| |
| |||||||
Log-Analyse und Auswertung: Win7: kein Sicherheitscenter nach BKA-TrojanerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
12.11.2013, 17:01
| #1 |
 |  Win7: kein Sicherheitscenter nach BKA-Trojaner Hallo, habe vor ein paar Tagen den PC meines Vaters zur "Wiederherstellung" bekommen. Seine Freundin surft öfters mal auf dubioseren Seiten; dabei wurden dem Rechner sukzessive sämtliche Sicherheitssysteme genommen (Firewall, AV etc). Schließlich fing er sich einen BKA-Trojaner ein (Desktop gesperrt, kein abgesicherter Modus möglich). Mein Weg zur Wiederherstellung verlief bisher wie folgt: ich bootete den Rechner von einer Desinfec't-CD, ließ Avira, BitDefender, Kaspersky und ClamAV laufen und die von ihnen gefunden Trojaner (waren mehrere) beseitigen. Danach startete der Rechner ohne größere Probleme (Fehlermeldung beim Aufruf des Trojaners > mit CCleaner aus Autostart gekickt). Nun bestehen noch ein paar Probleme. Erstens bekomme ich häufiger eine "Server ist ausgelastet"-Meldung, die ich nicht zuordnen kann (Malware oder normales Programm?). Zweitens lassen sich weder das Windows-Sicherheitscenter noch das installierte Avira Internet Security aktivieren. Nach Googlen von "Fehler 1068" landete ich schließlich bei einer Microsoft-Supportseite (hxxp://support.microsoft.com/kb/2519899/de), die ich auch abarbeitete. Ein vollständiger Scan mit MSE (vorübergehend installiert) ergab einen weiteren Trojanerfund (Win32/Reveton.V). Ich vermute, daß ich durch meine Eigenarbeit mehr Schaden als Nutzen produziert habe ... vielleicht gibt es trotzdem noch Rettung für dieses verseuchte Gerät. Eurem Leitfaden für neue Posts folgend ergeben sich folgende Logs: DeFogger lief ohne Fehlermeldung durch. FRST: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-11-2013 01
Ran by **** (administrator) on ****-PC on 12-11-2013 11:30:21
Running from C:\Users\****\Desktop
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Could not list processes ===============
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [TosNC] - C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe [595816 2010-04-23] (TOSHIBA Corporation)
HKLM\...\Run: [TFPUPWDBankService] - C:\Program Files\TOSHIBA\TFPU\TFPUPWDBank.exe [925104 2010-03-02] (TOSHIBA)
HKLM\...\Run: [TFPUService] - C:\Program Files\TOSHIBA\TFPU\TFPUTaskMonitor.exe [793008 2010-03-02] (TOSHIBA)
HKLM\...\Run: [ThpSrv] - C:\Windows\system32\thpsrv /logon
HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe [307768 2010-04-28] ()
HKLM\...\Run: [Toshiba TEMPRO] - C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1050072 2010-10-26] (Toshiba Europe GmbH)
HKLM\...\Run: [Acronis Scheduler2 Service] - C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [140568 2007-08-31] (Acronis)
HKLM\...\Run: [Logitech Download Assistant] - C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKCU\...\Run: [AnyDVD] - C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe [4763256 2010-12-17] (SlySoft, Inc.)
HKCU\...\Run: [SAFE14 Browser Monitor] - C:\Program Files (x86)\Steganos Safe 14\SteganosBrowserMonitor.exe [71168 2012-11-28] (Steganos Software GmbH)
HKCU\...\Run: [My Driver Updater] - C:\Program Files (x86)\Large Software\My Driver Updater\MDULauncher.exe [388240 2012-03-06] (Large Software)
HKCU\...\Run: [Google Update] - C:\Users\****\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-06-07] (Google Inc.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-05] (Intel Corporation)
HKLM-x32\...\Run: [TWebCamera] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe [2454840 2010-05-01] (TOSHIBA CORPORATION.)
HKLM-x32\...\Run: [TrueImageMonitor.exe] - C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [2622232 2007-08-31] (Acronis)
HKLM-x32\...\Run: [AcronisTimounterMonitor] - C:\Program Files (x86)\Acronis\TrueImageHome\TimounterMonitor.exe [907040 2007-08-31] (Acronis)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-04] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SAFE14 HotKeys] - C:\Program Files (x86)\Steganos Safe 14\SteganosHotKeyService.exe [85504 2012-11-28] (Steganos Software GmbH)
HKLM-x32\...\Run: [SAFE14 File Redirection Starter] - C:\Program Files (x86)\Steganos Safe 14\fredirstarter.exe [17408 2012-11-28] (Steganos Software GmbH)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
AppInit_DLLs: C:\PROGRA~3\Wincert\WIN64C~1.DLL c:\progra~2\movies~1\datamngr\x64\mgrldr.dll [97280 2009-07-14] ()
IMEO\bitguard.exe: [Debugger] tasklist.exe
IMEO\bprotect.exe: [Debugger] tasklist.exe
IMEO\browserdefender.exe: [Debugger] tasklist.exe
IMEO\browserprotect.exe: [Debugger] tasklist.exe
Lsa: [Authentication Packages] msv1_0 relog_ap
HKLM\...\AppCertDlls: [x86] -> C:\Program Files (x86)\Movies Toolbar\Datamngr\apcrtldr.dll <===== ATTENTION
HKLM\...\AppCertDlls: [x64] -> C:\Program Files (x86)\Movies Toolbar\Datamngr\x64\apcrtldr.dll <===== ATTENTION
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xC939DB442CA4CB01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
URLSearchHook: HKCU - pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files (x86)\pdfforge Toolbar\IE\7.6\pdfforgeToolbarIE.dll (Spigot, Inc.)
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=707&systemid=406&v=a9301-109&apn_uid=9359343755744811&apn_dtid=BND406&o=APN10645&apn_ptnrs=AG6&q={searchTerms}
SearchScopes: HKLM-x32 - Yandex URL = hxxp://yandex.ru/yandsearch?clid=39942&text={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=707&systemid=406&v=a9301-109&apn_uid=9359343755744811&apn_dtid=BND406&o=APN10645&apn_ptnrs=AG6&q={searchTerms}
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2851647
SearchScopes: HKCU - DefaultScope {0CF2F0EB-651F-4B96-B8C5-A6FC52CE7E83} URL = hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKCU - A55766DDBED142D08744997BABF88302 URL = hxxp://www.google.de/search?q={searchTerms}&rlz=1I7ADRA_deCH483
SearchScopes: HKCU - Moikrug URL = hxxp://moikrug.ru/persons/?clid=39942&charset=utf-8&keywords={searchTerms}&submitted=1
SearchScopes: HKCU - Yandex URL = hxxp://yandex.ru/yandsearch?clid=39942&text={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {621291BE-6E45-4CCF-B87B-8D7CF9BE7869} URL = hxxp://ch.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=302398&p={searchTerms}
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=707&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=9359343755744811&q={searchTerms}
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2851647
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: TFPUPWDBankBHO Class - {030AC7B6-E7EC-40F1-8FB2-C0FD344DE0B9} - C:\Program Files\TOSHIBA\TFPU\x86\TFPUPWDBankBHO.dll (TODO: <Company name>)
BHO-x32: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files (x86)\pdfforge Toolbar\IE\7.6\pdfforgeToolbarIE.dll (Spigot, Inc.)
BHO-x32: GbIehObj Class - {C41A1C0E-EA6C-11D4-B1B8-444553540008} - C:\Program Files (x86)\GbPlugin\gbiehuni.dll (Banco Itaú Unibanco)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - No Name - {91397D20-1446-11D4-8AF4-0040CA1127B6} - No File
Toolbar: HKLM-x32 - No Name - {377e5d4d-77e5-476a-8716-7e70a9272da0} - No File
Toolbar: HKLM-x32 - pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files (x86)\pdfforge Toolbar\IE\7.6\pdfforgeToolbarIE.dll (Spigot, Inc.)
Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks-x32: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399008} - C:\Program Files (x86)\GbPlugin\gbiehuni.dll [1502264 2013-09-25] (Banco Itaú Unibanco)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Windows\SysWOW64\npdeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\****\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\****\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @talk.google.com/O3DPlugin - C:\Users\****\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\****\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\****\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF HKLM\...\Firefox\Extensions: [{C1CA7765-44E4-452e-9D00-A04F3D434281}] -
FF HKLM-x32\...\Firefox\Extensions: [{C1CA7765-44E4-452e-9D00-A04F3D434281}] -
==================== Services (Whitelisted) =================
S2 AntiVirFirewallService; C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [655928 2013-09-04] (Avira Operations GmbH & Co. KG)
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [622648 2013-09-04] (Avira Operations GmbH & Co. KG)
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-04] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-04] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-04] (Avira Operations GmbH & Co. KG)
R2 GbpSv; C:\PROGRA~2\GbPlugin\GbpSv.exe [451640 2013-09-25] (GAS Tecnologia)
R2 mozybackup; C:\Program Files\MozyHome\mozybackup.exe [54672 2012-08-02] (Mozy, Inc.)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
S2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
R2 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [124368 2010-10-26] (Toshiba Europe GmbH)
R2 TryAndDecideService; C:\Program Files (x86)\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe [498872 2007-08-31] ()
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe [2028864 2011-12-13] (TuneUp Software)
S2 Winmgmt; C:\PROGRA~3\fwl1lbo.pzz [x]
==================== Drivers (Whitelisted) ====================
R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [125512 2010-12-01] (SlySoft, Inc.)
R3 AnyDVD; C:\Windows\SysWow64\Drivers\AnyDVD.sys [125512 2010-12-01] (SlySoft, Inc.)
R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [114608 2013-02-18] (Avira GmbH)
R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [141376 2013-02-18] (Avira GmbH)
R1 avfwot; C:\Windows\SysWow64\DRIVERS\avfwot.sys [131336 2011-06-28] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-04-05] (Avira Operations GmbH & Co. KG)
R1 mozyFilter; C:\Windows\System32\DRIVERS\mozy.sys [67368 2012-08-02] (Mozy, Inc.)
R3 O2SDGRDR; C:\Windows\System32\DRIVERS\o2sdgx64.sys [49568 2009-08-18] (O2Micro )
S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R1 SLEE_18_DRIVER; C:\Windows\Sleen1864.sys [108648 2012-07-24] (Softwareentwicklung Remus - ArchiCrypt - )
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys [11856 2010-10-07] (TuneUp Software)
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-12 11:29 - 2013-11-12 11:29 - 01957590 _____ (Farbar) C:\Users\****\Desktop\FRST64.exe
2013-11-12 11:29 - 2013-11-12 11:29 - 00000000 ____D C:\FRST
2013-11-12 11:27 - 2013-11-12 11:28 - 00000470 _____ C:\Users\****\Desktop\defogger_disable.log
2013-11-12 11:27 - 2013-11-12 11:27 - 00000000 _____ C:\Users\****\defogger_reenable
2013-11-12 11:24 - 2013-11-12 11:24 - 00050477 _____ C:\Users\****\Desktop\Defogger.exe
2013-11-11 22:35 - 2013-11-11 22:32 - 00873384 _____ (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll
2013-11-11 22:35 - 2013-11-11 22:32 - 00796072 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-11-11 22:33 - 2013-11-11 22:33 - 00000000 ____D C:\ProgramData\Oracle
2013-11-11 22:32 - 2013-11-11 22:32 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-11-11 20:05 - 2013-11-11 22:30 - 00001912 _____ C:\Windows\epplauncher.mif
2013-11-11 19:22 - 2013-11-12 11:12 - 00000168 _____ C:\Windows\setupact.log
2013-11-11 19:22 - 2013-11-11 19:22 - 00000000 _____ C:\Windows\setuperr.log
2013-11-11 19:00 - 2013-11-11 19:20 - 00002579 _____ C:\Users\****\Desktop\Hkey.reg
2013-11-11 18:37 - 2013-11-11 18:37 - 00000193 _____ C:\Windows\wininit.ini
2013-11-11 18:17 - 2013-11-11 18:37 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-11-11 18:17 - 2013-11-11 18:17 - 00001391 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-11-11 18:17 - 2013-11-11 18:17 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2013-11-11 18:17 - 2009-01-25 13:14 - 00017272 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2013-11-11 18:16 - 2013-11-11 18:17 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-11-11 18:13 - 2013-11-11 18:13 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Macromedia
2013-11-11 18:12 - 2013-11-11 18:12 - 00000000 ____D C:\Users\Temp\AppData\Roaming\TFPU
2013-11-11 18:11 - 2013-11-11 18:12 - 00000000 ____D C:\Users\Temp\AppData\Local\Toshiba
2013-11-11 18:11 - 2013-11-11 18:11 - 00118048 _____ C:\Users\Temp\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-11 18:11 - 2013-11-11 18:11 - 00001433 _____ C:\Users\Temp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ___RD C:\Users\Temp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ___RD C:\Users\Temp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\Documents\Bluetooth
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Steganos
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Intel Corporation
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Avira
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Apple Computer
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Adobe
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Local\VirtualStore
2013-11-11 18:10 - 2013-11-11 18:10 - 00000020 ___SH C:\Users\Temp\ntuser.ini
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Vorlagen
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Startmenü
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Netzwerkumgebung
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Lokale Einstellungen
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Eigene Dateien
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Druckumgebung
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Documents\Eigene Musik
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Documents\Eigene Bilder
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\AppData\Local\Verlauf
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\AppData\Local\Anwendungsdaten
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Anwendungsdaten
2013-11-11 18:10 - 2011-06-19 02:20 - 00000000 ____D C:\Users\Temp\Documents\Visual Studio 2008
2013-11-11 18:10 - 2011-06-19 02:20 - 00000000 ____D C:\Users\Temp\AppData\Local\Microsoft Help
2013-11-11 18:10 - 2009-07-14 05:54 - 00000000 ___RD C:\Users\Temp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-11-11 18:10 - 2009-07-14 05:49 - 00000000 ___RD C:\Users\Temp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-11-11 17:09 - 2013-11-11 17:09 - 00156192 _____ C:\Users\****\Desktop\cc_20131111_170852.reg
2013-11-11 17:02 - 2013-11-11 17:02 - 00002770 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-11-11 17:02 - 2013-11-11 17:02 - 00000834 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-11-11 17:02 - 2013-11-11 17:02 - 00000000 ____D C:\Program Files\CCleaner
2013-11-11 16:12 - 2013-11-11 17:13 - 00000000 ____D C:\Windows\pss
2013-11-11 13:57 - 2013-11-11 13:57 - 00001121 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-11 13:57 - 2013-11-11 13:57 - 00000000 ____D C:\Users\****\AppData\Roaming\Malwarebytes
2013-11-11 13:57 - 2013-11-11 13:57 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-11 13:57 - 2013-11-11 13:57 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-11 13:57 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-10-16 21:13 - 2013-11-10 10:26 - 95025368 ____T C:\ProgramData\fwl1lbo.pff
2013-10-16 21:13 - 2013-11-10 10:26 - 00000000 _____ C:\ProgramData\fwl1lbo.ctrl
2013-10-15 17:31 - 2013-09-23 00:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-10-15 17:31 - 2013-09-23 00:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-10-15 17:31 - 2013-09-22 23:55 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-15 17:31 - 2013-09-22 23:55 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-15 17:31 - 2013-09-22 23:55 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-15 17:31 - 2013-09-22 23:54 - 19252224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-15 17:31 - 2013-09-22 23:54 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-15 17:31 - 2013-09-22 23:54 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-15 17:31 - 2013-09-22 23:54 - 02647552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-15 17:31 - 2013-09-22 23:54 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-15 17:31 - 2013-09-22 23:54 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-15 17:31 - 2013-09-22 23:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-15 17:31 - 2013-09-22 23:54 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-15 17:31 - 2013-09-22 23:54 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-15 17:31 - 2013-09-22 23:54 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-15 17:31 - 2013-09-22 23:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-15 17:31 - 2013-09-21 04:38 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-15 17:31 - 2013-09-21 04:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-10-15 17:31 - 2013-09-21 03:48 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-15 17:31 - 2013-09-21 03:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-10-15 17:03 - 2013-09-14 02:10 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-15 17:03 - 2013-09-08 03:30 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-15 17:03 - 2013-09-08 03:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-15 17:03 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2013-10-15 17:03 - 2013-08-28 02:21 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-15 17:03 - 2013-07-12 11:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-15 17:03 - 2013-07-12 11:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-15 17:03 - 2013-07-12 11:40 - 00109824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys
2013-10-15 17:03 - 2013-07-04 13:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-15 17:03 - 2013-07-04 13:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-15 17:03 - 2013-07-04 13:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-15 17:03 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2013-10-15 17:03 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2013-10-15 17:03 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2013-10-15 17:03 - 2013-07-04 11:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-15 17:03 - 2013-07-03 05:40 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-15 17:03 - 2013-07-03 05:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-15 17:03 - 2013-07-03 05:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-15 17:03 - 2013-06-25 23:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-15 17:03 - 2013-06-06 06:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-15 17:03 - 2013-06-06 06:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-15 17:03 - 2013-06-06 06:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-15 17:03 - 2013-06-06 06:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-15 17:03 - 2013-06-06 05:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2013-10-15 17:03 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2013-10-15 17:03 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2013-10-15 17:03 - 2013-06-06 04:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-15 17:03 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2013-10-15 17:03 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2013-10-15 17:02 - 2013-08-29 03:17 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-15 17:02 - 2013-08-29 03:16 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-15 17:02 - 2013-08-29 03:16 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-15 17:02 - 2013-08-29 03:16 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-10-15 17:02 - 2013-08-29 03:13 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-15 17:02 - 2013-08-29 02:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-10-15 17:02 - 2013-08-29 02:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-10-15 17:02 - 2013-08-29 02:50 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-10-15 17:02 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2013-10-15 17:02 - 2013-08-29 02:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-10-15 17:02 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2013-10-15 17:02 - 2013-08-29 01:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-10-15 17:02 - 2013-08-29 01:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-10-15 17:02 - 2013-08-29 01:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-10-15 17:02 - 2013-08-29 01:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-10-15 17:02 - 2013-08-28 02:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-15 17:02 - 2013-08-01 13:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-15 17:02 - 2013-07-20 11:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-15 17:02 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
==================== One Month Modified Files and Folders =======
2013-11-12 11:29 - 2013-11-12 11:29 - 01957590 _____ (Farbar) C:\Users\****\Desktop\FRST64.exe
2013-11-12 11:29 - 2013-11-12 11:29 - 00000000 ____D C:\FRST
2013-11-12 11:28 - 2013-11-12 11:27 - 00000470 _____ C:\Users\****\Desktop\defogger_disable.log
2013-11-12 11:27 - 2013-11-12 11:27 - 00000000 _____ C:\Users\****\defogger_reenable
2013-11-12 11:27 - 2010-12-17 13:50 - 00000000 ____D C:\Users\****
2013-11-12 11:24 - 2013-11-12 11:24 - 00050477 _____ C:\Users\****\Desktop\Defogger.exe
2013-11-12 11:20 - 2010-12-17 13:50 - 01402820 _____ C:\Windows\WindowsUpdate.log
2013-11-12 11:20 - 2009-07-14 05:45 - 00013440 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-12 11:20 - 2009-07-14 05:45 - 00013440 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-12 11:18 - 2012-05-03 08:45 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-12 11:12 - 2013-11-11 19:22 - 00000168 _____ C:\Windows\setupact.log
2013-11-12 11:12 - 2013-04-20 13:21 - 00031088 _____ (GbPlugin NDIS Device Driver) C:\Windows\SysWOW64\Drivers\gbpndisrd.sys
2013-11-12 11:12 - 2013-04-20 13:21 - 00010266 _____ C:\Windows\SysWOW64\Drivers\ndisrd.cat
2013-11-12 11:12 - 2013-04-20 13:21 - 00001402 _____ C:\Windows\SysWOW64\Drivers\gas.cer
2013-11-12 11:12 - 2013-03-24 10:06 - 00000000 ____D C:\ProgramData\GbPlugin
2013-11-12 11:12 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-11 23:01 - 2011-06-07 11:48 - 00001116 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2200878598-3108500986-400413442-1000UA.job
2013-11-11 22:33 - 2013-11-11 22:33 - 00000000 ____D C:\ProgramData\Oracle
2013-11-11 22:32 - 2013-11-11 22:35 - 00873384 _____ (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll
2013-11-11 22:32 - 2013-11-11 22:35 - 00796072 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-11-11 22:32 - 2013-11-11 22:32 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-11-11 22:32 - 2012-10-27 12:59 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-11-11 22:32 - 2012-10-27 12:59 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-11-11 22:32 - 2012-10-27 12:59 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-11-11 22:32 - 2011-01-17 22:03 - 00000000 ____D C:\Program Files (x86)\Java
2013-11-11 22:30 - 2013-11-11 20:05 - 00001912 _____ C:\Windows\epplauncher.mif
2013-11-11 19:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-11-11 19:22 - 2013-11-11 19:22 - 00000000 _____ C:\Windows\setuperr.log
2013-11-11 19:20 - 2013-11-11 19:00 - 00002579 _____ C:\Users\****\Desktop\Hkey.reg
2013-11-11 18:37 - 2013-11-11 18:37 - 00000193 _____ C:\Windows\wininit.ini
2013-11-11 18:37 - 2013-11-11 18:17 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-11-11 18:17 - 2013-11-11 18:17 - 00001391 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-11-11 18:17 - 2013-11-11 18:17 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2013-11-11 18:17 - 2013-11-11 18:16 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-11-11 18:13 - 2013-11-11 18:13 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Macromedia
2013-11-11 18:12 - 2013-11-11 18:12 - 00000000 ____D C:\Users\Temp\AppData\Roaming\TFPU
2013-11-11 18:12 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Local\Toshiba
2013-11-11 18:11 - 2013-11-11 18:11 - 00118048 _____ C:\Users\Temp\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-11 18:11 - 2013-11-11 18:11 - 00001433 _____ C:\Users\Temp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ___RD C:\Users\Temp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ___RD C:\Users\Temp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\Documents\Bluetooth
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Steganos
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Intel Corporation
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Avira
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Apple Computer
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Adobe
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Local\VirtualStore
2013-11-11 18:10 - 2013-11-11 18:10 - 00000020 ___SH C:\Users\Temp\ntuser.ini
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Vorlagen
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Startmenü
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Netzwerkumgebung
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Lokale Einstellungen
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Eigene Dateien
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Druckumgebung
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Documents\Eigene Musik
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Documents\Eigene Bilder
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\AppData\Local\Verlauf
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\AppData\Local\Anwendungsdaten
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Anwendungsdaten
2013-11-11 17:13 - 2013-11-11 16:12 - 00000000 ____D C:\Windows\pss
2013-11-11 17:09 - 2013-11-11 17:09 - 00156192 _____ C:\Users\****\Desktop\cc_20131111_170852.reg
2013-11-11 17:07 - 2012-10-07 08:40 - 00000000 ____D C:\Windows\Minidump
2013-11-11 17:07 - 2012-09-26 19:50 - 00000000 ____D C:\Users\****\AppData\Roaming\uTorrent
2013-11-11 17:07 - 2010-12-26 14:17 - 00000000 ____D C:\Users\****\AppData\Roaming\Skype
2013-11-11 17:07 - 2010-12-17 13:42 - 00000000 ____D C:\Windows\Panther
2013-11-11 17:02 - 2013-11-11 17:02 - 00002770 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-11-11 17:02 - 2013-11-11 17:02 - 00000834 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-11-11 17:02 - 2013-11-11 17:02 - 00000000 ____D C:\Program Files\CCleaner
2013-11-11 16:47 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-11-11 16:28 - 2012-09-26 19:55 - 00000000 ____D C:\Users\****\AppData\Local\Conduit
2013-11-11 16:19 - 2011-04-17 07:27 - 00000000 ____D C:\Windows\system32\appmgmt
2013-11-11 16:13 - 2012-05-14 08:52 - 00000000 ____D C:\Program Files\Google
2013-11-11 16:13 - 2012-05-14 08:50 - 00000000 ____D C:\Program Files (x86)\Google
2013-11-11 16:12 - 2010-12-17 13:50 - 00000000 ___RD C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-11 16:06 - 2012-05-14 08:50 - 00000000 ____D C:\ProgramData\Google
2013-11-11 16:06 - 2011-04-17 07:23 - 00000000 ____D C:\Users\****\AppData\Local\Google
2013-11-11 16:04 - 2013-09-18 09:36 - 00000000 ____D C:\Program Files (x86)\Movies Toolbar
2013-11-11 16:03 - 2013-03-24 10:06 - 00000000 ____D C:\Program Files (x86)\GbPlugin
2013-11-11 16:02 - 2013-04-09 13:33 - 00000000 ____D C:\ProgramData\Wincert
2013-11-11 16:02 - 2013-04-09 13:32 - 00000000 ____D C:\Program Files (x86)\Search Results Toolbar
2013-11-11 14:26 - 2012-08-02 11:43 - 00003630 _____ C:\Windows\mozy.blk
2013-11-11 14:26 - 2012-08-02 11:43 - 00003498 _____ C:\Windows\mozy.flt
2013-11-11 13:58 - 2010-12-17 16:36 - 00003922 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{3E05B566-424F-4E42-9BD8-AFFA959CC984}
2013-11-11 13:57 - 2013-11-11 13:57 - 00001121 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-11 13:57 - 2013-11-11 13:57 - 00000000 ____D C:\Users\****\AppData\Roaming\Malwarebytes
2013-11-11 13:57 - 2013-11-11 13:57 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-11 13:57 - 2013-11-11 13:57 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-11 01:38 - 2010-12-17 17:14 - 00000000 __SHD C:\ProgramData\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
2013-11-10 10:26 - 2013-10-16 21:13 - 95025368 ____T C:\ProgramData\fwl1lbo.pff
2013-11-10 10:26 - 2013-10-16 21:13 - 00000000 _____ C:\ProgramData\fwl1lbo.ctrl
2013-10-21 12:00 - 2011-06-07 11:48 - 00001064 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2200878598-3108500986-400413442-1000Core.job
2013-10-21 11:56 - 2011-06-07 11:48 - 00004084 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2200878598-3108500986-400413442-1000UA
2013-10-21 11:56 - 2011-06-07 11:48 - 00003688 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2200878598-3108500986-400413442-1000Core
2013-10-16 10:18 - 2012-05-03 08:45 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-10-16 10:18 - 2012-05-03 08:45 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-10-16 10:18 - 2011-05-17 04:13 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-10-16 09:48 - 2009-07-14 18:58 - 00659238 _____ C:\Windows\system32\perfh007.dat
2013-10-16 09:48 - 2009-07-14 18:58 - 00132776 _____ C:\Windows\system32\perfc007.dat
2013-10-16 09:48 - 2009-07-14 06:13 - 01512418 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-16 09:41 - 2009-07-14 05:45 - 00427392 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-16 09:35 - 2013-03-14 14:01 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-16 09:35 - 2013-03-14 14:01 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-10-15 17:34 - 2010-12-17 17:05 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-15 17:26 - 2013-08-31 22:10 - 00000000 ____D C:\Windows\system32\MRT
2013-10-15 17:25 - 2010-12-17 16:21 - 80541720 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
Files to move or delete:
====================
C:\Users\****\AppData\Roaming\skype.ini
C:\ProgramData\fwl1lbo.ctrl
C:\ProgramData\fwl1lbo.pff
C:\Users\****\WinZip155.exe
Some content of TEMP:
====================
C:\Users\****\AppData\Local\Temp\tbuTo0.dll
C:\Users\****\AppData\Local\Temp\UNINSTALL.EXE
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-11-11 19:40
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-11-2013 01 Ran by **** at 2013-11-12 11:31:13 Running from C:\Users\****\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== ==================== Installed Programs ====================== µTorrent (HKCU Version: 3.3.1.30017) Acronis*True*Image*Home (x32 Version: 11.0.8010) Adobe Acrobat 5.0 (x32 Version: 5.0) Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.117) Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117) Adobe Reader X (10.1.8) - Deutsch (x32 Version: 10.1.8) AnyDVD (x32 Version: 6.7.6.0) Apple Application Support (x32 Version: 2.3.6) Apple Mobile Device Support (Version: 7.0.0.117) Apple Software Update (x32 Version: 2.1.3.127) Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 1.0.0.22) ATI Catalyst Install Manager (Version: 3.0.800.0) AuthenTec Fingerprint Software (Version: 8.5.5.6) Avira Internet Security (x32 Version: 13.0.0.4052) Bluetooth Monitor 4 (x32 Version: 4.05.000) Bluetooth Stack for Windows by Toshiba (Version: v8.00.02(T)) Bonjour (Version: 3.0.0.10) CCleaner (Version: 4.07) Cisco EAP-FAST Module (x32 Version: 2.2.14) Cisco LEAP Module (x32 Version: 1.0.19) Cisco PEAP Module (x32 Version: 1.1.6) Conexant HD Audio (Version: 4.126.0.62) Corel Graphics - Windows Shell Extension (x32 Version: 15.0.0.487) Corel Graphics - Windows Shell Extension (x32 Version: 15.0.487) CorelDRAW Graphics Suite X5 - Capture (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - Common (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - Connect (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - Custom Data (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - DE (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - Draw (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - Filters (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - FontNav (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - IPM (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - PHOTO-PAINT (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - Photozoom Plugin (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - Redist (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - Setup Files (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - VBA (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - VideoBrowser (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - VSTA (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - Windows Shell Extension 64 Bit (Version: 15.0.487) CorelDRAW Graphics Suite X5 - WT (x32 Version: 15.0) CorelDRAW Graphics Suite X5 (x32 Version: 15.0) CorelDRAW(R) Graphics Suite X5 (x32 Version: 15.0.0.486) Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32) Driver Genius Professional Edition (x32 Version: 10.0) Google Talk Plugin (x32 Version: 4.7.0.15362) Hotfix für Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947789) (x32 Version: 1) HP Officejet Pro 8500 A910 - Grundlegende Software für das Gerät (Version: 22.0.334.0) HP Officejet Pro 8500 A910 Hilfe (x32 Version: 140.0.2.2) hp print screen utility (x32) HP Update (x32 Version: 5.002.005.003) I.R.I.S. OCR (x32 Version: 12.3.4) Intel(R) Rapid Storage Technology (x32 Version: 10.1.0.1008) iTunes (Version: 11.1.0.126) Java 7 Update 45 (x32 Version: 7.0.450) Java Auto Updater (x32 Version: 2.1.9.8) JNLP (HKCU) Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300) Marketsplash Schnellzugriffe (x32 Version: 1.0.0.9) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft Office 2010 Service Pack 1 (SP1) (x32) Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000) Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Professional 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000) Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Single Image 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Silverlight (Version: 5.1.20913.0) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (Version: 9.0.30729.5570) Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (x32 Version: 9.0.30729.5570) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219) Microsoft Visual Studio Tools for Applications 2.0 - ENU (x32 Version: 9.0.30729) Microsoft Visual Studio Tools for Applications 2.0 Language Pack - DEU (x32 Version: 9.0.30729) Microsoft Visual Studio Tools for Applications 2.0 Runtime (x32 Version: 9.0.30729) Microsoft Visual Studio Tools for Applications 2.0 Runtime Language Pack - DEU (x32 Version: 9.0.30729) MozyHome (Version: 2.16.0.215) MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0) My Driver Updater v3.0 (x32 Version: 3.0) Nero 10 Menu TemplatePack Basic (x32 Version: 10.2.10000.0.0) Nero 10 Movie ThemePack Basic (x32 Version: 10.2.10000.0.0) Nero 12 (x32 Version: 12.0.03500) Nero 12 Content Pack (x32 Version: 12.0.00400) Nero Abstract Themes (x32 Version: 12.0.11500) Nero Audio Pack 1 (x32 Version: 11.0.11500.110.0) Nero BackItUp (x32 Version: 12.5.7000) Nero BackItUp 10 (x32 Version: 5.6.11000.11.100) Nero BackItUp 10 Help (CHM) (x32 Version: 10.5.10000) Nero BackItUp Help (CHM) (x32 Version: 12.0.13000) Nero Blu-ray Player (x32 Version: 12.0.20030) Nero Blu-ray Player Help (CHM) (x32 Version: 12.0.9000) Nero Burning ROM (x32 Version: 12.5.6000) Nero Burning ROM 10 (x32 Version: 10.2.11000.12.100) Nero Burning ROM Help (CHM) (x32 Version: 12.0.3000) Nero BurningROM 10 Help (CHM) (x32 Version: 10.5.10100) Nero BurnRights 10 (x32 Version: 4.2.10300.0.102) Nero BurnRights 10 Help (CHM) (x32 Version: 10.5.10000) Nero Cliparts (x32 Version: 12.0.11500) Nero Control Center 10 (x32 Version: 10.2.10600.0.6) Nero ControlCenter (x32 Version: 11.0.15600) Nero ControlCenter 10 Help (CHM) (x32 Version: 10.5.10000) Nero ControlCenter Help (CHM) (x32 Version: 12.0.12000) Nero Core Components (x32 Version: 11.0.21800) Nero Core Components 10 (x32 Version: 2.0.17400.8.2) Nero CoverDesigner 10 (x32 Version: 5.2.10700.7.100) Nero CoverDesigner 10 Help (CHM) (x32 Version: 10.5.10000) Nero Disc Menus 1 (x32 Version: 12.0.11500) Nero Disc Menus 2 (x32 Version: 12.0.11500) Nero Disc Menus 3 (x32 Version: 12.0.11500) Nero Disc Menus Basic (x32 Version: 12.0.11500) Nero DiscSpeed 10 (x32 Version: 6.2.10300.1.100) Nero DiscSpeed 10 Help (CHM) (x32 Version: 10.5.10000) Nero Effects Basic (x32 Version: 12.0.11500) Nero Express (x32 Version: 12.5.7000) Nero Express 10 (x32 Version: 10.2.11100.12.100) Nero Express 10 Help (CHM) (x32 Version: 10.5.10100) Nero Express Help (CHM) (x32 Version: 12.0.13000) Nero Family and Events Themes (x32 Version: 12.0.11500) Nero Football (Soccer) Themes (x32 Version: 12.0.11500) Nero Holiday and Sports Themes (x32 Version: 12.0.11500) Nero Image Samples (x32 Version: 12.0.11500) Nero InfoTool 10 (x32 Version: 7.2.10300.5.100) Nero InfoTool 10 Help (CHM) (x32 Version: 10.5.10000) Nero Kwik Media (x32 Version: 1.18.20100) Nero Kwik Media Help (CHM) (x32 Version: 12.0.12000) Nero Kwik Themes Basic (x32 Version: 12.0.11500) Nero Multimedia Suite 10 (x32 Version: 10.5.10500) Nero PiP Effects 1 (x32 Version: 12.0.11500) Nero PiP Effects Basic (x32 Version: 12.0.11500) Nero Platinum Effects 12 (x32 Version: 12.0.11500) Nero Recode (x32 Version: 12.5.6000) Nero Recode 10 (x32 Version: 4.8.10400.3.100) Nero Recode 10 Help (CHM) (x32 Version: 10.5.10000) Nero Recode Help (CHM) (x32 Version: 12.0.12000) Nero RescueAgent (x32 Version: 12.0.11000) Nero RescueAgent 10 (x32 Version: 3.2.10600.7.100) Nero RescueAgent 10 Help (CHM) (x32 Version: 10.5.10000) Nero RescueAgent Help (CHM) (x32 Version: 12.0.7000) Nero Retro Film Themes (x32 Version: 12.0.11700) Nero SharedVideoCodecs (x32 Version: 1.0.12100.2.0) Nero SoundTrax 10 (x32 Version: 4.8.10200.1.100) Nero SoundTrax 10 Help (CHM) (x32 Version: 10.5.10000) Nero StartSmart 10 (x32 Version: 10.2.11100.10.100) Nero StartSmart 10 Help (CHM) (x32 Version: 10.5.10000) Nero Update (x32 Version: 11.0.11800.31.0) Nero Video (x32 Version: 12.5.4000) Nero Video Help (CHM) (x32 Version: 12.0.12000) Nero Video Samples (x32 Version: 12.0.11500) Nero Video Transitions 1 (x32 Version: 12.0.11500) Nero Vision 10 (x32 Version: 7.2.14700.9.100) Nero Vision 10 Help (CHM) (x32 Version: 10.5.10000) Nero WaveEditor 10 (x32 Version: 5.8.10400.2.100) Nero WaveEditor 10 Help (CHM) (x32 Version: 10.5.10000) NVIDIA Display Control Panel (Version: 6.14.12.5912) NVIDIA Drivers (Version: 1.10.62.40) NVIDIA PhysX (x32 Version: 9.10.0224) O2Micro Flash Memory Card Windows Driver (Version: 2.0.46) O2Micro Flash Memory Card Windows Driver (x32 Version: 2.0.46) pdfforge Toolbar v7.6 (x32 Version: 7.6) Prerequisite installer (x32 Version: 12.0.0003) QuickTime (x32 Version: 7.74.80.86) Realtek WLAN Driver (x32 Version: 2.00.0006) Skype Click to Call (x32 Version: 6.3.11079) Skype™ 6.7 (x32 Version: 6.7.102) Spybot - Search & Destroy (x32 Version: 2.1.21) Steganos Safe 14 (x32 Version: 14.0.4) Studie zur Verbesserung von HP Officejet Pro 8500 A910 Produkten (Version: 22.0.334.0) TFPU (Version: 1.0.0) ThinkPad Wireless LAN Adapter Software (x32 Version: 1.00.0029.2) TOSHIBA Bulletin Board (Version: 1.6.08.64) TOSHIBA Bulletin Board (x32 Version: 1.6.08.64) TOSHIBA ConfigFree (x32 Version: 8.0.30) TOSHIBA Fingerprint Utility (Version: 1.0.2.29) TOSHIBA HDD Protection (Version: 2.2.0.4) TOSHIBA Supervisor Password (Version: 4.02.01.00) TOSHIBA Supervisor Password (x32 Version: 4.02.01.00) TOSHIBA TEMPRO (x32 Version: 3.34) TOSHIBA Web Camera Application (x32 Version: 1.1.1.16) TuneUp Utilities 2011 (x32 Version: 10.0.4600.4) TuneUp Utilities Language Pack (de-DE) (x32 Version: 10.0.4600.4) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3) Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32) Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2494150) (x32) Update for Microsoft Office 2010 (KB2553065) (x32) Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2566458) (x32) Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32) Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (x32) Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32) Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (x32) Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (x32) Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32) Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32) Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32) Update for Microsoft Word 2010 (KB2827323) 32-Bit Edition (x32) Visual Basic for Applications (R) Core - English (x32 Version: 6.4.99.69) Visual Basic for Applications (R) Core - German (x32 Version: 6.4.99.69) Visual Basic for Applications (R) Core (x32 Version: 6.4.99.69) VLC media player 1.0.1 (x32 Version: 1.0.1) Welcome App (Start-up experience) (x32 Version: 12.0.15000) Windows Live ID Sign-in Assistant (Version: 6.500.3165.0) WinZip 15.5 (x32 Version: 15.5.9580) ==================== Restore Points ========================= Could not list Restore Points. Check WMI. ==================== Hosts content: ========================== 2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {2D91BF06-669E-40A5-A189-8C568B188B08} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {2F2260F8-824C-442A-83AD-A53BA17F2879} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe Task: {3F4A0B98-200E-4DD5-A974-357CC5B9A9D1} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation) Task: {44BE5261-FDC1-441D-95D3-B2E80076984C} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation) Task: {48E2E6C1-00EB-4F4A-887A-FB17EFB423BA} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2011 => C:\Program Files (x86)\TuneUp Utilities 2011\OneClick.exe [2011-12-13] (TuneUp Software) Task: {4A89B471-61E9-47DC-915C-4E7BAEDF247E} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc Task: {6F252F5F-E425-462A-A9F2-14FEFA3BA57C} - System32\Tasks\ConfigFree Startup Programs => C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe [2010-05-06] (TOSHIBA CORPORATION) Task: {79D72E36-43DF-4124-B9BB-BAF81D48FA90} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2200878598-3108500986-400413442-1000Core => C:\Users\****\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-07] (Google Inc.) Task: {7AE077AA-D982-4611-9037-4FADAC8B73F5} - System32\Tasks\HP-Online-Aktualisierungsprogramm => C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [2010-03-12] (Hewlett-Packard) Task: {892A7C19-BBD8-46B9-A909-448B331C8A4F} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe Task: {8D458BD0-289F-4B0B-9123-0A0B985C4B28} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe Task: {9FD95489-814E-4598-94BB-BF2C1BB23F14} - System32\Tasks\Google Updater and Installer => C:\Users\****\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-07] (Google Inc.) Task: {AFAF5612-7138-4A62-A12B-8A87E288D4BD} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2200878598-3108500986-400413442-1000UA => C:\Users\****\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-07] (Google Inc.) Task: {B2825274-0FF2-4011-8963-57A079B8CE1F} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04] (Adobe Systems Incorporated) Task: {BD4C85D8-FEAE-4100-8DF0-1378F1690569} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-16] (Adobe Systems Incorporated) Task: {DA495C4C-96D1-4E95-BA41-326DA7397F90} - System32\Tasks\HPCustParticipation HP Officejet Pro 8500 A910 => C:\Program Files\HP\HP Officejet Pro 8500 A910\Bin\HPCustPartic.exe [2010-06-14] (Hewlett-Packard Co.) Task: {E0548D08-C2C5-4A63-A6B8-68A8864EFA52} - System32\Tasks\{397A41EF-4B83-4C62-86C9-1A6924D92332} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2013-07-25] (Skype Technologies S.A.) Task: {EFE8AB58-9451-44FA-88BD-A2CF49C9443D} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-10-22] (Piriform Ltd) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2200878598-3108500986-400413442-1000Core.job => C:\Users\****\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2200878598-3108500986-400413442-1000UA.job => C:\Users\****\AppData\Local\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= ==================== Alternate Data Streams (whitelisted) ========= AlternateDataStreams: C:\Windows\System32:3E8B0037_Uni.gbp ==================== Safe Mode (whitelisted) =================== ==================== Faulty Device Manager Devices ============= Could not list Devices. Check WMI. ==================== Event log errors: ========================= Application errors: ================== Error: (11/12/2013 11:17:45 AM) (Source: MsiInstaller) (User: ****-PC) Description: Product: pdfforge Toolbar v8.1 -- Error 1714.The older version of pdfforge Toolbar v8.1 cannot be removed. Contact your technical support group. System Error 1612. Error: (11/12/2013 11:12:19 AM) (Source: Avira FireWall) (User: ) Description: Fehler beim Erstellen KDrvLogger::_StartThread Error: (11/12/2013 11:12:19 AM) (Source: Avira FireWall) (User: ) Description: Fehler beim Erstellen AVEvtLog_Init FAILED Versioncheck failed. Error: (11/11/2013 07:54:48 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: loggingserver.exe, Version: 17.0.1.12, Zeitstempel: 0x51d41c91 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000332b0 ID des fehlerhaften Prozesses: 0xbf4 Startzeit der fehlerhaften Anwendung: 0xloggingserver.exe0 Pfad der fehlerhaften Anwendung: loggingserver.exe1 Pfad des fehlerhaften Moduls: loggingserver.exe2 Berichtskennung: loggingserver.exe3 Error: (11/11/2013 07:54:24 PM) (Source: Avira FireWall) (User: ) Description: Fehler beim Erstellen KDrvLogger::_StartThread Error: (11/11/2013 07:54:24 PM) (Source: Avira FireWall) (User: ) Description: Fehler beim Erstellen AVEvtLog_Init FAILED Versioncheck failed. Error: (11/11/2013 07:41:21 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "NFD,type="win32",version="5.2.0.0"1". Fehler in Manifest- oder Richtliniendatei "NFD,type="win32",version="5.2.0.0"2" in Zeile NFD,type="win32",version="5.2.0.0"3. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: NFD,type="win32",version="5.2.0.0". Definition: NFD,type="win32",version="5.0.0.0". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error: (11/11/2013 07:22:42 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: loggingserver.exe, Version: 17.0.1.12, Zeitstempel: 0x51d41c91 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000332b0 ID des fehlerhaften Prozesses: 0xbf0 Startzeit der fehlerhaften Anwendung: 0xloggingserver.exe0 Pfad der fehlerhaften Anwendung: loggingserver.exe1 Pfad des fehlerhaften Moduls: loggingserver.exe2 Berichtskennung: loggingserver.exe3 Error: (11/11/2013 07:22:11 PM) (Source: Avira FireWall) (User: ) Description: Fehler beim Erstellen KDrvLogger::_StartThread Error: (11/11/2013 07:22:11 PM) (Source: Avira FireWall) (User: ) Description: Fehler beim Erstellen AVEvtLog_Init FAILED Versioncheck failed. System errors: ============= Error: (11/12/2013 11:34:43 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: %%126 Error: (11/12/2013 11:34:13 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: %%126 Error: (11/12/2013 11:33:43 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: %%126 Error: (11/12/2013 11:33:13 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: %%126 Error: (11/12/2013 11:32:43 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: %%126 Error: (11/12/2013 11:32:13 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: %%126 Error: (11/12/2013 11:31:43 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: %%126 Error: (11/12/2013 11:31:13 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: %%126 Error: (11/12/2013 11:30:21 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: %%126 Error: (11/12/2013 11:24:01 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: %%126 Microsoft Office Sessions: ========================= Error: (11/12/2013 11:17:45 AM) (Source: MsiInstaller)(User: ****-PC) Description: Product: pdfforge Toolbar v8.1 -- Error 1714.The older version of pdfforge Toolbar v8.1 cannot be removed. Contact your technical support group. System Error 1612.(NULL)(NULL)(NULL)(NULL)(NULL) Error: (11/12/2013 11:12:19 AM) (Source: Avira FireWall)(User: ) Description: Fehler beim Erstellen KDrvLogger::_StartThread Error: (11/12/2013 11:12:19 AM) (Source: Avira FireWall)(User: ) Description: Fehler beim Erstellen AVEvtLog_Init FAILED Versioncheck failed. Error: (11/11/2013 07:54:48 PM) (Source: Application Error)(User: ) Description: loggingserver.exe17.0.1.1251d41c91ntdll.dll6.1.7601.18247521ea8e7c0000005000332b0bf401cedf0f77dc2ce3C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\17.0.12\loggingserver.exeC:\Windows\SysWOW64\ntdll.dllbc656f4d-4b02-11e3-bcb8-60eb6983875b Error: (11/11/2013 07:54:24 PM) (Source: Avira FireWall)(User: ) Description: Fehler beim Erstellen KDrvLogger::_StartThread Error: (11/11/2013 07:54:24 PM) (Source: Avira FireWall)(User: ) Description: Fehler beim Erstellen AVEvtLog_Init FAILED Versioncheck failed. Error: (11/11/2013 07:41:21 PM) (Source: SideBySide)(User: ) Description: NFD,type="win32",version="5.2.0.0"NFD,type="win32",version="5.0.0.0"C:\Program Files (x86)\Nero\Nero 10\Nero SoundTrax\NMDllHost.exe.ManifestC:\Program Files (x86)\Nero\Nero 10\Nero SoundTrax\NFD\NFD.MANIFEST3 Error: (11/11/2013 07:22:42 PM) (Source: Application Error)(User: ) Description: loggingserver.exe17.0.1.1251d41c91ntdll.dll6.1.7601.18247521ea8e7c0000005000332b0bf001cedf0afb32d5e5C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\17.0.12\loggingserver.exeC:\Windows\SysWOW64\ntdll.dll4041655f-4afe-11e3-9588-60eb6983875b Error: (11/11/2013 07:22:11 PM) (Source: Avira FireWall)(User: ) Description: Fehler beim Erstellen KDrvLogger::_StartThread Error: (11/11/2013 07:22:11 PM) (Source: Avira FireWall)(User: ) Description: Fehler beim Erstellen AVEvtLog_Init FAILED Versioncheck failed. ==================== Memory info =========================== Percentage of memory in use: 22% Total physical RAM: 8180.48 MB Available physical RAM: 6354.89 MB Total Pagefile: 16359.14 MB Available Pagefile: 14350.51 MB Total Virtual: 8192 MB Available Virtual: 8191.8 MB ==================== Drives ================================ Drive c: (Systemplatte) (Fixed) (Total:465.76 GB) (Free:300.46 GB) NTFS Drive f: (Datenplatte) (Fixed) (Total:465.66 GB) (Free:293.82 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 21FAF9D0) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=466 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (Size: 466 GB) (Disk ID: 3488D94C) Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS) ==================== End Of Log ============================ Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-11-12 12:11:34
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk1\DR1 -> \Device\Ide\IAAStorageDevice-2 ST950042 rev.0001 465,76GB
Running: 36mjusbb.exe; Driver: C:\Users\****\AppData\Local\Temp\kwldypog.sys
---- User code sections - GMER 2.1 ----
.text C:\PROGRA~2\GbPlugin\GbpSv.exe[1108] C:\Windows\syswow64\kernel32.dll!FreeLibrary 0000000076b73468 5 bytes JMP 0000000174dc844e
.text C:\PROGRA~2\GbPlugin\GbpSv.exe[1108] C:\Windows\syswow64\kernel32.dll!FreeLibraryAndExitThread 0000000076b8d51a 5 bytes JMP 0000000174dc83c6
.text C:\PROGRA~2\GbPlugin\GbpSv.exe[1108] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000076991465 2 bytes [99, 76]
.text C:\PROGRA~2\GbPlugin\GbpSv.exe[1108] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000769914bb 2 bytes [99, 76]
.text ... * 2
.text C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe[2180] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076991465 2 bytes [99, 76]
.text C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe[2180] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000769914bb 2 bytes [99, 76]
.text ... * 2
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2332] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000076991465 2 bytes [99, 76]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2332] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000769914bb 2 bytes [99, 76]
.text ... * 2
.text C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe[3548] C:\Windows\SysWOW64\ksuser.dll!KsCreatePin + 35 00000000731811a8 2 bytes [18, 73]
.text C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe[3548] C:\Windows\SysWOW64\ksuser.dll!KsCreateAllocator + 21 00000000731813a8 2 bytes [18, 73]
.text C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe[3548] C:\Windows\SysWOW64\ksuser.dll!KsCreateClock + 21 0000000073181422 2 bytes [18, 73]
.text C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe[3548] C:\Windows\SysWOW64\ksuser.dll!KsCreateTopologyNode + 19 0000000073181498 2 bytes [18, 73]
.text C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe[3548] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 195 0000000073161b41 2 bytes [16, 73]
.text C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe[3548] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 362 0000000073161be8 2 bytes [16, 73]
.text C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe[3548] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 418 0000000073161c20 2 bytes [16, 73]
.text C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe[3548] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 596 0000000073161cd2 2 bytes [16, 73]
.text C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe[3548] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 628 0000000073161cf2 2 bytes [16, 73]
.text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[1632] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076991465 2 bytes [99, 76]
.text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[1632] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000769914bb 2 bytes [99, 76]
.text ... * 2
.text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[1864] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076991465 2 bytes [99, 76]
.text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[1864] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000769914bb 2 bytes [99, 76]
.text ... * 2
.text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe[4220] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076991465 2 bytes [99, 76]
.text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe[4220] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000769914bb 2 bytes [99, 76]
.text ... * 2
---- Threads - GMER 2.1 ----
Thread C:\Windows\System32\svchost.exe [4580:3240] 000007feeead9688
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\e839df5563ee
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\e839df5563ee (not active ControlSet)
Reg HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@F:\Install\Adobe Reader\x00a09\Setup.exe 1
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk1\DR1 unknown MBR code
---- EOF - GMER 2.1 ----
Vielen lieben Dank schon mal im Voraus, Sho PS. Beim oberflächlichen Durchsehen der Logs stieß ich auf µTorrent - bitte um Entschuldigung, hatte es gar nicht bemerkt. Soll ich es noch deinstallieren? |
| Themen zu Win7: kein Sicherheitscenter nach BKA-Trojaner |
| antivir, ausgelastet, avira, browser, desktop, device driver, excel, failed, farbar, farbar recovery scan tool, fehlermeldung, flash player, google, helper, internet, kaspersky, malware, mozilla, msiinstaller, officejet, pdfforge toolbar, plug-in, programm, refresh, registry, richtlinie, rundll, safer networking, scan, secure search, security, server, software, svchost.exe, system error, vtoolbarupdater, win32/reveton.v, wlan, yandex |
Baum-Darstellung