Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Netbook auf Virenbefall überprüfen (https://www.trojaner-board.de/161217-netbook-virenbefall-ueberpruefen.html)

3kats3 26.11.2014 14:42
Netbook auf Virenbefall überprüfen
 
Der PC eines Bekannten hat sich einen Virus eingefangen, wobei u.a. der Mailaccount gehackt wurde, wodurch Spammails versendet wurden und versucht wurde, das Login bei der Sparkasse abzugreifen, was zum Glück noch rechtzeitig bemerkt wurde. Diesen PC hatte ich dann, um auf Nummer sicher zu gehen, komplett neu aufgesetzt.

Im gleichen Netzwerk war aber noch ein Netbook, das ebenfalls im Internet genutzt wurde, aber keine Symptome einer Infektion zeigt(e). Da eine komplette Neuinstallation immer sehr zeitaufwendig ist, hätte ich gerne Eure Hilfe, um einmal zu checken, ob das Netbook evtl. auf befallen ist.

Ich bitte also um die Aufforderungen zum Posten einiger Logfiles. :)

cosinus 26.11.2014 14:45
Hallo und :hallo:

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!



Zudem bitte auch ein Log mit Farbars Tool machen:

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)



Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

3kats3 26.11.2014 15:01
Noch ein paar Zusatzinfos. Das Netbook hat wie gesagt keinen Virenbefall gezeigt, nur der PC, der aber schon komplett neu installiert wurde und wo keine Logs mehr vorhanden sind, was er denn gehabt hat.

Das Netbook hat zudem sehr veraltete Software. Das habe ich schon gestgestellt (Java, Firefox, Flash etc.) und keinen Virenscanner.

Ich habe nun das FRST versucht zu starten, es meldet: AutoIT Error: Error: "EndIf" statement with no matching "If" statement.

Das Netbook hat Windows 7 Starter SP1 32bit installiert. Vielleicht ist das damit nicht kompatibel?

cosinus 26.11.2014 15:05
In einem Strang behandeln und bereinigen wir genau einen PC, also bitte nicht mit Logs von verschiedenen Rechnern ankommen, das stiftet nur Verwirrung und endet im Chaos

Zitat:
Das Netbook hat Windows 7 Starter SP1 32bit installiert. Vielleicht ist das damit nicht kompatibel?
Behandeln wir also in diesem Strang das Netbook.
Ja, FRST läuft definitiv auf einem 32 Bit Windows 7. Für ein 64 Bit Windows 7 muss es es FRST64 sein.

Stell dicher, dass du die richtige Version hast, außerdem muss FRST auf dem Desktop liegen und von da gestartet werden. Deaktiviere den Virenscanner vor dem Doppelklick auf FRST

3kats3 26.11.2014 15:27
Ja nur das Netbook, der PC ist wie gesagt schon bereinigt durch komplette Neuinstallation!

Ich habe die 32bit Version von FRST gezogen und auf dem Desktop abgelegt. Er startet aber nicht, sondern bringt oben genannten Fehler:

AutoIT Error:

Error: "EndIf" statement with no matching "If" statement.

Vielleicht liegt es doch daran, dass nur ein Windows Starter drauf ist? Der User, der es ausführt, hat Admin-Rechte.

cosinus 26.11.2014 15:36
FRST löschen, nochmal neu runterladen

3kats3 26.11.2014 15:50
Zitat:
Zitat von cosinus (Beitrag 1389557)
FRST löschen, nochmal neu runterladen
Leider bringt er immer wieder den gleichen Fehler, hab die Datei jetzt schon 4x neu gezogen, Mist. Oder braucht das Programm eine aktive Internetverbindung oder so?

cosinus 26.11.2014 15:58
Nein...Virenscanner vorher deaktiviert?

3kats3 27.11.2014 10:58
Ja, den hab ich sogar deinstalliert, nachdem er eh seit 2011 kein Update mehr gezogen hatte. Hab das Netbook noch mal neu gestartet und FRST erneut ausgeführt, aber er bleibt bei der Fehlermeldung. Adminrechte hat der Benutzer auch, ich leg mal einen weiteren Benutzer an und probiere es über den oder ist das eher kontraproduktiv?

Leider hat das mit dem anderen Benutzeraccouts auch keine Verbesserung gebracht, er bringt immer den gleichen Fehler. Gibt es vielleicht noch einen anderen Ansatz?

cosinus 27.11.2014 13:48
FRST hatte in der gestrigen Versionen offensichtlich nen Bug.
Einfach nochmal neu runterladen und erneut ausführen.

3kats3 27.11.2014 14:00

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 26-11-2014 01
Ran by Nils (administrator) on NILS-NETBOOK on 27-11-2014 13:54:38
Running from C:\Users\Nils\Desktop
Loaded Profile: Nils (Available profiles: Nils & Test)
Platform: Microsoft Windows 7 Starter  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

() C:\Windows\System32\AsusService.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\VS7DEBUG\mdm.exe
() C:\Program Files\ASUS\Game Park\GameConsole\OberonGameConsoleService.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files\ASUS\Eee Docking\Eee Docking.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe
(ASUS) C:\Windows\AsScrPro.exe
() C:\Program Files\ASUS\EPC\EeeSplendid\AsAgent.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Boingo Wireless, Inc.) C:\Program Files\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe
(ASUSTeK Computer Inc.) C:\Program Files\EeePC\HotkeyService\HotKeyMon.exe
(ASUSTeK Computer Inc.) C:\Program Files\EeePC\HotkeyService\HotkeyService.exe
(ASUSTeK Computer Inc.) C:\Program Files\EeePC\SHE\SuperHybridEngine.exe
() C:\Program Files\ASUS\LiveUpdate\LiveUpdate.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1545512 2009-07-20] (Synaptics Incorporated)
HKLM\...\Run: [HotkeyMon] => C:\Program Files\EeePC\HotkeyService\HotKeyMon.exe [100328 2009-09-11] (ASUSTeK Computer Inc.)
HKLM\...\Run: [HotkeyService] => C:\Program Files\EeePC\HotkeyService\HotkeyService.exe [1021424 2009-10-17] (ASUSTeK Computer Inc.)
HKLM\...\Run: [SuperHybridEngine] => C:\Program Files\EeePC\SHE\SuperHybridEngine.exe [413688 2009-10-26] (ASUSTeK Computer Inc.)
HKLM\...\Run: [Eee Docking] => C:\Program Files\ASUS\Eee Docking\Eee Docking.exe [414384 2009-11-17] ()
HKLM\...\Run: [LiveUpdate] => C:\Program Files\Asus\LiveUpdate\LiveUpdate.exe [803304 2009-08-28] ()
HKLM\...\Run: [SynAsusAcpi] => C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [83240 2009-07-20] (Synaptics Incorporated)
HKLM\...\Run: [ASUS Screen Saver Protector] => C:\Windows\AsScrPro.exe [3058304 2010-01-06] (ASUS)
HKLM\...\Run: [EeeSplendidAgent] => C:\Program Files\ASUS\EPC\EeeSplendid\AsAgent.exe [104960 2009-12-30] ()
HKLM\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7744032 2009-09-29] (Realtek Semiconductor)
HKLM\...\Run: [Boingo Wi-Fi] => C:\Program Files\Boingo\Boingo Wi-Fi\Boingo.lnk [2429 2010-06-09] ()
HKLM\...\Run: [ASUSPRP] => C:\Program Files\ASUS\APRP\APRP.EXE [2018032 2010-01-06] (ASUSTek Computer Inc.)
HKLM\...\Run: [CanonSolutionMenu] => C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe [644696 2007-05-14] (CANON INC.)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [1603152 2007-04-03] (CANON INC.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKU\S-1-5-21-2771088097-4119805611-136013659-1000\...\Run: [msnmsgr] => "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\tmchlang.lnk
ShortcutTarget: tmchlang.lnk -> C:\Program Files\Trend Micro\Internet Security\TmChLang.exe (No File)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2771088097-4119805611-136013659-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus.msn.com
HKU\S-1-5-21-2771088097-4119805611-136013659-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com
HKU\S-1-5-21-2771088097-4119805611-136013659-1000\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://eeepc.asus.com
HKU\S-1-5-21-2771088097-4119805611-136013659-1000\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://eeepc.asus.com
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Skype add-on (mastermind) -> {22BF413B-C6D2-4d91-82A9-A0F997BA588C} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
Toolbar: HKU\S-1-5-21-2771088097-4119805611-136013659-1000 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\Nils\AppData\Roaming\Mozilla\Firefox\Profiles\gcrmjyv1.default
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF32_15_0_0_189.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

Chrome:
=======
CHR Profile: C:\Users\Nils\AppData\Local\Google\Chrome\User Data\Default

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AsusService; C:\Windows\System32\AsusService.exe [219136 2009-08-19] () [File not signed]
R2 MDM; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed]
S2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2009-05-15] (Hewlett-Packard) [File not signed]
R2 OberonGameConsoleService; C:\Program Files\Asus\Game Park\GameConsole\OberonGameConsoleService.exe [44312 2009-09-15] ()
S2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2009-05-15] (Hewlett-Packard) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 AsUpIO; C:\windows\System32\drivers\AsUpIO.sys [11448 2009-07-06] ()
R3 kbfiltr; C:\windows\System32\DRIVERS\kbfiltr.sys [13880 2009-07-20] ( )
S3 btwaudio; system32\drivers\btwaudio.sys [X]
S3 btwavdt; \SystemRoot\system32\DRIVERS\btwavdt.sys [X]
S3 btwl2cap; system32\DRIVERS\btwl2cap.sys [X]
S3 btwrchid; \SystemRoot\system32\DRIVERS\btwrchid.sys [X]
S3 ncplelhp; system32\DRIVERS\ncplelhp.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-27 13:54 - 2014-11-27 13:55 - 00008607 _____ () C:\Users\Nils\Desktop\FRST.txt
2014-11-27 13:54 - 2014-11-27 13:54 - 00000000 ____D () C:\FRST
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 _SHDL () C:\Users\Test\Startmenü
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 _SHDL () C:\Users\Test\Netzwerkumgebung
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 _SHDL () C:\Users\Test\Druckumgebung
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 _SHDL () C:\Users\Test\Documents\Eigene Musik
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 _SHDL () C:\Users\Test\Documents\Eigene Bilder
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 _SHDL () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 _SHDL () C:\Users\Test\AppData\Local\Verlauf
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 ____D () C:\Users\Test\AppData\Local\VirtualStore
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 ____D () C:\Users\Test
2014-11-26 16:10 - 2010-01-07 23:43 - 00000000 ____D () C:\Users\Test\AppData\Roaming\E-Cam
2014-11-26 16:10 - 2010-01-06 23:49 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Game Park
2014-11-26 16:10 - 2010-01-06 23:24 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Adobe
2014-11-26 16:10 - 2010-01-06 23:16 - 00067856 _____ () C:\Users\Test\AppData\Local\GDIPFONTCACHEV1.DAT
2014-11-26 16:10 - 2010-01-06 22:56 - 00000000 ____D () C:\Users\Test\AppData\Local\Microsoft Help
2014-11-26 16:10 - 2010-01-06 22:55 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Macromedia
2014-11-26 16:10 - 2010-01-06 22:55 - 00000000 ____D () C:\Users\Test\AppData\Local\Adobe
2014-11-26 16:10 - 2010-01-06 22:53 - 00000000 ____D () C:\Users\Test\Documents\EBI
2014-11-26 16:10 - 2010-01-06 22:46 - 00000000 ____D () C:\Users\Test\Documents\Bluetooth Exchange Folder
2014-11-26 16:10 - 2010-01-06 22:46 - 00000000 ____D () C:\Users\Test\AppData\Local\Broadcom
2014-11-26 16:10 - 2010-01-06 22:39 - 00000000 ____D () C:\Users\Test\AppData\Roaming\InstallShield
2014-11-26 16:10 - 2009-07-14 05:54 - 00001419 _____ () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-11-26 16:10 - 2009-07-14 05:53 - 00000020 ___SH () C:\Users\Test\ntuser.ini
2014-11-26 16:10 - 2009-07-14 05:42 - 00000000 ___RD () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-11-26 16:10 - 2009-07-14 05:37 - 00000000 ___RD () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-11-26 15:52 - 2014-11-27 13:52 - 01109504 _____ (Farbar) C:\Users\Nils\Desktop\FRST.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-27 13:53 - 2012-09-14 10:04 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-11-27 13:53 - 2010-06-10 04:11 - 01870596 _____ () C:\windows\WindowsUpdate.log
2014-11-26 16:13 - 2009-07-14 05:34 - 00016160 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-26 16:13 - 2009-07-14 05:34 - 00016160 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-26 16:06 - 2010-01-06 23:21 - 00109872 _____ () C:\windows\PFRO.log
2014-11-26 16:06 - 2009-07-14 05:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-11-26 16:06 - 2009-07-14 05:39 - 00090678 _____ () C:\windows\setupact.log
2014-11-26 14:55 - 2009-07-25 08:50 - 01750500 _____ () C:\windows\system32\PerfStringBackup.INI
2014-11-26 14:39 - 2010-01-06 22:47 - 00000000 ____D () C:\Program Files\Trend Micro
2014-11-03 22:34 - 2013-06-29 23:10 - 00000328 _____ () C:\windows\TMFilter.log
2014-11-03 17:34 - 2009-07-14 03:37 - 00000000 ____D () C:\windows\Microsoft.NET
2014-11-03 08:20 - 2014-05-20 08:58 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-11-03 07:59 - 2009-07-14 05:33 - 00418496 _____ () C:\windows\system32\FNTCACHE.DAT

Some content of TEMP:
====================
C:\Users\Nils\AppData\Local\Temp\atl80.dll
C:\Users\Nils\AppData\Local\Temp\mfc80.dll
C:\Users\Nils\AppData\Local\Temp\mfc80u.dll
C:\Users\Nils\AppData\Local\Temp\mfcm80.dll
C:\Users\Nils\AppData\Local\Temp\mfcm80u.dll
C:\Users\Nils\AppData\Local\Temp\msvcm80.dll
C:\Users\Nils\AppData\Local\Temp\msvcp80.dll
C:\Users\Nils\AppData\Local\Temp\msvcr80.dll
C:\Users\Nils\AppData\Local\Temp\TmDbg32.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2013-09-13 20:10

==================== End Of Log ============================
--- --- ---


Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 26-11-2014 01
Ran by Nils at 2014-11-27 13:56:08
Running from C:\Users\Nils\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

32 Bit HP CIO Components Installer (Version: 1.1.0 - Hewlett-Packard) Hidden
Acrobat.com (HKLM\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe AIR (HKLM\...\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)
Adobe Flash Player 10 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 10.0.32.18 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.189 - Adobe Systems Incorporated)
Adobe Reader 9.5.5 MUI (HKLM\...\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.5.5 - Adobe Systems Incorporated)
ASUS VIBE (HKLM\...\ASUS VIBE) (Version: 1.0.187 - Ecareme, Inc.)
ASUSUpdate for Eee PC (HKLM\...\{587178E7-B1DF-494E-9838-FA4DD36E873C}) (Version: 1.03.06 - ASUSTeK Computer Inc.)
Atheros Client Installation Program (HKLM\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 7.0 - Atheros)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.10 - Atheros Communications Inc.)
Boingo Wi-Fi (HKLM\...\{84C2B80B-64A2-4B22-93EC-F30C3D6BF7D8}) (Version: 1.7.0048 - Boingo Wireless, Inc.)
Canon IJ Network Scan Utility (HKLM\...\Canon_IJ_Network_Scan_UTILITY) (Version:  - )
Canon IJ Network Tool (HKLM\...\Canon_IJ_Network_UTILITY) (Version:  - )
Canon MP Navigator EX 1.0 (HKLM\...\MP Navigator EX 1.0) (Version:  - )
Canon MX700 series (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX700_series) (Version:  - )
Canon My Printer (HKLM\...\CanonMyPrinter) (Version:  - )
Canon Utilities Easy-PhotoPrint EX (HKLM\...\Easy-PhotoPrint EX) (Version:  - )
Canon Utilities Solution Menu (HKLM\...\CanonSolutionMenu) (Version:  - )
Chicken Invaders 2 (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110209593}) (Version:  - Oberon Media)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
ebi.BookReader3J (HKLM\...\{F3D2DEDC-4732-4188-8A3A-1A3FFBD4D6C8}) (Version: 3.75.14 - eBOOK Initiative Japan Co., Ltd.)
E-Cam (HKLM\...\{185AFA7A-F63E-450B-94AA-011CAC18090E}) (Version: 2.0.2.3 - )
Eee Docking 3.6.0 (HKLM\...\Eee Docking_is1) (Version: 3.6.0 - ASUSTek Computer Inc.)
EeeSplendid (HKLM\...\{6333FC29-BFE5-4024-AC78-958A1A7555D1}) (Version: 5.1.2.0008 - ASUS)
EeeSplendid (Version: 5.1.2.0008 - ASUS) Hidden
FontResizer (HKLM\...\InstallShield_{17780F99-A9DF-450B-81B3-6781B20A17A8}) (Version: 1.01.0011 - ASUSTek)
FontResizer (Version: 1.01.0011 - ASUSTek) Hidden
Game Park Console (HKLM\...\{BB5E5F87-E939-4974-A006-2B4A2F60EEA3}_is1) (Version: 5.2.1.4 - Oberon Media, Inc.)
Hotkey Service (HKLM\...\{71C0E38E-09F2-4386-9977-404D4F6640CD}) (Version: 1.15 - AsusTek Computer)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.14.10.2117 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
LiveUpdate (HKLM\...\{38E5A3B1-ADF1-47E0-8024-76310A30EB36}) (Version: 1.19 - Asus)
LocaleMe (HKLM\...\{F58C1D44-4AC9-48E8-9049-7A6CDFCB415C}) (Version: 1.3 - ASUS)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0100-040C-0000-0000000FF1CE}_OMUI.fr-fr_{CF3C20A6-47B7-48DA-95C1-6FBB5A439AF8}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0100-0410-0000-0000000FF1CE}_OMUI.it-it_{7F40286D-09A7-4DC0-A2A4-AA18D026D369}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0100-0413-0000-0000000FF1CE}_OMUI.nl-nl_{26257879-B20D-4D30-A429-B387A4890929}) (Version:  - Microsoft)
Microsoft Office Excel 2007 Help - Aggiornamento (KB963678) (HKLM\...\{90120000-0016-0410-0000-0000000FF1CE}_OMUI.it-it_{9F57BDED-B51B-4D2F-B360-5B4EFAAF0F1A}) (Version:  - Microsoft)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Language Pack 2007 - Dutch/Nederlands (HKLM\...\OMUI.nl-nl) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Language Pack 2007 - French/Français (HKLM\...\OMUI.fr-fr) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Language Pack 2007 - German/Deutsch (HKLM\...\OMUI.de-de) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Language Pack 2007 - Italian/Italiano (HKLM\...\OMUI.it-it) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Outlook 2007 Help - Aggiornamento (KB963677) (HKLM\...\{90120000-001A-0410-0000-0000000FF1CE}_OMUI.it-it_{2278E02A-AB15-4BF7-B2B4-5C0EEB4B7EEB}) (Version:  - Microsoft)
Microsoft Office Powerpoint 2007 Help - Aggiornamento (KB963669) (HKLM\...\{90120000-0018-0410-0000-0000000FF1CE}_OMUI.it-it_{C76C02F1-B07F-4974-876A-A18DEC9887C8}) (Version:  - Microsoft)
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2007 (HKLM\...\PROPLUS) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Word 2007 Help - Aggiornamento (KB963665) (HKLM\...\{90120000-001B-0410-0000-0000000FF1CE}_OMUI.it-it_{E5B82DB3-DD7D-4C45-BC5E-09864B26F9BC}) (Version:  - Microsoft)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Mise à jour Microsoft Office Excel 2007 Help  (KB963678) (HKLM\...\{90120000-0016-040C-0000-0000000FF1CE}_OMUI.fr-fr_{B761869A-B85C-40E2-994C-A1CE78AC8F2C}) (Version:  - Microsoft)
Mise à jour Microsoft Office Outlook 2007 Help  (KB963677) (HKLM\...\{90120000-001A-040C-0000-0000000FF1CE}_OMUI.fr-fr_{51EFB347-1F3D-4BAC-8B79-F056B904FE21}) (Version:  - Microsoft)
Mise à jour Microsoft Office Powerpoint 2007 Help  (KB963669) (HKLM\...\{90120000-0018-040C-0000-0000000FF1CE}_OMUI.fr-fr_{C3DCA38E-005E-41BA-A52A-7C3429F351C3}) (Version:  - Microsoft)
Mise à jour Microsoft Office Word 2007 Help  (KB963665) (HKLM\...\{90120000-001B-040C-0000-0000000FF1CE}_OMUI.fr-fr_{81536A04-DBFB-4DB3-978F-0F284590C223}) (Version:  - Microsoft)
Mozilla Firefox 7.0.1 (x86 de) (HKLM\...\Mozilla Firefox 7.0.1 (x86 de)) (Version: 7.0.1 - Mozilla)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
Ralink RT2860 Wireless LAN Card (HKLM\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309B0}) (Version: 1.2.0.1 - Ralink)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5948 - Realtek Semiconductor Corp.)
Skype web features (HKLM\...\{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}) (Version: 1.0.3971 - Skype Technologies S.A.)
Skype™ 6.11 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Super Hybrid Engine (HKLM\...\{88F08F98-12BC-4613-81A2-8F9B88CFC73E}) (Version: 2.10 - AsusTek Computer)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 13.2.6.1 - Synaptics Incorporated)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_OMUI.de-de_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_PROPLUS_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_PROPLUS_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_OMUI.de-de_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_PROPLUS_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_OMUI.de-de_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_PROPLUS_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Update voor Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0413-0000-0000000FF1CE}_OMUI.nl-nl_{5CF7002F-6F49-4482-9564-5614FBE560FA}) (Version:  - Microsoft)
Update voor Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0413-0000-0000000FF1CE}_OMUI.nl-nl_{15D84E79-1ED7-42C5-B2FD-745C3FBDDDC5}) (Version:  - Microsoft)
Update voor Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0413-0000-0000000FF1CE}_OMUI.nl-nl_{A66AE6A1-8D8C-4102-BC18-38CBDE40F809}) (Version:  - Microsoft)
Windows Driver Package - Broadcom Bluetooth  (07/17/2009 6.2.0.9403) (HKLM\...\B41C7C96D83162A676DA7365ADEFD6C1AF62A4EE) (Version: 07/17/2009 6.2.0.9403 - Broadcom)
Windows Driver Package - Broadcom Bluetooth  (07/29/2009 6.1.7100.0) (HKLM\...\B5C82F3814F82FB37F1513B3185399BD88892B08) (Version: 07/29/2009 6.1.7100.0 - Broadcom)
Windows Driver Package - Broadcom HIDClass  (07/28/2009 6.2.0.9800) (HKLM\...\BF20603967CFDCB2BBF91950E8A56DFBC5C833FE) (Version: 07/28/2009 6.2.0.9800 - Broadcom)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

11-09-2014 08:04:00 Windows Update
26-09-2014 10:40:03 Windows Update
27-09-2014 06:39:56 Windows Update
05-10-2014 05:18:44 Windows Update
06-10-2014 18:44:55 Windows Update
22-10-2014 15:25:15 Windows Update
24-10-2014 07:35:54 Windows Update
03-11-2014 07:02:49 Windows Update
03-11-2014 07:18:42 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {C4FBF6D9-661D-49FA-8AC5-34203AA420E7} - System32\Tasks\Adobe Flash Player Updater => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-10-22] (Adobe Systems Incorporated)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2010-01-06 22:47 - 2009-08-19 02:35 - 00219136 _____ () C:\Windows\System32\AsusService.exe
2010-01-06 23:49 - 2009-09-15 02:05 - 00044312 _____ () C:\Program Files\Asus\Game Park\GameConsole\OberonGameConsoleService.exe
2010-01-06 23:16 - 2009-11-17 22:47 - 00414384 _____ () C:\Program Files\ASUS\Eee Docking\Eee Docking.exe
2010-01-06 23:30 - 2009-12-30 00:28 - 00104960 _____ () C:\Program Files\ASUS\EPC\EeeSplendid\AsAgent.exe
2009-08-28 00:38 - 2009-08-28 00:38 - 00803304 _____ () C:\Program Files\Asus\LiveUpdate\LiveUpdate.exe
2009-08-28 00:45 - 2009-08-28 00:45 - 00120808 _____ () C:\Program Files\Asus\LiveUpdate\ClientSocket.dll
2009-08-28 01:29 - 2009-08-28 01:29 - 00182240 _____ () C:\Program Files\Asus\LiveUpdate\Parser.dll
2009-08-28 01:22 - 2009-08-28 01:22 - 00161768 _____ () C:\Program Files\Asus\LiveUpdate\Enumeration.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: NcpBudgetGui => "C:\Program Files\WatchGuard\Mobile VPN\NcpBudgetGui.exe" -start
MSCONFIG\startupreg: NcpMonitor => "C:\Program Files\WatchGuard\Mobile VPN\ncpmon.exe" autorun
MSCONFIG\startupreg: NcpPopup => "C:\Program Files\WatchGuard\Mobile VPN\ncppopup.exe" noerrmsg
MSCONFIG\startupreg: NcpRsuGui => "C:\Program Files\WatchGuard\Mobile VPN\rwsrsu.exe" -gui

========================= Accounts: ==========================

Administrator (S-1-5-21-2771088097-4119805611-136013659-500 - Administrator - Disabled)
Gast (S-1-5-21-2771088097-4119805611-136013659-501 - Limited - Disabled)
Nils (S-1-5-21-2771088097-4119805611-136013659-1000 - Administrator - Enabled) => C:\Users\Nils
Test (S-1-5-21-2771088097-4119805611-136013659-1002 - Administrator - Enabled) => C:\Users\Test

==================== Faulty Device Manager Devices =============

Name: Canon MX700 ser Network
Description: Canon MX700 ser Network
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Canon
Service: StillCam
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (11/26/2014 04:10:55 PM) (Source: ESENT) (EventID: 215) (User: )
Description: WinMail (3476) WindowsMail0: Die Sicherung wurde abgebrochen, weil sie vom Client angehalten wurde, oder weil die Verbindung mit dem Client unterbrochen wurde.

Error: (11/26/2014 02:38:17 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: tmlisten.exe, Version: 11.5.0.1049, Zeitstempel: 0x4c736eb2
Name des fehlerhaften Moduls: tmlisten.exe, Version: 11.5.0.1049, Zeitstempel: 0x4c736eb2
Ausnahmecode: 0x40000015
Fehleroffset: 0x000f2b25
ID des fehlerhaften Prozesses: 0xb60
Startzeit der fehlerhaften Anwendung: 0xtmlisten.exe0
Pfad der fehlerhaften Anwendung: tmlisten.exe1
Pfad des fehlerhaften Moduls: tmlisten.exe2
Berichtskennung: tmlisten.exe3

Error: (11/03/2014 00:25:55 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm pccnt.exe, Version 10.5.0.1103 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 384

Startzeit: 01cff758887b2b44

Endzeit: 16

Anwendungspfad: C:\Program Files\Trend Micro\OfficeScan Client\pccnt.exe

Berichts-ID: 272a2ab0-634c-11e4-941b-485b3925aa2e

Error: (10/24/2014 08:38:51 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: OUTLOOK.EXE, Version: 12.0.6691.5000, Zeitstempel: 0x52e8c57c
Name des fehlerhaften Moduls: olmapi32.dll, Version: 12.0.6672.5000, Zeitstempel: 0x50e61339
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00026445
ID des fehlerhaften Prozesses: 0xb58
Startzeit der fehlerhaften Anwendung: 0xOUTLOOK.EXE0
Pfad der fehlerhaften Anwendung: OUTLOOK.EXE1
Pfad des fehlerhaften Moduls: OUTLOOK.EXE2
Berichtskennung: OUTLOOK.EXE3

Error: (09/11/2014 11:19:57 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm OUTLOOK.EXE, Version 12.0.6691.5000 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1554

Startzeit: 01cfcda84e1ea05e

Endzeit: 124

Anwendungspfad: C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE

Berichts-ID: 0286ac41-399d-11e4-941b-485b3925aa2e

Error: (09/18/2012 02:01:16 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: AutoRun.exe_AutoRun, Version: 5.1.2.0, Zeitstempel: 0x4b037266
Name des fehlerhaften Moduls: Chameleon.dll, Version: 2.0.2.0, Zeitstempel: 0x48fdc859
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00007383
ID des fehlerhaften Prozesses: 0x152c
Startzeit der fehlerhaften Anwendung: 0xAutoRun.exe_AutoRun0
Pfad der fehlerhaften Anwendung: AutoRun.exe_AutoRun1
Pfad des fehlerhaften Moduls: AutoRun.exe_AutoRun2
Berichtskennung: AutoRun.exe_AutoRun3

Error: (05/01/2012 06:40:14 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\windows\system32\svchost.exe -k netsvcs; Beschreibung = Windows Update; Fehler = 0x81000101).

Error: (04/26/2012 04:09:25 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: rwsrsu.exe, Version: 0.0.0.0, Zeitstempel: 0x4ad3310e
Name des fehlerhaften Moduls: rwsrsu.exe, Version: 0.0.0.0, Zeitstempel: 0x4ad3310e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00037668
ID des fehlerhaften Prozesses: 0xc50
Startzeit der fehlerhaften Anwendung: 0xrwsrsu.exe0
Pfad der fehlerhaften Anwendung: rwsrsu.exe1
Pfad des fehlerhaften Moduls: rwsrsu.exe2
Berichtskennung: rwsrsu.exe3

Error: (02/11/2012 01:49:15 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (02/11/2012 01:49:15 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren, die für die Sprach-ID "009" definiert wurden, können nicht gelesen werden. Das erste DWORD im Datenbereich enthält den Win32-Fehlercode.


System errors:
=============
Error: (11/26/2014 04:06:42 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom

Error: (11/26/2014 02:24:44 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom

Error: (11/07/2014 08:50:53 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom

Error: (11/06/2014 07:25:54 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom

Error: (11/06/2014 03:29:20 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom

Error: (11/06/2014 09:33:04 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom

Error: (11/05/2014 10:06:40 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom

Error: (11/03/2014 04:31:51 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst ShellHWDetection erreicht.

Error: (11/03/2014 04:05:06 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom

Error: (11/03/2014 00:22:09 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom


Microsoft Office Sessions:
=========================
Error: (10/24/2014 08:38:48 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 16 seconds with 0 seconds of active time.  This session ended with a crash.


==================== Memory info ===========================

Processor: Intel(R) Atom(TM) CPU N450 @ 1.66GHz
Percentage of memory in use: 30%
Total physical RAM: 2038.18 MB
Available physical RAM: 1413.54 MB
Total Pagefile: 4076.36 MB
Available Pagefile: 3339 MB
Total Virtual: 2047.88 MB
Available Virtual: 1911.05 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:80 GB) (Free:40.3 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:59.03 GB) (Free:48.97 GB) NTFS
Drive e: (Elements) (Fixed) (Total:931.48 GB) (Free:0.27 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149.1 GB) (Disk ID: 9F1192B6)
Partition 1: (Active) - (Size=80 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=59 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=10 GB) - (Type=1B)
Partition 4: (Not Active) - (Size=17 MB) - (Type=EF)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 931.5 GB) (Disk ID: 52DD04D5)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

==================== End Of Log ============================

cosinus 27.11.2014 15:35
Zitat:
Microsoft Office Professional Plus 2007
Was macht man denn mit so ner teuren Office Edition auf nem winzigen Netbook? :wtf:

3kats3 27.11.2014 15:39
Das Office wurde vom Arbeitgeber gestellt und ist eine sehr vergünstigte Lizenz EDU, aber das Netbook wird überwiegend privat genutzt und wurde nicht vom Arbeitgeber gestellt.

Ich weiß, dass viele Programme dringend aktualisiert gehören, aber ist ein Virenbefall zu entdecken? Symptome zeigt das Gerät ja nicht, es ist nur, dass es mit einem stark infizierten PC zusammen im gleichen Netzwerk betrieben wurde.

cosinus 27.11.2014 15:54
Ich find eine derartige Office Version nur ungewöhnlich auf nem Netbook, deswegen hab ich dich gefragt...

Adware/Junkware/Toolbars entfernen

(alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!)

1. Schritt: adwCleaner

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).




2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.




3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


3kats3 27.11.2014 16:16
Hier die gewünschten Logs, heute läuft es ja doch schon sehr viel flüssiger als gestern mit den Tools:

Code:
# AdwCleaner v4.102 - Bericht erstellt am 27/11/2014 um 16:02:33
# Aktualisiert 23/11/2014 von Xplode
# Database : 2014-11-23.7 [Local]
# Betriebssystem : Windows 7 Starter Service Pack 1 (32 bits)
# Benutzername : Nils - NILS-NETBOOK
# Gestartet von : C:\Users\Nils\Desktop\AdwCleaner_4.102.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.EasyHideBtn
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.EasyHideBtn.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.Localizer
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.Localizer.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.NameHighlighter
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.NameHighlighter.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.NameHighlighterStatistics
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.NameHighlighterStatistics.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.SkypeIEHelper
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.SkypeIEHelper.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.SNameProxy
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.SNameProxy.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{937936AF-28CA-4973-B8AE-F250406149A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{937936AF-28CA-4973-B8AE-F250406149A2}

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17344


-\\ Mozilla Firefox v7.0.1 (de)


-\\ Google Chrome v

[C:\Users\Nils\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://de.ask.com/web?q={searchTerms}

*************************

AdwCleaner[R0].txt - [1946 octets] - [27/11/2014 15:58:07]
AdwCleaner[S0].txt - [1867 octets] - [27/11/2014 16:02:33]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1927 octets] ##########
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.9 (11.15.2014:2)
OS: Windows 7 Starter x86
Ran by Nils on 27.11.2014 at 16:04:59,51
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 27.11.2014 at 16:10:28,31
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 26-11-2014 01
Ran by Nils (administrator) on NILS-NETBOOK on 27-11-2014 16:10:56
Running from C:\Users\Nils\Desktop
Loaded Profile: Nils (Available profiles: Nils & Test)
Platform: Microsoft Windows 7 Starter  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

() C:\Windows\System32\AsusService.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\VS7DEBUG\mdm.exe
() C:\Program Files\ASUS\Game Park\GameConsole\OberonGameConsoleService.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe
(ASUS) C:\Windows\AsScrPro.exe
() C:\Program Files\ASUS\EPC\EeeSplendid\AsAgent.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(ASUSTeK Computer Inc.) C:\Program Files\EeePC\HotkeyService\HotKeyMon.exe
(ASUSTeK Computer Inc.) C:\Program Files\EeePC\SHE\SuperHybridEngine.exe
(ASUSTeK Computer Inc.) C:\Program Files\EeePC\HotkeyService\HotkeyService.exe
() C:\Program Files\ASUS\LiveUpdate\LiveUpdate.exe
(Boingo Wireless, Inc.) C:\Program Files\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files\ASUS\Eee Docking\Eee Docking.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1545512 2009-07-20] (Synaptics Incorporated)
HKLM\...\Run: [HotkeyMon] => C:\Program Files\EeePC\HotkeyService\HotKeyMon.exe [100328 2009-09-11] (ASUSTeK Computer Inc.)
HKLM\...\Run: [HotkeyService] => C:\Program Files\EeePC\HotkeyService\HotkeyService.exe [1021424 2009-10-17] (ASUSTeK Computer Inc.)
HKLM\...\Run: [SuperHybridEngine] => C:\Program Files\EeePC\SHE\SuperHybridEngine.exe [413688 2009-10-26] (ASUSTeK Computer Inc.)
HKLM\...\Run: [Eee Docking] => C:\Program Files\ASUS\Eee Docking\Eee Docking.exe [414384 2009-11-17] ()
HKLM\...\Run: [LiveUpdate] => C:\Program Files\Asus\LiveUpdate\LiveUpdate.exe [803304 2009-08-28] ()
HKLM\...\Run: [SynAsusAcpi] => C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [83240 2009-07-20] (Synaptics Incorporated)
HKLM\...\Run: [ASUS Screen Saver Protector] => C:\Windows\AsScrPro.exe [3058304 2010-01-06] (ASUS)
HKLM\...\Run: [EeeSplendidAgent] => C:\Program Files\ASUS\EPC\EeeSplendid\AsAgent.exe [104960 2009-12-30] ()
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7744032 2009-09-29] (Realtek Semiconductor)
HKLM\...\Run: [Boingo Wi-Fi] => C:\Program Files\Boingo\Boingo Wi-Fi\Boingo.lnk [2429 2010-06-09] ()
HKLM\...\Run: [ASUSPRP] => C:\Program Files\ASUS\APRP\APRP.EXE [2018032 2010-01-06] (ASUSTek Computer Inc.)
HKLM\...\Run: [CanonSolutionMenu] => C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe [644696 2007-05-14] (CANON INC.)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [1603152 2007-04-03] (CANON INC.)
HKU\S-1-5-21-2771088097-4119805611-136013659-1000\...\Run: [msnmsgr] => "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\tmchlang.lnk
ShortcutTarget: tmchlang.lnk -> C:\Program Files\Trend Micro\Internet Security\TmChLang.exe (No File)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2771088097-4119805611-136013659-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus.msn.com
HKU\S-1-5-21-2771088097-4119805611-136013659-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com
HKU\S-1-5-21-2771088097-4119805611-136013659-1000\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://eeepc.asus.com
HKU\S-1-5-21-2771088097-4119805611-136013659-1000\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://eeepc.asus.com
BHO: Skype add-on (mastermind) -> {22BF413B-C6D2-4d91-82A9-A0F997BA588C} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
Toolbar: HKU\S-1-5-21-2771088097-4119805611-136013659-1000 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\Nils\AppData\Roaming\Mozilla\Firefox\Profiles\gcrmjyv1.default
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF32_15_0_0_189.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

Chrome:
=======
CHR Profile: C:\Users\Nils\AppData\Local\Google\Chrome\User Data\Default

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AsusService; C:\Windows\System32\AsusService.exe [219136 2009-08-19] () [File not signed]
R2 MDM; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed]
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2009-05-15] (Hewlett-Packard) [File not signed]
R2 OberonGameConsoleService; C:\Program Files\Asus\Game Park\GameConsole\OberonGameConsoleService.exe [44312 2009-09-15] ()
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2009-05-15] (Hewlett-Packard) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 AsUpIO; C:\windows\System32\drivers\AsUpIO.sys [11448 2009-07-06] ()
R3 kbfiltr; C:\windows\System32\DRIVERS\kbfiltr.sys [13880 2009-07-20] ( )
S3 btwaudio; system32\drivers\btwaudio.sys [X]
S3 btwavdt; \SystemRoot\system32\DRIVERS\btwavdt.sys [X]
S3 btwl2cap; system32\DRIVERS\btwl2cap.sys [X]
S3 btwrchid; \SystemRoot\system32\DRIVERS\btwrchid.sys [X]
S3 ncplelhp; system32\DRIVERS\ncplelhp.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-27 16:10 - 2014-11-27 16:13 - 00007817 _____ () C:\Users\Nils\Desktop\FRST.txt
2014-11-27 16:10 - 2014-11-27 16:10 - 00000619 _____ () C:\Users\Nils\Desktop\JRT.txt
2014-11-27 16:04 - 2014-11-27 16:04 - 00000000 ____D () C:\windows\ERUNT
2014-11-27 15:58 - 2014-11-27 16:02 - 00000000 ____D () C:\AdwCleaner
2014-11-27 15:57 - 2014-11-27 15:56 - 01707532 _____ (Thisisu) C:\Users\Nils\Desktop\JRT.exe
2014-11-27 15:57 - 2014-11-27 15:55 - 02148864 _____ () C:\Users\Nils\Desktop\AdwCleaner_4.102.exe
2014-11-27 13:54 - 2014-11-27 16:11 - 00000000 ____D () C:\FRST
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 _SHDL () C:\Users\Test\Startmenü
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 _SHDL () C:\Users\Test\Netzwerkumgebung
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 _SHDL () C:\Users\Test\Druckumgebung
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 _SHDL () C:\Users\Test\Documents\Eigene Musik
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 _SHDL () C:\Users\Test\Documents\Eigene Bilder
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 _SHDL () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 _SHDL () C:\Users\Test\AppData\Local\Verlauf
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 ____D () C:\Users\Test\AppData\Local\VirtualStore
2014-11-26 16:10 - 2014-11-26 16:10 - 00000000 ____D () C:\Users\Test
2014-11-26 16:10 - 2010-01-07 23:43 - 00000000 ____D () C:\Users\Test\AppData\Roaming\E-Cam
2014-11-26 16:10 - 2010-01-06 23:49 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Game Park
2014-11-26 16:10 - 2010-01-06 23:24 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Adobe
2014-11-26 16:10 - 2010-01-06 23:16 - 00067856 _____ () C:\Users\Test\AppData\Local\GDIPFONTCACHEV1.DAT
2014-11-26 16:10 - 2010-01-06 22:56 - 00000000 ____D () C:\Users\Test\AppData\Local\Microsoft Help
2014-11-26 16:10 - 2010-01-06 22:55 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Macromedia
2014-11-26 16:10 - 2010-01-06 22:55 - 00000000 ____D () C:\Users\Test\AppData\Local\Adobe
2014-11-26 16:10 - 2010-01-06 22:53 - 00000000 ____D () C:\Users\Test\Documents\EBI
2014-11-26 16:10 - 2010-01-06 22:46 - 00000000 ____D () C:\Users\Test\Documents\Bluetooth Exchange Folder
2014-11-26 16:10 - 2010-01-06 22:46 - 00000000 ____D () C:\Users\Test\AppData\Local\Broadcom
2014-11-26 16:10 - 2010-01-06 22:39 - 00000000 ____D () C:\Users\Test\AppData\Roaming\InstallShield
2014-11-26 16:10 - 2009-07-14 05:54 - 00001419 _____ () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-11-26 16:10 - 2009-07-14 05:53 - 00000020 ___SH () C:\Users\Test\ntuser.ini
2014-11-26 16:10 - 2009-07-14 05:42 - 00000000 ___RD () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-11-26 16:10 - 2009-07-14 05:37 - 00000000 ___RD () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-11-26 15:52 - 2014-11-27 13:52 - 01109504 _____ (Farbar) C:\Users\Nils\Desktop\FRST.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-27 16:12 - 2012-09-14 10:04 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-11-27 16:10 - 2009-07-14 05:34 - 00016160 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-27 16:10 - 2009-07-14 05:34 - 00016160 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-27 16:08 - 2010-06-10 04:11 - 01882919 _____ () C:\windows\WindowsUpdate.log
2014-11-27 16:03 - 2010-01-06 23:21 - 00110668 _____ () C:\windows\PFRO.log
2014-11-27 16:03 - 2009-07-14 05:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-11-27 16:03 - 2009-07-14 05:39 - 00090734 _____ () C:\windows\setupact.log
2014-11-27 14:07 - 2010-06-09 11:12 - 00000000 ____D () C:\Users\Nils\AppData\Local\Adobe
2014-11-27 14:07 - 2010-01-07 18:04 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-11-27 14:07 - 2010-01-06 22:54 - 00000000 ____D () C:\ProgramData\Adobe
2014-11-27 14:07 - 2010-01-06 22:54 - 00000000 ____D () C:\Program Files\Adobe
2014-11-26 14:55 - 2009-07-25 08:50 - 01750500 _____ () C:\windows\system32\PerfStringBackup.INI
2014-11-26 14:39 - 2010-01-06 22:47 - 00000000 ____D () C:\Program Files\Trend Micro
2014-11-03 22:34 - 2013-06-29 23:10 - 00000328 _____ () C:\windows\TMFilter.log
2014-11-03 17:34 - 2009-07-14 03:37 - 00000000 ____D () C:\windows\Microsoft.NET
2014-11-03 08:20 - 2014-05-20 08:58 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-11-03 07:59 - 2009-07-14 05:33 - 00418496 _____ () C:\windows\system32\FNTCACHE.DAT

Some content of TEMP:
====================
C:\Users\Nils\AppData\Local\Temp\atl80.dll
C:\Users\Nils\AppData\Local\Temp\mfc80.dll
C:\Users\Nils\AppData\Local\Temp\mfc80u.dll
C:\Users\Nils\AppData\Local\Temp\mfcm80.dll
C:\Users\Nils\AppData\Local\Temp\mfcm80u.dll
C:\Users\Nils\AppData\Local\Temp\msvcm80.dll
C:\Users\Nils\AppData\Local\Temp\msvcp80.dll
C:\Users\Nils\AppData\Local\Temp\msvcr80.dll
C:\Users\Nils\AppData\Local\Temp\Quarantine.exe
C:\Users\Nils\AppData\Local\Temp\sqlite3.dll
C:\Users\Nils\AppData\Local\Temp\TmDbg32.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2013-09-13 20:10

==================== End Of Log ============================
--- --- ---


Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 26-11-2014 01
Ran by Nils at 2014-11-27 16:13:57
Running from C:\Users\Nils\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

32 Bit HP CIO Components Installer (Version: 1.1.0 - Hewlett-Packard) Hidden
Acrobat.com (HKLM\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe AIR (HKLM\...\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.189 - Adobe Systems Incorporated)
ASUS VIBE (HKLM\...\ASUS VIBE) (Version: 1.0.187 - Ecareme, Inc.)
ASUSUpdate for Eee PC (HKLM\...\{587178E7-B1DF-494E-9838-FA4DD36E873C}) (Version: 1.03.06 - ASUSTeK Computer Inc.)
Atheros Client Installation Program (HKLM\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 7.0 - Atheros)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.10 - Atheros Communications Inc.)
Boingo Wi-Fi (HKLM\...\{84C2B80B-64A2-4B22-93EC-F30C3D6BF7D8}) (Version: 1.7.0048 - Boingo Wireless, Inc.)
Canon IJ Network Scan Utility (HKLM\...\Canon_IJ_Network_Scan_UTILITY) (Version:  - )
Canon IJ Network Tool (HKLM\...\Canon_IJ_Network_UTILITY) (Version:  - )
Canon MP Navigator EX 1.0 (HKLM\...\MP Navigator EX 1.0) (Version:  - )
Canon MX700 series (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX700_series) (Version:  - )
Canon My Printer (HKLM\...\CanonMyPrinter) (Version:  - )
Canon Utilities Easy-PhotoPrint EX (HKLM\...\Easy-PhotoPrint EX) (Version:  - )
Canon Utilities Solution Menu (HKLM\...\CanonSolutionMenu) (Version:  - )
Chicken Invaders 2 (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110209593}) (Version:  - Oberon Media)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
ebi.BookReader3J (HKLM\...\{F3D2DEDC-4732-4188-8A3A-1A3FFBD4D6C8}) (Version: 3.75.14 - eBOOK Initiative Japan Co., Ltd.)
E-Cam (HKLM\...\{185AFA7A-F63E-450B-94AA-011CAC18090E}) (Version: 2.0.2.3 - )
Eee Docking 3.6.0 (HKLM\...\Eee Docking_is1) (Version: 3.6.0 - ASUSTek Computer Inc.)
EeeSplendid (HKLM\...\{6333FC29-BFE5-4024-AC78-958A1A7555D1}) (Version: 5.1.2.0008 - ASUS)
EeeSplendid (Version: 5.1.2.0008 - ASUS) Hidden
FontResizer (HKLM\...\InstallShield_{17780F99-A9DF-450B-81B3-6781B20A17A8}) (Version: 1.01.0011 - ASUSTek)
FontResizer (Version: 1.01.0011 - ASUSTek) Hidden
Game Park Console (HKLM\...\{BB5E5F87-E939-4974-A006-2B4A2F60EEA3}_is1) (Version: 5.2.1.4 - Oberon Media, Inc.)
Hotkey Service (HKLM\...\{71C0E38E-09F2-4386-9977-404D4F6640CD}) (Version: 1.15 - AsusTek Computer)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.14.10.2117 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
LiveUpdate (HKLM\...\{38E5A3B1-ADF1-47E0-8024-76310A30EB36}) (Version: 1.19 - Asus)
LocaleMe (HKLM\...\{F58C1D44-4AC9-48E8-9049-7A6CDFCB415C}) (Version: 1.3 - ASUS)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0100-040C-0000-0000000FF1CE}_OMUI.fr-fr_{CF3C20A6-47B7-48DA-95C1-6FBB5A439AF8}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0100-0410-0000-0000000FF1CE}_OMUI.it-it_{7F40286D-09A7-4DC0-A2A4-AA18D026D369}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0100-0413-0000-0000000FF1CE}_OMUI.nl-nl_{26257879-B20D-4D30-A429-B387A4890929}) (Version:  - Microsoft)
Microsoft Office Excel 2007 Help - Aggiornamento (KB963678) (HKLM\...\{90120000-0016-0410-0000-0000000FF1CE}_OMUI.it-it_{9F57BDED-B51B-4D2F-B360-5B4EFAAF0F1A}) (Version:  - Microsoft)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Language Pack 2007 - Dutch/Nederlands (HKLM\...\OMUI.nl-nl) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Language Pack 2007 - French/Français (HKLM\...\OMUI.fr-fr) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Language Pack 2007 - German/Deutsch (HKLM\...\OMUI.de-de) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Language Pack 2007 - Italian/Italiano (HKLM\...\OMUI.it-it) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Outlook 2007 Help - Aggiornamento (KB963677) (HKLM\...\{90120000-001A-0410-0000-0000000FF1CE}_OMUI.it-it_{2278E02A-AB15-4BF7-B2B4-5C0EEB4B7EEB}) (Version:  - Microsoft)
Microsoft Office Powerpoint 2007 Help - Aggiornamento (KB963669) (HKLM\...\{90120000-0018-0410-0000-0000000FF1CE}_OMUI.it-it_{C76C02F1-B07F-4974-876A-A18DEC9887C8}) (Version:  - Microsoft)
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2007 (HKLM\...\PROPLUS) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Word 2007 Help - Aggiornamento (KB963665) (HKLM\...\{90120000-001B-0410-0000-0000000FF1CE}_OMUI.it-it_{E5B82DB3-DD7D-4C45-BC5E-09864B26F9BC}) (Version:  - Microsoft)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Mise à jour Microsoft Office Excel 2007 Help  (KB963678) (HKLM\...\{90120000-0016-040C-0000-0000000FF1CE}_OMUI.fr-fr_{B761869A-B85C-40E2-994C-A1CE78AC8F2C}) (Version:  - Microsoft)
Mise à jour Microsoft Office Outlook 2007 Help  (KB963677) (HKLM\...\{90120000-001A-040C-0000-0000000FF1CE}_OMUI.fr-fr_{51EFB347-1F3D-4BAC-8B79-F056B904FE21}) (Version:  - Microsoft)
Mise à jour Microsoft Office Powerpoint 2007 Help  (KB963669) (HKLM\...\{90120000-0018-040C-0000-0000000FF1CE}_OMUI.fr-fr_{C3DCA38E-005E-41BA-A52A-7C3429F351C3}) (Version:  - Microsoft)
Mise à jour Microsoft Office Word 2007 Help  (KB963665) (HKLM\...\{90120000-001B-040C-0000-0000000FF1CE}_OMUI.fr-fr_{81536A04-DBFB-4DB3-978F-0F284590C223}) (Version:  - Microsoft)
Mozilla Firefox 7.0.1 (x86 de) (HKLM\...\Mozilla Firefox 7.0.1 (x86 de)) (Version: 7.0.1 - Mozilla)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
Ralink RT2860 Wireless LAN Card (HKLM\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309B0}) (Version: 1.2.0.1 - Ralink)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5948 - Realtek Semiconductor Corp.)
Skype web features (HKLM\...\{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}) (Version: 1.0.3971 - Skype Technologies S.A.)
Skype™ 6.11 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Super Hybrid Engine (HKLM\...\{88F08F98-12BC-4613-81A2-8F9B88CFC73E}) (Version: 2.10 - AsusTek Computer)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 13.2.6.1 - Synaptics Incorporated)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_OMUI.de-de_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_PROPLUS_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_PROPLUS_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_OMUI.de-de_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_PROPLUS_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_OMUI.de-de_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_PROPLUS_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Update voor Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0413-0000-0000000FF1CE}_OMUI.nl-nl_{5CF7002F-6F49-4482-9564-5614FBE560FA}) (Version:  - Microsoft)
Update voor Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0413-0000-0000000FF1CE}_OMUI.nl-nl_{15D84E79-1ED7-42C5-B2FD-745C3FBDDDC5}) (Version:  - Microsoft)
Update voor Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0413-0000-0000000FF1CE}_OMUI.nl-nl_{A66AE6A1-8D8C-4102-BC18-38CBDE40F809}) (Version:  - Microsoft)
Windows Driver Package - Broadcom Bluetooth  (07/17/2009 6.2.0.9403) (HKLM\...\B41C7C96D83162A676DA7365ADEFD6C1AF62A4EE) (Version: 07/17/2009 6.2.0.9403 - Broadcom)
Windows Driver Package - Broadcom Bluetooth  (07/29/2009 6.1.7100.0) (HKLM\...\B5C82F3814F82FB37F1513B3185399BD88892B08) (Version: 07/29/2009 6.1.7100.0 - Broadcom)
Windows Driver Package - Broadcom HIDClass  (07/28/2009 6.2.0.9800) (HKLM\...\BF20603967CFDCB2BBF91950E8A56DFBC5C833FE) (Version: 07/28/2009 6.2.0.9800 - Broadcom)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

26-09-2014 10:40:03 Windows Update
27-09-2014 06:39:56 Windows Update
05-10-2014 05:18:44 Windows Update
06-10-2014 18:44:55 Windows Update
22-10-2014 15:25:15 Windows Update
24-10-2014 07:35:54 Windows Update
03-11-2014 07:02:49 Windows Update
03-11-2014 07:18:42 Windows Update
27-11-2014 13:05:50 Removed Adobe Reader 9.5.5 MUI.

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {C4FBF6D9-661D-49FA-8AC5-34203AA420E7} - System32\Tasks\Adobe Flash Player Updater => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-10-22] (Adobe Systems Incorporated)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2010-01-06 22:47 - 2009-08-19 02:35 - 00219136 _____ () C:\Windows\System32\AsusService.exe
2010-01-06 23:49 - 2009-09-15 02:05 - 00044312 _____ () C:\Program Files\Asus\Game Park\GameConsole\OberonGameConsoleService.exe
2010-01-06 23:30 - 2009-12-30 00:28 - 00104960 _____ () C:\Program Files\ASUS\EPC\EeeSplendid\AsAgent.exe
2009-08-28 00:38 - 2009-08-28 00:38 - 00803304 _____ () C:\Program Files\Asus\LiveUpdate\LiveUpdate.exe
2009-08-28 00:45 - 2009-08-28 00:45 - 00120808 _____ () C:\Program Files\Asus\LiveUpdate\ClientSocket.dll
2009-08-28 01:29 - 2009-08-28 01:29 - 00182240 _____ () C:\Program Files\Asus\LiveUpdate\Parser.dll
2009-08-28 01:22 - 2009-08-28 01:22 - 00161768 _____ () C:\Program Files\Asus\LiveUpdate\Enumeration.dll
2010-01-06 23:16 - 2009-11-17 22:47 - 00414384 _____ () C:\Program Files\Asus\Eee Docking\Eee Docking.exe

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: NcpBudgetGui => "C:\Program Files\WatchGuard\Mobile VPN\NcpBudgetGui.exe" -start
MSCONFIG\startupreg: NcpMonitor => "C:\Program Files\WatchGuard\Mobile VPN\ncpmon.exe" autorun
MSCONFIG\startupreg: NcpPopup => "C:\Program Files\WatchGuard\Mobile VPN\ncppopup.exe" noerrmsg
MSCONFIG\startupreg: NcpRsuGui => "C:\Program Files\WatchGuard\Mobile VPN\rwsrsu.exe" -gui

========================= Accounts: ==========================

Administrator (S-1-5-21-2771088097-4119805611-136013659-500 - Administrator - Disabled)
Gast (S-1-5-21-2771088097-4119805611-136013659-501 - Limited - Disabled)
Nils (S-1-5-21-2771088097-4119805611-136013659-1000 - Administrator - Enabled) => C:\Users\Nils
Test (S-1-5-21-2771088097-4119805611-136013659-1002 - Administrator - Enabled) => C:\Users\Test

==================== Faulty Device Manager Devices =============

Name: Canon MX700 ser Network
Description: Canon MX700 ser Network
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Canon
Service: StillCam
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================
Error: (10/24/2014 08:38:48 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 16 seconds with 0 seconds of active time.  This session ended with a crash.


==================== Memory info ===========================

Processor: Intel(R) Atom(TM) CPU N450 @ 1.66GHz
Percentage of memory in use: 32%
Total physical RAM: 2038.18 MB
Available physical RAM: 1384.99 MB
Total Pagefile: 4076.36 MB
Available Pagefile: 3387.78 MB
Total Virtual: 2047.88 MB
Available Virtual: 1934.37 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:80 GB) (Free:42.24 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:59.03 GB) (Free:48.97 GB) NTFS
Drive e: (Elements) (Fixed) (Total:931.48 GB) (Free:0.26 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149.1 GB) (Disk ID: 9F1192B6)
Partition 1: (Active) - (Size=80 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=59 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=10 GB) - (Type=1B)
Partition 4: (Not Active) - (Size=17 MB) - (Type=EF)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 931.5 GB) (Disk ID: 52DD04D5)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

==================== End Of Log ============================


Alle Zeitangaben in WEZ +1. Es ist jetzt 20:14 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131