| |
| |||||||
Log-Analyse und Auswertung: Email- und Ebaykonto missbraucht: TR/Fraud.Gen8 und TR/Crypt.TPM.Gen beim Virenscan gefundenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
09.01.2014, 01:36
| #1 |
| |  Email- und Ebaykonto missbraucht: TR/Fraud.Gen8 und TR/Crypt.TPM.Gen beim Virenscan gefunden Hallo Trojaner-Board, ich benötige bitte Eure Hilfe. Ich habe vor einigen Tagen durch Zufall mitbekommen, dass mein Email- und mein Ebaykonto missbraucht wurden. Es war naheliegend, dass die Täter durch eine Schadsoftware an meine Zugangsdaten gekommen sind. Der Virenscan hat folgende Trojaner gefunden: TR/Fraud.Gen8 und TR/Crypt.TPM.Gen. Das Virenprogramm hat diese gelöscht. Da ich mir nicht sicher bin, ob der Rechner jetzt tatsächlich wieder sicher und virenfrei ist, habe ich Eure Anleitung befolgt und folgende Scans durchgeführt: FRST.txt Addition.txt Gmer.zip defogger_disable.txt. Des Weiteren habe ich den Log mit den Funden von Avira angehangen. Der Scan mit Malwarebytes' Anti Malware ergab keine Funde. defogger_disable.txt: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 23:58 on 08/01/2014 (*********)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-01-2014 01
Ran by ********* (administrator) on ANGI on 09-01-2014 00:02:10
Running from C:\Users\*********\Desktop
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Broadcom Corp.) C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Dritek System INC.) C:\Windows\RfBtnSvc64.exe
(Atheros) C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe
(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
(Qualcomm Atheros) C:\Program Files (x86)\Bluetooth Suite\BtTray.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\PmmUpdate.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe
() C:\Users\*********\Desktop\Defogger.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1212048 2012-06-07] (Realtek Semiconductor)
HKLM\...\Run: [BtPreLoad] - C:\Program Files (x86)\Bluetooth Suite\BtPreLoad.exe [64640 2012-08-10] ()
HKLM-x32\...\Run: [Dolby Home Theater v4] - C:\Dolby PCEE4\pcee4.exe [508256 2012-04-23] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [LManager] - [x]
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2014-01-06] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\Default\...\RunOnce: [RegAutoPlay] - C:\Program Files (x86)\Acer\clear.fi Media\RegAutoplay.exe [1845392 2012-08-21] (Acer Incorporated)
HKU\Default User\...\RunOnce: [RegAutoPlay] - C:\Program Files (x86)\Acer\clear.fi Media\RegAutoplay.exe [1845392 2012-08-21] (Acer Incorporated)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll [247144 2012-10-08] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [202600 2012-10-08] (NVIDIA Corporation)
Startup: C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\*********\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com
SearchScopes: HKLM - DefaultScope {E47707ED-8001-41BE-95A3-ECF1C7E956E6} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKLM - {E47707ED-8001-41BE-95A3-ECF1C7E956E6} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKLM-x32 - {E47707ED-8001-41BE-95A3-ECF1C7E956E6} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKCU - {E47707ED-8001-41BE-95A3-ECF1C7E956E6} URL =
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\office15\URLREDIR.DLL (Microsoft Corporation)
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Ghostery - C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\Extensions\firefox@ghostery.com.xpi
FF Extension: NoScript - C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: Adblock Plus - C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: BetterPrivacy - C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2014-01-06] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-27] (Avira Operations GmbH & Co. KG)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [211584 2012-08-10] (Qualcomm Atheros Commnucations)
R2 BrcmCardReader; C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe [176640 2012-08-20] (Broadcom Corp.)
R2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2435728 2012-08-23] (Acer Incorporated)
S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [468624 2012-08-23] (Acer Incorporated)
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [658576 2012-08-22] (Acer Incorporated)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [28560 2012-08-30] (ELAN Microelectronics Corp.)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [259136 2012-08-23] (NTI Corporation)
R2 OfficeSvc; C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [1907896 2013-11-02] (Microsoft Corporation)
R2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2012-10-11] (Dritek System INC.)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)
R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe [81536 2012-07-31] (Atheros)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2014-01-06] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2014-01-06] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-11-27] (Avira Operations GmbH & Co. KG)
S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation)
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-08-10] (Qualcomm Atheros)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2012-10-11] (Dritek System Inc.)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-09 00:02 - 2014-01-09 00:02 - 00013052 _____ C:\Users\*********\Desktop\FRST.txt
2014-01-09 00:01 - 2014-01-09 00:01 - 00000000 ____D C:\FRST
2014-01-08 23:59 - 2014-01-08 23:59 - 01931770 _____ (Farbar) C:\Users\*********\Desktop\FRST64.exe
2014-01-08 23:58 - 2014-01-08 23:58 - 00000480 _____ C:\Users\*********\Desktop\defogger_disable.log
2014-01-08 23:58 - 2014-01-08 23:58 - 00000000 _____ C:\Users\*********\defogger_reenable
2014-01-08 23:53 - 2014-01-08 23:53 - 00050477 _____ C:\Users\*********\Desktop\Defogger.exe
2014-01-08 23:39 - 2014-01-08 23:39 - 00449112 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-08 23:36 - 2014-01-08 23:37 - 00000000 ____D C:\AdwCleaner
2014-01-08 23:35 - 2014-01-08 23:35 - 01233962 _____ C:\Users\*********\Desktop\adwcleaner.exe
2014-01-08 21:48 - 2014-01-08 21:48 - 00000000 ____D C:\Windows\de
2014-01-08 21:47 - 2014-01-08 21:47 - 00000000 ____D C:\Windows\PCHEALTH
2014-01-08 21:47 - 2014-01-08 21:47 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2014-01-08 21:46 - 2014-01-08 21:47 - 00000000 ____D C:\Program Files (x86)\Windows Live
2014-01-08 21:46 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2014-01-08 21:46 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2014-01-08 21:46 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2014-01-08 21:46 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2014-01-08 21:46 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2014-01-08 21:46 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2014-01-08 21:46 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2014-01-08 21:46 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2014-01-08 21:46 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2014-01-08 21:46 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll
2014-01-08 21:45 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll
2014-01-08 21:45 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll
2014-01-08 21:42 - 2014-01-08 21:42 - 00000000 ____D C:\Users\*********\AppData\Local\Windows Live
2014-01-08 21:40 - 2014-01-08 21:41 - 142602520 _____ (Microsoft Corporation) C:\Users\*********\Downloads\wlsetup-all_16.4.3508.0205.exe
2014-01-08 21:34 - 2014-01-08 21:34 - 00000000 ____D C:\ProgramData\NTIRegEt
2014-01-08 20:25 - 2014-01-08 20:25 - 00010639 _____ C:\Users\*********\Downloads\hijackthis.log
2014-01-08 20:24 - 2014-01-08 20:24 - 00388608 _____ (Trend Micro Inc.) C:\Users\*********\Downloads\HiJackThis204.exe
2014-01-08 20:15 - 2014-01-08 20:15 - 00052634 _____ C:\Users\*********\Documents\cc_20140108_201532.reg
2014-01-08 18:00 - 2014-01-08 18:00 - 00000000 ____D C:\Users\*********\AppData\Roaming\Malwarebytes
2014-01-08 17:59 - 2014-01-08 17:59 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-08 17:47 - 2014-01-08 17:47 - 00001039 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-01-08 17:42 - 2014-01-08 23:43 - 00000000 ____D C:\Program Files (x86)\FileHippo.com
2014-01-08 17:30 - 2014-01-08 17:30 - 00000000 ____D C:\Users\*********\AppData\Local\Secunia PSI
2014-01-08 17:30 - 2014-01-08 17:30 - 00000000 ____D C:\Program Files (x86)\Secunia
2014-01-06 18:43 - 2014-01-06 18:46 - 00000000 ____D C:\Users\*********\Desktop\Best_of_Wt_komplett
2014-01-06 16:58 - 2014-01-06 16:58 - 00002176 _____ C:\Users\Public\Desktop\Google Earth.lnk
==================== One Month Modified Files and Folders =======
2014-01-09 00:02 - 2014-01-09 00:02 - 00013052 _____ C:\Users\*********\Desktop\FRST.txt
2014-01-09 00:01 - 2014-01-09 00:01 - 00000000 ____D C:\FRST
2014-01-09 00:00 - 2013-06-23 00:28 - 00003594 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-627669732-214247668-4251278340-1002
2014-01-09 00:00 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\sru
2014-01-08 23:59 - 2014-01-08 23:59 - 01931770 _____ (Farbar) C:\Users\*********\Desktop\FRST64.exe
2014-01-08 23:58 - 2014-01-08 23:58 - 00000480 _____ C:\Users\*********\Desktop\defogger_disable.log
2014-01-08 23:58 - 2014-01-08 23:58 - 00000000 _____ C:\Users\*********\defogger_reenable
2014-01-08 23:58 - 2013-06-23 00:21 - 00000000 ____D C:\Users\*********
2014-01-08 23:56 - 2013-08-13 20:50 - 00000000 ____D C:\Program Files\Microsoft Office 15
2014-01-08 23:53 - 2014-01-08 23:53 - 00050477 _____ C:\Users\*********\Desktop\Defogger.exe
2014-01-08 23:43 - 2014-01-08 17:42 - 00000000 ____D C:\Program Files (x86)\FileHippo.com
2014-01-08 23:40 - 2013-08-30 20:49 - 00001122 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-08 23:39 - 2014-01-08 23:39 - 00449112 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-08 23:39 - 2013-06-28 18:35 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2014-01-08 23:39 - 2012-07-26 08:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-08 23:38 - 2013-06-23 00:21 - 01869891 _____ C:\Windows\WindowsUpdate.log
2014-01-08 23:38 - 2012-07-26 06:26 - 00262144 ___SH C:\Windows\system32\config\BBI
2014-01-08 23:37 - 2014-01-08 23:36 - 00000000 ____D C:\AdwCleaner
2014-01-08 23:35 - 2014-01-08 23:35 - 01233962 _____ C:\Users\*********\Desktop\adwcleaner.exe
2014-01-08 23:31 - 2013-11-30 17:12 - 00000000 ____D C:\ProgramData\Skype
2014-01-08 23:27 - 2013-09-22 10:48 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-08 23:04 - 2013-08-30 20:49 - 00001126 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-08 21:48 - 2014-01-08 21:48 - 00000000 ____D C:\Windows\de
2014-01-08 21:47 - 2014-01-08 21:47 - 00000000 ____D C:\Windows\PCHEALTH
2014-01-08 21:47 - 2014-01-08 21:47 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2014-01-08 21:47 - 2014-01-08 21:46 - 00000000 ____D C:\Program Files (x86)\Windows Live
2014-01-08 21:47 - 2012-07-26 09:12 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2014-01-08 21:42 - 2014-01-08 21:42 - 00000000 ____D C:\Users\*********\AppData\Local\Windows Live
2014-01-08 21:41 - 2014-01-08 21:40 - 142602520 _____ (Microsoft Corporation) C:\Users\*********\Downloads\wlsetup-all_16.4.3508.0205.exe
2014-01-08 21:37 - 2012-10-11 17:27 - 00001024 ___RH C:\Users\Public\Documents\NTIMMV9REGET.dll
2014-01-08 21:34 - 2014-01-08 21:34 - 00000000 ____D C:\ProgramData\NTIRegEt
2014-01-08 21:34 - 2012-10-11 17:28 - 00001024 ___RH C:\Users\Public\Documents\NTILiveUpdateV9.dll
2014-01-08 21:34 - 2012-10-11 17:27 - 00001024 ___RH C:\Users\Public\Documents\NTIMMV9Acer.dll
2014-01-08 21:33 - 2012-10-11 17:28 - 00000000 ____D C:\ProgramData\NTI Launcher
2014-01-08 20:25 - 2014-01-08 20:25 - 00010639 _____ C:\Users\*********\Downloads\hijackthis.log
2014-01-08 20:24 - 2014-01-08 20:24 - 00388608 _____ (Trend Micro Inc.) C:\Users\*********\Downloads\HiJackThis204.exe
2014-01-08 20:24 - 2013-06-23 00:21 - 00000000 ____D C:\Users\*********\AppData\Local\VirtualStore
2014-01-08 20:15 - 2014-01-08 20:15 - 00052634 _____ C:\Users\*********\Documents\cc_20140108_201532.reg
2014-01-08 18:00 - 2014-01-08 18:00 - 00000000 ____D C:\Users\*********\AppData\Roaming\Malwarebytes
2014-01-08 17:59 - 2014-01-08 17:59 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-08 17:47 - 2014-01-08 17:47 - 00001039 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-01-08 17:47 - 2013-12-01 11:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2014-01-08 17:41 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\AUInstallAgent
2014-01-08 17:36 - 2013-10-31 16:01 - 00000000 ____D C:\Users\*********\AppData\Local\CrashDumps
2014-01-08 17:36 - 2012-09-03 12:56 - 00000000 ____D C:\Windows\Panther
2014-01-08 17:30 - 2014-01-08 17:30 - 00000000 ____D C:\Users\*********\AppData\Local\Secunia PSI
2014-01-08 17:30 - 2014-01-08 17:30 - 00000000 ____D C:\Program Files (x86)\Secunia
2014-01-06 18:57 - 2013-06-22 19:01 - 00000000 ____D C:\Users\*********\AppData\Roaming\vlc
2014-01-06 18:46 - 2014-01-06 18:43 - 00000000 ____D C:\Users\*********\Desktop\Best_of_Wt_komplett
2014-01-06 18:42 - 2012-10-12 02:44 - 00753134 _____ C:\Windows\system32\perfh007.dat
2014-01-06 18:42 - 2012-10-12 02:44 - 00155826 _____ C:\Windows\system32\perfc007.dat
2014-01-06 18:42 - 2012-07-26 08:28 - 01745416 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-06 17:27 - 2013-09-22 10:48 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-01-06 16:58 - 2014-01-06 16:58 - 00002176 _____ C:\Users\Public\Desktop\Google Earth.lnk
2014-01-06 16:58 - 2013-08-30 20:49 - 00000000 ____D C:\Program Files (x86)\Google
2014-01-06 16:58 - 2013-06-23 20:19 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-01-06 16:58 - 2013-06-23 20:14 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-01-06 16:58 - 2013-06-23 20:14 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-01-06 16:55 - 2013-08-05 18:13 - 00000000 ___RD C:\Users\*********\Dropbox
2014-01-06 16:55 - 2013-08-05 18:10 - 00000000 ____D C:\Users\*********\AppData\Roaming\Dropbox
Some content of TEMP:
====================
C:\Users\*********\AppData\Local\Temp\avgnt.exe
C:\Users\*********\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-06 22:55
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-01-2014 01
Ran by ********* at 2014-01-09 00:02:39
Running from C:\Users\*********\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
clear.fi SDK - Video 2 (x32 Version: 2.1.1925 - CyberLink Corp.) Hidden
clear.fi SDK- Movie 2 (x32 Version: 2.1.2008 - CyberLink Corp.) Hidden
Acer Backup Manager (x32 Version: 4.0.0.0059 - NTI Corporation)
Acer Device Fast-lane (Version: 1.00.3007 - Acer Incorporated)
Acer Instant Update Service (Version: 1.00.3013 - Acer Incorporated)
Acer Power Management (Version: 7.00.3006 - Acer Incorporated)
Acer Recovery Management (Version: 6.00.3011 - Acer Incorporated)
AcerCloud (x32 Version: 2.01.3115 - Acer Incorporated)
AcerCloud Docs (x32 Version: 1.00.3201 - Acer Incorporated)
Adobe AIR (x32 Version: 3.7.0.2090 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.7.0.2090 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Avira Free Antivirus (x32 Version: 14.0.2.286 - Avira)
Backup Manager v4 (x32 Version: 4.0.0.0059 - NTI Corporation) Hidden
Broadcom Card Reader Driver Installer (Version: 15.4.7.1 - Broadcom Corporation)
clear.fi Media (x32 Version: 2.01.3108 - Acer Incorporated)
clear.fi Photo (x32 Version: 2.01.3108 - Acer Incorporated)
CyberLink MediaEspresso 6.5 (x32 Version: 6.5.3103_44819 - CyberLink Corp.)
CyberLink MediaEspresso 6.5 (x32 Version: 6.5.3103_44819 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
dm-Fotowelt (x32 Version: 5.0.4 - CEWE COLOR AG u Co. OHG)
Dolby Home Theater v4 (x32 Version: 7.2.8000.13 - Dolby Laboratories Inc)
Dropbox (HKCU Version: 2.2.13 - Dropbox, Inc.)
ETDWare PS/2-X64 11.6.8.001_WHQL (Version: 11.6.8.001 - ELAN Microelectronic Corp.)
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
GIMP 2.8.6 (Version: 2.8.6 - The GIMP Team)
Google Earth (x32 Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Identity Card (x32 Version: 2.00.3004 - Acer Incorporated)
Intel(R) Management Engine Components (x32 Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (x32 Version: 9.17.10.2828 - Intel Corporation)
Intel(R) Rapid Storage Technology (x32 Version: 11.5.0.1207 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (x32 Version: 2.0.0.37149 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden
Launch Manager (x32 Version: 7.0.5 - Acer Inc.)
Live Updater (x32 Version: 2.00.3004 - Acer Incorporated)
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 365 Home Premium - de-de (Version: 15.0.4551.1011 - Microsoft Corporation)
Microsoft SkyDrive (HKCU Version: 17.0.2003.1112 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2005 Tools for Office Runtime (x32 Version: 8.0.60940.0 - Microsoft Corporation) Hidden
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
Mozilla Thunderbird 24.1.1 (x86 de) (x32 Version: 24.1.1 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MyWinLocker (Version: 4.0.14.35 - Egis Technology Inc.) Hidden
MyWinLocker 4 (x32 Version: 4.0.14.35 - Egis Technology Inc.) Hidden
MyWinLocker Suite (x32 Version: 4.0.14.24 - Egis Technology Inc.)
MyWinLocker Suite (x32 Version: 4.0.14.24 - Egis Technology Inc.) Hidden
NTI Media Maker 9 (x32 Version: 9.0.2.9008 - NTI Corporation)
NTI Media Maker 9 (x32 Version: 9.0.2.9008 - NTI Corporation) Hidden
NVIDIA Grafiktreiber 306.97 (Version: 306.97 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.85.551 - NVIDIA Corporation) Hidden
NVIDIA Optimus 1.10.8 (Version: 1.10.8 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.12.0613 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.12.0613 (Version: 9.12.0613 - NVIDIA Corporation)
NVIDIA Systemsteuerung 306.97 (Version: 306.97 - NVIDIA Corporation) Hidden
NVIDIA Update 1.10.8 (Version: 1.10.8 - NVIDIA Corporation)
NVIDIA Update Components (Version: 1.10.8 - NVIDIA Corporation) Hidden
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4551.1011 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4551.1011 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4551.1011 - Microsoft Corporation) Hidden
Office Addin (x32 Version: 2.01.3200 - Acer)
OpenOffice.org 3.4.1 (x32 Version: 3.41.9593 - Apache Software Foundation)
Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Qualcomm Atheros Bluetooth Suite (64) (Version: 8.0.0.206 - Ihr Firmenname)
Qualcomm Atheros WiFi Driver Installation (x32 Version: 11.05 - Qualcomm Atheros)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6657 - Realtek Semiconductor Corp.)
Saal Design Software (x32 Version: 3.1.26 - SSW Software GmbH)
Saal Design Software (x32 Version: 3.1.26 - SSW Software GmbH) Hidden
Shared C Run-time for x64 (Version: 10.0.0 - McAfee)
Shredder (Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Shredder (x32 Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Spotify (x32 Version: 0.8.4.99.ga249b5f1 - Spotify AB)
Visual Studio 2005 Tools for Office Second Edition Runtime (x32 Version: - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime (x32 Version: - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Visual Studio Tools for the Office system 3.0 Runtime Service Pack 1 (KB949258) (x32 Version: 1 - Microsoft Corporation)
VLC media player 2.0.7 (x32 Version: 2.0.7 - VideoLAN)
Windows Live Communications Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 16.4.3508.0205 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
==================== Restore Points =========================
30-11-2013 16:20:51 Geplanter Prüfpunkt
06-01-2014 22:31:32 Geplanter Prüfpunkt
08-01-2014 20:42:35 Windows Live Essentials
08-01-2014 20:44:59 DirectX wurde installiert
==================== Hosts content: ==========================
2012-07-26 06:26 - 2012-07-26 06:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {1C5FFE65-693F-4FF6-B38B-7BB11A6BE63E} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-01-06] (Microsoft Corporation)
Task: {1F069D73-D2DA-4AAF-A370-6B1C036D7A3D} - System32\Tasks\EgisUpdate => C:\Program Files\EgisTec IPS\EgisUpdate.exe [2012-07-12] (Egis Technology Inc.)
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {356FB18C-819E-4EDA-A16B-7FDC6D1C607F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-08-30] (Google Inc.)
Task: {3B04812C-632E-440A-9B5B-B3AEF5B353AF} - System32\Tasks\iuEmailOutlookAgent => C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe [2012-08-22] ()
Task: {93FBD9F6-5C1F-4B2F-840C-7D2248B7EAF7} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTray.exe [2012-08-22] (Acer Incorporated)
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {AC55B1E4-5529-46F4-A4BB-ED179CA6C012} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [2013-11-02] (Microsoft Corporation)
Task: {B7FF15ED-EA7E-4BD3-861B-A8B8547E91C3} - System32\Tasks\DeviceDetector => C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe [2012-07-04] (CyberLink)
Task: {C29914B2-FB69-4A6D-ADCA-C1C36A633DD5} - System32\Tasks\ALU => C:\Program Files (x86)\Acer\Live Updater\updater.exe [2012-08-30] ()
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {CEDAB060-F54A-42B8-BFD4-65CDCA82D8CE} - System32\Tasks\PMMUpdate => C:\Program Files\EgisTec IPS\PmmUpdate.exe [2012-07-12] (Egis Technology Inc.)
Task: {D006E8A2-BFD0-4652-AB90-5D00FE4B91F3} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-08-30] (Google Inc.)
Task: {E1B232EC-44E8-4A4C-974B-D2ECB59CF591} - System32\Tasks\iuBrowserIEAgent => C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe [2012-08-22] ()
Task: {E3A2E92C-8A5E-469E-83FB-DFCC1F111F33} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Acer\Live Updater\liveupdater_agent.exe [2012-06-22] ()
Task: {E93B81FF-7E59-4CB3-85D0-CB8E5CF6B286} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-01-06] (Adobe Systems Incorporated)
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2012-06-22 02:12 - 2012-06-22 02:12 - 01407568 _____ () C:\Program Files (x86)\EgisTec MyWinLocker\x64\LIBEAY32.dll
2012-09-03 12:50 - 2012-08-08 16:48 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2012-08-10 17:28 - 2012-08-10 17:28 - 00384128 _____ () C:\Program Files (x86)\Bluetooth Suite\ContactsApi.dll
2012-08-10 17:23 - 2012-08-10 17:23 - 00020992 _____ () C:\Program Files (x86)\Bluetooth Suite\L10n\de-DE\BtTray.de-DE.dll
2013-06-23 20:14 - 2013-01-25 09:25 - 00397704 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2012-08-23 07:26 - 2012-08-23 07:26 - 00465384 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\sqlite3.dll
2012-08-23 07:25 - 2012-08-23 07:25 - 00125504 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\MailConverter32.dll
2012-08-23 07:26 - 2012-08-23 07:26 - 00155712 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\VolumeSnapshot.dll
2012-08-23 07:25 - 2012-08-23 07:25 - 00118336 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\Online.dll
2012-08-23 07:25 - 2012-08-23 07:25 - 01081408 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\ACE.dll
2012-08-23 07:25 - 2012-08-23 07:25 - 00052288 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\OsSettingPort.dll
2012-08-23 07:26 - 2012-08-23 07:26 - 00727616 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\OutlookShadow.dll
2012-10-11 17:06 - 2012-06-25 18:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2013-12-01 11:25 - 2013-12-05 20:36 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
Name: Bluetooth USB Module
Description: Bluetooth USB Module
Class Guid: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}
Manufacturer: Qualcomm Atheros Communications
Service: BTHUSB
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (01/08/2014 11:57:25 PM) (Source: Application Hang) (User: )
Description: Programm soffice.bin, Version 3.4.9593.500 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 718
Startzeit: 01cf0cc4be9b5ae5
Endzeit: 0
Anwendungspfad: C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
Berichts-ID: 38bb39a2-78b8-11e3-bea3-b888e3a652b8
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (01/08/2014 11:39:48 PM) (Source: ETDService) (User: )
Description: ETDServiceCreateInteractiveProcess failed w/err 0x000003f0
Error: (01/08/2014 09:45:39 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddWin32ServiceFiles: Unable to back up image of service McAfee SiteAdvisor Service since QueryServiceConfig API failed
System Error:
Das System kann die angegebene Datei nicht finden.
.
Error: (01/08/2014 09:43:58 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddWin32ServiceFiles: Unable to back up image of service McAfee SiteAdvisor Service since QueryServiceConfig API failed
System Error:
Das System kann die angegebene Datei nicht finden.
.
Error: (01/08/2014 08:37:40 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.
Error: (01/08/2014 07:53:06 PM) (Source: Office 2013 Licensing Service) (User: )
Description: Subscription licensing service failed: -1073415161
Error: (01/08/2014 06:55:36 PM) (Source: Application Hang) (User: )
Description: Programm iuEmailOutlookAgent.exe, Version 1.0.3013.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 11c8
Startzeit: 01cf0af7ecb5c314
Endzeit: 188
Anwendungspfad: C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe
Berichts-ID: f4d64800-788d-11e3-bea2-b888e3a652b8
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (01/08/2014 05:21:05 PM) (Source: Office 2013 Licensing Service) (User: )
Description: Subscription licensing service failed: -1073415161
Error: (01/06/2014 10:21:31 PM) (Source: Office 2013 Licensing Service) (User: )
Description: Subscription licensing service failed: -1073415161
Error: (01/06/2014 04:52:44 PM) (Source: ETDService) (User: )
Description: ETDServiceCreateInteractiveProcess failed w/err 0x000003f0
System errors:
=============
Error: (01/06/2014 04:52:44 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (12/06/2013 00:24:59 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (12/06/2013 10:10:22 AM) (Source: DCOM) (User: Angi)
Description: App.wwa
Error: (12/06/2013 10:08:17 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (12/02/2013 08:53:27 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (12/01/2013 11:24:34 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst defragsvc erreicht.
Error: (11/30/2013 04:41:52 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (11/30/2013 00:11:30 AM) (Source: Tcpip) (User: )
Description: Das System hat einen Adressenkonflikt der IP-Adresse 192.168.0.101 mit dem Computer mit der
Netzwerkhardwareadresse 88-30-8A-7D-B1-43 ermittelt. Netzwerkvorgänge könnten daher auf diesem
System unterbrochen werden.
Error: (11/29/2013 09:06:10 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (11/29/2013 07:19:39 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Microsoft Office Sessions:
=========================
Error: (01/08/2014 11:57:25 PM) (Source: Application Hang)(User: )
Description: soffice.bin3.4.9593.50071801cf0cc4be9b5ae50C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin38bb39a2-78b8-11e3-bea3-b888e3a652b8
Error: (01/08/2014 11:39:48 PM) (Source: ETDService)(User: )
Description: ETDServiceCreateInteractiveProcess failed w/err 0x000003f0
Error: (01/08/2014 09:45:39 PM) (Source: Microsoft-Windows-CAPI2)(User: )
Description:
Details:
AddWin32ServiceFiles: Unable to back up image of service McAfee SiteAdvisor Service since QueryServiceConfig API failed
System Error:
Das System kann die angegebene Datei nicht finden.
Error: (01/08/2014 09:43:58 PM) (Source: Microsoft-Windows-CAPI2)(User: )
Description:
Details:
AddWin32ServiceFiles: Unable to back up image of service McAfee SiteAdvisor Service since QueryServiceConfig API failed
System Error:
Das System kann die angegebene Datei nicht finden.
Error: (01/08/2014 08:37:40 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\*********\AppData\Local\Temp\IDC2.tmp\ESETSmartInstaller.exe
Error: (01/08/2014 07:53:06 PM) (Source: Office 2013 Licensing Service)(User: )
Description: Subscription licensing service failed: -1073415161
Error: (01/08/2014 06:55:36 PM) (Source: Application Hang)(User: )
Description: iuEmailOutlookAgent.exe1.0.3013.011c801cf0af7ecb5c314188C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exef4d64800-788d-11e3-bea2-b888e3a652b8
Error: (01/08/2014 05:21:05 PM) (Source: Office 2013 Licensing Service)(User: )
Description: Subscription licensing service failed: -1073415161
Error: (01/06/2014 10:21:31 PM) (Source: Office 2013 Licensing Service)(User: )
Description: Subscription licensing service failed: -1073415161
Error: (01/06/2014 04:52:44 PM) (Source: ETDService)(User: )
Description: ETDServiceCreateInteractiveProcess failed w/err 0x000003f0
==================== Memory info ===========================
Percentage of memory in use: 23%
Total physical RAM: 8007.27 MB
Available physical RAM: 6164.89 MB
Total Pagefile: 9223.27 MB
Available Pagefile: 7239.14 MB
Total Virtual: 8192 MB
Available Virtual: 8191.75 MB
==================== Drives ================================
Drive c: (Acer) (Fixed) (Total:913.19 GB) (Free:531.86 GB) NTFS
Drive e: (My Passport) (Fixed) (Total:298.02 GB) (Free:249.26 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 932 GB) (Disk ID: 6B73424A)
Partition: GPT Partition Type
========================================================
Disk: 1 (Size: 298 GB) (Disk ID: B13D6473)
Partition 1: (Not Active) - (Size=298 GB) - (Type=0C)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2014-01-09 00:14:08
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000039 ST1000LM024_HN-M101MBB rev.2AR10001 931,51GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\******~1\AppData\Local\Temp\uglorpod.sys
---- User code sections - GMER 2.1 ----
.text C:\Windows\system32\dwm.exe[492] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\system32\dwm.exe[492] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\system32\dwm.exe[492] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[336] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[336] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[336] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\system32\nvvsvc.exe[128] C:\Windows\system32\MSIMG32.dll!GradientFill + 690 000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\system32\nvvsvc.exe[128] C:\Windows\system32\MSIMG32.dll!GradientFill + 698 000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\system32\nvvsvc.exe[128] C:\Windows\system32\MSIMG32.dll!TransparentBlt + 246 000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\system32\nvvsvc.exe[128] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007f81fa8177a 4 bytes [A8, 1F, F8, 07]
.text C:\Windows\system32\nvvsvc.exe[128] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007f81fa81782 4 bytes [A8, 1F, F8, 07]
.text C:\Windows\system32\taskhostex.exe[2712] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\system32\taskhostex.exe[2712] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\system32\taskhostex.exe[2712] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files\Elantech\ETDCtrl.exe[3080] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files\Elantech\ETDCtrl.exe[3080] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files\Elantech\ETDCtrl.exe[3080] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\Explorer.EXE[3212] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\Explorer.EXE[3212] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\Explorer.EXE[3212] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\Explorer.EXE[3212] C:\Windows\SYSTEM32\WSOCK32.dll!recvfrom + 742 000007f80e581b32 4 bytes [58, 0E, F8, 07]
.text C:\Windows\Explorer.EXE[3212] C:\Windows\SYSTEM32\WSOCK32.dll!recvfrom + 750 000007f80e581b3a 4 bytes [58, 0E, F8, 07]
.text C:\Windows\system32\wbem\unsecapp.exe[3708] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\system32\wbem\unsecapp.exe[3708] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\system32\wbem\unsecapp.exe[3708] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files\Elantech\ETDCtrlHelper.exe[3720] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files\Elantech\ETDCtrlHelper.exe[3720] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files\Elantech\ETDCtrlHelper.exe[3720] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[3792] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[3792] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[3792] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\system32\igfxext.exe[3820] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\system32\igfxext.exe[3820] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\system32\igfxext.exe[3820] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1868] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1868] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1868] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\System32\igfxtray.exe[1624] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\System32\igfxtray.exe[1624] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\System32\igfxtray.exe[1624] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\System32\hkcmd.exe[1404] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\System32\hkcmd.exe[1404] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\System32\hkcmd.exe[1404] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\System32\igfxpers.exe[4084] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007f81fa8177a 4 bytes [A8, 1F, F8, 07]
.text C:\Windows\System32\igfxpers.exe[4084] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007f81fa81782 4 bytes [A8, 1F, F8, 07]
.text C:\Windows\System32\igfxpers.exe[4084] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\System32\igfxpers.exe[4084] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\System32\igfxpers.exe[4084] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[236] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[236] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[236] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[2200] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[2200] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[2200] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text C:\Dolby PCEE4\pcee4.exe[4548] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text C:\Dolby PCEE4\pcee4.exe[4548] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text C:\Dolby PCEE4\pcee4.exe[4548] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe[4920] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007f81fa8177a 4 bytes [A8, 1F, F8, 07]
.text C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe[4920] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007f81fa81782 4 bytes [A8, 1F, F8, 07]
.text C:\Windows\system32\igfxsrvc.exe[4980] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\system32\igfxsrvc.exe[4980] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\system32\igfxsrvc.exe[4980] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\system32\wbem\unsecapp.exe[5008] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\system32\wbem\unsecapp.exe[5008] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text C:\Windows\system32\wbem\unsecapp.exe[5008] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[5036] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[5036] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[5036] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files (x86)\Bluetooth Suite\BtTray.exe[1148] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files (x86)\Bluetooth Suite\BtTray.exe[1148] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files (x86)\Bluetooth Suite\BtTray.exe[1148] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[1944] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[1944] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[1944] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[1944] C:\Windows\SYSTEM32\WSOCK32.dll!recvfrom + 742 000007f80e581b32 4 bytes [58, 0E, F8, 07]
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[1944] C:\Windows\SYSTEM32\WSOCK32.dll!recvfrom + 750 000007f80e581b3a 4 bytes [58, 0E, F8, 07]
.text C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe[2132] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007f81fa8177a 4 bytes [A8, 1F, F8, 07]
.text C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe[2132] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007f81fa81782 4 bytes [A8, 1F, F8, 07]
---- Threads - GMER 2.1 ----
Thread C:\Windows\system32\csrss.exe [592:636] fffff960009235e8
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Code:
ATTFilter Exportierte Ereignisse:
08.01.2014 17:11 [System-Scanner] Malware gefunden
Die Datei
'C:\Users\*********\Desktop\Festplatte\Magix.Fotos.auf.CD.und.DVD.Deluxe.6.5.Ger
man.DVD-RESTORE\mfotos65dlx\RESTORE\scheduler.exe'
enthielt einen Virus oder unerwünschtes Programm 'TR/Fraud.Gen8' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde gelöscht.
08.01.2014 17:11 [System-Scanner] Malware gefunden
Die Datei 'C:\Users\*********\Desktop\Festplatte\Ansys\MAGNiTUDE\a11calc.exe'
enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.TPM.Gen' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde gelöscht.
Vielen Dank schon einmal.  Viele Grüße anwo |
| Themen zu Email- und Ebaykonto missbraucht: TR/Fraud.Gen8 und TR/Crypt.TPM.Gen beim Virenscan gefunden |
| adblock, antivir, antivirus, avira, computer, error, failed, festplatte, firefox, flash player, google, hijack, home, installation, launch, mozilla, office 365, programm, realtek, registry, richtlinie, rojaner gefunden, rundll, scan, security, siteadvisor, svchost.exe, system, tr/crypt., tr/crypt.tpm.gen, tr/fraud.gen8, updates, usb |
Baum-Darstellung