| |
| |||||||
Log-Analyse und Auswertung: Windows-8-PC mit Systemabsturz und temporärem StartproblemWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
13.08.2013, 15:39
| #1 |
 |  Windows-8-PC mit Systemabsturz und temporärem Startproblem Guten Tag liebe Trojaner-Board-Helfer, unser Zweit-PC verhält sich seit gestern zeitweilig recht seltsam. Gestern wollte mein Mann nach dem Systemstart ein Programm starten, woraufhin der Bildschirm schwarz wurde und nur noch ein Meldung zeigte, dass ein schwerer Windows-Fehler vorläge und man von einem funktionstüchtgen Systemdatenträger neu booten solle. Vor Schreck hat er dann den PC einfach ausgemacht und neu hochgefahren. Funktionierte auch wieder prima. quickscan mit Mbam ergab keinen Fund. Zwischenzeitlich wurde der PC noch ein paarmal ohne Probleme benutzt - Vor 2 Stunden hab ich dann den Startknopf des PCs gedrückt, der dann aber nicht startete sondern lediglich einen weißen Mauszeiger auf schwarzem Grund zeigte. - Kein Startbildschirm, kein Willkommensbildschirm und schon gar keine Anmeldung. Habe also das Ding wieder ausgeschaltet, vom Strom getrennt und wieder neu gestartet - und siehe, da er funktioniert wieder. Vollscan mit Avast Free gemacht - Kein Fund! Daraufhin habe ich noch die von euch gewünschten Scans mit defogger, Frst und GMER gemacht. Bei GMER hat er ein paar Mal gemäkelt: Direkt nach gmer-Start: C:\windows\system32\config\system: Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird gleiche Meldung während des scans bei Sektor C:\users\sanne\Downloads \gmer_2.1.19163.exe[3480]@c:\windows\system32\OLEAUT32.dll und so ziemlich am Scan-Ende kam die Meldung C:\User\sanne\ntuser.dat Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird So, ich hoffe, ich habe nichts vergessen und wäre Euch unendlich dankbar, wenn Ihr Euch die Logs einmal anschauen würdet, ob da irgendwas bösartiges zu finden ist  Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 15:48 on 13/08/2013 (Sanne)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-08-2013
Ran by Sanne (administrator) on 13-08-2013 15:50:00
Running from C:\Users\Sanne\Downloads
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Microsoft Corporation) C:\Windows\system32\dashost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(SoftPerfect Research) C:\Program Files\NetWorx\networx.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieCtrl.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13192848 2012-08-20] (Realtek Semiconductor)
HKLM\...\Run: [NetWorx] - C:\Program Files\NetWorx\networx.exe [4886648 2013-07-24] (SoftPerfect Research)
HKCU\...\Run: [Pando Media Booster] - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624 2013-03-06] ()
HKCU\...\Run: [FileHippo.com] - C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe [307712 2012-11-23] (FileHippo.com)
HKCU\...\Run: [SecureBanking] - C:\Program Files (x86)\Secure Banking\SecureBanking.exe [507904 2013-07-04] (Secure Banking)
HKCU\...\Run: [SandboxieControl] - C:\Program Files\Sandboxie\SbieCtrl.exe [759384 2013-07-08] (Sandboxie Holdings, LLC)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [277504 2012-08-16] (Intel Corporation)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] - C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] - C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-20] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Reader Application Helper] - C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe [899400 2013-03-18] (Sony Corporation)
HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)
HKLM-x32\...\Run: [] - [x]
HKU\Default\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [x]
HKU\Default User\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [x]
HKU\Philipp\...\Run: [SandboxieControl] - C:\Program Files\Sandboxie\SbieCtrl.exe [759384 2013-07-08] (Sandboxie Holdings, LLC)
HKU\UpdatusUser\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [x]
AppInit_DLLs: C:\PROGRA~2\NVIDIA~1\3DVISI~1\NVSTIN~1.DLL [759384 2013-07-08] ()
AppInit_DLLs-x32: C:\PROGRA~2\NVIDIA~1\3DVISI~1\nvStInit.dll [759384 2013-07-08] ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo13.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13.msn.com
SearchScopes: HKCU - DefaultScope {0C688C30-1FFE-47A6-A484-31890FF3D232} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MALNJS
SearchScopes: HKCU - {0C688C30-1FFE-47A6-A484-31890FF3D232} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MALNJS
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
FireFox:
========
FF ProfilePath: C:\Users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @sony.com/ReaderDesktop - C:\Program Files (x86)\Sony\ReaderDesktop\npreaderdetectmoz.dll (Sony Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Extension: WOT - C:\Users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF Extension: No Name - C:\Users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR Extension: (Docs) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Google Drive) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0
CHR Extension: (YouTube) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (Gmail) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
==================== Services (Whitelisted) =================
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-13] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-13] (CyberLink)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-07-19] (Intel Corporation)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2010-08-19] ()
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [183896 2013-07-08] (Sandboxie Holdings, LLC)
S3 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1223704 2013-02-07] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [660504 2013-02-07] (Secunia)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [14920 2013-01-29] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-06-27] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-06-27] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-06-27] ()
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
R1 networx; C:\Windows\System32\drivers\networx.sys [41976 2013-07-20] (NetFilterSDK.com)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-02-07] (Secunia)
S3 RTL8192cu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1576080 2012-08-07] (Realtek Semiconductor Corporation )
R3 RtlWlanu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1576080 2012-08-07] (Realtek Semiconductor Corporation )
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [199384 2013-07-08] (Sandboxie Holdings, LLC)
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [x]
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-13 15:49 - 2013-08-13 15:49 - 00000000 ____D C:\FRST
2013-08-13 15:48 - 2013-08-13 15:48 - 00000472 _____ C:\Users\Sanne\Desktop\defogger_disable.log
2013-08-13 15:48 - 2013-08-13 15:48 - 00000000 _____ C:\Users\Sanne\defogger_reenable
2013-08-13 15:45 - 2013-08-13 15:45 - 00377856 _____ C:\Users\Sanne\Downloads\gmer_2.1.19163.exe
2013-08-13 15:44 - 2013-08-13 15:44 - 01575190 _____ (Farbar) C:\Users\Sanne\Downloads\FRST64.exe
2013-08-13 15:42 - 2013-08-13 15:42 - 00050477 _____ C:\Users\Sanne\Downloads\Defogger.exe
2013-08-13 15:37 - 2013-08-13 15:37 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-13 15:33 - 2013-08-13 15:33 - 01110476 _____ C:\Users\Philipp\Downloads\7z920.exe
2013-08-12 19:30 - 2013-08-12 19:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-12 19:27 - 2013-08-12 19:27 - 01492848 _____ (Skype Technologies S.A.) C:\Users\Sanne\Downloads\SkypeSetup.exe
2013-08-12 19:07 - 2013-08-12 19:07 - 497783871 _____ C:\Windows\MEMORY.DMP
2013-08-12 19:07 - 2013-08-12 19:07 - 00294544 _____ C:\Windows\Minidump\081213-15968-01.dmp
2013-08-12 19:07 - 2013-08-12 19:07 - 00000000 ____D C:\Windows\Minidump
2013-08-11 12:03 - 2013-08-11 12:03 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-29 13:33 - 2013-07-29 13:33 - 00001130 _____ C:\Users\Philipp\Desktop\FiestaOnline.lnk
2013-07-29 12:36 - 2013-07-29 12:36 - 03313224 _____ (Softperfect Research ) C:\Users\Sanne\Downloads\networx_setup.exe
2013-07-21 21:04 - 2013-07-21 21:06 - 00000000 ____D C:\Windows\system32\MRT
2013-07-21 19:25 - 2013-07-21 19:25 - 00386216 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-20 16:17 - 2013-06-28 00:04 - 00693112 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-20 16:17 - 2013-06-28 00:04 - 00078200 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-20 15:58 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-20 15:58 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-20 15:58 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-20 15:58 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-20 15:58 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-20 15:57 - 2013-06-17 00:41 - 00997632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2013-07-20 15:57 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-20 15:57 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-20 15:57 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-20 15:57 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-20 15:57 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-20 15:57 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-20 15:57 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-20 15:57 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-20 15:57 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-20 15:57 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-20 15:57 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-20 15:57 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-20 15:57 - 2013-06-01 13:54 - 00194816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys
2013-07-20 15:57 - 2013-06-01 13:54 - 00125184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys
2013-07-20 15:57 - 2013-06-01 13:34 - 02391280 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2013-07-20 15:57 - 2013-06-01 13:33 - 02233600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-07-20 15:57 - 2013-06-01 13:29 - 00337152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBXHCI.SYS
2013-07-20 15:57 - 2013-06-01 13:29 - 00213248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\UCX01000.SYS
2013-07-20 15:57 - 2013-06-01 13:26 - 06987008 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-07-20 15:57 - 2013-06-01 13:26 - 00327936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2013-07-20 15:57 - 2013-06-01 12:24 - 02106176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2013-07-20 15:57 - 2013-06-01 11:25 - 00496640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-20 15:57 - 2013-06-01 11:25 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2013-07-20 15:57 - 2013-06-01 11:25 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\samlib.dll
2013-07-20 15:57 - 2013-06-01 11:24 - 01453568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcore.dll
2013-07-20 15:57 - 2013-06-01 11:24 - 00850944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfasfsrcsnk.dll
2013-07-20 15:57 - 2013-06-01 11:24 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll
2013-07-20 15:57 - 2013-06-01 11:23 - 01842176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2013-07-20 15:57 - 2013-06-01 11:23 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\vds.exe
2013-07-20 15:57 - 2013-06-01 11:22 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2013-07-20 15:57 - 2013-06-01 11:22 - 00446976 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2013-07-20 15:57 - 2013-06-01 11:22 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\vdsutil.dll
2013-07-20 15:57 - 2013-06-01 11:22 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\MbaeParserTask.exe
2013-07-20 15:57 - 2013-06-01 11:21 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2013-07-20 15:57 - 2013-06-01 11:21 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-20 15:57 - 2013-06-01 11:21 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\samlib.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 02219520 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 01527808 _____ (Microsoft Corporation) C:\Windows\system32\mfcore.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 01048576 _____ (Microsoft Corporation) C:\Windows\system32\mfasfsrcsnk.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 00583168 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2013-07-20 15:57 - 2013-06-01 11:19 - 00785408 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2013-07-20 15:57 - 2013-06-01 11:19 - 00207872 _____ (Microsoft Corporation) C:\Windows\system32\DeviceSetupManager.dll
2013-07-20 15:57 - 2013-06-01 05:08 - 00037632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\BthAvrcpTg.sys
2013-07-20 15:57 - 2013-05-31 01:14 - 04036096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-20 15:57 - 2013-05-25 00:09 - 01403296 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2013-07-20 15:57 - 2013-05-25 00:09 - 01271584 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2013-07-20 15:57 - 2013-05-25 00:09 - 01217352 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2013-07-20 15:57 - 2013-05-25 00:09 - 01093904 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2013-07-20 15:57 - 2013-05-20 02:08 - 00386642 _____ C:\Windows\system32\ApnDatabase.xml
2013-07-20 15:57 - 2013-05-04 08:59 - 02842112 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-20 15:57 - 2013-05-04 06:57 - 02620928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-20 15:57 - 2013-04-12 00:30 - 01421312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-20 15:57 - 2013-04-12 00:22 - 01838080 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
==================== One Month Modified Files and Folders =======
2013-08-13 15:49 - 2013-08-13 15:49 - 00000000 ____D C:\FRST
2013-08-13 15:48 - 2013-08-13 15:48 - 00000472 _____ C:\Users\Sanne\Desktop\defogger_disable.log
2013-08-13 15:48 - 2013-08-13 15:48 - 00000000 _____ C:\Users\Sanne\defogger_reenable
2013-08-13 15:48 - 2012-12-17 11:30 - 00000000 ____D C:\Users\Sanne
2013-08-13 15:45 - 2013-08-13 15:45 - 00377856 _____ C:\Users\Sanne\Downloads\gmer_2.1.19163.exe
2013-08-13 15:44 - 2013-08-13 15:44 - 01575190 _____ (Farbar) C:\Users\Sanne\Downloads\FRST64.exe
2013-08-13 15:43 - 2012-08-28 15:12 - 00752930 _____ C:\Windows\system32\perfh007.dat
2013-08-13 15:43 - 2012-08-28 15:12 - 00156156 _____ C:\Windows\system32\perfc007.dat
2013-08-13 15:43 - 2012-07-26 09:28 - 01748838 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-13 15:42 - 2013-08-13 15:42 - 00050477 _____ C:\Users\Sanne\Downloads\Defogger.exe
2013-08-13 15:40 - 2012-11-29 12:41 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-13 15:39 - 2012-07-26 09:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-13 15:38 - 2012-09-11 14:11 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-13 15:37 - 2013-08-13 15:37 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-13 15:37 - 2012-11-29 12:05 - 00000000 ____D C:\Users\Jürgen
2013-08-13 15:33 - 2013-08-13 15:33 - 01110476 _____ C:\Users\Philipp\Downloads\7z920.exe
2013-08-13 15:06 - 2013-02-12 23:00 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-13 15:00 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\system32\sru
2013-08-13 14:58 - 2012-11-29 12:41 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-13 14:46 - 2013-02-20 10:23 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-08-13 14:45 - 2012-07-26 07:26 - 00524288 ___SH C:\Windows\system32\config\BBI
2013-08-13 13:30 - 2012-11-29 12:05 - 01170115 _____ C:\Windows\WindowsUpdate.log
2013-08-13 12:52 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\rescache
2013-08-13 11:43 - 2013-06-21 12:36 - 00001322 _____ C:\Users\Sanne\Desktop\Sandboxed Web Browser.lnk
2013-08-12 22:16 - 2012-11-29 17:03 - 00000000 ____D C:\Users\Philipp\AppData\Roaming\Skype
2013-08-12 19:32 - 2012-11-29 12:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-12 19:30 - 2013-08-12 19:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-12 19:29 - 2013-01-12 18:35 - 00000000 ____D C:\Users\Sanne\AppData\Roaming\Skype
2013-08-12 19:28 - 2012-11-29 16:14 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-08-12 19:28 - 2012-11-29 16:14 - 00000000 ____D C:\ProgramData\Skype
2013-08-12 19:27 - 2013-08-12 19:27 - 01492848 _____ (Skype Technologies S.A.) C:\Users\Sanne\Downloads\SkypeSetup.exe
2013-08-12 19:26 - 2013-03-14 11:32 - 00002450 _____ C:\Windows\Sandboxie.ini
2013-08-12 19:08 - 2013-02-20 10:23 - 00001926 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-08-12 19:08 - 2013-02-20 10:23 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-08-12 19:07 - 2013-08-12 19:07 - 497783871 _____ C:\Windows\MEMORY.DMP
2013-08-12 19:07 - 2013-08-12 19:07 - 00294544 _____ C:\Windows\Minidump\081213-15968-01.dmp
2013-08-12 19:07 - 2013-08-12 19:07 - 00000000 ____D C:\Windows\Minidump
2013-08-12 16:58 - 2012-11-29 12:42 - 00002187 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-08-11 15:54 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\AUInstallAgent
2013-08-11 12:03 - 2013-08-11 12:03 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-29 13:33 - 2013-07-29 13:33 - 00001130 _____ C:\Users\Philipp\Desktop\FiestaOnline.lnk
2013-07-29 12:38 - 2012-08-28 13:13 - 00163234 _____ C:\Windows\PFRO.log
2013-07-29 12:36 - 2013-07-29 12:36 - 03313224 _____ (Softperfect Research ) C:\Users\Sanne\Downloads\networx_setup.exe
2013-07-29 12:36 - 2013-05-03 11:10 - 00000000 ____D C:\Program Files\NetWorx
2013-07-28 12:36 - 2012-12-03 10:00 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-25 18:19 - 2012-12-23 16:28 - 00000000 ____D C:\Users\Philipp\Documents\Fiesta
2013-07-21 21:06 - 2013-07-21 21:04 - 00000000 ____D C:\Windows\system32\MRT
2013-07-21 19:25 - 2013-07-21 19:25 - 00386216 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-20 16:25 - 2013-05-15 10:41 - 00000000 ____D C:\Users\Sanne\AppData\Local\Adobe
2013-07-20 16:24 - 2013-02-12 23:00 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-07-20 16:14 - 2013-02-01 19:23 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-20 16:14 - 2013-02-01 19:23 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-20 16:13 - 2012-07-26 11:45 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-20 16:13 - 2012-07-26 07:38 - 00000000 ____D C:\Windows\system32\oobe
2013-07-20 15:53 - 2012-11-29 12:41 - 00004096 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-20 15:53 - 2012-11-29 12:41 - 00003860 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-20 11:12 - 2013-05-03 11:10 - 00041976 _____ (NetFilterSDK.com) C:\Windows\system32\Drivers\networx.sys
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-13 11:50
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-08-2013 Ran by Sanne at 2013-08-13 15:50:27 Running from C:\Users\Sanne\Downloads Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= 7-Zip 9.20 (x32) Adobe Digital Editions 2.0 (x32 Version: 2.0) Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94) Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03) Ashampoo AppLauncher (Medion) v.1.0.0 (x32 Version: 1.0.0) avast! Free Antivirus (x32 Version: 8.0.1489.0) CyberLink LabelPrint 2.5 (x32 Version: 2.5.5415) CyberLink MediaEspresso 6.5 (x32 Version: 6.5.3111_44883) CyberLink PhotoDirector 3 (x32 Version: 3.0.3124) CyberLink PhotoNow (x32 Version: 1.1.7717) CyberLink Power2Go 8 (x32 Version: 8.0.0.1920) CyberLink PowerDirector (Version: 9.0.0.3815c) CyberLink PowerDVD 10 (x32 Version: 10.0.4125.02) CyberLink PowerDVD Copy 1.5 (x32 Version: 1.5.2715b) CyberLink PowerRecover (Version: 5.7.0.0906) CyberLink PowerRecover (x32 Version: 5.7.0.0906) D3DX10 (x32 Version: 15.4.2368.0902) Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32) DIE SIEDLER - Das Erbe der Könige - Gold Edition (x32 Version: 1.00.0000) Fiesta Online DE 1.04.095 (x32 Version: 1.04.095) FileHippo.com Update Checker (x32) Fotogalerie (x32 Version: 16.4.3503.0728) Fotogalerija (x32 Version: 16.4.3503.0728) Fotogalleri (x32 Version: 16.4.3503.0728) Fotogalleriet (x32 Version: 16.4.3503.0728) Fotoğraf Galerisi (x32 Version: 16.4.3503.0728) Fotótár (x32 Version: 16.4.3503.0728) Galeria de Fotografias (x32 Version: 16.4.3503.0728) Galería de fotos (x32 Version: 16.4.3503.0728) Galeria fotografii (x32 Version: 16.4.3503.0728) Galerie de photos (x32 Version: 16.4.3503.0728) Google Chrome (x32 Version: 28.0.1500.95) Google Update Helper (x32 Version: 1.3.21.153) Intel(R) Management Engine Components (x32 Version: 8.1.0.1281) Intel(R) Rapid Storage Technology (x32 Version: 11.5.4.1001) Intel® Trusted Connect Service Client (Version: 1.24.738.1) League of Legends (x32 Version: 1.3) Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300) Mediathek (x32 Version: 1.4.0) Medion Home Cinema 10 (x32 Version: 10.0) Medion Home Cinema 10 (x32 Version: 10.1924) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Home and Student 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000) Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000) Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Silverlight (Version: 5.1.20513.0) Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219) Movie Maker (x32 Version: 16.4.3503.0728) Mozilla Firefox 23.0 (x86 de) (x32 Version: 23.0) Mozilla Maintenance Service (x32 Version: 17.0.8) Mozilla Thunderbird 17.0.8 (x86 de) (x32 Version: 17.0.8) MSVCRT (x32 Version: 15.4.2862.0708) MSVCRT110 (x32 Version: 16.4.1108.0727) MSVCRT110_amd64 (Version: 16.4.1108.0727) NVIDIA 3D Vision Controller-Treiber 314.07 (Version: 314.07) NVIDIA 3D Vision Treiber 314.07 (Version: 314.07) NVIDIA Grafiktreiber 314.07 (Version: 314.07) NVIDIA HD-Audiotreiber 1.3.23.1 (Version: 1.3.23.1) NVIDIA Install Application (Version: 2.1002.109.706) NVIDIA PhysX (x32 Version: 9.12.1031) NVIDIA PhysX-Systemsoftware 9.12.1031 (Version: 9.12.1031) NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1407) NVIDIA Systemsteuerung 314.07 (Version: 314.07) NVIDIA Update 1.12.12 (Version: 1.12.12) NVIDIA Update Components (Version: 1.12.12) Pando Media Booster (x32 Version: 2.6.0.8) Photo Common (x32 Version: 16.4.3503.0728) Photo Gallery (x32 Version: 16.4.3503.0728) Podstawowe programy Windows Live (x32 Version: 16.4.3503.0728) QuickLaunch (x32 Version: 1.00.0019) Raccolta foto (x32 Version: 16.4.3503.0728) Reader for PC (x32 Version: 2.0.02.15180) Realtek Ethernet Controller Driver (x32 Version: 8.3.730.2012) Realtek High Definition Audio Driver (x32 Version: 6.0.1.6710) Sandboxie 4.04 (64-bit) (Version: 4.04) Secunia PSI (3.0.0.6005) (x32 Version: 3.0.0.6005) Secure Banking Version 1.5.1 (x32 Version: 1.5.1) Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32) Skype™ 6.7 (x32 Version: 6.7.102) Stronghold 2 (x32 Version: 1.40.1000) Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32) Windows Live (x32 Version: 16.4.3503.0728) Windows Live Communications Platform (x32 Version: 16.4.3503.0728) Windows Live Essentials (x32 Version: 16.4.3503.0728) Windows Live Installer (x32 Version: 16.4.3503.0728) Windows Live Photo Common (x32 Version: 16.4.3503.0728) Windows Live PIMT Platform (x32 Version: 16.4.3503.0728) Windows Live SOXE (x32 Version: 16.4.3503.0728) Windows Live SOXE Definitions (x32 Version: 16.4.3503.0728) Windows Live Temel Parçalar (x32 Version: 16.4.3503.0728) Windows Live UX Platform (x32 Version: 16.4.3503.0728) Windows Live UX Platform Language Pack (x32 Version: 16.4.3503.0728) Worx 5.2.9 Συλλογή φωτογραφιών (x32 Version: 16.4.3503.0728) ==================== Restore Points ========================= 28-07-2013 10:32:53 Windows Update 11-08-2013 14:04:39 Geplanter Prüfpunkt ==================== Hosts content: ========================== 2012-07-26 07:26 - 2012-07-26 07:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {10D85952-E3F6-47A1-96CF-5E1C2D874EA6} - System32\Tasks\Microsoft\Windows\SystemRestore\SR => C:\Windows\system32\srtasks.exe [2012-07-26] (Microsoft Corporation) Task: {13A2AC02-B682-48CC-9155-2E2673580117} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64 Critical Task: {17644F17-DC4C-4AC8-9444-7AAA52EB5CDC} - System32\Tasks\Microsoft\Windows\NetCfg\BindingWorkItemQueueHandler Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => C:\Windows\system32\rundll32.exe [2012-07-26] (Microsoft Corporation) Task: {1DB7C2F1-876C-4F24-AD17-8428211113F9} - System32\Tasks\Microsoft\Windows\MemoryDiagnostic\ProcessMemoryDiagnosticEvents Task: {214B24F4-FEB4-4C59-AF1F-70136065199C} - System32\Tasks\Microsoft\Windows\Shell\IndexerAutomaticMaintenance Task: {23700E5C-0E77-499D-908A-415D5C6252F4} - System32\Tasks\Microsoft\Windows\Plug and Play\Device Install Group Policy Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => C:\Windows\System32\rundll32.exe [2012-07-26] (Microsoft Corporation) Task: {2C6B9EA8-7F5A-4ABA-BF96-8D352D02A743} - System32\Tasks\Microsoft\Windows\Device Setup\Metadata Refresh Task: {2E030FA7-3D7C-4E1D-8CFE-56ADB26FD402} - System32\Tasks\Microsoft\Windows\PI\Sqm-Tasks Task: {3054485A-F517-4E95-9977-4DD827B1E9B3} - System32\Tasks\Microsoft\Windows\WS\Badge Update Task: {30FFF6E4-FAB3-4B7F-B4A8-AD0D7E73A529} - System32\Tasks\WPD\SqmUpload_S-1-5-21-1234656636-18614592-3897552348-1003 => C:\Windows\system32\rundll32.exe [2012-07-26] (Microsoft Corporation) Task: {349EA0C3-8CAB-4B08-8D73-3A0D82CBD554} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-11-29] (Google Inc.) Task: {378401BA-A703-444A-A79C-3C47AD2DC5B6} - System32\Tasks\Microsoft\Windows\TaskScheduler\Maintenance Configurator Task: {3AE164E7-30CD-40BC-9422-3EC7A5618965} - System32\Tasks\Microsoft\Windows\WS\WSTask Task: {3C490ABD-D849-41AF-9AC4-87DD759B0996} - System32\Tasks\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem Task: {4073C1B3-6E16-4AA8-B7F3-C6A6D35D5071} - System32\Tasks\Microsoft\Windows\TPM\Tpm-Maintenance Task: {44B3F1B8-5943-4072-8D8C-A9484676AC44} - System32\Tasks\Microsoft\Windows\Live\Roaming\SynchronizeWithStorage Task: {483A8F5C-5D26-44B5-B49E-AF6741D1BBEB} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => C:\Windows\System32\MbaeParserTask.exe [2013-06-01] (Microsoft Corporation) Task: {4B952129-9AE9-41A3-BE2B-8AD2E06F66B6} - System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTaskLogon Task: {4F1D2AE7-1069-46FA-9457-53A2CCAEFE92} - System32\Tasks\WPD\SqmUpload_S-1-5-21-1234656636-18614592-3897552348-1008 => C:\Windows\system32\rundll32.exe [2012-07-26] (Microsoft Corporation) Task: {5755E746-D7ED-4C20-A472-66C11834CDE4} - System32\Tasks\Microsoft\Windows\TaskScheduler\Manual Maintenance Task: {5C4EFB77-EFA6-45DF-A373-D795C0725BFF} - System32\Tasks\Microsoft\Windows\Plug and Play\Device Install Reboot Required Task: {627441F3-8526-4B62-BF9A-1A3EA414E71A} - System32\Tasks\Microsoft\Windows\SpacePort\SpaceAgentTask => C:\Windows\system32\SpaceAgent.exe [2012-07-26] (Microsoft Corporation) Task: {6E9DE125-5583-4031-B572-FEE48F25CFFF} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyMonitor => C:\Windows\System32\wpcmon.exe [2012-09-20] (Microsoft Corporation) Task: {6FDDEA7C-6310-428D-AEB2-54FFC72811EF} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 Task: {74096F94-B654-4DB0-96F5-3C3408B92FE3} - System32\Tasks\Microsoft\Windows\PI\Secure-Boot-Update Task: {77DD17B7-3F1A-401C-B40D-3718D24C2CF4} - System32\Tasks\Microsoft\Windows\WindowsUpdate\AUSessionConnect Task: {7A23DED5-0D43-4C22-ABAB-568C017EDE40} - System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1234656636-18614592-3897552348-1003 Task: {7D9A9A1C-499C-40A6-8F8A-5BCC4CC9A87C} - System32\Tasks\Microsoft\Windows\TaskScheduler\Regular Maintenance Task: {81762FBB-0464-4396-A6E5-4602F39C3CBC} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start => C:\Windows\system32\sc.exe [2012-07-26] (Microsoft Corporation) Task: {845CB020-68B5-4C6B-9876-7BEC7B3E27AC} - System32\Tasks\Microsoft\Windows\TaskScheduler\Idle Maintenance Task: {87354DAA-66DF-4B41-9346-15958D96E1D2} - System32\Tasks\Microsoft\Windows\FileHistory\File History (maintenance mode) Task: {8EC9F6B1-67D5-4658-9E1A-4E8289B0E760} - System32\Tasks\WPD\SqmUpload_S-1-5-21-1234656636-18614592-3897552348-1007 => C:\Windows\system32\rundll32.exe [2012-07-26] (Microsoft Corporation) Task: {901A0531-78F7-4B09-A7E5-5959A6C7F5CD} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-05-09] (AVAST Software) Task: {921A1D4E-32FB-46D7-B6C0-6F467884074D} - System32\Tasks\Microsoft\Windows\WS\Sync Licenses Task: {9479EF8E-11D4-41B3-9783-CC65070D592D} - System32\Tasks\Microsoft\Windows\Time Synchronization\ForceSynchronizeTime Task: {94DCF254-64FB-4C4E-8E12-5F4055C10C2A} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64 Task: {989A7C6D-BE82-4C3C-AF96-6116039E336B} - System32\Tasks\Microsoft\Windows\MemoryDiagnostic\RunFullMemoryDiagnostic Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => C:\Windows\System32\rundll32.exe [2012-07-26] (Microsoft Corporation) Task: {A800277E-E202-4492-AD38-3312641CBC04} - System32\Tasks\Microsoft\Windows\Live\Roaming\MaintenanceTask Task: {AB289308-A5D6-43CE-9449-016AB0332E3F} - System32\Tasks\Microsoft\Windows\Servicing\StartComponentCleanup Task: {AB62FA47-2C99-44B1-A5D0-D4161423BE43} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyRefresh Task: {AC221D7B-E624-4F18-9671-369646ADCA38} - System32\Tasks\Microsoft\Windows\WindowsUpdate\AUScheduledInstall Task: {AC6259DE-AC59-459E-849E-6ADFFD1ADE63} - System32\Tasks\Microsoft\Windows\Shell\CreateObjectTask Task: {AD021103-C0F3-45F4-B707-180DFD69782D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-20] (Adobe Systems Incorporated) Task: {AEB0B5BD-B9E5-458A-898A-E559BD9EB51B} - System32\Tasks\Microsoft\Windows\SettingSync\BackgroundUploadTask Task: {AF549BD8-337C-4BF7-8681-36A182E30507} - System32\Tasks\Microsoft\Windows\Chkdsk\ProactiveScan Task: {B1277EC7-70CD-41A4-8D37-A94F9FAC8752} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-11-29] (Google Inc.) Task: {B151B483-01FD-44B2-83E3-9AF0254E61F3} - System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1234656636-18614592-3897552348-1008 Task: {BC76AEF7-2CF0-4EB6-B65B-A8803E0B5E12} - System32\Tasks\Microsoft\Windows\AppID\SmartScreenSpecific Task: {BCF9560B-3A82-476A-9148-87249A19F82A} - System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1234656636-18614592-3897552348-500 Task: {BF3E6C21-FDAB-4A55-A481-4FB76127DACB} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2012-09-20] (Microsoft Corporation) Task: {C1ACCD1E-4385-4FB2-B5E4-7F2A57A626A2} - System32\Tasks\Microsoft\Windows\Data Integrity Scan\Data Integrity Scan Task: {C463FD1E-31C7-4C20-AB65-08E514CA152D} - System32\Tasks\Microsoft\Windows\IME\SQM data sender Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => C:\Windows\system32\rundll32.exe [2012-07-26] (Microsoft Corporation) Task: {CD1054FF-8005-4904-8B9C-436EAB1E2021} - System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTaskNetwork Task: {D5C2E41C-C889-45D7-A357-23386F57A207} - System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1234656636-18614592-3897552348-1007 Task: {DBCF6E1B-CE0A-441E-B7A5-219C8BE50C65} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 Critical Task: {DECE5921-598D-454B-9A04-B2DE95EFC1B3} - System32\Tasks\Microsoft\Windows\Data Integrity Scan\Data Integrity Scan for Crash Recovery Task: {E4DFE66F-E089-4CC3-A70F-957223D565F4} - System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask Task: {E8DAA09B-DF2A-4951-9134-6FA9587793F9} - System32\Tasks\Microsoft\Windows\Plug and Play\Sysprep Generalize Drivers => C:\Windows\System32\drvinst.exe [2012-09-20] (Microsoft Corporation) Task: {EB66C230-1811-4263-97B6-5D14FDC3CDFA} - System32\Tasks\WPD\SqmUpload_S-1-5-21-1234656636-18614592-3897552348-1006 => C:\Windows\system32\rundll32.exe [2012-07-26] (Microsoft Corporation) Task: {EBA33922-91B8-48FA-BBCC-8388AD87766D} - System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1234656636-18614592-3897552348-1006 Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => C:\Windows\system32\rundll32.exe [2012-07-26] (Microsoft Corporation) Task: {EC552CC1-91E5-4FC2-9A3C-DCAEED992A81} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task Task: {ED0C1F69-C3A2-41EA-B8C3-3F0D83A1F6C0} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\BthSQM Task: {F3A236AB-4E73-44B2-8718-486A2D793D45} - System32\Tasks\Microsoft\Windows\WindowsUpdate\AUFirmwareInstall Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (08/13/2013 03:34:48 PM) (Source: Application Hang) (User: ) Description: Programm firefox.exe, Version 23.0.0.4959 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 8a8 Startzeit: 01ce98292c428806 Endzeit: 47 Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe Berichts-ID: fe40c736-041c-11e3-bf05-d43d7e2e172b Vollständiger Name des fehlerhaften Pakets: Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Error: (08/12/2013 08:40:13 PM) (Source: Application Hang) (User: ) Description: Programm Fiesta.bin, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 974 Startzeit: 01ce978b54870240 Endzeit: 32 Anwendungspfad: C:\gamigo\FIESTA~1\Fiesta.bin Berichts-ID: 9a5c4ae5-037e-11e3-bf02-d43d7e2e172b Vollständiger Name des fehlerhaften Pakets: Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Error: (08/12/2013 07:23:53 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: LenovoQuickLaunch.exe, Version: 1.0.0.0, Zeitstempel: 0x5023cd23 Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.2.9200.16451, Zeitstempel: 0x50988aa6 Ausnahmecode: 0xe0434352 Fehleroffset: 0x000000000003811c ID des fehlerhaften Prozesses: 0x324 Startzeit der fehlerhaften Anwendung: 0xLenovoQuickLaunch.exe0 Pfad der fehlerhaften Anwendung: LenovoQuickLaunch.exe1 Pfad des fehlerhaften Moduls: LenovoQuickLaunch.exe2 Berichtskennung: LenovoQuickLaunch.exe3 Vollständiger Name des fehlerhaften Pakets: LenovoQuickLaunch.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: LenovoQuickLaunch.exe5 Error: (08/12/2013 07:23:53 PM) (Source: .NET Runtime) (User: ) Description: Anwendung: LenovoQuickLaunch.exe Frameworkversion: v4.0.30319 Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet. Ausnahmeinformationen: System.NotSupportedException Stapel: bei System.Security.Util.StringExpressionSet.CanonicalizePath(System.String, Boolean) bei System.Security.Util.StringExpressionSet.CreateListFromExpressions(System.String[], Boolean) bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.Security.AccessControl.AccessControlActions, System.String[], Boolean, Boolean, Boolean) bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean, Boolean) bei System.Security.Permissions.FileIOPermission..ctor(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean) bei System.IO.FileSystemEnumerableIterator`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]..ctor(System.String, System.String, System.String, System.IO.SearchOption, System.IO.SearchResultHandler`1<System.__Canon>, Boolean) bei System.IO.Directory.InternalGetFileDirectoryNames(System.String, System.String, System.String, Boolean, Boolean, System.IO.SearchOption, Boolean) bei System.IO.Directory.InternalGetFiles(System.String, System.String, System.IO.SearchOption) bei Lenovo.WPF.StartMenu.Logger.MonitorLog() bei Lenovo.WPF.StartMenu.Logger.WriteLog() bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object) bei System.Threading.ThreadHelper.ThreadStart() Error: (07/04/2013 07:59:12 PM) (Source: Desktop Window Manager) (User: ) Description: Der Desktopfenster-Manager hat einen schwerwiegenden Fehler (0x8898008d) festgestellt. Error: (07/04/2013 11:54:49 AM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: LenovoQuickLaunch.exe, Version: 1.0.0.0, Zeitstempel: 0x5023cd23 Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.2.9200.16451, Zeitstempel: 0x50988aa6 Ausnahmecode: 0xe0434352 Fehleroffset: 0x000000000003811c ID des fehlerhaften Prozesses: 0x5c4 Startzeit der fehlerhaften Anwendung: 0xLenovoQuickLaunch.exe0 Pfad der fehlerhaften Anwendung: LenovoQuickLaunch.exe1 Pfad des fehlerhaften Moduls: LenovoQuickLaunch.exe2 Berichtskennung: LenovoQuickLaunch.exe3 Vollständiger Name des fehlerhaften Pakets: LenovoQuickLaunch.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: LenovoQuickLaunch.exe5 Error: (07/04/2013 11:54:49 AM) (Source: .NET Runtime) (User: ) Description: Anwendung: LenovoQuickLaunch.exe Frameworkversion: v4.0.30319 Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet. Ausnahmeinformationen: System.NotSupportedException Stapel: bei System.Security.Util.StringExpressionSet.CanonicalizePath(System.String, Boolean) bei System.Security.Util.StringExpressionSet.CreateListFromExpressions(System.String[], Boolean) bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.Security.AccessControl.AccessControlActions, System.String[], Boolean, Boolean, Boolean) bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean, Boolean) bei System.Security.Permissions.FileIOPermission..ctor(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean) bei System.IO.FileSystemEnumerableIterator`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]..ctor(System.String, System.String, System.String, System.IO.SearchOption, System.IO.SearchResultHandler`1<System.__Canon>, Boolean) bei System.IO.Directory.InternalGetFileDirectoryNames(System.String, System.String, System.String, Boolean, Boolean, System.IO.SearchOption, Boolean) bei System.IO.Directory.InternalGetFiles(System.String, System.String, System.IO.SearchOption) bei Lenovo.WPF.StartMenu.Logger.MonitorLog() bei Lenovo.WPF.StartMenu.Logger.WriteLog() bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object) bei System.Threading.ThreadHelper.ThreadStart() Error: (07/04/2013 11:54:37 AM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: LenovoQuickLaunch.exe, Version: 1.0.0.0, Zeitstempel: 0x5023cd23 Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.2.9200.16451, Zeitstempel: 0x50988aa6 Ausnahmecode: 0xe0434352 Fehleroffset: 0x000000000003811c ID des fehlerhaften Prozesses: 0x11a0 Startzeit der fehlerhaften Anwendung: 0xLenovoQuickLaunch.exe0 Pfad der fehlerhaften Anwendung: LenovoQuickLaunch.exe1 Pfad des fehlerhaften Moduls: LenovoQuickLaunch.exe2 Berichtskennung: LenovoQuickLaunch.exe3 Vollständiger Name des fehlerhaften Pakets: LenovoQuickLaunch.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: LenovoQuickLaunch.exe5 Error: (07/04/2013 11:54:37 AM) (Source: .NET Runtime) (User: ) Description: Anwendung: LenovoQuickLaunch.exe Frameworkversion: v4.0.30319 Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet. Ausnahmeinformationen: System.NotSupportedException Stapel: bei System.Security.Util.StringExpressionSet.CanonicalizePath(System.String, Boolean) bei System.Security.Util.StringExpressionSet.CreateListFromExpressions(System.String[], Boolean) bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.Security.AccessControl.AccessControlActions, System.String[], Boolean, Boolean, Boolean) bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean, Boolean) bei System.Security.Permissions.FileIOPermission..ctor(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean) bei System.IO.FileSystemEnumerableIterator`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]..ctor(System.String, System.String, System.String, System.IO.SearchOption, System.IO.SearchResultHandler`1<System.__Canon>, Boolean) bei System.IO.Directory.InternalGetFileDirectoryNames(System.String, System.String, System.String, Boolean, Boolean, System.IO.SearchOption, Boolean) bei System.IO.Directory.InternalGetFiles(System.String, System.String, System.IO.SearchOption) bei Lenovo.WPF.StartMenu.Logger.MonitorLog() bei Lenovo.WPF.StartMenu.Logger.WriteLog() bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object) bei System.Threading.ThreadHelper.ThreadStart() Error: (07/04/2013 11:53:58 AM) (Source: Application Hang) (User: ) Description: Programm psi.exe, Version 3.0.0.6005 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 12dc Startzeit: 01ce789c52f11484 Endzeit: 16 Anwendungspfad: C:\Program Files (x86)\Secunia\PSI\psi.exe Berichts-ID: a176d318-e48f-11e2-bef3-801f02803614 Vollständiger Name des fehlerhaften Pakets: Anwendungs-ID, die relativ zum fehlerhaften Paket ist: System errors: ============= Error: (08/13/2013 03:41:15 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: %%1069 Error: (08/13/2013 03:41:15 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%1330 Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC). Error: (08/13/2013 03:38:58 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT) Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden. Modulpfad: C:\Windows\system32\Rtlihvs.dll Fehlercode: 126 Error: (08/13/2013 03:38:40 PM) (Source: Microsoft-Windows-Kernel-General) (User: NT-AUTORITÄT) Description: 0xc000014d0 Error: (08/13/2013 02:57:34 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: %%1069 Error: (08/13/2013 02:57:34 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%1330 Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC). Error: (08/13/2013 02:46:24 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT) Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden. Modulpfad: C:\Windows\system32\Rtlihvs.dll Fehlercode: 126 Error: (08/13/2013 02:46:06 PM) (Source: Microsoft-Windows-Kernel-General) (User: NT-AUTORITÄT) Description: 0xc000014d0 Error: (08/13/2013 02:37:22 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: %%1069 Error: (08/13/2013 02:37:22 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%1330 Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC). Microsoft Office Sessions: ========================= Error: (08/13/2013 03:34:48 PM) (Source: Application Hang)(User: ) Description: firefox.exe23.0.0.49598a801ce98292c42880647C:\Program Files (x86)\Mozilla Firefox\firefox.exefe40c736-041c-11e3-bf05-d43d7e2e172b Error: (08/12/2013 08:40:13 PM) (Source: Application Hang)(User: ) Description: Fiesta.bin0.0.0.097401ce978b5487024032C:\gamigo\FIESTA~1\Fiesta.bin9a5c4ae5-037e-11e3-bf02-d43d7e2e172b Error: (08/12/2013 07:23:53 PM) (Source: Application Error)(User: ) Description: LenovoQuickLaunch.exe1.0.0.05023cd23KERNELBASE.dll6.2.9200.1645150988aa6e0434352000000000003811c32401ce9780b17f17faC:\Program Files (x86)\Lenovo\LenovoQuickLaunch\LenovoQuickLaunch.exeC:\Windows\system32\KERNELBASE.dllf5b7cb99-0373-11e3-bf01-801f02803614 Error: (08/12/2013 07:23:53 PM) (Source: .NET Runtime)(User: ) Description: Anwendung: LenovoQuickLaunch.exe Frameworkversion: v4.0.30319 Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet. Ausnahmeinformationen: System.NotSupportedException Stapel: bei System.Security.Util.StringExpressionSet.CanonicalizePath(System.String, Boolean) bei System.Security.Util.StringExpressionSet.CreateListFromExpressions(System.String[], Boolean) bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.Security.AccessControl.AccessControlActions, System.String[], Boolean, Boolean, Boolean) bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean, Boolean) bei System.Security.Permissions.FileIOPermission..ctor(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean) bei System.IO.FileSystemEnumerableIterator`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]..ctor(System.String, System.String, System.String, System.IO.SearchOption, System.IO.SearchResultHandler`1<System.__Canon>, Boolean) bei System.IO.Directory.InternalGetFileDirectoryNames(System.String, System.String, System.String, Boolean, Boolean, System.IO.SearchOption, Boolean) bei System.IO.Directory.InternalGetFiles(System.String, System.String, System.IO.SearchOption) bei Lenovo.WPF.StartMenu.Logger.MonitorLog() bei Lenovo.WPF.StartMenu.Logger.WriteLog() bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object) bei System.Threading.ThreadHelper.ThreadStart() Error: (07/04/2013 07:59:12 PM) (Source: Desktop Window Manager)(User: ) Description: 0x8898008d Error: (07/04/2013 11:54:49 AM) (Source: Application Error)(User: ) Description: LenovoQuickLaunch.exe1.0.0.05023cd23KERNELBASE.dll6.2.9200.1645150988aa6e0434352000000000003811c5c401ce789c844d8ae6C:\Program Files (x86)\Lenovo\LenovoQuickLaunch\LenovoQuickLaunch.exeC:\Windows\system32\KERNELBASE.dllc37de74b-e48f-11e2-bef3-801f02803614 Error: (07/04/2013 11:54:49 AM) (Source: .NET Runtime)(User: ) Description: Anwendung: LenovoQuickLaunch.exe Frameworkversion: v4.0.30319 Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet. Ausnahmeinformationen: System.NotSupportedException Stapel: bei System.Security.Util.StringExpressionSet.CanonicalizePath(System.String, Boolean) bei System.Security.Util.StringExpressionSet.CreateListFromExpressions(System.String[], Boolean) bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.Security.AccessControl.AccessControlActions, System.String[], Boolean, Boolean, Boolean) bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean, Boolean) bei System.Security.Permissions.FileIOPermission..ctor(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean) bei System.IO.FileSystemEnumerableIterator`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]..ctor(System.String, System.String, System.String, System.IO.SearchOption, System.IO.SearchResultHandler`1<System.__Canon>, Boolean) bei System.IO.Directory.InternalGetFileDirectoryNames(System.String, System.String, System.String, Boolean, Boolean, System.IO.SearchOption, Boolean) bei System.IO.Directory.InternalGetFiles(System.String, System.String, System.IO.SearchOption) bei Lenovo.WPF.StartMenu.Logger.MonitorLog() bei Lenovo.WPF.StartMenu.Logger.WriteLog() bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object) bei System.Threading.ThreadHelper.ThreadStart() Error: (07/04/2013 11:54:37 AM) (Source: Application Error)(User: ) Description: LenovoQuickLaunch.exe1.0.0.05023cd23KERNELBASE.dll6.2.9200.1645150988aa6e0434352000000000003811c11a001ce789c6f90083aC:\Program Files (x86)\Lenovo\LenovoQuickLaunch\LenovoQuickLaunch.exeC:\Windows\system32\KERNELBASE.dllbc6ba0f7-e48f-11e2-bef3-801f02803614 Error: (07/04/2013 11:54:37 AM) (Source: .NET Runtime)(User: ) Description: Anwendung: LenovoQuickLaunch.exe Frameworkversion: v4.0.30319 Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet. Ausnahmeinformationen: System.NotSupportedException Stapel: bei System.Security.Util.StringExpressionSet.CanonicalizePath(System.String, Boolean) bei System.Security.Util.StringExpressionSet.CreateListFromExpressions(System.String[], Boolean) bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.Security.AccessControl.AccessControlActions, System.String[], Boolean, Boolean, Boolean) bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean, Boolean) bei System.Security.Permissions.FileIOPermission..ctor(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean) bei System.IO.FileSystemEnumerableIterator`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]..ctor(System.String, System.String, System.String, System.IO.SearchOption, System.IO.SearchResultHandler`1<System.__Canon>, Boolean) bei System.IO.Directory.InternalGetFileDirectoryNames(System.String, System.String, System.String, Boolean, Boolean, System.IO.SearchOption, Boolean) bei System.IO.Directory.InternalGetFiles(System.String, System.String, System.IO.SearchOption) bei Lenovo.WPF.StartMenu.Logger.MonitorLog() bei Lenovo.WPF.StartMenu.Logger.WriteLog() bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object) bei System.Threading.ThreadHelper.ThreadStart() Error: (07/04/2013 11:53:58 AM) (Source: Application Hang)(User: ) Description: psi.exe3.0.0.600512dc01ce789c52f1148416C:\Program Files (x86)\Secunia\PSI\psi.exea176d318-e48f-11e2-bef3-801f02803614 ==================== Memory info =========================== Percentage of memory in use: 26% Total physical RAM: 4037.83 MB Available physical RAM: 2961.18 MB Total Pagefile: 8133.83 MB Available Pagefile: 6964.02 MB Total Virtual: 8192 MB Available Virtual: 8191.77 MB ==================== Drives ================================ Drive c: (Boot) (Fixed) (Total:1801.3 GB) (Free:1728.11 GB) NTFS Drive d: (Recover) (Fixed) (Total:60 GB) (Free:44.38 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 1863 GB) (Disk ID: 00000000) Partition: GPT Partition Type ==================== End Of Log ============================ Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-08-13 16:02:33
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000035 ST2000DM001-9YN164 rev.CC4G 1863,02GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Sanne\AppData\Local\Temp\uwtoypog.sys
---- User code sections - GMER 2.1 ----
.text C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\kernel32.dll!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\wininit.exe[664] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\services.exe[736] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\lsass.exe[772] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\svchost.exe[876] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\nvvsvc.exe[932] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\svchost.exe[1000] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\System32\svchost.exe[328] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\svchost.exe[560] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\svchost.exe[580] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\System32\svchost.exe[1068] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Program Files\Sandboxie\SbieSvc.exe[1212] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\svchost.exe[1356] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\System32\spoolsv.exe[2000] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\svchost.exe[1136] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\dashost.exe[2340] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2348] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Program Files\CyberLink\Shared files\RichVideo64.exe[2476] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\SearchIndexer.exe[2892] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\svchost.exe[2944] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000007f8bcb82120 5 bytes JMP 000007f93ccd1284
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000007f8bcb8bee0 5 bytes JMP 000007f93ccd0ecc
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\system32\USER32.dll!UnhookWinEvent 000007f8bcb8e030 5 bytes JMP 000007f93ccd075c
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\system32\USER32.dll!SetWinEventHook 000007f8bcb92f70 5 bytes JMP 000007f93ccd03a4
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\system32\USER32.dll!SetWindowsHookExA 000007f8bcbb1850 5 bytes JMP 000007f93ccd0b14
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000007f8bcb82120 5 bytes JMP 000007f93ccd1284
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000007f8bcb8bee0 5 bytes JMP 000007f93ccd0ecc
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\system32\USER32.dll!UnhookWinEvent 000007f8bcb8e030 5 bytes JMP 000007f93ccd075c
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\system32\USER32.dll!SetWinEventHook 000007f8bcb92f70 5 bytes JMP 000007f93ccd03a4
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\system32\USER32.dll!SetWindowsHookExA 000007f8bcbb1850 5 bytes JMP 000007f93ccd0b14
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000007f8bcb82120 5 bytes JMP 000007f93ccd1284
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000007f8bcb8bee0 5 bytes JMP 000007f93ccd0ecc
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\system32\USER32.dll!UnhookWinEvent 000007f8bcb8e030 5 bytes JMP 000007f93ccd075c
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\system32\USER32.dll!SetWinEventHook 000007f8bcb92f70 5 bytes JMP 000007f93ccd03a4
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\system32\USER32.dll!SetWindowsHookExA 000007f8bcbb1850 5 bytes JMP 000007f93ccd0b14
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007f8bf77177a 4 bytes [77, BF, F8, 07]
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007f8bf771782 4 bytes [77, BF, F8, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000007f8bcb82120 5 bytes JMP 000007f93ccd1284
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000007f8bcb8bee0 5 bytes JMP 000007f93ccd0ecc
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\system32\USER32.dll!UnhookWinEvent 000007f8bcb8e030 5 bytes JMP 000007f93ccd075c
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\system32\USER32.dll!SetWinEventHook 000007f8bcb92f70 5 bytes JMP 000007f93ccd03a4
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\system32\USER32.dll!SetWindowsHookExA 000007f8bcbb1850 5 bytes JMP 000007f93ccd0b14
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f8ba5f1532 4 bytes [5F, BA, F8, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f8ba5f153a 4 bytes [5F, BA, F8, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f8ba5f165a 4 bytes [5F, BA, F8, 07]
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000007f8bcb82120 5 bytes JMP 000007f93ccd1284
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000007f8bcb8bee0 5 bytes JMP 000007f93ccd0ecc
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\USER32.dll!UnhookWinEvent 000007f8bcb8e030 5 bytes JMP 000007f93ccd075c
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\USER32.dll!SetWinEventHook 000007f8bcb92f70 5 bytes JMP 000007f93ccd03a4
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\USER32.dll!SetWindowsHookExA 000007f8bcbb1850 5 bytes JMP 000007f93ccd0b14
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\MSIMG32.dll!GradientFill + 690 000007f8ba5f1532 4 bytes [5F, BA, F8, 07]
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\MSIMG32.dll!GradientFill + 698 000007f8ba5f153a 4 bytes [5F, BA, F8, 07]
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\MSIMG32.dll!TransparentBlt + 246 000007f8ba5f165a 4 bytes [5F, BA, F8, 07]
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007f8bf77177a 4 bytes [77, BF, F8, 07]
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007f8bf771782 4 bytes [77, BF, F8, 07]
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\user32.dll!UnhookWindowsHookEx 000007f8bcb82120 5 bytes JMP 000007f93ccd1284
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\user32.dll!SetWindowsHookExW 000007f8bcb8bee0 5 bytes JMP 000007f93ccd0ecc
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\user32.dll!UnhookWinEvent 000007f8bcb8e030 5 bytes JMP 000007f93ccd075c
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\user32.dll!SetWinEventHook 000007f8bcb92f70 5 bytes JMP 000007f93ccd03a4
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\user32.dll!SetWindowsHookExA 000007f8bcbb1850 5 bytes JMP 000007f93ccd0b14
.text C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text C:\Windows\Explorer.EXE[1688] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\Explorer.EXE[1688] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000007f8bcb82120 5 bytes JMP 000007f93ccd1284
.text C:\Windows\Explorer.EXE[1688] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000007f8bcb8bee0 5 bytes JMP 000007f93ccd0ecc
.text C:\Windows\Explorer.EXE[1688] C:\Windows\system32\USER32.dll!UnhookWinEvent 000007f8bcb8e030 5 bytes JMP 000007f93ccd075c
.text C:\Windows\Explorer.EXE[1688] C:\Windows\system32\USER32.dll!SetWinEventHook 000007f8bcb92f70 5 bytes JMP 000007f93ccd03a4
.text C:\Windows\Explorer.EXE[1688] C:\Windows\system32\USER32.dll!SetWindowsHookExA 000007f8bcbb1850 5 bytes JMP 000007f93ccd0b14
.text C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
.text C:\Windows\Explorer.EXE[1688] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007f8bf77177a 4 bytes [77, BF, F8, 07]
.text C:\Windows\Explorer.EXE[1688] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007f8bf771782 4 bytes [77, BF, F8, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000007f8bcb82120 5 bytes JMP 000007f93ccd1284
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000007f8bcb8bee0 5 bytes JMP 000007f93ccd0ecc
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\system32\USER32.dll!UnhookWinEvent 000007f8bcb8e030 5 bytes JMP 000007f93ccd075c
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\system32\USER32.dll!SetWinEventHook 000007f8bcb92f70 5 bytes JMP 000007f93ccd03a4
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\system32\USER32.dll!SetWindowsHookExA 000007f8bcbb1850 5 bytes JMP 000007f93ccd0b14
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f8ba5f1532 4 bytes [5F, BA, F8, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f8ba5f153a 4 bytes [5F, BA, F8, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f8ba5f165a 4 bytes [5F, BA, F8, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000007f8bcb82120 5 bytes JMP 000007f93ccd1284
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000007f8bcb8bee0 5 bytes JMP 000007f93ccd0ecc
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\system32\USER32.dll!UnhookWinEvent 000007f8bcb8e030 5 bytes JMP 000007f93ccd075c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\system32\USER32.dll!SetWinEventHook 000007f8bcb92f70 5 bytes JMP 000007f93ccd03a4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\system32\USER32.dll!SetWindowsHookExA 000007f8bcbb1850 5 bytes JMP 000007f93ccd0b14
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f8ba5f1532 4 bytes [5F, BA, F8, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f8ba5f153a 4 bytes [5F, BA, F8, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f8ba5f165a 4 bytes [5F, BA, F8, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000007f8bcb82120 5 bytes JMP 000007f93ccd1284
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000007f8bcb8bee0 5 bytes JMP 000007f93ccd0ecc
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\system32\USER32.dll!UnhookWinEvent 000007f8bcb8e030 5 bytes JMP 000007f93ccd075c
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\system32\USER32.dll!SetWinEventHook 000007f8bcb92f70 5 bytes JMP 000007f93ccd03a4
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\system32\USER32.dll!SetWindowsHookExA 000007f8bcbb1850 5 bytes JMP 000007f93ccd0b14
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
---- Threads - GMER 2.1 ----
Thread C:\Windows\system32\csrss.exe [3704:3688] fffff960008805e8
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
SuNi |
|
13.08.2013, 15:56
| #2 | |
| /// the machine /// TB-Ausbilder    | Windows-8-PC mit Systemabsturz und temporärem Startproblem hi,
__________________Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ |
|
13.08.2013, 16:26
| #3 |
| | Windows-8-PC mit Systemabsturz und temporärem Startproblem Hallo Schrauber
__________________ Wow, das ging ja superschnell  Vielen Dank, dass Du dich meines Problems annimmst!! Hier das gewünschte combofix-log: Code:
ATTFilter ComboFix 13-08-12.01 - Sanne 13.08.2013 17:13:39.1.4 - x64
Microsoft Windows 8 6.2.9200.0.1252.49.1031.18.4038.2688 [GMT 2:00]
ausgeführt von:: c:\users\Sanne\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AV: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\ntuser.dat
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-07-13 bis 2013-08-13 ))))))))))))))))))))))))))))))
.
.
2013-08-13 15:17 . 2013-08-13 15:17 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-08-13 15:17 . 2013-08-13 15:17 -------- d-----w- c:\users\Sanne\AppData\Local\temp
2013-08-13 15:17 . 2013-08-13 15:17 -------- d-----w- c:\users\Philipp\AppData\Local\temp
2013-08-13 13:49 . 2013-08-13 13:49 -------- d-----w- C:\FRST
2013-08-13 13:37 . 2013-08-13 13:37 -------- d-----w- c:\program files (x86)\7-Zip
2013-08-12 17:30 . 2013-08-12 17:30 -------- d-----w- c:\program files (x86)\Mozilla Thunderbird
2013-08-12 14:30 . 2013-08-12 14:30 261808 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10213.bin
2013-07-21 19:04 . 2013-07-21 19:06 -------- d-----w- c:\windows\system32\MRT
2013-07-20 14:17 . 2013-06-27 22:04 78200 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-07-20 14:17 . 2013-06-27 22:04 693112 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-07-20 13:58 . 2013-06-11 23:25 15404032 ----a-w- c:\windows\system32\ieframe.dll
2013-07-20 13:58 . 2013-06-11 23:25 19238912 ----a-w- c:\windows\system32\mshtml.dll
2013-07-20 13:58 . 2013-06-11 23:25 3958784 ----a-w- c:\windows\system32\jscript9.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-20 09:12 . 2013-05-03 09:10 41976 ----a-w- c:\windows\system32\drivers\networx.sys
2013-06-27 19:17 . 2013-03-01 16:58 189936 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-06-27 19:17 . 2013-02-20 08:23 378944 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-06-27 19:17 . 2013-02-20 08:23 1030952 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-06-23 22:57 . 2012-12-12 16:17 78277128 ----a-w- c:\windows\system32\MRT.exe
2013-05-30 23:24 . 2013-06-12 09:03 1257472 ----a-w- c:\windows\system32\kernel32.dll
2013-05-23 23:01 . 2013-06-12 09:03 1300992 ----a-w- c:\windows\system32\gdi32.dll
2013-05-23 22:27 . 2013-06-12 09:03 1022464 ----a-w- c:\windows\SysWow64\gdi32.dll
2013-05-23 06:25 . 2012-07-26 08:13 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-15 22:37 . 2013-06-12 09:03 44032 ----a-w- c:\windows\SysWow64\UXInit.dll
2013-05-15 22:35 . 2013-06-12 09:03 53760 ----a-w- c:\windows\system32\UXInit.dll
2013-05-15 22:35 . 2013-06-12 09:20 144384 ----a-w- c:\windows\system32\tssdisai.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Pando Media Booster"="c:\program files (x86)\Pando Networks\Media Booster\PMB.exe" [2013-03-06 3093624]
"FileHippo.com"="c:\program files (x86)\FileHippo.com\UpdateChecker.exe" [2012-11-23 307712]
"SecureBanking"="c:\program files (x86)\Secure Banking\SecureBanking.exe" [2013-07-04 507904]
"SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2013-07-08 759384]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" [2012-08-23 56128]
"CLMLServer_For_P2G8"="c:\program files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe" [2012-06-08 111120]
"CLVirtualDrive"="c:\program files (x86)\CyberLink\Power2Go8\VirtualDrive.exe" [2012-07-20 491120]
"RemoteControl10"="c:\program files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe" [2012-07-13 93296]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"Reader Application Helper"="c:\program files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe" [2013-03-18 899400]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-05-09 4858968]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableCursorSuppression"= 1 (0x1)
"ConsentPromptBehaviorUser"= 3 (0x3)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ConfirmFileDelete"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R2 gupdate;Google Update-Dienst (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe;c:\program files (x86)\Google\Update\GoogleUpdate.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe;c:\program files (x86)\Google\Update\GoogleUpdate.exe [x]
R3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf_amd64.sys;c:\windows\SYSNATIVE\DRIVERS\psi_mf_amd64.sys [x]
R3 RTL8192cu;Realtek RTL8192CU Wireless LAN 802.11n-USB 2.0-Netzwerkadapter;c:\windows\system32\DRIVERS\rtwlanu.sys;c:\windows\SYSNATIVE\DRIVERS\rtwlanu.sys [x]
R3 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe;c:\program files (x86)\Secunia\PSI\PSIA.exe [x]
R3 X6va011;X6va011;c:\windows\SysWOW64\Drivers\X6va011;c:\windows\SysWOW64\Drivers\X6va011 [x]
R3 X6va012;X6va012;c:\windows\SysWOW64\Drivers\X6va012;c:\windows\SysWOW64\Drivers\X6va012 [x]
S0 aswRvrt;aswRvrt; [x]
S0 aswVmm;aswVmm; [x]
S0 iaStorA;iaStorA;c:\windows\System32\drivers\iaStorA.sys;c:\windows\SYSNATIVE\drivers\iaStorA.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 CLVirtualDrive;CLVirtualDrive;c:\windows\system32\DRIVERS\CLVirtualDrive.sys;c:\windows\SYSNATIVE\DRIVERS\CLVirtualDrive.sys [x]
S1 networx;networx;c:\windows\system32\drivers\networx.sys;c:\windows\SYSNATIVE\drivers\networx.sys [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 CyberLink PowerDVD 10 MS Monitor Service;CyberLink PowerDVD 10 MS Monitor Service;c:\program files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe;c:\program files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [x]
S2 CyberLink PowerDVD 10 MS Service;CyberLink PowerDVD 10 MS Service;c:\program files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe;c:\program files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 RichVideo64;Cyberlink RichVideo64 Service(CRVS);c:\program files\CyberLink\Shared files\RichVideo64.exe;c:\program files\CyberLink\Shared files\RichVideo64.exe [x]
S2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe;c:\program files (x86)\Secunia\PSI\sua.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 RTL8168;Realtek 8168 NT Driver;c:\windows\system32\DRIVERS\Rt630x64.sys;c:\windows\SYSNATIVE\DRIVERS\Rt630x64.sys [x]
S3 RtlWlanu;Realtek Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\rtwlanu.sys;c:\windows\SYSNATIVE\DRIVERS\rtwlanu.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-08-12 14:58 1173456 ----a-w- c:\program files (x86)\Google\Chrome\Application\28.0.1500.95\Installer\chrmstp.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{A6EADE66-0000-0000-484E-7E8A45000000}]
2012-12-18 19:08 215264 ----a-w- c:\program files (x86)\Adobe\Reader 11.0\Esl\AiodLite.dll
.
Inhalt des "geplante Tasks" Ordners
.
2013-08-13 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-12-01 14:24]
.
2013-08-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-29 10:41]
.
2013-08-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-29 10:41]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58 133840 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-08-20 13192848]
"NetWorx"="c:\program files\NetWorx\networx.exe" [2013-07-24 4886648]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://lenovo13.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1 192.168.2.1
FF - ProfilePath - c:\users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default\
FF - ExtSQL: 2013-08-13 11:41; {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}; c:\users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF - ExtSQL: 2013-08-13 11:42; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\X6va011]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va011"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\X6va012]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va012"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
@SACL=(02 0000)
.
Zeit der Fertigstellung: 2013-08-13 17:18:58
ComboFix-quarantined-files.txt 2013-08-13 15:18
.
Vor Suchlauf: 13 Verzeichnis(se), 1.855.553.593.344 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 1.855.953.498.112 Bytes frei
.
- - End Of File - - 1B1DF7CD36BF979F82636FE5BFE8F6BB
D41D8CD98F00B204E9800998ECF8427E
SuNi |
|
13.08.2013, 18:20
| #4 |
| /// the machine /// TB-Ausbilder | Windows-8-PC mit Systemabsturz und temporärem Startproblem Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
13.08.2013, 19:51
| #5 |
| | Windows-8-PC mit Systemabsturz und temporärem Startproblem So, ich glaube, jetzt habe ich alles zusammen 1. MBAM Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.08.13.05 Windows 8 x64 NTFS Internet Explorer 10.0.9200.16635 Sanne :: SANNE2 [Administrator] 13.08.2013 20:00:14 mbam-log-2013-08-13 (20-00-14).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 318560 Laufzeit: 2 Minute(n), 4 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter # AdwCleaner v2.306 - Datei am 13/08/2013 um 20:09:32 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows 8 (64 bits)
# Benutzer : Sanne - SANNE2
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Sanne\Desktop\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
***** [Registrierungsdatenbank] *****
***** [Internet Browser] *****
-\\ Internet Explorer v10.0.9200.16537
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Mozilla Firefox v23.0 (de)
Datei : C:\Users\Jürgen\AppData\Roaming\Mozilla\Firefox\Profiles\fklcd9c4.default\prefs.js
[OK] Die Datei ist sauber.
Datei : C:\Users\Internet\AppData\Roaming\Mozilla\Firefox\Profiles\h247z9js.default\prefs.js
[OK] Die Datei ist sauber.
Datei : C:\Users\Philipp\AppData\Roaming\Mozilla\Firefox\Profiles\aoo1lnp8.default\prefs.js
[OK] Die Datei ist sauber.
Datei : C:\Users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default\prefs.js
[OK] Die Datei ist sauber.
-\\ Google Chrome v28.0.1500.95
Datei : C:\Users\Jürgen\AppData\Local\Google\Chrome\User Data\Default\Preferences
[OK] Die Datei ist sauber.
Datei : C:\Users\Philipp\AppData\Local\Google\Chrome\User Data\Default\Preferences
[OK] Die Datei ist sauber.
Datei : C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Preferences
[OK] Die Datei ist sauber.
*************************
AdwCleaner[R1].txt - [1577 octets] - [13/08/2013 20:07:18]
AdwCleaner[S1].txt - [1510 octets] - [13/08/2013 20:09:32]
########## EOF - C:\AdwCleaner[S1].txt - [1570 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.4.4 (08.12.2013:1)
OS: Windows 8 x64
Ran by Sanne on 13.08.2013 at 20:18:14,85
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\Sanne\AppData\Roaming\mozilla\firefox\profiles\nr0cwijt.default\minidumps [1 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 13.08.2013 at 20:21:16,62
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-08-2013 01
Ran by Sanne (administrator) on 13-08-2013 20:28:56
Running from C:\Users\Sanne\Desktop
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Microsoft Corporation) C:\Windows\system32\dashost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(SoftPerfect Research) C:\Program Files\NetWorx\networx.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(Lenovo) C:\Program Files (x86)\Lenovo\LenovoQuickLaunch\LenovoQuickLaunch.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieCtrl.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13192848 2012-08-20] (Realtek Semiconductor)
HKLM\...\Run: [NetWorx] - C:\Program Files\NetWorx\networx.exe [4886648 2013-07-24] (SoftPerfect Research)
HKCU\...\Run: [Pando Media Booster] - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624 2013-03-06] ()
HKCU\...\Run: [FileHippo.com] - C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe [307712 2012-11-23] (FileHippo.com)
HKCU\...\Run: [SecureBanking] - C:\Program Files (x86)\Secure Banking\SecureBanking.exe [507904 2013-07-04] (Secure Banking)
HKCU\...\Run: [SandboxieControl] - C:\Program Files\Sandboxie\SbieCtrl.exe [759384 2013-07-08] (Sandboxie Holdings, LLC)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [277504 2012-08-16] (Intel Corporation)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] - C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] - C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-20] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Reader Application Helper] - C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe [899400 2013-03-18] (Sony Corporation)
HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)
HKLM-x32\...\Run: [] - [x]
HKU\Default\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [x]
HKU\Default User\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [x]
HKU\Philipp\...\Run: [SandboxieControl] - C:\Program Files\Sandboxie\SbieCtrl.exe [759384 2013-07-08] (Sandboxie Holdings, LLC)
HKU\UpdatusUser\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [x]
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo13.msn.com
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {0C688C30-1FFE-47A6-A484-31890FF3D232} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MALNJS
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
FireFox:
========
FF ProfilePath: C:\Users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @sony.com/ReaderDesktop - C:\Program Files (x86)\Sony\ReaderDesktop\npreaderdetectmoz.dll (Sony Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Extension: WOT - C:\Users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF Extension: No Name - C:\Users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR Extension: (Docs) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Google Drive) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0
CHR Extension: (YouTube) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (Gmail) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
==================== Services (Whitelisted) =================
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-13] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-13] (CyberLink)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-07-19] (Intel Corporation)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2010-08-19] ()
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [183896 2013-07-08] (Sandboxie Holdings, LLC)
S3 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1223704 2013-02-07] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [660504 2013-02-07] (Secunia)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [14920 2013-01-29] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-06-27] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-06-27] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-06-27] ()
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
R1 networx; C:\Windows\System32\drivers\networx.sys [41976 2013-07-20] (NetFilterSDK.com)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-02-07] (Secunia)
S3 RTL8192cu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1576080 2012-08-07] (Realtek Semiconductor Corporation )
R3 RtlWlanu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1576080 2012-08-07] (Realtek Semiconductor Corporation )
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [199384 2013-07-08] (Sandboxie Holdings, LLC)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [x]
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-13 20:18 - 2013-08-13 20:18 - 00000000 ____D C:\Windows\ERUNT
2013-08-13 20:16 - 2013-08-13 20:16 - 01158722 _____ (Thisisu) C:\Users\Sanne\Desktop\JRT.exe
2013-08-13 20:09 - 2013-08-13 20:09 - 00001639 _____ C:\AdwCleaner[S1].txt
2013-08-13 20:07 - 2013-08-13 20:07 - 00001577 _____ C:\AdwCleaner[R1].txt
2013-08-13 20:04 - 2013-08-13 20:04 - 00666633 _____ C:\Users\Sanne\Desktop\adwcleaner.exe
2013-08-13 19:56 - 2013-08-13 19:56 - 00000000 ____D C:\Users\Sanne\Desktop\reinigung
2013-08-13 17:18 - 2013-08-13 17:18 - 00012685 _____ C:\ComboFix.txt
2013-08-13 17:12 - 2013-08-13 17:19 - 00000000 ____D C:\Qoobox
2013-08-13 17:12 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-13 17:12 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-13 17:12 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\Windows\SWXCACLS.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-13 17:11 - 2013-08-13 17:17 - 00000000 ____D C:\Windows\erdnt
2013-08-13 17:05 - 2013-08-13 17:05 - 05102975 ____R (Swearware) C:\Users\Sanne\Desktop\ComboFix.exe
2013-08-13 15:49 - 2013-08-13 15:49 - 00000000 ____D C:\FRST
2013-08-13 15:48 - 2013-08-13 15:48 - 00000000 _____ C:\Users\Sanne\defogger_reenable
2013-08-13 15:45 - 2013-08-13 15:45 - 00377856 _____ C:\Users\Sanne\Downloads\gmer_2.1.19163.exe
2013-08-13 15:44 - 2013-08-13 20:28 - 01575274 _____ (Farbar) C:\Users\Sanne\Desktop\FRST64.exe
2013-08-13 15:42 - 2013-08-13 15:42 - 00050477 _____ C:\Users\Sanne\Downloads\Defogger.exe
2013-08-13 15:37 - 2013-08-13 15:37 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-13 15:33 - 2013-08-13 15:33 - 01110476 _____ C:\Users\Philipp\Downloads\7z920.exe
2013-08-12 19:30 - 2013-08-12 19:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-12 19:27 - 2013-08-12 19:27 - 01492848 _____ (Skype Technologies S.A.) C:\Users\Sanne\Downloads\SkypeSetup.exe
2013-08-12 19:07 - 2013-08-12 19:07 - 497783871 _____ C:\Windows\MEMORY.DMP
2013-08-12 19:07 - 2013-08-12 19:07 - 00294544 _____ C:\Windows\Minidump\081213-15968-01.dmp
2013-08-12 19:07 - 2013-08-12 19:07 - 00000000 ____D C:\Windows\Minidump
2013-08-11 12:03 - 2013-08-11 12:03 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-29 13:33 - 2013-07-29 13:33 - 00001130 _____ C:\Users\Philipp\Desktop\FiestaOnline.lnk
2013-07-29 12:36 - 2013-07-29 12:36 - 03313224 _____ (Softperfect Research ) C:\Users\Sanne\Downloads\networx_setup.exe
2013-07-21 21:04 - 2013-07-21 21:06 - 00000000 ____D C:\Windows\system32\MRT
2013-07-21 19:25 - 2013-07-21 19:25 - 00386216 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-20 16:17 - 2013-06-28 00:04 - 00693112 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-20 16:17 - 2013-06-28 00:04 - 00078200 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-20 15:58 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-20 15:58 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-20 15:58 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-20 15:58 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-20 15:58 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-20 15:57 - 2013-06-17 00:41 - 00997632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2013-07-20 15:57 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-20 15:57 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-20 15:57 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-20 15:57 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-20 15:57 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-20 15:57 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-20 15:57 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-20 15:57 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-20 15:57 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-20 15:57 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-20 15:57 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-20 15:57 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-20 15:57 - 2013-06-01 13:54 - 00194816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys
2013-07-20 15:57 - 2013-06-01 13:54 - 00125184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys
2013-07-20 15:57 - 2013-06-01 13:34 - 02391280 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2013-07-20 15:57 - 2013-06-01 13:33 - 02233600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-07-20 15:57 - 2013-06-01 13:29 - 00337152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBXHCI.SYS
2013-07-20 15:57 - 2013-06-01 13:29 - 00213248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\UCX01000.SYS
2013-07-20 15:57 - 2013-06-01 13:26 - 06987008 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-07-20 15:57 - 2013-06-01 13:26 - 00327936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2013-07-20 15:57 - 2013-06-01 12:24 - 02106176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2013-07-20 15:57 - 2013-06-01 11:25 - 00496640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-20 15:57 - 2013-06-01 11:25 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2013-07-20 15:57 - 2013-06-01 11:25 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\samlib.dll
2013-07-20 15:57 - 2013-06-01 11:24 - 01453568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcore.dll
2013-07-20 15:57 - 2013-06-01 11:24 - 00850944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfasfsrcsnk.dll
2013-07-20 15:57 - 2013-06-01 11:24 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll
2013-07-20 15:57 - 2013-06-01 11:23 - 01842176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2013-07-20 15:57 - 2013-06-01 11:23 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\vds.exe
2013-07-20 15:57 - 2013-06-01 11:22 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2013-07-20 15:57 - 2013-06-01 11:22 - 00446976 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2013-07-20 15:57 - 2013-06-01 11:22 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\vdsutil.dll
2013-07-20 15:57 - 2013-06-01 11:22 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\MbaeParserTask.exe
2013-07-20 15:57 - 2013-06-01 11:21 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2013-07-20 15:57 - 2013-06-01 11:21 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-20 15:57 - 2013-06-01 11:21 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\samlib.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 02219520 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 01527808 _____ (Microsoft Corporation) C:\Windows\system32\mfcore.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 01048576 _____ (Microsoft Corporation) C:\Windows\system32\mfasfsrcsnk.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 00583168 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2013-07-20 15:57 - 2013-06-01 11:19 - 00785408 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2013-07-20 15:57 - 2013-06-01 11:19 - 00207872 _____ (Microsoft Corporation) C:\Windows\system32\DeviceSetupManager.dll
2013-07-20 15:57 - 2013-06-01 05:08 - 00037632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\BthAvrcpTg.sys
2013-07-20 15:57 - 2013-05-31 01:14 - 04036096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-20 15:57 - 2013-05-25 00:09 - 01403296 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2013-07-20 15:57 - 2013-05-25 00:09 - 01271584 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2013-07-20 15:57 - 2013-05-25 00:09 - 01217352 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2013-07-20 15:57 - 2013-05-25 00:09 - 01093904 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2013-07-20 15:57 - 2013-05-20 02:08 - 00386642 _____ C:\Windows\system32\ApnDatabase.xml
2013-07-20 15:57 - 2013-05-04 08:59 - 02842112 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-20 15:57 - 2013-05-04 06:57 - 02620928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-20 15:57 - 2013-04-12 00:30 - 01421312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-20 15:57 - 2013-04-12 00:22 - 01838080 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
==================== One Month Modified Files and Folders =======
2013-08-13 20:28 - 2013-08-13 15:44 - 01575274 _____ (Farbar) C:\Users\Sanne\Desktop\FRST64.exe
2013-08-13 20:21 - 2013-08-13 20:21 - 00000743 _____ C:\Users\Sanne\Desktop\JRT.txt
2013-08-13 20:18 - 2013-08-13 20:18 - 00000000 ____D C:\Windows\ERUNT
2013-08-13 20:16 - 2013-08-13 20:16 - 01158722 _____ (Thisisu) C:\Users\Sanne\Desktop\JRT.exe
2013-08-13 20:15 - 2012-08-28 15:12 - 00752930 _____ C:\Windows\system32\perfh007.dat
2013-08-13 20:15 - 2012-08-28 15:12 - 00156156 _____ C:\Windows\system32\perfc007.dat
2013-08-13 20:15 - 2012-07-26 09:28 - 01748838 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-13 20:12 - 2012-11-29 12:05 - 01234496 _____ C:\Windows\WindowsUpdate.log
2013-08-13 20:11 - 2012-11-29 12:41 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-13 20:11 - 2012-07-26 09:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-13 20:10 - 2012-09-11 14:11 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-13 20:10 - 2012-08-28 13:13 - 00164596 _____ C:\Windows\PFRO.log
2013-08-13 20:09 - 2013-08-13 20:09 - 00001639 _____ C:\AdwCleaner[S1].txt
2013-08-13 20:07 - 2013-08-13 20:07 - 00001577 _____ C:\AdwCleaner[R1].txt
2013-08-13 20:06 - 2013-02-12 23:00 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-13 20:04 - 2013-08-13 20:04 - 00666633 _____ C:\Users\Sanne\Desktop\adwcleaner.exe
2013-08-13 20:02 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\system32\sru
2013-08-13 19:58 - 2012-11-29 12:41 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-13 19:56 - 2013-08-13 19:56 - 00000000 ____D C:\Users\Sanne\Desktop\reinigung
2013-08-13 19:33 - 2013-03-14 11:32 - 00002498 _____ C:\Windows\Sandboxie.ini
2013-08-13 17:19 - 2013-08-13 17:12 - 00000000 ____D C:\Qoobox
2013-08-13 17:19 - 2012-07-26 07:37 - 00000000 __RHD C:\Users\Default
2013-08-13 17:18 - 2013-08-13 17:18 - 00012685 _____ C:\ComboFix.txt
2013-08-13 17:17 - 2013-08-13 17:11 - 00000000 ____D C:\Windows\erdnt
2013-08-13 17:17 - 2012-07-26 07:26 - 00000215 _____ C:\Windows\system.ini
2013-08-13 17:05 - 2013-08-13 17:05 - 05102975 ____R (Swearware) C:\Users\Sanne\Desktop\ComboFix.exe
2013-08-13 15:49 - 2013-08-13 15:49 - 00000000 ____D C:\FRST
2013-08-13 15:48 - 2013-08-13 15:48 - 00000000 _____ C:\Users\Sanne\defogger_reenable
2013-08-13 15:48 - 2012-12-17 11:30 - 00000000 ____D C:\Users\Sanne
2013-08-13 15:45 - 2013-08-13 15:45 - 00377856 _____ C:\Users\Sanne\Downloads\gmer_2.1.19163.exe
2013-08-13 15:42 - 2013-08-13 15:42 - 00050477 _____ C:\Users\Sanne\Downloads\Defogger.exe
2013-08-13 15:37 - 2013-08-13 15:37 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-13 15:37 - 2012-11-29 12:05 - 00000000 ____D C:\Users\Jürgen
2013-08-13 15:33 - 2013-08-13 15:33 - 01110476 _____ C:\Users\Philipp\Downloads\7z920.exe
2013-08-13 14:46 - 2013-02-20 10:23 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-08-13 14:45 - 2012-07-26 07:26 - 00524288 ___SH C:\Windows\system32\config\BBI
2013-08-13 12:52 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\rescache
2013-08-13 11:43 - 2013-06-21 12:36 - 00001322 _____ C:\Users\Sanne\Desktop\Sandboxed Web Browser.lnk
2013-08-12 22:16 - 2012-11-29 17:03 - 00000000 ____D C:\Users\Philipp\AppData\Roaming\Skype
2013-08-12 19:32 - 2012-11-29 12:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-12 19:30 - 2013-08-12 19:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-12 19:29 - 2013-01-12 18:35 - 00000000 ____D C:\Users\Sanne\AppData\Roaming\Skype
2013-08-12 19:28 - 2012-11-29 16:14 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-08-12 19:28 - 2012-11-29 16:14 - 00000000 ____D C:\ProgramData\Skype
2013-08-12 19:27 - 2013-08-12 19:27 - 01492848 _____ (Skype Technologies S.A.) C:\Users\Sanne\Downloads\SkypeSetup.exe
2013-08-12 19:08 - 2013-02-20 10:23 - 00001926 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-08-12 19:08 - 2013-02-20 10:23 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-08-12 19:07 - 2013-08-12 19:07 - 497783871 _____ C:\Windows\MEMORY.DMP
2013-08-12 19:07 - 2013-08-12 19:07 - 00294544 _____ C:\Windows\Minidump\081213-15968-01.dmp
2013-08-12 19:07 - 2013-08-12 19:07 - 00000000 ____D C:\Windows\Minidump
2013-08-12 16:58 - 2012-11-29 12:42 - 00002187 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-08-11 15:54 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\AUInstallAgent
2013-08-11 12:03 - 2013-08-11 12:03 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-29 13:33 - 2013-07-29 13:33 - 00001130 _____ C:\Users\Philipp\Desktop\FiestaOnline.lnk
2013-07-29 12:36 - 2013-07-29 12:36 - 03313224 _____ (Softperfect Research ) C:\Users\Sanne\Downloads\networx_setup.exe
2013-07-29 12:36 - 2013-05-03 11:10 - 00000000 ____D C:\Program Files\NetWorx
2013-07-28 12:36 - 2012-12-03 10:00 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-25 18:19 - 2012-12-23 16:28 - 00000000 ____D C:\Users\Philipp\Documents\Fiesta
2013-07-21 21:06 - 2013-07-21 21:04 - 00000000 ____D C:\Windows\system32\MRT
2013-07-21 19:25 - 2013-07-21 19:25 - 00386216 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-20 16:25 - 2013-05-15 10:41 - 00000000 ____D C:\Users\Sanne\AppData\Local\Adobe
2013-07-20 16:24 - 2013-02-12 23:00 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-07-20 16:14 - 2013-02-01 19:23 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-20 16:14 - 2013-02-01 19:23 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-20 16:13 - 2012-07-26 11:45 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-20 16:13 - 2012-07-26 07:38 - 00000000 ____D C:\Windows\system32\oobe
2013-07-20 15:53 - 2012-11-29 12:41 - 00004096 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-20 15:53 - 2012-11-29 12:41 - 00003860 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-20 11:12 - 2013-05-03 11:10 - 00041976 _____ (NetFilterSDK.com) C:\Windows\system32\Drivers\networx.sys
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-13 11:50
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- Addition.txt gab's diesmal keine. Und der QuickLauncher funktioniert jetzt auch wieder ohne Fehlermeldung *juchu* Kannst du mir verraten, was unser lieber Sohn da mit seiner Spiele-, YouTube-, und Skype-Leidenschaft eingeschleppt hat (er ist nämlich auf diesem Rechner der Hauptnutzer und weigert sich hartnäckig Sandboxie zu nutzen  )? Und muss ich jetzt sicherheitshalber außerplanmäßig Passwörter ändern? Liebe Grüße SuNi |
|
14.08.2013, 15:40
| #6 |
| /// the machine /// TB-Ausbilder | Windows-8-PC mit Systemabsturz und temporärem StartproblemESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ --> Windows-8-PC mit Systemabsturz und temporärem Startproblem |
|
14.08.2013, 19:27
| #7 |
| | Windows-8-PC mit Systemabsturz und temporärem Startproblem Geschafft, alles fertig! 1.Eset Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=387e51afe9353e48a4be8bf0e232329c
# engine=14773
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-08-14 05:27:42
# local_time=2013-08-14 07:27:42 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.2.9200 NT
# compatibility_mode=774 16777213 85 91 2170915 153211134 0 0
# compatibility_mode=5893 16776574 100 94 13341322 24109392 0 0
# scanned=264646
# found=0
# cleaned=0
# scan_time=4112
Code:
ATTFilter Results of screen317's Security Check version 0.99.72 x64 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` avast! Antivirus Windows Defender Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Secunia PSI (3.0.0.6005) Malwarebytes Anti-Malware Version 1.75.0.1300 Adobe Flash Player 11.8.800.94 Adobe Reader XI Mozilla Firefox (23.0) Mozilla Thunderbird (17.0.8) Google Chrome 28.0.1500.72 Google Chrome 28.0.1500.95 ````````Process Check: objlist.exe by Laurent```````` Windows Defender MSMpEng.exe Windows Defender MsMpEng.exe Windows Defender MpCmdRun.exe AVAST Software Avast AvastSvc.exe AVAST Software Avast AvastUI.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: % ````````````````````End of Log`````````````````````` FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-08-2013 01
Ran by Sanne (administrator) on 14-08-2013 19:57:25
Running from C:\Users\Sanne\Desktop
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\system32\dashost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(SoftPerfect Research) C:\Program Files\NetWorx\networx.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieCtrl.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13192848 2012-08-20] (Realtek Semiconductor)
HKLM\...\Run: [NetWorx] - C:\Program Files\NetWorx\networx.exe [4886648 2013-07-24] (SoftPerfect Research)
HKCU\...\Run: [Pando Media Booster] - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624 2013-03-06] ()
HKCU\...\Run: [FileHippo.com] - C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe [307712 2012-11-23] (FileHippo.com)
HKCU\...\Run: [SecureBanking] - C:\Program Files (x86)\Secure Banking\SecureBanking.exe [507904 2013-07-04] (Secure Banking)
HKCU\...\Run: [SandboxieControl] - C:\Program Files\Sandboxie\SbieCtrl.exe [759384 2013-07-08] (Sandboxie Holdings, LLC)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [277504 2012-08-16] (Intel Corporation)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] - C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] - C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-20] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Reader Application Helper] - C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe [899400 2013-03-18] (Sony Corporation)
HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)
HKLM-x32\...\Run: [] - [x]
HKU\Default\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [x]
HKU\Default User\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [x]
HKU\Philipp\...\Run: [SandboxieControl] - C:\Program Files\Sandboxie\SbieCtrl.exe [759384 2013-07-08] (Sandboxie Holdings, LLC)
HKU\UpdatusUser\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [x]
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo13.msn.com
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {0C688C30-1FFE-47A6-A484-31890FF3D232} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MALNJS
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
FireFox:
========
FF ProfilePath: C:\Users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @sony.com/ReaderDesktop - C:\Program Files (x86)\Sony\ReaderDesktop\npreaderdetectmoz.dll (Sony Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Extension: WOT - C:\Users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF Extension: No Name - C:\Users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR Extension: (Docs) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Google Drive) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0
CHR Extension: (YouTube) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (Gmail) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
==================== Services (Whitelisted) =================
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-13] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-13] (CyberLink)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-07-19] (Intel Corporation)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2010-08-19] ()
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [183896 2013-07-08] (Sandboxie Holdings, LLC)
S3 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1223704 2013-02-07] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [660504 2013-02-07] (Secunia)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [14920 2013-01-29] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-06-27] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-06-27] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-06-27] ()
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
R1 networx; C:\Windows\System32\drivers\networx.sys [41976 2013-07-20] (NetFilterSDK.com)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-02-07] (Secunia)
S3 RTL8192cu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1576080 2012-08-07] (Realtek Semiconductor Corporation )
R3 RtlWlanu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1576080 2012-08-07] (Realtek Semiconductor Corporation )
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [199384 2013-07-08] (Sandboxie Holdings, LLC)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [x]
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-14 19:46 - 2013-08-14 19:46 - 00891115 _____ C:\Users\Sanne\Desktop\SecurityCheck.exe
2013-08-14 18:16 - 2013-08-14 18:16 - 02347384 _____ (ESET) C:\Users\Sanne\Desktop\esetsmartinstaller_enu.exe
2013-08-14 18:16 - 2013-08-14 18:16 - 00000000 ____D C:\Program Files (x86)\ESET
2013-08-14 10:25 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-14 10:25 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-14 10:25 - 2013-07-26 07:13 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2013-08-14 10:25 - 2013-07-26 07:13 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2013-08-14 10:25 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-14 10:25 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-14 10:25 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-14 10:25 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-14 10:25 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-14 10:25 - 2013-07-26 05:13 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-14 10:25 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-14 10:25 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-14 10:25 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-14 10:25 - 2013-07-26 02:54 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll
2013-08-14 10:24 - 2013-07-13 08:18 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 10:24 - 2013-07-13 08:16 - 01889280 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 10:24 - 2013-07-13 08:16 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 10:24 - 2013-07-13 08:15 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\apprepapi.dll
2013-08-14 10:24 - 2013-07-13 08:15 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\apprepsync.dll
2013-08-14 10:24 - 2013-07-13 06:24 - 00261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-14 10:24 - 2013-07-13 06:23 - 01568256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-14 10:24 - 2013-07-13 06:23 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apprepapi.dll
2013-08-14 10:24 - 2013-07-13 06:23 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apprepsync.dll
2013-08-13 20:18 - 2013-08-13 20:18 - 00000000 ____D C:\Windows\ERUNT
2013-08-13 20:16 - 2013-08-13 20:16 - 01158722 _____ (Thisisu) C:\Users\Sanne\Desktop\JRT.exe
2013-08-13 20:09 - 2013-08-13 20:09 - 00001639 _____ C:\AdwCleaner[S1].txt
2013-08-13 20:07 - 2013-08-13 20:07 - 00001577 _____ C:\AdwCleaner[R1].txt
2013-08-13 20:04 - 2013-08-13 20:04 - 00666633 _____ C:\Users\Sanne\Desktop\adwcleaner.exe
2013-08-13 19:56 - 2013-08-14 07:49 - 00000000 ____D C:\Users\Sanne\Desktop\reinigung
2013-08-13 17:18 - 2013-08-13 17:18 - 00012685 _____ C:\ComboFix.txt
2013-08-13 17:12 - 2013-08-13 17:19 - 00000000 ____D C:\Qoobox
2013-08-13 17:12 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-13 17:12 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-13 17:12 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\Windows\SWXCACLS.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-13 17:11 - 2013-08-13 17:17 - 00000000 ____D C:\Windows\erdnt
2013-08-13 17:05 - 2013-08-13 17:05 - 05102975 ____R (Swearware) C:\Users\Sanne\Desktop\ComboFix.exe
2013-08-13 15:49 - 2013-08-13 15:49 - 00000000 ____D C:\FRST
2013-08-13 15:48 - 2013-08-13 15:48 - 00000000 _____ C:\Users\Sanne\defogger_reenable
2013-08-13 15:45 - 2013-08-13 15:45 - 00377856 _____ C:\Users\Sanne\Downloads\gmer_2.1.19163.exe
2013-08-13 15:42 - 2013-08-13 15:42 - 00050477 _____ C:\Users\Sanne\Downloads\Defogger.exe
2013-08-13 15:37 - 2013-08-13 15:37 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-13 15:33 - 2013-08-13 15:33 - 01110476 _____ C:\Users\Philipp\Downloads\7z920.exe
2013-08-12 19:30 - 2013-08-12 19:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-12 19:27 - 2013-08-12 19:27 - 01492848 _____ (Skype Technologies S.A.) C:\Users\Sanne\Downloads\SkypeSetup.exe
2013-08-12 19:07 - 2013-08-12 19:07 - 497783871 _____ C:\Windows\MEMORY.DMP
2013-08-12 19:07 - 2013-08-12 19:07 - 00294544 _____ C:\Windows\Minidump\081213-15968-01.dmp
2013-08-12 19:07 - 2013-08-12 19:07 - 00000000 ____D C:\Windows\Minidump
2013-08-11 12:03 - 2013-08-11 12:03 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-29 13:33 - 2013-07-29 13:33 - 00001130 _____ C:\Users\Philipp\Desktop\FiestaOnline.lnk
2013-07-29 12:36 - 2013-07-29 12:36 - 03313224 _____ (Softperfect Research ) C:\Users\Sanne\Downloads\networx_setup.exe
2013-07-21 21:04 - 2013-08-14 19:29 - 00000000 ____D C:\Windows\system32\MRT
2013-07-21 19:25 - 2013-07-21 19:25 - 00386216 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-20 16:17 - 2013-06-28 00:04 - 00693112 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-20 16:17 - 2013-06-28 00:04 - 00078200 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-20 15:57 - 2013-06-17 00:41 - 00997632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2013-07-20 15:57 - 2013-06-01 13:54 - 00194816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys
2013-07-20 15:57 - 2013-06-01 13:54 - 00125184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys
2013-07-20 15:57 - 2013-06-01 13:34 - 02391280 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2013-07-20 15:57 - 2013-06-01 13:33 - 02233600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-07-20 15:57 - 2013-06-01 13:29 - 00337152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBXHCI.SYS
2013-07-20 15:57 - 2013-06-01 13:29 - 00213248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\UCX01000.SYS
2013-07-20 15:57 - 2013-06-01 13:26 - 06987008 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-07-20 15:57 - 2013-06-01 13:26 - 00327936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2013-07-20 15:57 - 2013-06-01 12:24 - 02106176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2013-07-20 15:57 - 2013-06-01 11:25 - 00496640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-20 15:57 - 2013-06-01 11:25 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2013-07-20 15:57 - 2013-06-01 11:25 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\samlib.dll
2013-07-20 15:57 - 2013-06-01 11:24 - 01453568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcore.dll
2013-07-20 15:57 - 2013-06-01 11:24 - 00850944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfasfsrcsnk.dll
2013-07-20 15:57 - 2013-06-01 11:24 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll
2013-07-20 15:57 - 2013-06-01 11:23 - 01842176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2013-07-20 15:57 - 2013-06-01 11:23 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\vds.exe
2013-07-20 15:57 - 2013-06-01 11:22 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2013-07-20 15:57 - 2013-06-01 11:22 - 00446976 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2013-07-20 15:57 - 2013-06-01 11:22 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\vdsutil.dll
2013-07-20 15:57 - 2013-06-01 11:22 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\MbaeParserTask.exe
2013-07-20 15:57 - 2013-06-01 11:21 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2013-07-20 15:57 - 2013-06-01 11:21 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-20 15:57 - 2013-06-01 11:21 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\samlib.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 02219520 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 01527808 _____ (Microsoft Corporation) C:\Windows\system32\mfcore.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 01048576 _____ (Microsoft Corporation) C:\Windows\system32\mfasfsrcsnk.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 00583168 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2013-07-20 15:57 - 2013-06-01 11:19 - 00785408 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2013-07-20 15:57 - 2013-06-01 11:19 - 00207872 _____ (Microsoft Corporation) C:\Windows\system32\DeviceSetupManager.dll
2013-07-20 15:57 - 2013-06-01 05:08 - 00037632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\BthAvrcpTg.sys
2013-07-20 15:57 - 2013-05-31 01:14 - 04036096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-20 15:57 - 2013-05-25 00:09 - 01403296 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2013-07-20 15:57 - 2013-05-25 00:09 - 01271584 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2013-07-20 15:57 - 2013-05-25 00:09 - 01217352 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2013-07-20 15:57 - 2013-05-25 00:09 - 01093904 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2013-07-20 15:57 - 2013-05-20 02:08 - 00386642 _____ C:\Windows\system32\ApnDatabase.xml
2013-07-20 15:57 - 2013-05-04 08:59 - 02842112 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-20 15:57 - 2013-05-04 06:57 - 02620928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-20 15:57 - 2013-04-12 00:30 - 01421312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-20 15:57 - 2013-04-12 00:22 - 01838080 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
==================== One Month Modified Files and Folders =======
2013-08-14 19:56 - 2013-08-14 19:56 - 01575570 _____ (Farbar) C:\Users\Sanne\Desktop\FRST64.exe
2013-08-14 19:46 - 2013-08-14 19:46 - 00891115 _____ C:\Users\Sanne\Desktop\SecurityCheck.exe
2013-08-14 19:43 - 2012-08-28 15:12 - 00752930 _____ C:\Windows\system32\perfh007.dat
2013-08-14 19:43 - 2012-08-28 15:12 - 00156156 _____ C:\Windows\system32\perfc007.dat
2013-08-14 19:43 - 2012-07-26 09:28 - 01748838 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-14 19:40 - 2012-11-29 12:41 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-14 19:39 - 2012-11-29 12:05 - 01617838 _____ C:\Windows\WindowsUpdate.log
2013-08-14 19:38 - 2012-09-11 14:11 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-14 19:38 - 2012-07-26 09:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-14 19:32 - 2013-07-21 21:04 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 19:29 - 2012-12-12 18:17 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-14 19:06 - 2013-02-12 23:00 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-14 19:02 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\system32\sru
2013-08-14 18:58 - 2012-11-29 12:41 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-14 18:16 - 2013-08-14 18:16 - 02347384 _____ (ESET) C:\Users\Sanne\Desktop\esetsmartinstaller_enu.exe
2013-08-14 18:16 - 2013-08-14 18:16 - 00000000 ____D C:\Program Files (x86)\ESET
2013-08-14 13:09 - 2012-11-29 17:03 - 00000000 ____D C:\Users\Philipp\AppData\Roaming\Skype
2013-08-14 07:49 - 2013-08-13 19:56 - 00000000 ____D C:\Users\Sanne\Desktop\reinigung
2013-08-13 20:18 - 2013-08-13 20:18 - 00000000 ____D C:\Windows\ERUNT
2013-08-13 20:16 - 2013-08-13 20:16 - 01158722 _____ (Thisisu) C:\Users\Sanne\Desktop\JRT.exe
2013-08-13 20:10 - 2012-08-28 13:13 - 00164596 _____ C:\Windows\PFRO.log
2013-08-13 20:09 - 2013-08-13 20:09 - 00001639 _____ C:\AdwCleaner[S1].txt
2013-08-13 20:07 - 2013-08-13 20:07 - 00001577 _____ C:\AdwCleaner[R1].txt
2013-08-13 20:04 - 2013-08-13 20:04 - 00666633 _____ C:\Users\Sanne\Desktop\adwcleaner.exe
2013-08-13 19:33 - 2013-03-14 11:32 - 00002498 _____ C:\Windows\Sandboxie.ini
2013-08-13 17:19 - 2013-08-13 17:12 - 00000000 ____D C:\Qoobox
2013-08-13 17:19 - 2012-07-26 07:37 - 00000000 __RHD C:\Users\Default
2013-08-13 17:18 - 2013-08-13 17:18 - 00012685 _____ C:\ComboFix.txt
2013-08-13 17:17 - 2013-08-13 17:11 - 00000000 ____D C:\Windows\erdnt
2013-08-13 17:17 - 2012-07-26 07:26 - 00000215 _____ C:\Windows\system.ini
2013-08-13 17:05 - 2013-08-13 17:05 - 05102975 ____R (Swearware) C:\Users\Sanne\Desktop\ComboFix.exe
2013-08-13 15:49 - 2013-08-13 15:49 - 00000000 ____D C:\FRST
2013-08-13 15:48 - 2013-08-13 15:48 - 00000000 _____ C:\Users\Sanne\defogger_reenable
2013-08-13 15:48 - 2012-12-17 11:30 - 00000000 ____D C:\Users\Sanne
2013-08-13 15:45 - 2013-08-13 15:45 - 00377856 _____ C:\Users\Sanne\Downloads\gmer_2.1.19163.exe
2013-08-13 15:42 - 2013-08-13 15:42 - 00050477 _____ C:\Users\Sanne\Downloads\Defogger.exe
2013-08-13 15:37 - 2013-08-13 15:37 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-13 15:37 - 2012-11-29 12:05 - 00000000 ____D C:\Users\Jürgen
2013-08-13 15:33 - 2013-08-13 15:33 - 01110476 _____ C:\Users\Philipp\Downloads\7z920.exe
2013-08-13 14:46 - 2013-02-20 10:23 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-08-13 14:45 - 2012-07-26 07:26 - 00524288 ___SH C:\Windows\system32\config\BBI
2013-08-13 12:52 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\rescache
2013-08-13 11:43 - 2013-06-21 12:36 - 00001322 _____ C:\Users\Sanne\Desktop\Sandboxed Web Browser.lnk
2013-08-12 19:32 - 2012-11-29 12:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-12 19:30 - 2013-08-12 19:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-12 19:29 - 2013-01-12 18:35 - 00000000 ____D C:\Users\Sanne\AppData\Roaming\Skype
2013-08-12 19:28 - 2012-11-29 16:14 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-08-12 19:28 - 2012-11-29 16:14 - 00000000 ____D C:\ProgramData\Skype
2013-08-12 19:27 - 2013-08-12 19:27 - 01492848 _____ (Skype Technologies S.A.) C:\Users\Sanne\Downloads\SkypeSetup.exe
2013-08-12 19:08 - 2013-02-20 10:23 - 00001926 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-08-12 19:08 - 2013-02-20 10:23 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-08-12 19:07 - 2013-08-12 19:07 - 497783871 _____ C:\Windows\MEMORY.DMP
2013-08-12 19:07 - 2013-08-12 19:07 - 00294544 _____ C:\Windows\Minidump\081213-15968-01.dmp
2013-08-12 19:07 - 2013-08-12 19:07 - 00000000 ____D C:\Windows\Minidump
2013-08-12 16:58 - 2012-11-29 12:42 - 00002187 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-08-11 15:54 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\AUInstallAgent
2013-08-11 12:03 - 2013-08-11 12:03 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-29 13:33 - 2013-07-29 13:33 - 00001130 _____ C:\Users\Philipp\Desktop\FiestaOnline.lnk
2013-07-29 12:36 - 2013-07-29 12:36 - 03313224 _____ (Softperfect Research ) C:\Users\Sanne\Downloads\networx_setup.exe
2013-07-29 12:36 - 2013-05-03 11:10 - 00000000 ____D C:\Program Files\NetWorx
2013-07-28 12:36 - 2012-12-03 10:00 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-26 07:13 - 2013-08-14 10:25 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-26 07:13 - 2013-08-14 10:25 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-26 07:13 - 2013-08-14 10:25 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2013-07-26 07:13 - 2013-08-14 10:25 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2013-07-26 07:13 - 2013-08-14 10:25 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-26 07:12 - 2013-08-14 10:25 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-26 05:35 - 2013-08-14 10:25 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-26 05:13 - 2013-08-14 10:25 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-26 05:13 - 2013-08-14 10:25 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-26 05:13 - 2013-08-14 10:25 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-26 05:11 - 2013-08-14 10:25 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-26 05:11 - 2013-08-14 10:25 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-26 04:49 - 2013-08-14 10:25 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-26 02:54 - 2013-08-14 10:25 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll
2013-07-25 18:19 - 2012-12-23 16:28 - 00000000 ____D C:\Users\Philipp\Documents\Fiesta
2013-07-21 19:25 - 2013-07-21 19:25 - 00386216 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-20 16:25 - 2013-05-15 10:41 - 00000000 ____D C:\Users\Sanne\AppData\Local\Adobe
2013-07-20 16:24 - 2013-02-12 23:00 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-07-20 16:14 - 2013-02-01 19:23 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-20 16:14 - 2013-02-01 19:23 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-20 16:13 - 2012-07-26 11:45 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-20 16:13 - 2012-07-26 07:38 - 00000000 ____D C:\Windows\system32\oobe
2013-07-20 15:53 - 2012-11-29 12:41 - 00004096 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-20 15:53 - 2012-11-29 12:41 - 00003860 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-20 11:12 - 2013-05-03 11:10 - 00041976 _____ (NetFilterSDK.com) C:\Windows\system32\Drivers\networx.sys
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-13 11:50
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- Im Wartungscenter scheint irgendwas verstellt zu sein: Direkt nach Beendigung von eset hatte sich die Systemwartung einfach so eingeschaltet (trotzdem ich die Kiste erst vor 2 Tagen gewartet hatte), die hab ich erst mal wieder gestoppt. Dann hatte ich mich noch bei der Reaktivierung meines Antivirenprogramms verklickt und aus Versehen den Defender aktiviert, der sich dann über das Wartungscenter erst mal nicht mehr wieder beenden ließ. Ein Neustart hat daran erst mal nix geändert...Dummerweise hatte das blöde ding irgendwann in der Zwischenzeit Windows-Updates runtergeladen und dann während genau dieses Neustarts installiert - Ich hoffe, dass hat jetzt nix kaputt gemacht  Erst als ich dann versuchsweise einfach Avast mal wieder, reaktiviert habe verschwand der defender aus der Anzeige im Wartungscenter und avast scheint wieder zu laufen...Ich habe aber keine Ahnung, ob es jetzt wirklich in Ordnung ist ... Achja, außerdem kann ich seit gestern in firefox keine Lesezeichen setzen - wollte diesen thread bookmarken, geht aber nicht - ich muss ihn immer übers Kontrollzentrum aufrufen (aber den FF neu zu installieren wäre ja gar kein Prob.) So, lieber Schrauber, was meinst du, kriegst du das wieder in den Griff? Viele Grüße SuNi Geändert von SuNi67 (14.08.2013 um 19:45 Uhr) |
|
15.08.2013, 08:25
| #8 |
| /// the machine /// TB-Ausbilder | Windows-8-PC mit Systemabsturz und temporärem Startproblem Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [x]
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [x]
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Installier den FF mal neu und berichte ob es noch Probleme gibt
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
15.08.2013, 10:38
| #9 |
| | Windows-8-PC mit Systemabsturz und temporärem Startproblem Guten Morgen, Schrauber hier zunächst einmal das Fixlog: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 14-08-2013 01
Ran by Sanne at 2013-08-15 11:15:04 Run:1
Running from C:\Users\Sanne\Desktop
Boot Mode: Normal
==============================================
X6va011 => Service deleted successfully.
X6va012 => Service deleted successfully.
==== End of Fixlog ====
Scheint fast alles zu funktionieren, wie es soll - auch der WindowsDefender scheint tatsächlich deaktiviert und nur Avast aktiviert zu sein FF funktioniert nach Neu-Installation wieder fehlerfrei. Jedoch ist mir bei der Überprüfung der anderen Browser aufgefallen, dass der IE in keinem Benutzerkonto funktioniert (den hatte ich vergessen, weil er von uns nicht genutzt wird). Er startet zwar, lädt aber keine Seite...und das ist auch nach Fix und Neustart so geblieben. Viele Grüße SuNi |
|
15.08.2013, 14:35
| #10 |
| /// the machine /// TB-Ausbilder | Windows-8-PC mit Systemabsturz und temporärem Startproblem Setze folgendermassen den Internet Explorer zurück:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
15.08.2013, 18:12
| #11 |
| | Windows-8-PC mit Systemabsturz und temporärem Startproblem Hallo Schrauber Das hat geklappt - der IE funktioniert jetzt wieder in allen Konten Und bis jetzt hab ich auch keine neue Katastrophe gefunden Viele Grüße SuNi Update um 19:00 Uhr Hallo Schrauber, leider scheint das Absturz-Problem noch nicht vollständig behoben Als ich gerade eben den Rechner mit eingeschränkten Nutzerrechten startete und dann nach dem Systemstart FF in der Sandboxie starten wollte - Bluesccreen, mit Hinweis, dass der PC neugestartet werden müsse - Fehlerdetails sind einzusehen unter PAGE_FAULT_IN... (für den Rest war ich zu langsam) Nach den Neustart dann Blackscreen mit " Reboot and select propper boot deveice or insert boot media in selected boot device and press a key"  Also hab ich das Ding in altbewähter Manier wieder ausgemacht und neugestartet.... Ich denke mal, da willst Du bestimmt en frisches FRST-log, oder?! FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-08-2013 01
Ran by Sanne (administrator) on 15-08-2013 18:58:45
Running from C:\Users\Sanne\Desktop
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\system32\dashost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Microsoft Corporation) C:\Windows\system32\msiexec.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(SoftPerfect Research) C:\Program Files\NetWorx\networx.exe
(Secure Banking) C:\Program Files (x86)\Secure Banking\SecureBanking.exe
() C:\Program Files (x86)\Secure Banking\sbservice.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieCtrl.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13192848 2012-08-20] (Realtek Semiconductor)
HKLM\...\Run: [NetWorx] - C:\Program Files\NetWorx\networx.exe [4886648 2013-07-24] (SoftPerfect Research)
HKCU\...\Run: [Pando Media Booster] - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624 2013-03-06] ()
HKCU\...\Run: [FileHippo.com] - C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe [307712 2012-11-23] (FileHippo.com)
HKCU\...\Run: [SecureBanking] - C:\Program Files (x86)\Secure Banking\SecureBanking.exe [507904 2013-07-04] (Secure Banking)
HKCU\...\Run: [SandboxieControl] - C:\Program Files\Sandboxie\SbieCtrl.exe [759384 2013-07-08] (Sandboxie Holdings, LLC)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [277504 2012-08-16] (Intel Corporation)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] - C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] - C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-20] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Reader Application Helper] - C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe [899400 2013-03-18] (Sony Corporation)
HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)
HKLM-x32\...\Run: [] - [x]
HKU\Default\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [x]
HKU\Default User\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [x]
HKU\Philipp\...\Run: [SandboxieControl] - C:\Program Files\Sandboxie\SbieCtrl.exe [759384 2013-07-08] (Sandboxie Holdings, LLC)
HKU\UpdatusUser\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [x]
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo13.msn.com
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {0C688C30-1FFE-47A6-A484-31890FF3D232} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MALNJS
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
FireFox:
========
FF ProfilePath: C:\Users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @sony.com/ReaderDesktop - C:\Program Files (x86)\Sony\ReaderDesktop\npreaderdetectmoz.dll (Sony Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Extension: WOT - C:\Users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF Extension: No Name - C:\Users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR Extension: (Docs) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Google Drive) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0
CHR Extension: (YouTube) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (Gmail) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
==================== Services (Whitelisted) =================
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-13] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-13] (CyberLink)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-07-19] (Intel Corporation)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2010-08-19] ()
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [183896 2013-07-08] (Sandboxie Holdings, LLC)
S3 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1223704 2013-02-07] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [660504 2013-02-07] (Secunia)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-06-27] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-06-27] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-06-27] ()
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
R1 networx; C:\Windows\System32\drivers\networx.sys [41976 2013-07-20] (NetFilterSDK.com)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-02-07] (Secunia)
S3 RTL8192cu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1576080 2012-08-07] (Realtek Semiconductor Corporation )
R3 RtlWlanu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1576080 2012-08-07] (Realtek Semiconductor Corporation )
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [199384 2013-07-08] (Sandboxie Holdings, LLC)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-15 11:22 - 2013-08-15 11:22 - 00001151 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-08-15 11:17 - 2013-08-15 11:17 - 22268584 _____ (Mozilla) C:\Users\Sanne\Downloads\Firefox Setup 23.0.exe
2013-08-14 19:56 - 2013-08-14 19:56 - 01575570 _____ (Farbar) C:\Users\Sanne\Desktop\FRST64.exe
2013-08-14 19:46 - 2013-08-14 19:46 - 00891115 _____ C:\Users\Sanne\Desktop\SecurityCheck.exe
2013-08-14 18:16 - 2013-08-14 18:16 - 02347384 _____ (ESET) C:\Users\Sanne\Desktop\esetsmartinstaller_enu.exe
2013-08-14 10:26 - 2013-05-24 01:02 - 01314816 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 10:26 - 2013-05-24 00:25 - 00694272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-14 10:25 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-14 10:25 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-14 10:25 - 2013-07-26 07:13 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2013-08-14 10:25 - 2013-07-26 07:13 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2013-08-14 10:25 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-14 10:25 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-14 10:25 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-14 10:25 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-14 10:25 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-14 10:25 - 2013-07-26 05:13 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-14 10:25 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-14 10:25 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-14 10:25 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-14 10:25 - 2013-07-26 02:54 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll
2013-08-14 10:25 - 2013-07-09 08:07 - 02233168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 10:25 - 2013-07-02 02:44 - 00036288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys
2013-08-14 10:25 - 2013-07-02 00:08 - 00247216 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys
2013-08-14 10:24 - 2013-07-13 08:18 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 10:24 - 2013-07-13 08:16 - 01889280 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 10:24 - 2013-07-13 08:16 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 10:24 - 2013-07-13 08:15 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\apprepapi.dll
2013-08-14 10:24 - 2013-07-13 08:15 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\apprepsync.dll
2013-08-14 10:24 - 2013-07-13 06:24 - 00261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-14 10:24 - 2013-07-13 06:23 - 01568256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-14 10:24 - 2013-07-13 06:23 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apprepapi.dll
2013-08-14 10:24 - 2013-07-13 06:23 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apprepsync.dll
2013-08-13 20:18 - 2013-08-13 20:18 - 00000000 ____D C:\Windows\ERUNT
2013-08-13 20:16 - 2013-08-13 20:16 - 01158722 _____ (Thisisu) C:\Users\Sanne\Desktop\JRT.exe
2013-08-13 20:09 - 2013-08-13 20:09 - 00001639 _____ C:\AdwCleaner[S1].txt
2013-08-13 20:07 - 2013-08-13 20:07 - 00001577 _____ C:\AdwCleaner[R1].txt
2013-08-13 20:04 - 2013-08-13 20:04 - 00666633 _____ C:\Users\Sanne\Desktop\adwcleaner.exe
2013-08-13 19:56 - 2013-08-14 20:28 - 00000000 ____D C:\Users\Sanne\Desktop\reinigung
2013-08-13 17:18 - 2013-08-13 17:18 - 00012685 _____ C:\ComboFix.txt
2013-08-13 17:12 - 2013-08-13 17:19 - 00000000 ____D C:\Qoobox
2013-08-13 17:12 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-13 17:12 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-13 17:12 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\Windows\SWXCACLS.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-13 17:11 - 2013-08-13 17:17 - 00000000 ____D C:\Windows\erdnt
2013-08-13 17:05 - 2013-08-13 17:05 - 05102975 ____R (Swearware) C:\Users\Sanne\Desktop\ComboFix.exe
2013-08-13 15:49 - 2013-08-13 15:49 - 00000000 ____D C:\FRST
2013-08-13 15:48 - 2013-08-13 15:48 - 00000000 _____ C:\Users\Sanne\defogger_reenable
2013-08-13 15:45 - 2013-08-13 15:45 - 00377856 _____ C:\Users\Sanne\Downloads\gmer_2.1.19163.exe
2013-08-13 15:42 - 2013-08-13 15:42 - 00050477 _____ C:\Users\Sanne\Downloads\Defogger.exe
2013-08-13 15:37 - 2013-08-13 15:37 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-13 15:33 - 2013-08-13 15:33 - 01110476 _____ C:\Users\Philipp\Downloads\7z920.exe
2013-08-12 19:30 - 2013-08-12 19:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-12 19:27 - 2013-08-12 19:27 - 01492848 _____ (Skype Technologies S.A.) C:\Users\Sanne\Downloads\SkypeSetup.exe
2013-08-12 19:07 - 2013-08-15 18:53 - 476533879 _____ C:\Windows\MEMORY.DMP
2013-08-12 19:07 - 2013-08-15 18:53 - 00000000 ____D C:\Windows\Minidump
2013-08-12 19:07 - 2013-08-12 19:07 - 00294544 _____ C:\Windows\Minidump\081213-15968-01.dmp
2013-08-11 12:03 - 2013-08-15 11:22 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-29 13:33 - 2013-07-29 13:33 - 00001130 _____ C:\Users\Philipp\Desktop\FiestaOnline.lnk
2013-07-29 12:36 - 2013-07-29 12:36 - 03313224 _____ (Softperfect Research ) C:\Users\Sanne\Downloads\networx_setup.exe
2013-07-21 21:04 - 2013-08-14 19:32 - 00000000 ____D C:\Windows\system32\MRT
2013-07-21 19:25 - 2013-07-21 19:25 - 00386216 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-20 16:17 - 2013-06-28 00:04 - 00693112 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-20 16:17 - 2013-06-28 00:04 - 00078200 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-20 15:57 - 2013-06-17 00:41 - 00997632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2013-07-20 15:57 - 2013-06-01 13:54 - 00194816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys
2013-07-20 15:57 - 2013-06-01 13:54 - 00125184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys
2013-07-20 15:57 - 2013-06-01 13:34 - 02391280 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2013-07-20 15:57 - 2013-06-01 13:29 - 00337152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBXHCI.SYS
2013-07-20 15:57 - 2013-06-01 13:29 - 00213248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\UCX01000.SYS
2013-07-20 15:57 - 2013-06-01 13:26 - 06987008 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-07-20 15:57 - 2013-06-01 13:26 - 00327936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2013-07-20 15:57 - 2013-06-01 12:24 - 02106176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2013-07-20 15:57 - 2013-06-01 11:25 - 00496640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-20 15:57 - 2013-06-01 11:25 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2013-07-20 15:57 - 2013-06-01 11:25 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\samlib.dll
2013-07-20 15:57 - 2013-06-01 11:24 - 01453568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcore.dll
2013-07-20 15:57 - 2013-06-01 11:24 - 00850944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfasfsrcsnk.dll
2013-07-20 15:57 - 2013-06-01 11:24 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll
2013-07-20 15:57 - 2013-06-01 11:23 - 01842176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2013-07-20 15:57 - 2013-06-01 11:23 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\vds.exe
2013-07-20 15:57 - 2013-06-01 11:22 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2013-07-20 15:57 - 2013-06-01 11:22 - 00446976 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2013-07-20 15:57 - 2013-06-01 11:22 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\vdsutil.dll
2013-07-20 15:57 - 2013-06-01 11:22 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\MbaeParserTask.exe
2013-07-20 15:57 - 2013-06-01 11:21 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2013-07-20 15:57 - 2013-06-01 11:21 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-20 15:57 - 2013-06-01 11:21 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\samlib.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 02219520 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 01527808 _____ (Microsoft Corporation) C:\Windows\system32\mfcore.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 01048576 _____ (Microsoft Corporation) C:\Windows\system32\mfasfsrcsnk.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 00583168 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2013-07-20 15:57 - 2013-06-01 11:19 - 00785408 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2013-07-20 15:57 - 2013-06-01 11:19 - 00207872 _____ (Microsoft Corporation) C:\Windows\system32\DeviceSetupManager.dll
2013-07-20 15:57 - 2013-06-01 05:08 - 00037632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\BthAvrcpTg.sys
2013-07-20 15:57 - 2013-05-31 01:14 - 04036096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-20 15:57 - 2013-05-25 00:09 - 01403296 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2013-07-20 15:57 - 2013-05-25 00:09 - 01271584 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2013-07-20 15:57 - 2013-05-25 00:09 - 01217352 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2013-07-20 15:57 - 2013-05-25 00:09 - 01093904 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2013-07-20 15:57 - 2013-05-20 02:08 - 00386642 _____ C:\Windows\system32\ApnDatabase.xml
2013-07-20 15:57 - 2013-05-04 08:59 - 02842112 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-20 15:57 - 2013-05-04 06:57 - 02620928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-20 15:57 - 2013-04-12 00:30 - 01421312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-20 15:57 - 2013-04-12 00:22 - 01838080 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
==================== One Month Modified Files and Folders =======
2013-08-15 18:58 - 2012-11-29 12:41 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-15 18:58 - 2012-08-28 15:12 - 00752930 _____ C:\Windows\system32\perfh007.dat
2013-08-15 18:58 - 2012-08-28 15:12 - 00156156 _____ C:\Windows\system32\perfc007.dat
2013-08-15 18:58 - 2012-07-26 09:28 - 01748838 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-15 18:57 - 2012-11-29 12:41 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-15 18:54 - 2012-11-29 12:05 - 01321165 _____ C:\Windows\WindowsUpdate.log
2013-08-15 18:53 - 2013-08-15 18:53 - 00290648 _____ C:\Windows\Minidump\081513-15609-01.dmp
2013-08-15 18:53 - 2013-08-12 19:07 - 476533879 _____ C:\Windows\MEMORY.DMP
2013-08-15 18:53 - 2013-08-12 19:07 - 00000000 ____D C:\Windows\Minidump
2013-08-15 18:53 - 2012-09-11 14:11 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-15 18:53 - 2012-07-26 09:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-15 16:06 - 2013-02-12 23:00 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-15 16:00 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\system32\sru
2013-08-15 15:52 - 2012-07-26 07:26 - 00524288 ___SH C:\Windows\system32\config\BBI
2013-08-15 15:39 - 2012-11-29 12:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-15 11:53 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\rescache
2013-08-15 11:22 - 2013-08-15 11:22 - 00001151 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-08-15 11:22 - 2013-08-11 12:03 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-15 11:17 - 2013-08-15 11:17 - 22268584 _____ (Mozilla) C:\Users\Sanne\Downloads\Firefox Setup 23.0.exe
2013-08-15 10:31 - 2012-11-29 17:03 - 00000000 ____D C:\Users\Philipp\AppData\Roaming\Skype
2013-08-15 08:01 - 2012-07-26 10:12 - 00000000 ____D C:\Program Files\Windows Defender
2013-08-15 08:01 - 2012-07-26 10:12 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-08-15 07:51 - 2013-05-29 13:15 - 00000000 ____D C:\Users\Philipp\Desktop\Maxi
2013-08-15 07:47 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\AUInstallAgent
2013-08-14 20:50 - 2012-08-28 13:13 - 00165430 _____ C:\Windows\PFRO.log
2013-08-14 20:28 - 2013-08-13 19:56 - 00000000 ____D C:\Users\Sanne\Desktop\reinigung
2013-08-14 19:56 - 2013-08-14 19:56 - 01575570 _____ (Farbar) C:\Users\Sanne\Desktop\FRST64.exe
2013-08-14 19:46 - 2013-08-14 19:46 - 00891115 _____ C:\Users\Sanne\Desktop\SecurityCheck.exe
2013-08-14 19:32 - 2013-07-21 21:04 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 19:29 - 2012-12-12 18:17 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-14 18:16 - 2013-08-14 18:16 - 02347384 _____ (ESET) C:\Users\Sanne\Desktop\esetsmartinstaller_enu.exe
2013-08-13 20:18 - 2013-08-13 20:18 - 00000000 ____D C:\Windows\ERUNT
2013-08-13 20:16 - 2013-08-13 20:16 - 01158722 _____ (Thisisu) C:\Users\Sanne\Desktop\JRT.exe
2013-08-13 20:09 - 2013-08-13 20:09 - 00001639 _____ C:\AdwCleaner[S1].txt
2013-08-13 20:07 - 2013-08-13 20:07 - 00001577 _____ C:\AdwCleaner[R1].txt
2013-08-13 20:04 - 2013-08-13 20:04 - 00666633 _____ C:\Users\Sanne\Desktop\adwcleaner.exe
2013-08-13 19:33 - 2013-03-14 11:32 - 00002498 _____ C:\Windows\Sandboxie.ini
2013-08-13 17:19 - 2013-08-13 17:12 - 00000000 ____D C:\Qoobox
2013-08-13 17:19 - 2012-07-26 07:37 - 00000000 __RHD C:\Users\Default
2013-08-13 17:18 - 2013-08-13 17:18 - 00012685 _____ C:\ComboFix.txt
2013-08-13 17:17 - 2013-08-13 17:11 - 00000000 ____D C:\Windows\erdnt
2013-08-13 17:17 - 2012-07-26 07:26 - 00000215 _____ C:\Windows\system.ini
2013-08-13 17:05 - 2013-08-13 17:05 - 05102975 ____R (Swearware) C:\Users\Sanne\Desktop\ComboFix.exe
2013-08-13 15:49 - 2013-08-13 15:49 - 00000000 ____D C:\FRST
2013-08-13 15:48 - 2013-08-13 15:48 - 00000000 _____ C:\Users\Sanne\defogger_reenable
2013-08-13 15:48 - 2012-12-17 11:30 - 00000000 ____D C:\Users\Sanne
2013-08-13 15:45 - 2013-08-13 15:45 - 00377856 _____ C:\Users\Sanne\Downloads\gmer_2.1.19163.exe
2013-08-13 15:42 - 2013-08-13 15:42 - 00050477 _____ C:\Users\Sanne\Downloads\Defogger.exe
2013-08-13 15:37 - 2013-08-13 15:37 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-13 15:37 - 2012-11-29 12:05 - 00000000 ____D C:\Users\Jürgen
2013-08-13 15:33 - 2013-08-13 15:33 - 01110476 _____ C:\Users\Philipp\Downloads\7z920.exe
2013-08-13 14:46 - 2013-02-20 10:23 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-08-13 11:43 - 2013-06-21 12:36 - 00001322 _____ C:\Users\Sanne\Desktop\Sandboxed Web Browser.lnk
2013-08-12 19:30 - 2013-08-12 19:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-12 19:29 - 2013-01-12 18:35 - 00000000 ____D C:\Users\Sanne\AppData\Roaming\Skype
2013-08-12 19:28 - 2012-11-29 16:14 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-08-12 19:28 - 2012-11-29 16:14 - 00000000 ____D C:\ProgramData\Skype
2013-08-12 19:27 - 2013-08-12 19:27 - 01492848 _____ (Skype Technologies S.A.) C:\Users\Sanne\Downloads\SkypeSetup.exe
2013-08-12 19:08 - 2013-02-20 10:23 - 00001926 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-08-12 19:08 - 2013-02-20 10:23 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-08-12 19:07 - 2013-08-12 19:07 - 00294544 _____ C:\Windows\Minidump\081213-15968-01.dmp
2013-08-12 16:58 - 2012-11-29 12:42 - 00002187 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-07-29 13:33 - 2013-07-29 13:33 - 00001130 _____ C:\Users\Philipp\Desktop\FiestaOnline.lnk
2013-07-29 12:36 - 2013-07-29 12:36 - 03313224 _____ (Softperfect Research ) C:\Users\Sanne\Downloads\networx_setup.exe
2013-07-29 12:36 - 2013-05-03 11:10 - 00000000 ____D C:\Program Files\NetWorx
2013-07-28 12:36 - 2012-12-03 10:00 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-26 07:13 - 2013-08-14 10:25 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-26 07:13 - 2013-08-14 10:25 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-26 07:13 - 2013-08-14 10:25 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2013-07-26 07:13 - 2013-08-14 10:25 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2013-07-26 07:13 - 2013-08-14 10:25 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-26 07:12 - 2013-08-14 10:25 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-26 05:35 - 2013-08-14 10:25 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-26 05:13 - 2013-08-14 10:25 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-26 05:13 - 2013-08-14 10:25 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-26 05:13 - 2013-08-14 10:25 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-26 05:11 - 2013-08-14 10:25 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-26 05:11 - 2013-08-14 10:25 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-26 04:49 - 2013-08-14 10:25 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-26 02:54 - 2013-08-14 10:25 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll
2013-07-25 18:19 - 2012-12-23 16:28 - 00000000 ____D C:\Users\Philipp\Documents\Fiesta
2013-07-21 19:25 - 2013-07-21 19:25 - 00386216 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-20 16:25 - 2013-05-15 10:41 - 00000000 ____D C:\Users\Sanne\AppData\Local\Adobe
2013-07-20 16:24 - 2013-02-12 23:00 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-07-20 16:14 - 2013-02-01 19:23 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-20 16:14 - 2013-02-01 19:23 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-20 16:13 - 2012-07-26 11:45 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-20 16:13 - 2012-07-26 07:38 - 00000000 ____D C:\Windows\system32\oobe
2013-07-20 15:53 - 2012-11-29 12:41 - 00004096 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-20 15:53 - 2012-11-29 12:41 - 00003860 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-20 11:12 - 2013-05-03 11:10 - 00041976 _____ (NetFilterSDK.com) C:\Windows\system32\Drivers\networx.sys
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-13 11:50
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- --- --- --- --- --- --- Addition.txt gabs auch diesmal keine. Kann das Problem mit Sandboxie zusammenhängen? Das war nämlich auch beim allerersten Absturz beteiligt, allerdings ja dann nicht beim schwarzen Bildschirm direkt nach Drücken des Startknopfs... Ich hoffe, Dir fällt noch was dazu ein ansonsten  Viele Grüße SuNi |
|
15.08.2013, 20:08
| #12 |
| /// the machine /// TB-Ausbilder | Windows-8-PC mit Systemabsturz und temporärem Startproblem Deinstallier das mal und installier es neu. Und beobachte. Wenn das nochmal kommt brauch ich das aktuelle Dumpfile aus dem Ordner C:\Windows\Minidump um den Absturz zu analysieren.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
16.08.2013, 08:59
| #13 |
| | Windows-8-PC mit Systemabsturz und temporärem Startproblem Guten Morgen Schrauber Sandboxie ist jetzt deinstalliert. Da mein Sohn es, wie gesagt, sowieso nicht nutzt, wollte ich es auf diesem Rechner eigentlich auch vorerst nicht wieder installieren (sondern dann lieber mit WinPatrol versuchen)...Es sei denn, Du bist der Meinung, es wäre zur Ursachenfindung evtl. sinnvoll. Die Minidumps vom 13.8. und von gestern würde ich dir zwar sehr gerne schicken, allerdings kann ich keine .dmp-Dateien hier einfügen und habe auch keine Ahnung in welchem Programm die geöffnet gehören. Viele Grüße SuNi P:S Der QuickLauncher hat seinen Geist wieder ausgehaucht Geändert von SuNi67 (16.08.2013 um 09:10 Uhr) |
|
16.08.2013, 15:55
| #14 |
| /// the machine /// TB-Ausbilder | Windows-8-PC mit Systemabsturz und temporärem Startproblem Zip es mit 7zip oder Winrar, dann kannste das Dumpfile hochladen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
16.08.2013, 16:31
| #15 |
| | Windows-8-PC mit Systemabsturz und temporärem Startproblem Hallo Schrauber na, dann versuche ich es mal - in dem einen Zip-Ordner sollte das minidump des ersten Absturzes sein und in dem zweiten hoffentlich das vom gestrigen. Allerdings bin ich nicht sicher, da 7zip mir beide Male die Fehler meldung "Zugriff verweigert" angezeigt hat... Von dem Blackscreen mit weißem Mauszeiger direkt nach Anschalten des PCs gab's scheinbar kein dumpfile. Viele Grüße SuNi |
|
| Themen zu Windows-8-PC mit Systemabsturz und temporärem Startproblem |
| adobe, antivirus, avast, bildschirm, booten, browser, defender, diagnostics, error, excel, explorer, farbar, farbar recovery scan tool, flash player, helper, homepage, kein fund, minidump, mozilla, ntdll.dll, problem, programm, prozess, realtek, registry, rundll, secunia psi, security, services.exe, software, srtasks.exe, startbildschirm, starten, svchost.exe |
Linear-Darstellung
