-Virus und Anti-Spyware (Disabled - Up to date) {DA9F8ED0-D0DE-39CC-F55A-51AB4CC1B556}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: McAfee Anti-Virus und Anti-Spyware (Disabled - Up to date) {61FE6F34-F6E4-3642-CFEA-6AD93746FFEB}
FW: McAfee Firewall (Enabled) {E2A40FF5-9AB1-3894-DE05-F89EB212F22D}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 18.0.0.180 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{EC394F5E-3BC1-1AC9-820E-B37B76266456}) (Version: 8.0.911.0 - Advanced Micro Devices, Inc.)
Benutzerhandbuch (x32 Version: 1.0.0.9 - Lenovo) Hidden
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.64.49.0 - Conexant)
Dolby Advanced Audio v2 (HKLM-x32\...\{B9E70C7A-9F85-4A39-A4A3-BFA3C3BF7613}) (Version: 7.2.8000.17 - Dolby Laboratories Inc)
Energy Management (HKLM-x32\...\InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}) (Version: 8.0.2.4 - Lenovo)
Energy Management (x32 Version: 8.0.2.4 - Lenovo) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.134 - Google Inc.)
Google Update Helper (x32 Version: 1.3.28.1 - Google Inc.) Hidden
Intel AppUp(SM) center (HKLM-x32\...\Intel AppUp(SM) center 33057) (Version: 3.6.1.33057.10 - Intel)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1281 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2963 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.0.0.1083 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Jazz-Plugin (HKLM-x32\...\{1C92BD87-DC1B-4C4E-BFB4-2C79E88FA752}) (Version: 1.4 - Jazz-Soft)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Lenovo EasyCamera (HKLM-x32\...\{ADE16A9D-FBDC-4ecc-B6BD-9C31E51D0332}) (Version: 3.13.301.1 - Vimicro)
Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 8.0.0.1219 - CyberLink Corp.)
Lenovo OneKey Recovery (Version: 8.0.0.1219 - CyberLink Corp.) Hidden
Lenovo Photos (HKLM-x32\...\Lenovo Photos) (Version: 4.8.5 - CEWE COLOR AG u Co. OHG)
Lenovo pointing device (HKLM\...\Elantech) (Version: 11.4.14.1 - ELAN Microelectronic Corp.)
Lenovo PowerDVD10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.4331.52 - CyberLink Corp.)
Lenovo PowerDVD10 (x32 Version: 10.0.4331.52 - CyberLink Corp.) Hidden
Lenovo Solution Center (HKLM\...\{B8908ABE-8AAE-41FD-A367-391CD492981B}) (Version: 2.0.018.00 - Lenovo Group Limited)
Lenovo YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 4.1.3423 - CyberLink Corp.)
Lenovo YouCam (x32 Version: 4.1.3423 - CyberLink Corp.) Hidden
McAfee Internet Security (HKLM-x32\...\MSC) (Version: 14.0.1076 - McAfee, Inc.)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Nitro Pro 8 (HKLM\...\{34BE77EE-B563-49D7-A8A0-FFD76D29BBD3}) (Version: 8.0.10.7 - Nitro)
OEM Application Profile (HKLM-x32\...\{C89A97B6-F991-EBB5-77B7-927BCF420EBE}) (Version: 1.00.0000 - Ihr Firmenname)
Power2Go (HKLM-x32\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.0.9109 - CyberLink Corp.)
PowerXpressHybrid (x32 Version: 1.00.0000 - Ihr Firmenname) Hidden
PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.0.220 - Qualcomm Atheros Communications)
Qualcomm Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Qualcomm Atheros)
Qualcomm Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.12 - Qualcomm Atheros Communications Inc.)
Realtek USB Card Reader (HKLM-x32\...\{1E496A68-4943-424E-829D-5C3C85B7B8F2}) (Version: 6.2.9200.39041 - Realtek Semiconductor Corp.)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
SugarSync Manager (HKLM-x32\...\SugarSync) (Version: 1.9.61.90905 - SugarSync, Inc.)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
UserGuide (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 1.0.0.9 - Lenovo)
Windows-Treiberpaket - Lenovo (ACPIVPC) System (06/15/2012 8.1.0.1) (HKLM\...\71BC3FD63F450BA0A957AAECBDB4A000C4F2BE42) (Version: 06/15/2012 8.1.0.1 - Lenovo)
Windows-Treiberpaket - Lenovo (WUDFRd) LenovoVhid (06/19/2012 10.13.29.733) (HKLM\...\8A223E56FB1ED4F697B54E5BF96F1EB63B512684) (Version: 06/19/2012 10.13.29.733 - Lenovo)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== Restore Points =========================
20-07-2015 18:04:48 Microsoft Visual C++ 2005 Redistributable (x64) wird installiert
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2012-07-26 07:26 - 2012-07-26 07:26 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {084EE2C2-AA48-4984-9573-B2C6AD8FEBDA} - System32\Tasks\McAfee\McAfee Auto Maintenance Task Agent
Task: {22FB5694-B16C-46D6-9756-B381223A91DA} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-07-20] (Google Inc.)
Task: {25E61BE2-DC0F-4046-98BF-76B6EB1F47CE} - System32\Tasks\Lenovo\Lenovo-32138 => C:\ProgramData\Lenovo-32138.vbs [2015-05-12] ()
Task: {2618D2D2-B826-47D8-969D-E832E0CE2754} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2013-02-12] ()
Task: {290F5A5D-F250-4DCC-956B-A5ADB3BEE8BE} - System32\Tasks\Lenovo\LSC\RebootCountTask => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2013-02-12] ()
Task: {35E5C0B7-9F0B-4DCC-97E5-1D8AA8F545BE} - System32\Tasks\Dolby Selector => C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [2012-08-31] (Dolby Laboratories Inc.)
Task: {426D7668-6E5C-401E-8E0F-A4DDAC12B633} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-07-03] (Microsoft Corporation)
Task: {89842A03-7618-4272-9826-A51CB2B515D9} - System32\Tasks\Lenovo\LSC\Time72Task => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2013-02-12] ()
Task: {93CEBD37-F546-4899-9CDE-9512F4994033} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2013-02-12] (Lenovo)
Task: {D48EEDD6-B86F-46BE-B69F-7DE0793DACFB} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\lenovo\lenovo solution center\lsc.exe [2013-02-12] ()
Task: {F43CC1FB-0FA0-425A-A58A-5C3FE7ABD91E} - System32\Tasks\Lenovo\Lenovo-32164 => C:\ProgramData\Lenovo-32164.vbs [2015-05-12] ()
Task: {F7C0EC50-D5BE-4AFA-AA01-93896CF39D5F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-07-20] (Google Inc.)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (Whitelisted) ==============
2013-01-25 00:09 - 2013-01-25 00:09 - 00011264 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
2013-01-25 00:05 - 2013-01-25 00:05 - 00084992 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\Map\MAP.dll
2013-01-25 00:12 - 2013-01-25 00:12 - 00012928 _____ () C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe
2013-02-25 12:08 - 2013-01-16 22:27 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-02-12 15:22 - 2013-02-12 15:22 - 00148840 _____ () C:\Program Files\lenovo\lenovo solution center\lsc.exe
2015-07-23 19:33 - 2015-07-23 19:33 - 00050477 _____ () C:\Users\Baris\Downloads\Defogger.exe
2015-05-12 13:21 - 2012-07-18 06:55 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2015-07-20 22:13 - 2015-07-13 23:55 - 01281864 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.134\libglesv2.dll
2015-07-20 22:13 - 2015-07-13 23:55 - 00080712 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.134\libegl.dll
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Driver"
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-2752069299-2962197746-3765214069-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Baris\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
DNS Servers: 192.168.2.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{55302E81-9E73-4B03-A5A5-2DEED146232D}] => (Allow) C:\Program Files (x86)\Lenovo\PowerDVD10\PowerDVD Cinema\PowerDVDCinema10.exe
FirewallRules: [{9476F75B-44DF-4560-9B29-7ED9A8BA72E0}] => (Allow) C:\Program Files (x86)\Lenovo\PowerDVD10\PowerDVD10.EXE
FirewallRules: [{78160DD8-4D3B-4990-9A27-71C7E7B27EB8}] => (Allow) C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe
FirewallRules: [{39B34AD5-F04C-426E-B23F-0934C1F4012F}] => (Allow) C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe
FirewallRules: [{03C1534B-757F-4D12-A560-CB44FC962A6A}] => (Allow) C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe
FirewallRules: [{9190CCDD-A1AF-4B5A-A4F3-24EBFDC1F11C}] => (Allow) C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe
FirewallRules: [{CFB9102D-5B5C-4374-B928-8A13740C7D15}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Faulty Device Manager Devices =============
Name: Qualcomm Atheros AR3012 Bluetooth 4.0 + HS
Description: Qualcomm Atheros AR3012 Bluetooth 4.0 + HS
Class Guid: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}
Manufacturer: Qualcomm Atheros Communications
Service: BTHUSB
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (07/23/2015 05:27:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: MCUPDA~1.EXE, Version: 3.0.350.0, Zeitstempel: 0x55523a70
Name des fehlerhaften Moduls: McShieldClient.dll, Version: 1.3.2.533, Zeitstempel: 0x55146a5e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000002dcbc
ID des fehlerhaften Prozesses: 0x744
Startzeit der fehlerhaften Anwendung: 0xMCUPDA~1.EXE0
Pfad der fehlerhaften Anwendung: MCUPDA~1.EXE1
Pfad des fehlerhaften Moduls: MCUPDA~1.EXE2
Berichtskennung: MCUPDA~1.EXE3
Vollständiger Name des fehlerhaften Pakets: MCUPDA~1.EXE4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: MCUPDA~1.EXE5
Error: (07/20/2015 06:36:16 PM) (Source: McLogEvent) (EventID: 5022) (User: NT-AUTORITÄT)
Description: 1
Error: (07/20/2015 06:36:04 PM) (Source: McLogEvent) (EventID: 5022) (User: NT-AUTORITÄT)
Description: 1
Error: (07/20/2015 06:29:28 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: McHlp32.exe, Version: 11.6.334.0, Zeitstempel: 0x4fb00bab
Name des fehlerhaften Moduls: Flash.ocx, Version: 11.6.602.167, Zeitstempel: 0x510d5c95
Ausnahmecode: 0xc0000005
Fehleroffset: 0x001fbd53
ID des fehlerhaften Prozesses: 0x16a8
Startzeit der fehlerhaften Anwendung: 0xMcHlp32.exe0
Pfad der fehlerhaften Anwendung: McHlp32.exe1
Pfad des fehlerhaften Moduls: McHlp32.exe2
Berichtskennung: McHlp32.exe3
Vollständiger Name des fehlerhaften Pakets: McHlp32.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: McHlp32.exe5
Error: (07/20/2015 06:29:25 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: McHlp32.exe, Version: 11.6.334.0, Zeitstempel: 0x4fb00bab
Name des fehlerhaften Moduls: Flash.ocx, Version: 11.6.602.167, Zeitstempel: 0x510d5c95
Ausnahmecode: 0xc0000005
Fehleroffset: 0x001fbd53
ID des fehlerhaften Prozesses: 0xc20
Startzeit der fehlerhaften Anwendung: 0xMcHlp32.exe0
Pfad der fehlerhaften Anwendung: McHlp32.exe1
Pfad des fehlerhaften Moduls: McHlp32.exe2
Berichtskennung: McHlp32.exe3
Vollständiger Name des fehlerhaften Pakets: McHlp32.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: McHlp32.exe5
Error: (07/20/2015 05:59:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: McHlp32.exe, Version: 11.6.334.0, Zeitstempel: 0x4fb00bab
Name des fehlerhaften Moduls: Flash.ocx, Version: 11.6.602.167, Zeitstempel: 0x510d5c95
Ausnahmecode: 0xc0000005
Fehleroffset: 0x001fbd53
ID des fehlerhaften Prozesses: 0x135c
Startzeit der fehlerhaften Anwendung: 0xMcHlp32.exe0
Pfad der fehlerhaften Anwendung: McHlp32.exe1
Pfad des fehlerhaften Moduls: McHlp32.exe2
Berichtskennung: McHlp32.exe3
Vollständiger Name des fehlerhaften Pakets: McHlp32.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: McHlp32.exe5
System errors:
=============
Error: (07/23/2015 07:27:48 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "BARIS-PC :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.2.103
registriert werden. Der Computer mit IP-Adresse 192.168.2.102 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.
Error: (07/23/2015 07:27:48 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "BARIS-PC :20" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.2.103
registriert werden. Der Computer mit IP-Adresse 192.168.2.102 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.
Error: (07/23/2015 07:27:48 PM) (Source: Server) (EventID: 2505) (User: )
Description: Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{1CC1E401-3DEE-41B5-9233-83C3062221C5} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden.
Error: (07/23/2015 07:14:23 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "BARIS-PC :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.2.103
registriert werden. Der Computer mit IP-Adresse 192.168.2.102 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.
Error: (07/23/2015 07:14:23 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "BARIS-PC :20" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.2.103
registriert werden. Der Computer mit IP-Adresse 192.168.2.102 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.
Error: (07/23/2015 07:14:23 PM) (Source: Server) (EventID: 2505) (User: )
Description: Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{1CC1E401-3DEE-41B5-9233-83C3062221C5} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden.
Error: (07/23/2015 07:14:19 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "BARIS-PC :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.2.103
registriert werden. Der Computer mit IP-Adresse 192.168.2.102 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.
Error: (07/23/2015 07:14:02 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "BARIS-PC :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.2.103
registriert werden. Der Computer mit IP-Adresse 192.168.2.102 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.
Error: (07/23/2015 07:13:45 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 23.07.2015 um 18:35:36 unerwartet heruntergefahren.
Error: (07/23/2015 05:32:48 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x800f0841 fehlgeschlagen: Update für Windows 8 für x64-Systeme (KB2770917)
Microsoft Office:
=========================
Error: (07/23/2015 05:27:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: MCUPDA~1.EXE3.0.350.055523a70McShieldClient.dll1.3.2.53355146a5ec0000005000000000002dcbc74401d0c55c10d6c0d1c:\PROGRA~1\COMMON~1\mcafee\updmgr\30350~1.4\MCUPDA~1.EXEC:\Program Files\Common Files\McAfee\AMCore\McShieldClient.dll572e80fb-314f-11e5-be75-24fd52405a8f
Error: (07/20/2015 06:36:16 PM) (Source: McLogEvent) (EventID: 5022) (User: NT-AUTORITÄT)
Description: 1
Error: (07/20/2015 06:36:04 PM) (Source: McLogEvent) (EventID: 5022) (User: NT-AUTORITÄT)
Description: 1
Error: (07/20/2015 06:29:28 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: McHlp32.exe11.6.334.04fb00babFlash.ocx11.6.602.167510d5c95c0000005001fbd5316a801d0c3093f3ec3f9C:\PROGRA~2\McAfee\MSC\McHlp32.exeC:\Windows\SYSTEM32\Macromed\Flash\Flash.ocx7d7035d5-2efc-11e5-be72-24fd52405a8f
Error: (07/20/2015 06:29:25 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: McHlp32.exe11.6.334.04fb00babFlash.ocx11.6.602.167510d5c95c0000005001fbd53c2001d0c3093d74d96eC:\PROGRA~2\McAfee\MSC\McHlp32.exeC:\Windows\SYSTEM32\Macromed\Flash\Flash.ocx7bd6b24c-2efc-11e5-be72-24fd52405a8f
Error: (07/20/2015 05:59:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: McHlp32.exe11.6.334.04fb00babFlash.ocx11.6.602.167510d5c95c0000005001fbd53135c01d0c30518fa5677C:\PROGRA~2\McAfee\MSC\McHlp32.exeC:\Windows\SYSTEM32\Macromed\Flash\Flash.ocx5e584fd9-2ef8-11e5-be72-24fd52405a8f
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-3230M CPU @ 2.60GHz
Percentage of memory in use: 33%
Total physical RAM: 8089.77 MB
Available physical RAM: 5352.04 MB
Total Virtual: 12697.77 MB
Available Virtual: 9831.76 MB
==================== Drives ================================
Drive c: (Windows8_OS) (Fixed) (Total:883.74 GB) (Free:838.95 GB) NTFS ==>[system with boot components (obtained from reading drive)]
Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:22.48 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 8D042A54)
Partition: GPT Partition Type.
==================== End of log ============================
--- --- ---
Hier das Gmer Logfile
beim Ausführen von Gmer traten 2 Fehlermeldungen auf einmal: Code:
C:\WINDOWS\system32\config\system Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird
und nach dem ausführen des Scan Vorgangs Code:
C:\Users\Baris\ntuser.dat Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.
Gmer log Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-07-23 20:01:12
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000025 ST1000LM024_HN-M101MBB rev.2BA30001 931,51GB
Running: jf03w4lq.exe; Driver: C:\Users\Baris\AppData\Local\Temp\fgdoqpod.sys
---- User code sections - GMER 2.1 ----
.text C:\WINDOWS\system32\atiesrxx.exe[124] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007fe14ba177a 4 bytes [BA, 14, FE, 07]
.text C:\WINDOWS\system32\atiesrxx.exe[124] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007fe14ba1782 4 bytes [BA, 14, FE, 07]
.text C:\WINDOWS\system32\atieclxx.exe[1048] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007fe14ba177a 4 bytes [BA, 14, FE, 07]
.text C:\WINDOWS\system32\atieclxx.exe[1048] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007fe14ba1782 4 bytes [BA, 14, FE, 07]
.text C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe[1944] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007fe14ba177a 4 bytes [BA, 14, FE, 07]
.text C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe[1944] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007fe14ba1782 4 bytes [BA, 14, FE, 07]
.text C:\WINDOWS\system32\mfevtps.exe[2040] C:\WINDOWS\system32\psapi.dll!GetProcessImageFileNameA + 306 000007fe14ba177a 4 bytes [BA, 14, FE, 07]
.text C:\WINDOWS\system32\mfevtps.exe[2040] C:\WINDOWS\system32\psapi.dll!GetProcessImageFileNameA + 314 000007fe14ba1782 4 bytes [BA, 14, FE, 07]
.text C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe[940] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007fe14ba177a 4 bytes [BA, 14, FE, 07]
.text C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe[940] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007fe14ba1782 4 bytes [BA, 14, FE, 07]
.text C:\Program Files\Elantech\ETDCtrl.exe[2512] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fe0dd41532 4 bytes [D4, 0D, FE, 07]
.text C:\Program Files\Elantech\ETDCtrl.exe[2512] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fe0dd4153a 4 bytes [D4, 0D, FE, 07]
.text C:\Program Files\Elantech\ETDCtrl.exe[2512] C:\WINDOWS\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fe0dd4165a 4 bytes [D4, 0D, FE, 07]
.text C:\WINDOWS\Explorer.EXE[3000] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007fe14ba177a 4 bytes [BA, 14, FE, 07]
.text C:\WINDOWS\Explorer.EXE[3000] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007fe14ba1782 4 bytes [BA, 14, FE, 07]
.text C:\WINDOWS\Explorer.EXE[3000] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fe0dd41532 4 bytes [D4, 0D, FE, 07]
.text C:\WINDOWS\Explorer.EXE[3000] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fe0dd4153a 4 bytes [D4, 0D, FE, 07]
.text C:\WINDOWS\Explorer.EXE[3000] C:\WINDOWS\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fe0dd4165a 4 bytes [D4, 0D, FE, 07]
.text C:\Program Files\Common Files\McAfee\CSP\1.5.495.0\McCSPServiceHost.exe[3412] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007fe14ba177a 4 bytes [BA, 14, FE, 07]
.text C:\Program Files\Common Files\McAfee\CSP\1.5.495.0\McCSPServiceHost.exe[3412] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007fe14ba1782 4 bytes [BA, 14, FE, 07]
.text C:\Program Files\Elantech\ETDCtrlHelper.exe[3488] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fe0dd41532 4 bytes [D4, 0D, FE, 07]
.text C:\Program Files\Elantech\ETDCtrlHelper.exe[3488] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fe0dd4153a 4 bytes [D4, 0D, FE, 07]
.text C:\Program Files\Elantech\ETDCtrlHelper.exe[3488] C:\WINDOWS\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fe0dd4165a 4 bytes [D4, 0D, FE, 07]
.text C:\Program Files\Elantech\ETDIntelligent.exe[3512] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fe0dd41532 4 bytes [D4, 0D, FE, 07]
.text C:\Program Files\Elantech\ETDIntelligent.exe[3512] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fe0dd4153a 4 bytes [D4, 0D, FE, 07]
.text C:\Program Files\Elantech\ETDIntelligent.exe[3512] C:\WINDOWS\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fe0dd4165a 4 bytes [D4, 0D, FE, 07]
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4288] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fe0dd41532 4 bytes [D4, 0D, FE, 07]
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4288] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fe0dd4153a 4 bytes [D4, 0D, FE, 07]
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4288] C:\WINDOWS\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fe0dd4165a 4 bytes [D4, 0D, FE, 07]
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4288] C:\WINDOWS\SYSTEM32\WSOCK32.dll!recvfrom + 742 000007fe024f1b32 4 bytes [4F, 02, FE, 07]
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4288] C:\WINDOWS\SYSTEM32\WSOCK32.dll!recvfrom + 750 000007fe024f1b3a 4 bytes [4F, 02, FE, 07]
.text C:\Windows\System32\igfxpers.exe[4496] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007fe14ba177a 4 bytes [BA, 14, FE, 07]
.text C:\Windows\System32\igfxpers.exe[4496] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007fe14ba1782 4 bytes [BA, 14, FE, 07]
.text C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe[4660] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fe0dd41532 4 bytes [D4, 0D, FE, 07]
.text C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe[4660] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fe0dd4153a 4 bytes [D4, 0D, FE, 07]
.text C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe[4660] C:\WINDOWS\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fe0dd4165a 4 bytes [D4, 0D, FE, 07]
.text C:\Program Files\Common Files\McAfee\Platform\mcuicnt.exe[4764] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007fe14ba177a 4 bytes [BA, 14, FE, 07]
.text C:\Program Files\Common Files\McAfee\Platform\mcuicnt.exe[4764] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007fe14ba1782 4 bytes [BA, 14, FE, 07]
.text C:\Program Files\Common Files\McAfee\Platform\Core\mchost.exe[5444] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007fe14ba177a 4 bytes [BA, 14, FE, 07]
.text C:\Program Files\Common Files\McAfee\Platform\Core\mchost.exe[5444] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007fe14ba1782 4 bytes [BA, 14, FE, 07]
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[6008] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fe0dd41532 4 bytes [D4, 0D, FE, 07]
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[6008] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fe0dd4153a 4 bytes [D4, 0D, FE, 07]
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[6008] C:\WINDOWS\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fe0dd4165a 4 bytes [D4, 0D, FE, 07]
---- Threads - GMER 2.1 ----
Thread C:\WINDOWS\system32\csrss.exe [708:740] fffff960008835e8
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
|
Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
WARNUNG an die MITLESER: 