| |
| |||||||
Log-Analyse und Auswertung: GVU-Trojaner 2.07 HilfeWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
03.09.2013, 16:30
| #1 |
| |  GVU-Trojaner 2.07 Hilfe Hallo, Ich habe mittels des Programms FRST64.exe eine FRST.txt erstellt (siehe Anhang). Wie geht es nun weiter? Danke FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-09-2013 01
Ran by SYSTEM on MININT-BFQQ22T on 03-09-2013 16:49:51
Running from G:\
Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Recovery
The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [EvtMgr6] - C:\Program Files\Logitech\SetPointP\SetPoint.exe [1680976 2010-10-29] (Logitech, Inc.)
HKLM\...\Run: [MFNetworkScanUtility] - C:\Program Files\Canon\Canon MF Network Scan Utility\CNMFSUT6.EXE [508312 2009-12-15] (CANON INC.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKLM\...\Policies\Explorer: [NoActiveDesktop] 1
HKLM\...\Policies\Explorer: [NoActiveDesktopChanges] 1
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [35760 2010-09-23] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-09-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-26] (Microsoft Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254696 2012-01-18] (Sun Microsystems, Inc.)
HKU\pc\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [357696 2010-04-01] (DT Soft Ltd)
HKU\pc\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\pc\AppData\Local\Temp\eyvthsrubxcvfwjlg.exe [79360 2013-08-30] (Valve Corporation) <===== ATTENTION
HKU\pc\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil11g_ActiveX.exe [250528 2012-03-23] (Adobe Systems, Inc.)
HKU\pc\...\Winlogon: [Shell] cmd.exe [344576 2009-07-14] (Microsoft Corporation) <==== ATTENTION
HKU\pc\...\Command Processor: "C:\Users\pc\AppData\Local\Temp\eyvthsrubxcvfwjlg.exe" <===== ATTENTION!
Startup: C:\Users\pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> (No File)
==================== Services (Whitelisted) =================
S2 Canon Driver Information Assist Service; C:\Program Files\Canon\DIAS\CnxDIAS.exe [5480296 2009-03-27] (CANON INC.)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
==================== Drivers (Whitelisted) ====================
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19936 2010-08-16] ()
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19936 2010-08-16] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [13280 2010-08-16] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [13280 2010-08-16] ()
S0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2010-05-02] (Duplex Secure Ltd.)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-30 11:24 - 2013-08-30 11:24 - 00163111 _____ C:\Users\pc\AppData\Roaming\2433f433
2013-08-30 11:24 - 2013-08-30 11:24 - 00163072 _____ C:\ProgramData\2433f433
2013-08-30 11:24 - 2013-08-30 11:24 - 00163054 _____ C:\Users\pc\AppData\Local\2433f433
2013-08-17 19:12 - 2013-08-17 19:12 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-15 07:53 - 2013-08-15 07:53 - 00000000 ____D C:\Users\pc\AppData\Local\Macromedia
2013-08-15 07:52 - 2013-08-21 11:06 - 00002046 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-08-15 07:52 - 2013-08-21 11:06 - 00000000 ____D C:\Program Files (x86)\McAfee Security Scan
2013-08-15 07:52 - 2013-08-15 07:52 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-15 07:52 - 2013-08-15 07:52 - 00000000 ____D C:\Windows\System32\Macromed
2013-08-15 07:52 - 2013-08-15 07:52 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-08-15 07:52 - 2013-08-15 07:52 - 00000000 ____D C:\ProgramData\McAfee
2013-08-15 07:50 - 2013-08-15 07:50 - 01069032 _____ (Solid State Networks) C:\Users\pc\Downloads\install_flashplayer11x32_mssa_aaa_aih(1).exe
2013-08-04 18:32 - 2013-08-04 18:32 - 00002212 _____ C:\Users\Public\Desktop\Google Earth.lnk
==================== One Month Modified Files and Folders =======
2013-09-03 15:47 - 2010-04-26 01:37 - 01457645 _____ C:\Windows\WindowsUpdate.log
2013-09-03 15:27 - 2009-07-14 05:45 - 00015296 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-03 15:27 - 2009-07-14 05:45 - 00015296 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-03 15:25 - 2009-07-14 18:58 - 00657438 _____ C:\Windows\System32\perfh007.dat
2013-09-03 15:25 - 2009-07-14 18:58 - 00130810 _____ C:\Windows\System32\perfc007.dat
2013-09-03 15:25 - 2009-07-14 06:13 - 01507106 _____ C:\Windows\System32\PerfStringBackup.INI
2013-09-03 15:20 - 2012-05-10 16:37 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-03 15:20 - 2010-11-18 13:44 - 00046048 _____ C:\Windows\setupact.log
2013-09-03 15:20 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-30 11:24 - 2013-08-30 11:24 - 00163111 _____ C:\Users\pc\AppData\Roaming\2433f433
2013-08-30 11:24 - 2013-08-30 11:24 - 00163072 _____ C:\ProgramData\2433f433
2013-08-30 11:24 - 2013-08-30 11:24 - 00163054 _____ C:\Users\pc\AppData\Local\2433f433
2013-08-30 11:20 - 2012-05-10 16:37 - 00001102 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-30 08:15 - 2012-05-10 16:39 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-08-26 10:56 - 2012-12-19 11:39 - 00000000 ___RD C:\Users\pc\Dropbox
2013-08-26 10:56 - 2012-12-19 10:33 - 00000000 ____D C:\Users\pc\AppData\Roaming\Dropbox
2013-08-22 07:58 - 2013-01-22 20:32 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-21 11:06 - 2013-08-15 07:52 - 00002046 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-08-21 11:06 - 2013-08-15 07:52 - 00000000 ____D C:\Program Files (x86)\McAfee Security Scan
2013-08-17 19:12 - 2013-08-17 19:12 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-17 13:44 - 2010-11-15 16:04 - 00045422 _____ C:\Windows\PFRO.log
2013-08-15 07:53 - 2013-08-15 07:53 - 00000000 ____D C:\Users\pc\AppData\Local\Macromedia
2013-08-15 07:53 - 2010-05-02 04:15 - 00000000 ____D C:\Users\pc\AppData\Local\Adobe
2013-08-15 07:52 - 2013-08-15 07:52 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-15 07:52 - 2013-08-15 07:52 - 00000000 ____D C:\Windows\System32\Macromed
2013-08-15 07:52 - 2013-08-15 07:52 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-08-15 07:52 - 2013-08-15 07:52 - 00000000 ____D C:\ProgramData\McAfee
2013-08-15 07:52 - 2012-03-23 14:27 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-15 07:50 - 2013-08-15 07:50 - 01069032 _____ (Solid State Networks) C:\Users\pc\Downloads\install_flashplayer11x32_mssa_aaa_aih(1).exe
2013-08-15 07:45 - 2013-01-10 14:48 - 00000000 ____D C:\Users\pc\AppData\Roaming\vlc
2013-08-04 18:32 - 2013-08-04 18:32 - 00002212 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-08-04 18:31 - 2012-05-10 16:37 - 00000000 ____D C:\Program Files (x86)\Google
Files to move or delete:
====================
C:\Users\pc\AppData\Local\Temp\eyvthsrubxcvfwjlg.exe
C:\Users\pc\AppData\Local\Temp\AskSLib.dll
C:\Users\pc\AppData\Local\Temp\InitBDE.exe
C:\Users\pc\AppData\Local\Temp\jre-6u24-windows-i586-iftw-rv.exe
C:\Users\pc\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\pc\AppData\Local\Temp\ose00000.exe
C:\Users\pc\AppData\Local\Temp\nsq47DA.tmp\DropboxNSISTools.dll
C:\Users\pc\AppData\Local\Temp\nsaAF44.tmp\DropboxNSISTools.dll
C:\Users\pc\AppData\Local\Temp\nsaAF44.tmp\UAC.dll
C:\Users\pc\AppData\Local\Temp\nsa3AB0.tmp\DropboxNSISTools.dll
C:\Users\pc\AppData\Local\Temp\lu\1_spp_100009c.exe
C:\Users\pc\AppData\Local\Temp\lu\2_spp_2000067.exe
C:\Users\pc\AppData\Local\Temp\CDBurnerXP-updates\cdbxp_setup_4.3.8.2474.exe
C:\Users\pc\AppData\Local\Temp\CDBurnerXP-updates\cdbxp_setup_4.3.8.2631.exe
C:\Users\pc\AppData\Local\Temp\CDBurnerXP-updates\cdbxp_setup_4.3.9.2762.exe
C:\Users\pc\AppData\Local\Temp\CDBurnerXP-updates\cdbxp_setup_4.4.0.2838.exe
C:\Users\pc\AppData\Local\Temp\CDBurnerXP-updates\cdbxp_setup_4.4.0.2905.exe
C:\Users\pc\AppData\Local\Temp\CDBurnerXP-updates\cdbxp_setup_4.4.1.3341.exe
C:\Users\pc\AppData\Local\Temp\be29e7f1-71ae-4703-50cb-1d52be512f51\twapi-be29e7f1-71ae-4703-50cb-1d52be512f51.dll
C:\Users\pc\AppData\Local\Temp\AEE5.dir\InstallFlashPlayer.exe
C:\Users\pc\AppData\Local\Temp\7C12.dir\InstallFlashPlayer.exe
C:\Users\pc\AppData\Local\Temp\._msige61\GoogleEarth.exe
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\earthps.dll
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\geplugin.exe
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\ge_expat.dll
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\googleearth_free.dll
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\msvcp100.dll
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\msvcr100.dll
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\npgeplugin.dll
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\plugin_ax.dll
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\earthflashsol.exe
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\earthps.dll
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\ge_expat.dll
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\googleearth.exe
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\googleearth_free.dll
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\gpsbabel.exe
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\msvcp100.dll
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\msvcr100.dll
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\Plugins\npgeinprocessplugin.dll
==================== Known DLLs (Whitelisted) ================
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
==================== Restore Points =========================
==================== Memory info ===========================
Percentage of memory in use: 14%
Total physical RAM: 4095.37 MB
Available physical RAM: 3489.86 MB
Total Pagefile: 4093.52 MB
Available Pagefile: 3475.32 MB
Total Virtual: 8192 MB
Available Virtual: 8191.87 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:150.64 GB) (Free:121.03 GB) NTFS
Drive d: (Daten) (Fixed) (Total:780.77 GB) (Free:635.03 GB) NTFS
Drive g: () (Removable) (Total:1.92 GB) (Free:1.92 GB) FAT
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: EDA101F8)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=151 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=781 GB) - (Type=OF Extended)
========================================================
Disk: 1 (Size: 2 GB) (Disk ID: 91F72D24)
Partition 1: (Active) - (Size=2 GB) - (Type=06)
LastRegBack: 2013-09-03 15:38
==================== End Of Log ============================
--- --- --- --- --- --- Geändert von Stefan235 (03.09.2013 um 16:48 Uhr) |
|
03.09.2013, 16:54
| #2 |
| /// TB-Ausbilder   | GVU-Trojaner 2.07 Hilfe Hallo,
__________________startet der Rechner nach diesem Fix wieder normal? Drücke bitte die  + R Taste und schreibe notepad in das Ausführen Fenster.Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKU\pc\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\pc\AppData\Local\Temp\eyvthsrubxcvfwjlg.exe [79360 2013-08-30] (Valve Corporation) <===== ATTENTION
HKU\pc\...\Winlogon: [Shell] cmd.exe [344576 2009-07-14] (Microsoft Corporation) <==== ATTENTION
HKU\pc\...\Command Processor: "C:\Users\pc\AppData\Local\Temp\eyvthsrubxcvfwjlg.exe" <===== ATTENTION!
C:\Users\pc\AppData\Local\Temp\eyvthsrubxcvfwjlg.exe
2013-08-30 11:24 - 2013-08-30 11:24 - 00163111 _____ C:\Users\pc\AppData\Roaming\2433f433
2013-08-30 11:24 - 2013-08-30 11:24 - 00163072 _____ C:\ProgramData\2433f433
2013-08-30 11:24 - 2013-08-30 11:24 - 00163054 _____ C:\Users\pc\AppData\Local\2433f433
Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.
__________________ |
|
03.09.2013, 16:59
| #3 |
| | GVU-Trojaner 2.07 Hilfe Vielen Dank für die schnelle Antwort.
__________________Der Rechner startet nun wieder normal. Gibt es noch weitere Schritte, die notwendig sind, um den Trojaner zu entfernen? Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 03-09-2013 01
Ran by SYSTEM at 2013-09-03 17:57:20 Run:1
Running from G:\
Boot Mode: Recovery
==============================================
Content of fixlist:
*****************
HKU\pc\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\pc\AppData\Local\Temp\eyvthsrubxcvfwjlg.exe [79360 2013-08-30] (Valve Corporation) <===== ATTENTION
HKU\pc\...\Winlogon: [Shell] cmd.exe [344576 2009-07-14] (Microsoft Corporation) <==== ATTENTION
HKU\pc\...\Command Processor: "C:\Users\pc\AppData\Local\Temp\eyvthsrubxcvfwjlg.exe" <===== ATTENTION!
C:\Users\pc\AppData\Local\Temp\eyvthsrubxcvfwjlg.exe
2013-08-30 11:24 - 2013-08-30 11:24 - 00163111 _____ C:\Users\pc\AppData\Roaming\2433f433
2013-08-30 11:24 - 2013-08-30 11:24 - 00163072 _____ C:\ProgramData\2433f433
2013-08-30 11:24 - 2013-08-30 11:24 - 00163054 _____ C:\Users\pc\AppData\Local\2433f433
*****************
HKU\pc\Software\Microsoft\Windows\CurrentVersion\Run\\qcgce2mrvjq91kk1e7pnbb19m52fx => Value deleted successfully.
HKU\pc\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.
HKU\pc\Software\Microsoft\Command Processor\\AutoRun => Value deleted successfully.
C:\Users\pc\AppData\Local\Temp\eyvthsrubxcvfwjlg.exe => Moved successfully.
C:\Users\pc\AppData\Roaming\2433f433 => Moved successfully.
C:\ProgramData\2433f433 => Moved successfully.
C:\Users\pc\AppData\Local\2433f433 => Moved successfully.
==== End of Fixlog ====
|
|
03.09.2013, 17:08
| #4 |
| /// TB-Ausbilder | GVU-Trojaner 2.07 Hilfe Prima. Ja wir sollten noch grüdlich kontrollieren. Verschiebe die frst64.exe vom USB-Stick auf den Desktop.
__________________ cheers, Leo |
|
03.09.2013, 17:31
| #5 |
| | GVU-Trojaner 2.07 HilfeFRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-09-2013 02
Ran by pc (administrator) on PC-PC on 03-09-2013 18:27:29
Running from C:\Users\pc\Desktop
Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(CANON INC.) C:\Program Files\Canon\DIAS\CnxDIAS.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(CANON INC.) C:\Program Files\Canon\Canon MF Network Scan Utility\CNMFSUT6.EXE
(DT Soft Ltd) C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Sidebar\sidebar.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe
(Fred's Software) C:\Program Files (x86)\PrintKey2000\Printkey2000.exe
(Dropbox, Inc.) C:\Users\pc\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\sp6\LU\LULnchr.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\sp6\LU\LogitechUpdate.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Oracle Corporation) C:\Users\pc\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
(Microsoft Corporation) \\?\C:\Windows\system32\wbem\WMIADAP.EXE
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [EvtMgr6] - C:\Program Files\Logitech\SetPointP\SetPoint.exe [1680976 2010-10-29] (Logitech, Inc.)
HKLM\...\Run: [MFNetworkScanUtility] - C:\Program Files\Canon\Canon MF Network Scan Utility\CNMFSUT6.EXE [508312 2009-12-15] (CANON INC.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKLM\...\Policies\Explorer: [NoActiveDesktop] 1
HKLM\...\Policies\Explorer: [NoActiveDesktopChanges] 1
HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [357696 2010-04-01] (DT Soft Ltd)
MountPoints2: {d0c5ebd5-0829-11e0-a027-4487fc86ea1c} - K:\LaunchU3.exe -a
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [35760 2010-09-23] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-09-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254696 2012-01-18] (Sun Microsystems, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Printkey2000.lnk
ShortcutTarget: Printkey2000.lnk -> C:\Program Files (x86)\PrintKey2000\Printkey2000.exe (Fred's Software)
Startup: C:\Users\pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\pc\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.t-online.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Handler-x32: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GRA32A~1.DLL (Microsoft Corporation)
ShellExecuteHooks-x32: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL [2210608 2006-10-27] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\pc\AppData\Roaming\Mozilla\Firefox\Profiles\ex27qofs.default
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Виявлення пристроїв Logitech - C:\Users\pc\AppData\Roaming\Mozilla\Firefox\Profiles\ex27qofs.default\Extensions\DeviceDetection@logitech.com
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.152\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.152\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.152\pdf.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.310.5) - C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (2007 Microsoft Office system) - C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Extension: (YouTube) - C:\Users\pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1
CHR Extension: (Google Search) - C:\Users\pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1
CHR Extension: (Gmail) - C:\Users\pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
==================== Services (Whitelisted) =================
R2 Canon Driver Information Assist Service; C:\Program Files\Canon\DIAS\CnxDIAS.exe [5480296 2009-03-27] (CANON INC.)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
==================== Drivers (Whitelisted) ====================
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19936 2010-08-16] ()
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19936 2010-08-16] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [13280 2010-08-16] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [13280 2010-08-16] ()
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2010-05-03] ()
U3 a7c7qj48; C:\Windows\System32\Drivers\a7c7qj48.sys [0 ] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-03 18:03 - 2013-09-03 18:03 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-03 18:03 - 2013-09-03 18:03 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-03 18:03 - 2012-06-03 00:19 - 02428952 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2013-09-03 18:03 - 2012-06-03 00:19 - 00701976 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2013-09-03 18:03 - 2012-06-03 00:19 - 00057880 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2013-09-03 18:03 - 2012-06-03 00:19 - 00044056 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2013-09-03 18:03 - 2012-06-03 00:19 - 00038424 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2013-09-03 18:03 - 2012-06-03 00:15 - 02622464 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2013-09-03 18:03 - 2012-06-03 00:15 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2013-09-03 18:03 - 2012-06-02 15:19 - 00186752 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2013-09-03 18:03 - 2012-06-02 15:15 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2013-09-03 17:49 - 2013-09-03 17:49 - 00000000 ____D C:\FRST
2013-08-17 20:12 - 2013-08-17 20:12 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-15 08:53 - 2013-08-15 08:53 - 00000000 ____D C:\Users\pc\AppData\Local\Macromedia
2013-08-15 08:52 - 2013-09-03 18:03 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-15 08:52 - 2013-08-21 12:06 - 00002046 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-08-15 08:52 - 2013-08-21 12:06 - 00000000 ____D C:\Program Files (x86)\McAfee Security Scan
2013-08-15 08:52 - 2013-08-15 08:52 - 00000000 ____D C:\Windows\system32\Macromed
2013-08-15 08:52 - 2013-08-15 08:52 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-08-15 08:52 - 2013-08-15 08:52 - 00000000 ____D C:\ProgramData\McAfee
2013-08-15 08:50 - 2013-08-15 08:50 - 01069032 _____ (Solid State Networks) C:\Users\pc\Downloads\install_flashplayer11x32_mssa_aaa_aih(1).exe
2013-08-04 19:32 - 2013-08-04 19:32 - 00002212 _____ C:\Users\Public\Desktop\Google Earth.lnk
==================== One Month Modified Files and Folders =======
2013-09-03 18:27 - 2013-09-03 18:27 - 01950412 _____ (Farbar) C:\Users\pc\Desktop\FRST64.exe
2013-09-03 18:27 - 2009-07-14 19:58 - 00657438 _____ C:\Windows\system32\perfh007.dat
2013-09-03 18:27 - 2009-07-14 19:58 - 00130810 _____ C:\Windows\system32\perfc007.dat
2013-09-03 18:27 - 2009-07-14 07:13 - 01507106 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-03 18:23 - 2010-11-18 14:44 - 00046899 _____ C:\Windows\setupact.log
2013-09-03 18:20 - 2012-05-10 17:37 - 00001102 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-03 18:20 - 2010-04-26 02:37 - 01244938 _____ C:\Windows\WindowsUpdate.log
2013-09-03 18:08 - 2009-07-14 06:45 - 00015296 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-03 18:08 - 2009-07-14 06:45 - 00015296 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-03 18:03 - 2013-09-03 18:03 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-03 18:03 - 2013-09-03 18:03 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-03 18:03 - 2013-08-15 08:52 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-03 18:03 - 2012-03-23 15:27 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-03 17:59 - 2012-12-19 12:39 - 00000000 ___RD C:\Users\pc\Dropbox
2013-09-03 17:59 - 2012-12-19 11:33 - 00000000 ____D C:\Users\pc\AppData\Roaming\Dropbox
2013-09-03 17:58 - 2012-05-10 17:37 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-03 17:58 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-03 17:49 - 2013-09-03 17:49 - 00000000 ____D C:\FRST
2013-08-30 09:15 - 2012-05-10 17:39 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-08-27 18:12 - 2010-11-19 00:38 - 00000000 ____D D:\Users\pc\Documents\Björn
2013-08-22 08:58 - 2013-01-22 21:32 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-21 12:06 - 2013-08-15 08:52 - 00002046 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-08-21 12:06 - 2013-08-15 08:52 - 00000000 ____D C:\Program Files (x86)\McAfee Security Scan
2013-08-19 09:07 - 2012-12-13 18:26 - 00000000 ____D D:\Users\pc\Documents\Telefonrechnungen Isabell
2013-08-17 20:12 - 2013-08-17 20:12 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-17 14:44 - 2010-11-15 17:04 - 00045422 _____ C:\Windows\PFRO.log
2013-08-15 08:53 - 2013-08-15 08:53 - 00000000 ____D C:\Users\pc\AppData\Local\Macromedia
2013-08-15 08:53 - 2010-05-02 05:15 - 00000000 ____D C:\Users\pc\AppData\Local\Adobe
2013-08-15 08:52 - 2013-08-15 08:52 - 00000000 ____D C:\Windows\system32\Macromed
2013-08-15 08:52 - 2013-08-15 08:52 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-08-15 08:52 - 2013-08-15 08:52 - 00000000 ____D C:\ProgramData\McAfee
2013-08-15 08:50 - 2013-08-15 08:50 - 01069032 _____ (Solid State Networks) C:\Users\pc\Downloads\install_flashplayer11x32_mssa_aaa_aih(1).exe
2013-08-15 08:45 - 2013-01-10 15:48 - 00000000 ____D C:\Users\pc\AppData\Roaming\vlc
2013-08-04 19:32 - 2013-08-04 19:32 - 00002212 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-08-04 19:31 - 2012-05-10 17:37 - 00000000 ____D C:\Program Files (x86)\Google
Files to move or delete:
====================
C:\Users\pc\AppData\Local\Temp\AskSLib.dll
C:\Users\pc\AppData\Local\Temp\InitBDE.exe
C:\Users\pc\AppData\Local\Temp\jre-6u24-windows-i586-iftw-rv.exe
C:\Users\pc\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\pc\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\pc\AppData\Local\Temp\ose00000.exe
C:\Users\pc\AppData\Local\Temp\nsq47DA.tmp\DropboxNSISTools.dll
C:\Users\pc\AppData\Local\Temp\nsaAF44.tmp\DropboxNSISTools.dll
C:\Users\pc\AppData\Local\Temp\nsaAF44.tmp\UAC.dll
C:\Users\pc\AppData\Local\Temp\nsa3AB0.tmp\DropboxNSISTools.dll
C:\Users\pc\AppData\Local\Temp\lu\1_spp_100009c.exe
C:\Users\pc\AppData\Local\Temp\lu\2_spp_2000067.exe
C:\Users\pc\AppData\Local\Temp\CDBurnerXP-updates\cdbxp_setup_4.3.8.2474.exe
C:\Users\pc\AppData\Local\Temp\CDBurnerXP-updates\cdbxp_setup_4.3.8.2631.exe
C:\Users\pc\AppData\Local\Temp\CDBurnerXP-updates\cdbxp_setup_4.3.9.2762.exe
C:\Users\pc\AppData\Local\Temp\CDBurnerXP-updates\cdbxp_setup_4.4.0.2838.exe
C:\Users\pc\AppData\Local\Temp\CDBurnerXP-updates\cdbxp_setup_4.4.0.2905.exe
C:\Users\pc\AppData\Local\Temp\CDBurnerXP-updates\cdbxp_setup_4.4.1.3341.exe
C:\Users\pc\AppData\Local\Temp\be29e7f1-71ae-4703-50cb-1d52be512f51\twapi-be29e7f1-71ae-4703-50cb-1d52be512f51.dll
C:\Users\pc\AppData\Local\Temp\AEE5.dir\InstallFlashPlayer.exe
C:\Users\pc\AppData\Local\Temp\7C12.dir\InstallFlashPlayer.exe
C:\Users\pc\AppData\Local\Temp\._msige61\GoogleEarth.exe
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\earthps.dll
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\geplugin.exe
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\ge_expat.dll
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\googleearth_free.dll
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\msvcp100.dll
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\msvcr100.dll
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\npgeplugin.dll
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\plugin_ax.dll
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\earthflashsol.exe
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\earthps.dll
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\ge_expat.dll
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\googleearth.exe
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\googleearth_free.dll
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\gpsbabel.exe
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\msvcp100.dll
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\msvcr100.dll
C:\Users\pc\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\Plugins\npgeinprocessplugin.dll
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-03 16:38
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03-09-2013 02
Ran by pc at 2013-09-03 18:27:58
Running from C:\Users\pc\Desktop
Boot Mode: Normal
==========================================================
==================== Installed Programs =======================
7-Zip 4.65 (x64 edition) (Version: 4.65.00.0)
Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.94)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
Adobe Reader 9.4.0 - Deutsch (x32 Version: 9.4.0)
Canon MF Toolbox 4.9.1.1.mf11 (x32 Version: 4.9.1.1.mf11)
Canon MF8000 Series
CDBurnerXP (Version: 4.3.7.2423)
Dropbox (HKCU Version: 2.0.22)
ElsterFormular (x32 Version: 13.2.0.8623k)
eReg (x32 Version: 1.20.138.34)
Glucofacts Deluxe Updater 2.0 (HKCU)
GLUCOFACTS® Deluxe (x32 Version: 2.10.11)
Google Chrome (x32 Version: 29.0.1547.62)
Google Earth (x32 Version: 7.1.1.1888)
Google Update Helper (x32 Version: 1.3.21.153)
Java Auto Updater (x32 Version: 2.0.7.1)
Java(TM) 6 Update 23 (64-bit) (Version: 6.0.230)
Java(TM) 6 Update 31 (x32 Version: 6.0.310)
Logitech SetPoint 6.20 (Version: 6.20.64)
McAfee Security Scan Plus (x32 Version: 3.0.318.3)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.4518.1014)
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
MiniTool Partition Wizard Home Edition 5.2 (x32)
Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1)
Mozilla Maintenance Service (x32 Version: 23.0.1)
PrintKey2000 (x32)
rosoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Sage GS-Verein (x32)
SimpleOCR 3.1 (x32)
VLC media player 2.0.1 (x32 Version: 2.0.1)
==================== Restore Points =========================
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {044A6734-E90E-4F8F-B357-B2DC8AB3B5EC} - System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime => start w32time task_started
Task: {5402CDDD-BE83-4D05-8D3F-1F8A1664FAE9} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-03] (Adobe Systems Incorporated)
Task: {62799581-BF61-4F01-829D-F23C94AEDC8F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-05-10] (Google Inc.)
Task: {864F80C8-B065-4293-A615-C9534A9D8100} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe [2010-08-04] (Microsoft Corporation)
Task: {DBFDFE4F-87B2-4F12-BCA2-F73B97EFA104} - System32\Tasks\SidebarExecute => C:\Program Files (x86)\Windows Sidebar\sidebar.exe [2009-07-14] (Microsoft Corporation)
Task: {F96986FF-65F9-410E-AFB6-82F456D9DAC1} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: {FBAC730C-5949-4397-90BC-7FFFA382F36C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-05-10] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2010-03-19 23:43 - 2009-10-02 04:24 - 03599360 _____ (ATI Technologies Inc. ) C:\Windows\system32\atidxx64.dll
2009-07-14 01:40 - 2009-07-14 03:24 - 02165248 _____ (Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_2b4f45e87195fcc4\gdiplus.dll
2010-11-15 16:30 - 2010-08-21 08:12 - 02030080 _____ (Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7\comctl32.dll
2013-05-25 02:36 - 2013-05-25 02:36 - 00164016 _____ (Dropbox, Inc.) C:\Users\pc\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
2009-07-13 22:54 - 2009-06-10 22:31 - 00853328 _____ (Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4926_none_08e1a05ba83fe554\MSVCP90.dll
2009-07-13 22:54 - 2009-06-10 22:31 - 00623440 _____ (Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4926_none_08e1a05ba83fe554\MSVCR90.dll
2009-07-14 02:02 - 2009-07-14 03:41 - 00503296 _____ (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll
2009-07-14 01:40 - 2009-07-14 03:41 - 00235008 _____ (Microsoft Corporation) C:\Program Files\Windows Portable Devices\SqmApi.dll
2010-11-15 16:29 - 2010-09-08 07:34 - 00451072 _____ (Microsoft Corporation) C:\Program Files\Internet Explorer\ieproxy.dll
2009-07-14 01:21 - 2009-07-14 03:40 - 00094208 _____ (Microsoft Corporation) C:\Windows\system32\Cabinet.dll
2013-09-03 18:03 - 2012-06-03 00:19 - 00044056 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2009-07-14 01:36 - 2009-07-14 03:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\sdautoplay.dll
2009-07-14 01:36 - 2009-07-14 03:41 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\SPP.dll
2009-07-14 01:38 - 2009-07-14 03:41 - 01745408 _____ (Microsoft Corporation) C:\Windows\system32\VSSAPI.DLL
2009-07-14 01:36 - 2009-07-14 03:41 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\VssTrace.DLL
2009-07-14 01:37 - 2009-07-14 03:41 - 01120768 _____ (Microsoft Corporation) C:\Windows\system32\sdengin2.dll
2009-07-14 01:53 - 2009-07-14 03:40 - 00218112 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2009-07-14 01:36 - 2009-07-14 03:41 - 01780736 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll
2009-07-14 02:08 - 2009-07-14 03:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\NetworkItemFactory.dll
2009-07-14 02:08 - 2009-07-14 03:40 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\dtsh.dll
2009-07-14 02:08 - 2009-07-14 03:40 - 00101376 _____ (Microsoft Corporation) C:\Windows\System32\fdwcn.dll
2009-07-14 02:08 - 2009-07-14 03:41 - 00120832 _____ (Microsoft Corporation) C:\Windows\System32\wcnapi.dll
2009-07-14 01:35 - 2009-07-14 03:40 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\fdWNet.dll
2009-07-14 01:53 - 2009-07-14 03:40 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\dfscli.dll
2009-07-14 01:56 - 2009-07-14 03:41 - 00087552 _____ (Microsoft Corporation) C:\Program Files\Windows Sidebar\sbdrop.dll
2010-11-19 00:22 - 2010-11-19 00:22 - 05105656 _____ (Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_951ab4128654b0c9\mfc90u.dll
2010-11-15 16:30 - 2010-08-21 08:12 - 02030080 _____ (Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7\COMCTL32.dll
2010-11-19 00:22 - 2010-11-19 00:22 - 00066560 _____ (Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_92995f253c01eddb\MFC90DEU.DLL
2010-11-19 00:22 - 2010-11-19 00:22 - 00179704 _____ (Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_none_9aefdaaa829eb818\ATL90.DLL
2010-12-03 16:39 - 2010-01-17 17:00 - 00005120 _____ (CANON INC.) C:\Program Files\Canon\Canon MF Network Scan Utility\CNMFSUR6.DLL
2010-12-03 16:37 - 2009-12-14 06:50 - 00247296 _____ (CANON INC.) C:\Windows\system32\CNCENPM6.DLL
2010-04-01 11:15 - 2010-04-01 11:15 - 01234240 _____ (DT Soft Ltd) C:\Program Files (x86)\DAEMON Tools Lite\DTCommonRes.dll
2010-11-15 16:30 - 2010-08-21 07:21 - 01680896 _____ (Microsoft Corporation) C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\COMCTL32.dll
2009-08-21 15:16 - 2009-08-21 15:16 - 01093120 _____ (Microsoft Corporation) C:\Program Files (x86)\DAEMON Tools Lite\MFC80U.DLL
2009-07-13 22:46 - 2009-06-10 23:23 - 00632656 _____ (Microsoft Corporation) C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4927_none_d08a205e442db5b5\MSVCR80.dll
2009-07-13 22:46 - 2009-06-10 23:23 - 00554816 _____ (Microsoft Corporation) C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4927_none_d08a205e442db5b5\MSVCP80.dll
2010-04-01 11:16 - 2010-04-01 11:16 - 00419136 _____ (DT Soft Ltd) C:\Program Files (x86)\DAEMON Tools Lite\DTLiteUI.dll
2010-04-01 11:18 - 2010-04-01 11:18 - 02217280 _____ (DT Soft Ltd) C:\Program Files (x86)\DAEMON Tools Lite\Engine.dll
2009-11-02 01:28 - 2009-11-02 01:28 - 00295472 _____ (DT Soft Ltd.) C:\Program Files (x86)\DAEMON Tools Lite\imgengine.dll
2009-07-14 01:26 - 2009-07-14 03:03 - 01624576 _____ (Microsoft Corporation) C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll
2009-07-14 01:42 - 2009-07-14 03:15 - 00215552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Dxtrans.dll
2009-07-14 01:28 - 2009-07-14 03:15 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ddrawex.dll
2009-07-14 01:42 - 2009-07-14 03:15 - 00346112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Dxtmsft.dll
2009-07-14 02:00 - 2009-07-14 03:41 - 00283648 _____ (Microsoft Corporation) C:\Windows\System32\LocationApi.dll
2009-07-14 02:00 - 2009-07-14 03:41 - 00174592 _____ (Microsoft Corporation) C:\Windows\System32\SensorsApi.dll
2009-07-14 01:28 - 2009-07-14 03:41 - 00271360 _____ (Microsoft Corporation) C:\Windows\System32\WDSCORE.dll
2009-07-14 01:58 - 2009-07-14 03:41 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\ImgUtil.dll
2009-07-14 01:42 - 2009-07-14 03:16 - 00046592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2010-11-15 16:31 - 2010-03-08 23:33 - 00427520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2009-07-14 01:40 - 2009-07-14 03:16 - 00108544 _____ (Microsoft Corporation) C:\Program Files (x86)\Windows Sidebar\wlsrvc.dll
2013-05-25 02:36 - 2013-05-25 02:36 - 00130736 _____ (Dropbox, Inc.) C:\Users\pc\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
2012-05-09 17:29 - 2012-05-09 17:29 - 00569680 _____ (Microsoft Corporation) C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCP90.dll
2012-05-09 17:29 - 2012-05-09 17:29 - 00653136 _____ (Microsoft Corporation) C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCR90.dll
2006-10-26 21:41 - 2006-10-26 21:41 - 00044344 _____ (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL
2006-10-27 00:48 - 2006-10-27 00:48 - 02210608 _____ (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
2006-10-27 00:48 - 2006-10-27 00:48 - 00955680 _____ (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\GrooveUtil.dll
2006-10-27 00:47 - 2006-10-27 00:47 - 00022808 _____ (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\GrooveNew.dll
2010-05-03 00:41 - 2010-05-03 00:41 - 00095744 _____ (Microsoft Corporation) C:\Windows\WinSxS\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.42_none_dc990e4797f81af1\ATL80.DLL
2006-10-27 00:48 - 2006-10-27 00:48 - 00222512 _____ (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
2010-11-15 16:30 - 2010-08-21 07:33 - 00530432 _____ (Microsoft Corporation) C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7600.16661_none_ebfb56996c72aefc\comctl32.dll
2010-11-15 16:30 - 2010-08-21 07:21 - 01680896 _____ (Microsoft Corporation) C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.DLL
2009-07-14 01:50 - 2009-07-14 03:32 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\security.dll
2012-11-14 01:32 - 2012-11-14 01:32 - 03558400 _____ (wxWidgets development team) C:\Users\pc\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll
2013-03-13 22:48 - 2013-03-13 22:48 - 24978944 _____ () C:\Users\pc\AppData\Roaming\Dropbox\bin\libcef.dll
2013-03-13 22:48 - 2013-03-13 22:48 - 09956864 _____ (The ICU Project) C:\Users\pc\AppData\Roaming\Dropbox\bin\icudt.dll
2010-11-15 16:30 - 2010-08-21 07:21 - 01680896 _____ (Microsoft Corporation) C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll
2010-11-15 16:30 - 2010-08-21 07:33 - 00530432 _____ (Microsoft Corporation) C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7600.16661_none_ebfb56996c72aefc\COMCTL32.dll
==================== Alternate Data Streams (whitelisted) ==========
AlternateDataStreams: C:\Users\pc\Downloads\Gras schneiden(1).eml:OECustomProperty
AlternateDataStreams: C:\Users\pc\Downloads\Gras schneiden.eml:OECustomProperty
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (08/31/2013 11:06:55 AM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Vom Kryptografiedienst konnte das VSS-Sicherungsobjekt "System Writer" nicht initialisiert werden.
Details:
Could not query the status of the EventSystem service.
System Error:
Der Computer wird heruntergefahren.
.
Error: (08/30/2013 02:26:29 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Vom Kryptografiedienst konnte das VSS-Sicherungsobjekt "System Writer" nicht initialisiert werden.
Details:
Could not query the status of the EventSystem service.
System Error:
Der Computer wird heruntergefahren.
.
Error: (08/21/2013 00:16:52 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error: (08/21/2013 00:16:52 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error: (08/21/2013 00:16:52 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error: (08/21/2013 00:16:52 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error: (08/15/2013 09:32:01 AM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error: (08/15/2013 09:22:01 AM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error: (08/15/2013 09:00:39 AM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error: (08/02/2013 09:39:11 AM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
System errors:
=============
Error: (09/03/2013 06:23:46 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk9\DR9 gefunden.
Error: (09/03/2013 06:23:46 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk9\DR9 gefunden.
Error: (09/03/2013 06:23:45 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk9\DR9 gefunden.
Error: (09/03/2013 06:23:45 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk9\DR9 gefunden.
Error: (09/03/2013 05:59:19 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (09/03/2013 04:21:38 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (09/03/2013 04:19:55 PM) (Source: Microsoft-Windows-Directory-Services-SAM) (User: NT-AUTORITÄT)
Description: Das SAM-Modul konnte den TCP/IP- bzw. SPX/IPX-Listening-Thread nicht starten.
Error: (09/03/2013 04:19:46 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
AFD
DfsC
discache
NetBIOS
NetBT
nsiproxy
Psched
rdbss
spldr
sptd
tdx
Wanarpv6
WfpLwf
Error: (09/03/2013 04:19:46 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "NLA (Network Location Awareness)" ist vom Dienst "Netzwerkspeicher-Schnittstellendienst" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (09/03/2013 04:19:46 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "SMB 2.0-Miniredirector" ist vom Dienst "SMB-Miniredirector-Wrapper und -Modul" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Microsoft Office Sessions:
=========================
==================== Memory info ===========================
Percentage of memory in use: 42%
Total physical RAM: 4095.37 MB
Available physical RAM: 2347.62 MB
Total Pagefile: 8188.88 MB
Available Pagefile: 6419.49 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:150.64 GB) (Free:120.02 GB) NTFS
Drive d: (Daten) (Fixed) (Total:780.77 GB) (Free:635.03 GB) NTFS
Drive o: () (Removable) (Total:1.92 GB) (Free:1.92 GB) FAT
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: EDA101F8)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=151 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=781 GB) - (Type=OF Extended)
========================================================
Disk: 9 (Size: 2 GB) (Disk ID: 91F72D24)
Partition 1: (Active) - (Size=2 GB) - (Type=06)
==================== End Of Log ============================
|
|
03.09.2013, 17:36
| #6 |
| /// TB-Ausbilder | GVU-Trojaner 2.07 Hilfe Schritt 1 Downloade Dir bitte  Malwarebytes Anti-Malware
Schritt 2 ESET Online Scanner
__________________ --> GVU-Trojaner 2.07 Hilfe |
|
03.09.2013, 19:32
| #7 |
| | GVU-Trojaner 2.07 Hilfe Malwarebytes hat schonmal nichts gefunden. Eset läuft noch. Vielen, vielen Dank für deine Hilfe. Es hat mir sehr geholfen. Gruß Stefan |
|
04.09.2013, 13:11
| #8 |
| /// TB-Ausbilder | GVU-Trojaner 2.07 Hilfe Ok, ich warte noch auf das Ergebnis von ESET.
__________________ cheers, Leo |
|
11.09.2013, 08:50
| #9 |
| /// TB-Ausbilder | GVU-Trojaner 2.07 Hilfe Hi, ich hab schon länger keine Antwort mehr von dir erhalten. Brauchst du weiterhin noch Hilfe? Wenn ich in den nächsten 24 Stunden nichts von dir höre, gehe ich davon aus, dass sich das Thema erledigt hat und lösche es aus meinen Abos.
__________________ cheers, Leo |
|
16.09.2013, 17:21
| #10 |
| /// TB-Ausbilder | GVU-Trojaner 2.07 Hilfe Fehlende Rückmeldung Dieses Thema wurde aus meinen Abos gelöscht. Somit bekomme ich keine Benachrichtigung mehr über neue Antworten. Schreib mir eine PM, falls du das Thema doch wieder fortsetzen möchtest. Dann machen wir hier weiter. Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass dein Rechner schon sauber ist. Jeder andere bitte diese Anleitung lesen und einen eigenen Thread erstellen.
__________________ cheers, Leo |
|
| Themen zu GVU-Trojaner 2.07 Hilfe |
| .exe, anhang, association, canon, erstell, erstellt, farbar, farbar recovery scan tool, frst.txt, frst64.exe, gvu-trojaner, gvu-trojaner 2.07, hilfe |
Linear-Darstellung
