| |
| |||||||
Log-Analyse und Auswertung: Mediaplayer lehnt DVDs als Gebietsfremd abWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
30.08.2014, 21:03
| #1 |
 |  Mediaplayer lehnt DVDs als Gebietsfremd ab Und monatlich grüßt das Murmeltier.., Hallo Schrauber  ich versorge Dich gleich mal mit den frst-logs aber vermutlich werde ich die GMER evtl. nachliefern müssen weil sonst die Kapazität überschritten wird.Aber schaumermal.. Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:30-08-2014 01 Ran by Rollostoimetz (administrator) on ROLLOSTOIMETZ-P on 30-08-2014 21:53:50 Running from C:\Users\Rollostoimetz\Desktop Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Adobe Systems Incorporated) C:\Program Files\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe (Symantec Corporation) C:\Program Files\Norton 360\Engine\21.5.0.19\n360.exe (Symantec Corporation) C:\Program Files\Norton Identity Safe\Engine\2014.7.6.15\nst.exe (Secunia) C:\Program Files\Secunia\PSI\psia.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe (BillP Studios) C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe (Symantec Corporation) C:\Program Files\Norton Identity Safe\Engine\2014.7.6.15\nst.exe (Symantec Corporation) C:\Program Files\Norton 360\Engine\21.5.0.19\n360.exe () C:\Users\Rollostoimetz\AppData\Local\Amazon Music\Amazon Music Helper.exe (Logitech, Inc.) C:\Program Files\Logitech\SetPoint\SetPoint.exe (Secunia) C:\Program Files\Secunia\PSI\psi_tray.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (Google Inc.) C:\Program Files\Google\Update\1.3.24.15\GoogleCrashHandler.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2014-05-08] (Adobe Systems Incorporated) HKLM\...\Run: [Kernel and Hardware Abstraction Layer] => C:\Windows\KHALMNPR.EXE [55824 2009-06-17] (Logitech, Inc.) Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.) HKU\S-1-5-21-1442112818-2063436954-1665047480-1001\...\Run: [WinPatrol] => C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe [1128000 2014-06-03] (BillP Studios) HKU\S-1-5-21-1442112818-2063436954-1665047480-1001\...\Run: [Amazon Music] => C:\Users\Rollostoimetz\AppData\Local\Amazon Music\Amazon Music Helper.exe [3356480 2014-07-22] () Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Logitech SetPoint.lnk ShortcutTarget: Logitech SetPoint.lnk -> C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia) ShellIconOverlayIdentifiers: OverlayExcluded -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files\Norton 360\Engine\21.5.0.19\buShell.dll (Symantec Corporation) ShellIconOverlayIdentifiers: OverlayPending -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files\Norton 360\Engine\21.5.0.19\buShell.dll (Symantec Corporation) ShellIconOverlayIdentifiers: OverlayProtected -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files\Norton 360\Engine\21.5.0.19\buShell.dll (Symantec Corporation) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xC34A27FF5C78CF01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files\Norton 360\Engine\21.5.0.19\coIEPlg.dll (Symantec Corporation) BHO: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files\Norton 360\Engine\21.5.0.19\IPS\IPSBHO.DLL (Symantec Corporation) Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\21.5.0.19\coIEPlg.dll (Symantec Corporation) Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Rollostoimetz\AppData\Roaming\Mozilla\Firefox\Profiles\5jr4tkmt.default FF Homepage: about:home FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_179.dll () FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\Rollostoimetz\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Ghostery - C:\Users\Rollostoimetz\AppData\Roaming\Mozilla\Firefox\Profiles\5jr4tkmt.default\Extensions\firefox@ghostery.com.xpi [2014-05-26] FF Extension: NoScript - C:\Users\Rollostoimetz\AppData\Roaming\Mozilla\Firefox\Profiles\5jr4tkmt.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-05-26] FF HKLM\...\Firefox\Extensions: [{F04D2D30-776C-4d02-8627-8E4385ECA58D}] - C:\ProgramData\Norton\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST_2014.7.3.12\coFFPlgn FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.4.0.13\coFFPlgn FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.4.0.13\coFFPlgn [2014-08-30] Chrome: ======= CHR HKLM\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files\Norton 360\Engine\21.5.0.19\Exts\Chrome.crx [2014-08-11] CHR HKLM\...\Chrome\Extension: [nppllibpnmahfaklnpggkibhkapjkeob] - C:\Program Files\Norton Identity Safe\Engine\2014.7.6.15\Exts\Chrome.crx [2014-08-07] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AdobeActiveFileMonitor8.0; C:\Program Files\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [169312 2009-10-09] (Adobe Systems Incorporated) R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 N360; C:\Program Files\Norton 360\Engine\21.5.0.19\N360.exe [265040 2014-07-31] (Symantec Corporation) R2 NCO; C:\Program Files\Norton Identity Safe\Engine\2014.7.6.15\NST.exe [130104 2014-07-31] (Symantec Corporation) R2 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia) S2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R1 BHDrvx86; C:\Program Files\Norton 360\NortonData\21.4.0.13\Definitions\BASHDefs\20140821.007\BHDrvx86.sys [1138480 2014-08-19] (Symantec Corporation) R1 ccSet_N360; C:\Windows\system32\drivers\N360\1505000.013\ccSetx86.sys [127064 2014-02-21] (Symantec Corporation) R1 ccSet_NST; C:\Windows\system32\drivers\NST\7DE07060.00F\ccSetx86.sys [127064 2013-09-27] (Symantec Corporation) R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [377648 2014-07-21] (Symantec Corporation) R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [109872 2014-07-21] (Symantec Corporation) R1 IDSVix86; C:\Program Files\Norton 360\NortonData\21.4.0.13\Definitions\IPSDefs\20140829.001\IDSvix86.sys [476888 2014-08-29] (Symantec Corporation) R3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [28560 2009-06-17] (Logitech, Inc.) R1 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [74456 2014-05-12] (Malwarebytes Corporation) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-08-30] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation) R3 NAVENG; C:\Program Files\Norton 360\NortonData\21.4.0.13\Definitions\VirusDefs\20140829.018\NAVENG.SYS [95704 2014-08-21] (Symantec Corporation) R3 NAVEX15; C:\Program Files\Norton 360\NortonData\21.4.0.13\Definitions\VirusDefs\20140829.018\NAVEX15.SYS [1636696 2014-08-21] (Symantec Corporation) R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_x86.sys [16024 2013-12-06] (Secunia) R3 SRTSP; C:\Windows\System32\Drivers\N360\1505000.013\SRTSP.SYS [664280 2014-02-13] (Symantec Corporation) R1 SRTSPX; C:\Windows\system32\drivers\N360\1505000.013\SRTSPX.SYS [32344 2013-10-30] (Symantec Corporation) R0 SymDS; C:\Windows\System32\drivers\N360\1505000.013\SYMDS.SYS [367704 2013-10-30] (Symantec Corporation) R0 SymEFA; C:\Windows\System32\drivers\N360\1505000.013\SYMEFA.SYS [936152 2014-03-04] (Symantec Corporation) R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142936 2014-07-21] (Symantec Corporation) R1 SymIRON; C:\Windows\system32\drivers\N360\1505000.013\Ironx86.SYS [206936 2013-10-30] (Symantec Corporation) R1 SymNetS; C:\Windows\System32\Drivers\N360\1505000.013\SYMNETS.SYS [447704 2014-02-18] (Symantec Corporation) U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation) S3 catchme; \??\C:\Users\ROLLOS~1\AppData\Local\Temp\catchme.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-30 21:53 - 2014-08-30 21:54 - 00012306 _____ () C:\Users\Rollostoimetz\Desktop\FRST.txt 2014-08-30 21:53 - 2014-08-30 21:53 - 00000000 ____D () C:\FRST 2014-08-30 21:51 - 2014-08-30 21:51 - 01095680 _____ (Farbar) C:\Users\Rollostoimetz\Desktop\frst.exe 2014-08-30 21:50 - 2014-08-30 21:51 - 00380416 _____ () C:\Users\Rollostoimetz\Desktop\Gmer-19357(1).exe 2014-08-30 21:49 - 2014-08-30 21:50 - 00000488 _____ () C:\Users\Rollostoimetz\Downloads\defogger_disable.log 2014-08-30 21:49 - 2014-08-30 21:49 - 00000000 _____ () C:\Users\Rollostoimetz\defogger_reenable 2014-08-30 21:48 - 2014-08-30 21:48 - 00050477 _____ () C:\Users\Rollostoimetz\Downloads\Defogger.exe 2014-08-29 23:33 - 2014-08-29 23:33 - 00001175 _____ () C:\Users\Rollostoimetz\Desktop\Amazon Music.lnk 2014-08-29 23:28 - 2014-08-29 23:31 - 38603216 _____ (Amazon) C:\Users\Rollostoimetz\Downloads\AmazonMusicInstaller.exe 2014-08-28 19:27 - 2014-08-28 19:27 - 00000795 _____ () C:\Users\Rollostoimetz\Desktop\JRT.txt 2014-08-28 18:38 - 2014-08-28 18:38 - 01016261 _____ (Thisisu) C:\Users\Rollostoimetz\Downloads\JRT.exe 2014-08-27 20:47 - 2014-08-23 03:46 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-08-27 20:47 - 2014-08-23 02:42 - 02352640 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-08-27 20:29 - 2014-08-27 20:34 - 00000000 ____D () C:\AdwCleaner 2014-08-27 20:19 - 2014-08-27 20:19 - 01364531 _____ () C:\Users\Rollostoimetz\Downloads\adwcleaner_3.308.exe 2014-08-22 17:55 - 2014-05-14 18:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2014-08-22 17:55 - 2014-05-14 18:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2014-08-22 17:55 - 2014-05-14 18:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll 2014-08-22 17:55 - 2014-05-14 18:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2014-08-22 17:54 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll 2014-08-22 17:54 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll 2014-08-22 17:54 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll 2014-08-22 17:53 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2014-08-22 17:53 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2014-08-16 12:52 - 2014-08-21 21:55 - 00000000 ____D () C:\Users\Rollostoimetz\Documents\PDFs 2014-08-13 18:06 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll 2014-08-13 18:06 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe 2014-08-13 18:06 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll 2014-08-13 18:05 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe 2014-08-13 15:48 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-08-13 15:48 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-08-13 15:48 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-08-13 15:48 - 2014-07-25 15:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-08-13 15:48 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-08-13 15:48 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-08-13 15:48 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-08-13 15:48 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-08-13 15:48 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-08-13 15:48 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-08-13 15:48 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-08-13 15:48 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-08-13 15:48 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-08-13 15:48 - 2014-07-25 14:10 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-08-13 15:48 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-08-13 15:48 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-08-13 15:48 - 2014-07-25 13:59 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-08-13 15:48 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-08-13 15:48 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-08-13 15:48 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-08-13 15:48 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-08-13 15:48 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-08-13 15:48 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-08-13 15:48 - 2014-07-25 13:09 - 00663040 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-08-13 15:48 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-08-13 15:48 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-08-13 15:48 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-08-13 15:48 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-08-13 15:48 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-08-13 15:48 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-08-13 15:48 - 2014-07-14 03:42 - 00654336 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2014-08-13 15:48 - 2014-06-16 03:44 - 00730048 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2014-08-13 15:48 - 2014-06-16 03:44 - 00219072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys 2014-08-13 15:48 - 2014-06-16 03:40 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll 2014-08-13 15:45 - 2014-08-07 03:43 - 00412160 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-08-13 15:45 - 2014-08-07 03:39 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-08-13 15:45 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-08-13 15:45 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-08-13 15:45 - 2014-06-03 11:30 - 00101824 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe 2014-08-13 15:45 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll 2014-08-13 15:45 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2014-08-13 15:45 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll 2014-08-13 15:44 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL 2014-08-13 15:44 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL 2014-08-13 15:44 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL 2014-08-13 15:44 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL 2014-08-13 15:44 - 2014-07-09 03:29 - 00005632 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL 2014-08-13 15:44 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\system32\locale.nls 2014-08-13 01:00 - 2014-08-13 01:00 - 04575232 _____ (Google Inc.) C:\Windows\system32\GPhotos.scr 2014-08-11 19:03 - 2014-08-11 19:03 - 00000000 ___HD () C:\Users\Rollostoimetz\Downloads\.picasaoriginals 2014-08-11 18:57 - 2014-08-11 19:00 - 38754210 _____ () C:\Users\Rollostoimetz\Downloads\crab.tif 2014-08-09 10:35 - 2014-08-09 10:35 - 00000522 _____ () C:\DelFix.txt 2014-07-31 23:57 - 2014-07-31 23:57 - 00002180 _____ () C:\Users\Rollostoimetz\Documents\Giftgas.txt ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-30 21:54 - 2014-08-30 21:53 - 00012306 _____ () C:\Users\Rollostoimetz\Desktop\FRST.txt 2014-08-30 21:53 - 2014-08-30 21:53 - 00000000 ____D () C:\FRST 2014-08-30 21:51 - 2014-08-30 21:51 - 01095680 _____ (Farbar) C:\Users\Rollostoimetz\Desktop\frst.exe 2014-08-30 21:51 - 2014-08-30 21:50 - 00380416 _____ () C:\Users\Rollostoimetz\Desktop\Gmer-19357(1).exe 2014-08-30 21:50 - 2014-08-30 21:49 - 00000488 _____ () C:\Users\Rollostoimetz\Downloads\defogger_disable.log 2014-08-30 21:49 - 2014-08-30 21:49 - 00000000 _____ () C:\Users\Rollostoimetz\defogger_reenable 2014-08-30 21:49 - 2014-05-25 23:00 - 00000000 ____D () C:\Users\Rollostoimetz 2014-08-30 21:48 - 2014-08-30 21:48 - 00050477 _____ () C:\Users\Rollostoimetz\Downloads\Defogger.exe 2014-08-30 21:43 - 2014-07-10 17:34 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-08-30 21:30 - 2014-05-28 19:04 - 00001152 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1442112818-2063436954-1665047480-1001UA.job 2014-08-30 21:01 - 2014-06-23 23:30 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-08-30 20:57 - 2014-05-27 07:44 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-08-30 20:56 - 2014-05-27 07:44 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-08-30 20:51 - 2014-05-29 23:47 - 01444277 _____ () C:\Windows\WindowsUpdate.log 2014-08-30 20:50 - 2009-07-14 06:34 - 00028720 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-08-30 20:50 - 2009-07-14 06:34 - 00028720 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-08-30 20:39 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-08-30 20:39 - 2009-07-14 06:39 - 00046282 _____ () C:\Windows\setupact.log 2014-08-30 15:40 - 2014-05-26 13:37 - 00007601 _____ () C:\Users\Rollostoimetz\AppData\Local\Resmon.ResmonCfg 2014-08-30 15:31 - 2010-11-20 23:48 - 02351122 _____ () C:\Windows\PFRO.log 2014-08-29 23:33 - 2014-08-29 23:33 - 00001175 _____ () C:\Users\Rollostoimetz\Desktop\Amazon Music.lnk 2014-08-29 23:31 - 2014-08-29 23:28 - 38603216 _____ (Amazon) C:\Users\Rollostoimetz\Downloads\AmazonMusicInstaller.exe 2014-08-29 18:38 - 2014-07-10 18:51 - 00000000 ____D () C:\Users\Rollostoimetz\AppData\Local\CrashDumps 2014-08-28 19:50 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF 2014-08-28 19:27 - 2014-08-28 19:27 - 00000795 _____ () C:\Users\Rollostoimetz\Desktop\JRT.txt 2014-08-28 18:38 - 2014-08-28 18:38 - 01016261 _____ (Thisisu) C:\Users\Rollostoimetz\Downloads\JRT.exe 2014-08-27 20:52 - 2009-07-14 06:33 - 00336832 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-08-27 20:34 - 2014-08-27 20:29 - 00000000 ____D () C:\AdwCleaner 2014-08-27 20:19 - 2014-08-27 20:19 - 01364531 _____ () C:\Users\Rollostoimetz\Downloads\adwcleaner_3.308.exe 2014-08-26 19:22 - 2010-11-20 23:01 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-08-23 10:54 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE 2014-08-23 03:46 - 2014-08-27 20:47 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-08-23 02:42 - 2014-08-27 20:47 - 02352640 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-08-21 21:55 - 2014-08-16 12:52 - 00000000 ____D () C:\Users\Rollostoimetz\Documents\PDFs 2014-08-20 21:35 - 2014-05-26 08:34 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-08-19 19:23 - 2014-07-21 21:39 - 00000000 ____D () C:\Windows\system32\Drivers\N360 2014-08-19 19:21 - 2014-07-21 21:39 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360 2014-08-17 15:29 - 2014-05-28 19:04 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1442112818-2063436954-1665047480-1001Core.job 2014-08-17 11:45 - 2014-06-23 23:29 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-08-14 01:32 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET 2014-08-13 18:44 - 2014-07-10 17:34 - 00699568 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2014-08-13 18:44 - 2014-07-10 17:34 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2014-08-13 18:44 - 2014-06-12 19:19 - 00002958 _____ () C:\Windows\SecuniaPackage.log 2014-08-13 18:21 - 2014-05-27 18:37 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-08-13 18:18 - 2014-05-26 13:40 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-08-13 18:17 - 2014-05-26 21:52 - 00000000 ____D () C:\Windows\system32\MRT 2014-08-13 18:13 - 2014-05-26 21:51 - 96303304 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-08-13 01:00 - 2014-08-13 01:00 - 04575232 _____ (Google Inc.) C:\Windows\system32\GPhotos.scr 2014-08-12 09:42 - 2014-07-21 21:21 - 00000000 ____D () C:\Windows\system32\Drivers\NST 2014-08-12 09:41 - 2014-07-21 21:21 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Identity Safe 2014-08-11 19:03 - 2014-08-11 19:03 - 00000000 ___HD () C:\Users\Rollostoimetz\Downloads\.picasaoriginals 2014-08-11 19:03 - 2014-06-14 21:18 - 00000125 ____H () C:\Users\Rollostoimetz\Downloads\.picasa.ini 2014-08-11 19:00 - 2014-08-11 18:57 - 38754210 _____ () C:\Users\Rollostoimetz\Downloads\crab.tif 2014-08-09 10:35 - 2014-08-09 10:35 - 00000522 _____ () C:\DelFix.txt 2014-08-07 03:43 - 2014-08-13 15:45 - 00412160 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-08-07 03:39 - 2014-08-13 15:45 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-08-05 09:16 - 2014-07-22 17:54 - 00000000 ____D () C:\Users\Rollostoimetz\AppData\Local\Adobe 2014-08-04 21:45 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache 2014-08-01 01:16 - 2014-08-13 15:48 - 00307384 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-07-31 23:57 - 2014-07-31 23:57 - 00002180 _____ () C:\Users\Rollostoimetz\Documents\Giftgas.txt ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-08-08 15:11 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version:30-08-2014 01
Ran by Rollostoimetz at 2014-08-30 21:55:45
Running from C:\Users\Rollostoimetz\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Norton 360 (Enabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}
AS: Norton 360 (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Norton 360 (Enabled) {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 14 Plugin (HKLM\...\{16E20D9D-E7E2-4951-A944-6FFC40870AD4}) (Version: 14.0.0.179 - Adobe Systems Incorporated)
Adobe Photoshop Elements 8.0 (HKLM\...\Adobe Photoshop Elements 8.0) (Version: 8.0 - Adobe Systems Incorporated)
Adobe Photoshop Elements 8.0 (Version: 8.0 - Adobe Systems Incorporated) Hidden
Adobe Reader XI (11.0.08) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Amazon Music (HKCU\...\Amazon Amazon Music) (Version: 3.2.0.591 - Amazon Services LLC)
Camera RAW Plug-In for EPSON Creativity Suite (HKLM\...\{93EA9C3E-BDFD-4309-A605-9B5BBC0CCEFD}) (Version: 2.2.0.0 - SEIKO EPSON CORPORATION)
CDDRV_Installer (Version: 4.60 - Logitech) Hidden
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Diablo II (HKLM\...\Diablo II) (Version: - Blizzard Entertainment)
EPSON Attach To Email (HKLM\...\InstallShield_{20C45B32-5AB6-46A4-94EF-58950CAF05E5}) (Version: 1.01.0000 - SEIKO EPSON)
EPSON Attach To Email (Version: 1.01.0000 - SEIKO EPSON) Hidden
EPSON Copy Utility 3 (HKLM\...\{67EDD823-135A-4D59-87BD-950616D6E857}) (Version: 3.3.0.0 - )
EPSON Easy Photo Print (HKLM\...\{3D78F2A2-C893-4ABD-B5FE-AD7011837755}) (Version: 1.5.0.0 - SEIKO EPSON CORPORATION)
EPSON File Manager (HKLM\...\{2EB81825-E9EE-44F4-8F51-1240C3898DC6}) (Version: 1.3.0.0 - )
EPSON Print CD (HKLM\...\{FF477885-5EA8-40D0-ADF3-D4C1B86FAEA4}) (Version: 1.60.000 - )
EPSON Scan (HKLM\...\EPSON Scanner) (Version: - )
EPSON Scan Assistant (HKLM\...\{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}) (Version: 1.10.00 - )
EPSON Stylus Photo RX585_RX610 Handbuch (HKLM\...\EPSON Stylus Photo RX585_RX610 Benutzerhandbuch) (Version: - )
EPSON-Drucker-Software (HKLM\...\EPSON Printer and Utilities) (Version: - )
erLT (Version: 1.20.0137 - Logitech, Inc.) Hidden
ESET Online Scanner v3 (HKLM\...\ESET Online Scanner) (Version: - )
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden
Google+ Auto Backup (HKCU\...\Google+ Auto Backup) (Version: 1.0.26.151 - Google, Inc.)
KhalInstallWrapper (Version: 2.00.0000 - Logitech) Hidden
Logitech SetPoint (HKLM\...\{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}) (Version: 4.80 - Logitech)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (Version: - Microsoft) Hidden
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version: - Microsoft) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Mozilla Firefox 31.0 (x86 de) (HKLM\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 31.0 - Mozilla)
Norton 360 (HKLM\...\N360) (Version: 21.5.0.19 - Symantec Corporation)
Norton Identity Safe (HKLM\...\NST) (Version: 2014.7.6.15 - Symantec Corporation)
NVIDIA Grafiktreiber 307.83 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 307.83 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.109.706 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 307.83 (Version: 307.83 - NVIDIA Corporation) Hidden
NVIDIA Update 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.10.8 - NVIDIA Corporation)
NVIDIA Update Components (Version: 1.10.8 - NVIDIA Corporation) Hidden
Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Secunia PSI (3.0.0.9016) (HKLM\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
Skype™ 6.16 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
WinPatrol (HKLM\...\{84481A87-2316-4923-8FAB-3BA8CA29323D}) (Version: 31.0.2014.0 - BillP Studios)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1001_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Users\Rollostoimetz\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1001_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> "C:\Users\Rollostoimetz\AppData\Local\Google\Update\1.3.24.7\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1001_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> "C:\Users\Rollostoimetz\AppData\Local\Google\Update\1.3.24.7\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1001_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> "C:\Users\Rollostoimetz\AppData\Local\Google\Update\1.3.24.7\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1001_Classes\CLSID\{A45426FB-E444-42B2-AA56-419F8FBEEC61}\InprocServer32 -> C:\Users\Rollostoimetz\AppData\Local\Google\Update\1.3.22.3\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1001_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Users\Rollostoimetz\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1001_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Users\Rollostoimetz\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1001_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> "C:\Users\Rollostoimetz\AppData\Local\Google\Update\1.3.24.7\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Rollostoimetz\AppData\Local\Google\Update\1.3.24.7\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1001_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Rollostoimetz\AppData\Local\Google\Update\1.3.24.7\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1003_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Users\Rollostoimetz\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1003_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> "C:\Users\Rollostoimetz\AppData\Local\Google\Update\1.3.24.7\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1003_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> "C:\Users\Rollostoimetz\AppData\Local\Google\Update\1.3.24.7\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1003_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> "C:\Users\Rollostoimetz\AppData\Local\Google\Update\1.3.24.7\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1003_Classes\CLSID\{A45426FB-E444-42B2-AA56-419F8FBEEC61}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Local\Google\Update\1.3.22.3\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1003_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1003_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1003_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> "C:\Users\Rollostoimetz\AppData\Local\Google\Update\1.3.24.7\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1003_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Local\Google\Update\1.3.24.7\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1003_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Local\Google\Update\1.3.24.7\psuser.dll No File
==================== Restore Points =========================
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {03B16A37-75B8-41AA-A9C3-0C075DEF4919} - System32\Tasks\Norton WSC Integration => C:\Program Files\Norton 360\Engine\21.5.0.19\WSCStub.exe [2014-07-31] (Symantec Corporation)
Task: {3BD9C85A-C677-4068-82F1-87ACF046DD21} - System32\Tasks\Norton Identity Safe\Norton Error Analyzer => C:\Program Files\Norton Identity Safe\Engine\2014.7.6.15\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {4BCB4833-D069-454D-AD40-715C22738C33} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1442112818-2063436954-1665047480-1001UA => C:\Users\Rollostoimetz\AppData\Local\Google\Update\GoogleUpdate.exe [2014-05-28] (Google Inc.)
Task: {599540F6-338F-4BA5-8CDE-03C7DAEFD29E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-08-13] (Adobe Systems Incorporated)
Task: {75B830A5-64F0-4FB5-877E-11B7ACA3992B} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1442112818-2063436954-1665047480-1001Core => C:\Users\Rollostoimetz\AppData\Local\Google\Update\GoogleUpdate.exe [2014-05-28] (Google Inc.)
Task: {89FA4D25-ADF4-49E3-859A-3E1CB9C4E16C} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {A2EBAC0E-E1F1-4B3D-852A-7108162A558D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-05-27] (Google Inc.)
Task: {A3CD02CE-4D49-4544-BB41-290A72073576} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-05-27] (Google Inc.)
Task: {B386F51F-7CF7-41DF-B185-27484FAA103B} - System32\Tasks\Norton 360\Norton Error Processor => C:\Program Files\Norton 360\Engine\21.5.0.19\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {B6872783-7B6B-4F2B-BDB2-D75443FF6286} - System32\Tasks\Norton Identity Safe\Norton Error Processor => C:\Program Files\Norton Identity Safe\Engine\2014.7.6.15\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {B94B76F2-CAF4-4EA7-96D0-34D48E7AAAFF} - System32\Tasks\Norton 360\Norton Error Analyzer => C:\Program Files\Norton 360\Engine\21.5.0.19\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {FF0DD0F9-4661-43E8-B9A1-C4A4EBBDF19B} - System32\Tasks\Und Tschüß => Herunterfahren
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1442112818-2063436954-1665047480-1001Core.job => C:\Users\Rollostoimetz\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1442112818-2063436954-1665047480-1001UA.job => C:\Users\Rollostoimetz\AppData\Local\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2014-05-25 23:29 - 2013-01-31 11:00 - 00079648 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax.dll
2014-08-29 23:33 - 2014-07-22 22:46 - 03356480 _____ () C:\Users\Rollostoimetz\AppData\Local\Amazon Music\Amazon Music Helper.exe
2014-05-27 08:51 - 2009-07-20 12:27 - 00017936 _____ () C:\Program Files\Logitech\SetPoint\khalwrapper.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
==================== Faulty Device Manager Devices =============
Name: RAID-Controller
Description: RAID-Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (08/30/2014 08:41:20 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/30/2014 03:32:54 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/29/2014 08:26:01 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/29/2014 06:38:12 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: perfmon.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce78d0c
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea91c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00052d37
ID des fehlerhaften Prozesses: 0x16dc
Startzeit der fehlerhaften Anwendung: 0xperfmon.exe0
Pfad der fehlerhaften Anwendung: perfmon.exe1
Pfad des fehlerhaften Moduls: perfmon.exe2
Berichtskennung: perfmon.exe3
Error: (08/29/2014 06:09:55 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (08/30/2014 08:54:57 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "NOBBI",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{27528427-AF88-4ACF-8E65-7DE46F0C84C1-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
Error: (08/30/2014 03:46:43 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "NOBBI",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{27528427-AF88-4ACF-8E65-7DE46F0C84C1-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
Error: (08/30/2014 03:39:50 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" ist vom Dienst "Peernetzwerkidentitäts-Manager" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1053
Error: (08/30/2014 03:39:50 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peernetzwerkidentitäts-Manager" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1053
Error: (08/30/2014 03:39:50 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Peernetzwerkidentitäts-Manager" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (08/30/2014 03:39:50 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Peernetzwerkidentitäts-Manager erreicht.
Error: (08/30/2014 03:37:54 PM) (Source: WMPNetworkSvc) (EventID: 14332) (User: )
Description: WMPNetworkSvc0x80004005
Error: (08/29/2014 11:50:26 PM) (Source: WMPNetworkSvc) (EventID: 14365) (User: )
Description: 0x80004004-1
Error: (08/29/2014 08:28:58 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "NOBBI",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{27528427-AF88-4ACF-8E65-7DE46F0C84C1-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
Error: (08/29/2014 07:56:21 PM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
Microsoft Office Sessions:
=========================
==================== Memory info ===========================
Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz
Percentage of memory in use: 41%
Total physical RAM: 2047.54 MB
Available physical RAM: 1198.11 MB
Total Pagefile: 4095.08 MB
Available Pagefile: 2991.58 MB
Total Virtual: 2047.88 MB
Available Virtual: 1914.16 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:57.26 GB) (Free:30.16 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:146.48 GB) (Free:44.66 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 57.3 GB) (Disk ID: 8CA84EF1)
Partition 1: (Active) - (Size=57.3 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (Size: 149.1 GB) (Disk ID: 424CBF9C)
Partition 1: (Active) - (Size=146.5 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
30.08.2014, 21:38
| #2 |
| /// the machine /// TB-Ausbilder    | Mediaplayer lehnt DVDs als Gebietsfremd ab hi,
__________________keine Malware. Was sind das für DVDs?
__________________ |
|
30.08.2014, 21:51
| #3 |
| | Mediaplayer lehnt DVDs als Gebietsfremd ab Startrek "Voyager". The full Journey. Zuvor "the next Generation" Gleiches Problem.
__________________Über weite Strecken und unzählige DVDs überhaupt keine Mätzchen. Dann plötzlich die Meldung dass die DVDs für das Gebiet nicht zugelassen seien. Ich lasse Adwarecleaner Code:
ATTFilter # AdwCleaner v3.308 - Bericht erstellt am 30/08/2014 um 23:03:54
# Aktualisiert 20/08/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (32 bits)
# Benutzername : Rollostoimetz - ROLLOSTOIMETZ-P
# Gestartet von : C:\Users\Rollostoimetz\Downloads\adwcleaner_3.308.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17239
-\\ Mozilla Firefox v31.0 (x86 de)
[ Datei : C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\a4er7z10.default\prefs.js ]
[ Datei : C:\Users\Rollostoimetz\AppData\Roaming\Mozilla\Firefox\Profiles\5jr4tkmt.default\prefs.js ]
*************************
AdwCleaner[R0].txt - [971 octets] - [30/08/2014 22:56:20]
AdwCleaner[S0].txt - [893 octets] - [30/08/2014 23:03:54]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [952 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.3 (03.23.2014:1)
OS: Windows 7 Home Premium x86
Ran by Rollostoimetz on 28.08.2014 at 18:58:57,47
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\Rollostoimetz\AppData\Roaming\mozilla\firefox\profiles\5jr4tkmt.default\minidumps [9 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 28.08.2014 at 19:27:48,64
Computer was rebooted
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Hier übrigens noch das gmer Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-08-30 22:37:14
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Maxtor_6Y060L0 rev.YAR41VW0 57,27GB
Running: Gmer-19357(1).exe; Driver: C:\Users\ROLLOS~1\AppData\Local\Temp\uftdrpob.sys
---- System - GMER 2.1 ----
SSDT 863EFCD8 ZwAlertResumeThread
SSDT 863EFD70 ZwAlertThread
SSDT 8617A5A8 ZwAllocateVirtualMemory
SSDT 85D03DF0 ZwAlpcConnectPort
SSDT 863EF750 ZwAssignProcessToJobObject
SSDT 863EFB00 ZwCreateMutant
SSDT 863EF548 ZwCreateSymbolicLinkObject
SSDT 8617A900 ZwCreateThread
SSDT 863EF5F0 ZwCreateThreadEx
SSDT 863EF7E8 ZwDebugActiveProcess
SSDT 8617A6E8 ZwDuplicateObject
SSDT 8617A438 ZwFreeVirtualMemory
SSDT 863EFBA8 ZwImpersonateAnonymousToken
SSDT 863EFC40 ZwImpersonateThread
SSDT 85D0CF10 ZwLoadDriver
SSDT 8617A380 ZwMapViewOfSection
SSDT 863EFA68 ZwOpenEvent
SSDT 8617A838 ZwOpenProcess
SSDT 8617A650 ZwOpenProcessToken
SSDT 863EF938 ZwOpenSection
SSDT 8617A790 ZwOpenThread
SSDT 863EF6A8 ZwProtectVirtualMemory
SSDT 863EF4A0 ZwQueueApcThread
SSDT 863EF3F8 ZwQueueApcThreadEx
SSDT 863EFE08 ZwResumeThread
SSDT 863EFFD0 ZwSetContextThread
SSDT 8617A240 ZwSetInformationProcess
SSDT 863EF880 ZwSetSystemInformation
SSDT 863EF9D0 ZwSuspendProcess
SSDT 863EFEA0 ZwSuspendThread
SSDT 8617A9B8 ZwTerminateProcess
SSDT 863EFF38 ZwTerminateThread
SSDT 8617A2E8 ZwUnmapViewOfSection
SSDT 8617A4E0 ZwWriteVirtualMemory
Code \??\C:\Windows\system32\drivers\mbamchameleon.sys (Malwarebytes Chameleon Protection Driver/Malwarebytes Corporation) KeInsertQueueApc
---- Kernel code sections - GMER 2.1 ----
.text ntoskrnl.exe!ZwRollbackEnlistment + 1409 82C499A5 1 Byte [06]
.text ntoskrnl.exe!KiDispatchInterrupt + 5A2 82C69512 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntoskrnl.exe!KeRemoveQueueEx + 13A3 82C70998 8 Bytes [D8, FC, 3E, 86, 70, FD, 3E, ...]
.text ntoskrnl.exe!KeRemoveQueueEx + 13BB 82C709B0 4 Bytes [A8, A5, 17, 86]
.text ntoskrnl.exe!KeRemoveQueueEx + 13C7 82C709BC 4 Bytes [F0, 3D, D0, 85]
.text ntoskrnl.exe!KeRemoveQueueEx + 141B 82C70A10 4 Bytes [50, F7, 3E, 86]
.text ntoskrnl.exe!KeRemoveQueueEx + 1497 82C70A8C 4 Bytes [00, FB, 3E, 86]
.text ...
.text ntoskrnl.exe!KeInsertQueueApc 82CB8723 5 Bytes JMP 89C05662 \??\C:\Windows\system32\drivers\mbamchameleon.sys (Malwarebytes Chameleon Protection Driver/Malwarebytes Corporation)
---- Threads - GMER 2.1 ----
Thread System [4:720] 927EEE50
---- EOF - GMER 2.1 ----
Geändert von Fellefant (30.08.2014 um 22:13 Uhr) |
|
31.08.2014, 11:27
| #4 |
| /// the machine /// TB-Ausbilder | Mediaplayer lehnt DVDs als Gebietsfremd ab Mit welchem Programm spielst du die ab?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
31.08.2014, 13:24
| #5 |
| | Mediaplayer lehnt DVDs als Gebietsfremd ab Mit dem 0815 Windows Media Player meines schönen neuen Windows 7. Und das war die Lösung - wie ich soeben herausfand Die Probleme treten ausschließlich beim Mediaplayer auf. Über das Mediacenter läuft alles reibungslos.Also vielen Dank für Deine Mühe - ich beende damit diese Sitzung  Fellefant Geändert von Fellefant (31.08.2014 um 14:22 Uhr) |
|
31.08.2014, 17:07
| #6 |
| /// the machine /// TB-Ausbilder | Mediaplayer lehnt DVDs als Gebietsfremd ab ok
__________________ --> Mediaplayer lehnt DVDs als Gebietsfremd ab |
|
| Themen zu Mediaplayer lehnt DVDs als Gebietsfremd ab |
| adobe, adware, browser, cpu, defender, email, error, excel, explorer, flash player, google, home, homepage, mozilla, registry, rundll, scan, security, services.exe, software, svchost.exe, symantec, system, temp, windows |
Linear-Darstellung
