| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Werbefenster öffnet sich im FirefoxWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
10.01.2014, 22:26
| #1 |
 |  Werbefenster öffnet sich im Firefox Hallo Leute, folgendes Problem tritt bei mir auf. Firefox öffnet selbstständig ein neues Fenster in dem Werbung abgespielt wird, bei diesem gibt es keine Schaltflächen anzuklicken. Weiters, wenn eine von mir angewählte Seite geöffnet ist, wird diese nicht korrekt angezeigt. Sie ist z.b. von Werbeeinschaltungen oder Scanwarnungen unterbrochen. Ebenfalls sind bestimmte Keywörter hervorgehoben und mit links unterlegt. Leider finde ich die aviralogs nicht  so habe ich sie ebenfalls als code eingefügt.Hoffe das geht so in Ordnung. Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-01-2014
Ran by User at 2014-01-10 20:53:05
Running from C:\Users\User\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Update for Microsoft Office 2007 (KB2508958) (x32 Version: - Microsoft)
7-Zip 9.20 (x32 Version: - )
Acer Arcade Deluxe (x32 Version: 3.2.7116 - CyberLink Corp.)
Acer Arcade Deluxe (x32 Version: 3.2.7116 - CyberLink Corp.) Hidden
Acer Backup Manager (x32 Version: 2.0.2.19 - NewTech Infosystems)
Acer eRecovery Management (x32 Version: 4.05.3005 - Acer Incorporated)
Acer Registration (x32 Version: 1.02.3006 - Acer Incorporated)
Acer ScreenSaver (x32 Version: 1.1.0812 - Acer Incorporated)
Acer System Information (x32 Version: 1.0.0 - Acer)
Acer Updater (x32 Version: 1.01.3017 - Acer Incorporated)
Acrobat.com (x32 Version: 1.6.65 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 1.5.3.9130 - Adobe Systems Inc.)
Adobe AIR (x32 Version: 1.5.3.9130 - Adobe Systems Inc.) Hidden
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Reader X (10.1.8) - Deutsch (x32 Version: 10.1.8 - Adobe Systems Incorporated)
Advertising Center (x32 Version: 0.0.0.2 - Nero AG) Hidden
AMD Accelerated Video Transcoding (Version: 12.5.100.21219 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.1084.4 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (Version: 8.0.903.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.71219.1540 - Advanced Micro Devices, Inc.) Hidden
Apple Application Support (x32 Version: 2.1.9 - Apple Inc.)
Apple Mobile Device Support (Version: 5.2.0.6 - Apple Inc.)
Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.)
ArcSoft Print Creations - Album Page (x32 Version: - ArcSoft)
ArcSoft Print Creations - Photo Book (x32 Version: - ArcSoft)
ArcSoft Print Creations (x32 Version: 3.0.255.407 - ArcSoft)
ArcSoft TotalMedia HDCam (x32 Version: - ArcSoft)
ATI AVIVO64 Codecs (Version: 10.11.0.41019 - ATI Technologies Inc.) Hidden
Avira Free Antivirus (x32 Version: 14.0.2.286 - Avira)
Avira SearchFree Toolbar (x32 Version: 12.6.0.1900 - APN, LLC)
Backup Manager Advance (x32 Version: 2.0.2.19 - NewTech Infosystems) Hidden
Battlefield 1942™ (x32 Version: 1.6.20.0 - Electronic Arts)
Black ICE Mk VII r1046 (x32 Version: Mk VII r1046 - Panzeroo, Inc.)
Bonjour (Version: 3.0.0.10 - Apple Inc.)
Canon MP550 series MP Drivers (Version: - )
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center (x32 Version: 2012.1219.1521.27485 - Ihr Firmenname) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2009.1019.2131.36819 - ATI Technologies, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
Compatibility Pack für 2007 Office System (x32 Version: 12.0.6612.1000 - Microsoft Corporation)
Darkest Hour: Europe '44-'45 (x32 Version: - Darkest Hour Team)
Dota 2 (x32 Version: - Valve)
Dungeons & Dragons Online® (x32 Version: - )
EA Download Manager (x32 Version: 6.0.4.10 - Electronic Arts, Inc.)
Enhanced Wheel Mouse V 1.7.1 (x32 Version: - )
Europa Universalis III (x32 Version: - )
FIFA 13 (x32 Version: 1.7.0.0 - Electronic Arts)
FIFA 14 (x32 Version: 1.0.0.4 - Electronic Arts)
FormatFactory 3.0.1 (x32 Version: 3.0.1 - Free Time)
Free RAR Extract Frog (x32 Version: 2.10 - Philipp Winterberg)
FUSSBALL MANAGER 13 (x32 Version: 1.0.3.0 - Electronic Arts)
Gary Grigsby's War in the East (x32 Version: 1.04.36 - Matrix Games)
Google Earth (x32 Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Hearts of Iron III (x32 Version: - )
HiJackThis (x32 Version: 1.0.0 - Trend Micro)
HijackThis 2.0.2 (x32 Version: 2.0.2 - TrendMicro)
Hotkey Utility (x32 Version: 1.00.3004 - Acer Incorporated)
iCloud (Version: 1.1.0.40 - Apple Inc.)
Identity Card (x32 Version: 1.00.3002 - Acer Incorporated)
ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden
Intel(R) Management Engine Components (x32 Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Network Connections 17.3.63.0 (Version: 17.3.63.0 - Intel)
Intel(R) Network Connections 17.3.63.0 (Version: 17.3.63.0 - Intel) Hidden
Intel(R) Rapid Storage Technology (x32 Version: 12.0.0.1013 - Intel Corporation)
iTunes (Version: 10.6.3.25 - Apple Inc.)
Java 7 Update 17 (x32 Version: 7.0.170 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.0 - Sun Microsystems, Inc.) Hidden
JMicron JMB36X Driver (x32 Version: 1.00.0000 - JMicron Technology Corp.)
KeyRocket (HKCU Version: 1.1.0.3185 - Veodin)
Logitech Gaming Software 8.12 (Version: 8.12.030 - Logitech Inc.)
Men of War: Red Tide (Nur entfernen) (x32 Version: 1.0.0.1 - 1C Company)
MFC RunTime files (x32 Version: 1.0.0 - Extensoft) Hidden
Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322 - Microsoft)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Chart Controls for Microsoft .NET Framework 3.5 (x32 Version: 3.5.30730.0 - Microsoft Corporation)
Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (x32 Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (x32 Version: 9.7.0621 - Microsoft Corporation)
MobileMe Control Panel (Version: 3.1.8.0 - Apple Inc.)
MobileWiFi (x32 Version: TOOL-ConnLaucher_WIN1.09.02.00 - Huawei Technologies Co.,Ltd)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
Mp3tag v2.43 (x32 Version: v2.43 - Florian Heidenreich)
MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation)
My Driver Updater v3.0 (x32 Version: 3.0 - Large Software)
MyFreeCodec (HKCU Version: - )
MyWinLocker (x32 Version: 3.1.76.0 - Egis Technology Inc.)
Nero 9 Essentials (x32 Version: - Nero AG)
Nero ControlCenter (x32 Version: 9.0.0.1 - Nero AG) Hidden
Nero DiscSpeed (x32 Version: 5.4.7.201 - Nero AG) Hidden
Nero DiscSpeed Help (x32 Version: 5.4.4.100 - Nero AG) Hidden
Nero DriveSpeed (x32 Version: 4.4.7.201 - Nero AG) Hidden
Nero DriveSpeed Help (x32 Version: 4.4.4.100 - Nero AG) Hidden
Nero Express Help (x32 Version: 9.4.9.100 - Nero AG) Hidden
Nero InfoTool (x32 Version: 6.4.7.201 - Nero AG) Hidden
Nero InfoTool Help (x32 Version: 6.4.4.100 - Nero AG) Hidden
Nero Installer (x32 Version: 4.4.8.1 - Nero AG) Hidden
Nero Online Upgrade (x32 Version: 1.3.0.0 - Nero AG) Hidden
Nero StartSmart (x32 Version: 9.4.11.209 - Nero AG) Hidden
Nero StartSmart Help (x32 Version: 9.4.11.208 - Nero AG) Hidden
Nero StartSmart OEM (x32 Version: 9.16.0.100 - Nero AG) Hidden
NeroExpress (x32 Version: 9.4.10.505 - Nero AG) Hidden
neroxml (x32 Version: 1.0.0 - Nero AG) Hidden
NVIDIA PhysX (x32 Version: 9.10.0224 - NVIDIA Corporation)
Origin (x32 Version: 9.1.15.109 - Electronic Arts, Inc.)
Patrizier 4 (x32 Version: 1.3.0 - Kalypso Media)
PDF To Excel Converter V2.0 (x32 Version: - hxxp://www.PDFExcelConverter.com)
PlayReady PC Runtime amd64 (Version: 1.3.0 - Microsoft Corporation)
PokerStars (x32 Version: - PokerStars)
Presto! PVR (x32 Version: 5.40.02 - NewSoft)
ProtectDisc Driver, Version 11 (x32 Version: 11.0.0.14 - ProtectDisc Software GmbH)
PunkBuster Services (x32 Version: 0.992 - Even Balance, Inc.)
QuickTime (x32 Version: 7.72.80.56 - Apple Inc.)
Railroad Tycoon 3 (x32 Version: 1.0 - )
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6662 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (x32 Version: 6.1.8400.30136 - Realtek Semiconductor Corp.)
Red Orchestra 2: Heroes of Stalingrad (x32 Version: - Tripwire)
Red Orchestra 2: Heroes of Stalingrad Beta (x32 Version: - )
Red Orchestra: Ostfront 41-45 (x32 Version: - Tripwire Interactive)
RedOrchestra SDK Beta (x32 Version: - Tripwire Interactive)
Revo Uninstaller 1.95 (x32 Version: 1.95 - VS Revo Group)
Samsung Kies (x32 Version: 2.5.2.13021_10 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.5.2.13021_10 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (Version: 1.5.23.0 - SAMSUNG Electronics Co., Ltd.)
Scratch Live 1.9.2 (19222) (x32 Version: 1.9.2 - Serato Audio Research)
SearchAnonymizer (Version: 1.0.1 (de) - )
Sid Meier's Civilization V (x32 Version: - 2K Games, Inc.)
Silent Hunter III (x32 Version: - Ubisoft)
SimCity™ (x32 Version: 1.0.0.0 - Electronic Arts)
Software Version Updater (x32 Version: 1.1.3.8 - ) <==== ATTENTION
Steam (x32 Version: 1.0.0.0 - Valve)
Steganos Safe 14 (x32 Version: 14.1 - Steganos Software GmbH)
Stronghold Kingdoms (x32 Version: - Firefly Studios Ltd)
Trojan Killer (x32 Version: 2.2.0.0 - Gridinsoft LLC)
TuneUp Utilities 2013 (x32 Version: 13.0.4000.179 - TuneUp Software)
TuneUp Utilities 2013 (x32 Version: 13.0.4000.179 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (x32 Version: 13.0.4000.179 - TuneUp Software) Hidden
tvBuddy (Version: 1.1.0 - MEKmedia GmbH)
Überwachungstool für die Intel® Turbo-Boost-Technologie (Version: 1.0.115.11 - Intel)
Unity Web Player (HKCU Version: - Unity Technologies ApS)
Update for 2007 Microsoft Office System (KB967642) (x32 Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2850085) 32-Bit Edition (x32 Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (x32 Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (x32 Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32 Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (x32 Version: - Microsoft)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
Video Player (x32 Version: 1.1 - Video Player)
VLC media player 1.1.10 (x32 Version: 1.1.10 - VideoLAN)
watchmi (x32 Version: 3.0.0 - Axel Springer Digital TV Guide GmbH)
Webexp Enhanced (x32 Version: 1.1 - Webexp Enhanced) <==== ATTENTION
Windows Live Call (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8 - Microsoft Corp)
WinUHA 2.0 RC1 (2005.02.27) (x32 Version: - Klaimsoft)
WinZip 17.5 (Version: 17.5.10562 - WinZip Computing, S.L. )
Xfire (remove only) (x32 Version: - )
YTD Video Downloader 4.0 (x32 Version: 4.0 - GreenTree Applications SRL)
==================== Restore Points =========================
25-12-2013 23:09:29 Geplanter Prüfpunkt
29-12-2013 10:26:58 Wiederherstellungsvorgang
06-01-2014 22:39:09 Geplanter Prüfpunkt
==================== Hosts content: ==========================
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {037EC25A-E3DF-4BD3-8FC7-A6A4F634B48D} - System32\Tasks\{FC2E36A9-4BA1-4D36-B29A-CBEA385148FC} => E:\setup.exe [2010-07-29] ()
Task: {0511720D-368C-4C0C-B219-597505C6FDD3} - System32\Tasks\{3E937DC1-F5F9-4258-AB7C-75F03C68A065} => E:\setup.exe [2010-07-29] ()
Task: {0B759516-C788-4E8C-8C8F-23E65618ADE4} - System32\Tasks\{46327B71-3519-4F9F-ADC5-675F0592D76F} => E:\setup.exe [2010-07-29] ()
Task: {2BE8B792-8678-4181-971B-3FADEE599F74} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\TuneUp Utilities 2013\OneClick.exe [2013-12-10] (TuneUp Software)
Task: {34E6C70E-A5BD-4310-B350-6735840D591A} - System32\Tasks\{9891C0AE-A4E7-488F-8C5C-B293EB0EC2E9} => E:\setup.exe [2010-07-29] ()
Task: {3B860BBE-E828-4E6B-A525-2DE61133BA82} - System32\Tasks\{D260A612-DF67-4487-8EF0-B3C9E6142DF7} => E:\setup.exe [2010-07-29] ()
Task: {44953FBD-6561-4CAB-9718-3049EA8DAC85} - System32\Tasks\{71A2B46F-9907-4812-9E6A-8BB75C60C507} => E:\setup.exe [2010-07-29] ()
Task: {48BA27C1-8693-4D82-A652-BBD173AB1831} - System32\Tasks\{83FF96F8-59FD-428A-A328-42BCCC699916} => E:\setup.exe [2010-07-29] ()
Task: {5409807B-CADC-4084-B6BE-6311FEE19FBA} - System32\Tasks\{7BEE57FA-A916-4FED-AB17-EAE8E8731B81} => E:\setup.exe [2010-07-29] ()
Task: {5C88B78C-F4F7-438E-943A-7B1BDD2D2D48} - System32\Tasks\{0A4E5DFA-1C7C-44F9-A95B-BD12C0170181} => E:\setup.exe [2010-07-29] ()
Task: {616CE764-D890-4780-9AF4-E7268D3BF75A} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {6D1452B2-7AB9-48C6-889B-3C82AFD40FC1} - System32\Tasks\ArcSoft Connect Daemon => C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [2010-10-27] (ArcSoft Inc.)
Task: {6D2BAD29-79B8-4C79-9685-031BAC4D06DE} - System32\Tasks\{3ACF0099-9471-4307-A3AE-697CE99F1807} => E:\setup.exe [2010-07-29] ()
Task: {6E587766-8D03-429F-A865-EF12113416E0} - System32\Tasks\{12CC13A6-A8B4-4ED3-BCD0-A76B951447EB} => C:\Users\User\Desktop\docula_1.4.2.exe
Task: {70D12DB2-6DFC-4069-9488-764E88C7943C} - System32\Tasks\{5C3A79E7-FD88-4105-B853-1A35FD0E04F4} => E:\setup.exe [2010-07-29] ()
Task: {7C74F272-52F2-41E9-944C-6C3A95FB4BC5} - System32\Tasks\{0E1882D2-49D9-45AF-B4CD-06F456BF021D} => E:\setup.exe [2010-07-29] ()
Task: {7C855793-0093-409D-B435-CEB311628387} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04] (Adobe Systems Incorporated)
Task: {80C483AC-CD5D-4340-993C-4ADA71427006} - System32\Tasks\{7C0BB836-BAE2-41D9-95F8-50D0BFCB15F1} => E:\setup.exe [2010-07-29] ()
Task: {84787B00-9C0E-48E4-AD5E-2D3DAE595DA8} - System32\Tasks\{127BFB5E-AFC7-4DD9-AF67-FC53383EB646} => E:\setup.exe [2010-07-29] ()
Task: {8AA4CA44-8FA8-456B-B71B-1A7346904FD4} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {9251A992-8FB4-46DE-A6B0-3510FF695728} - System32\Tasks\{FEB2D5CB-C27B-476E-8B0D-74CB957E0972} => E:\setup.exe [2010-07-29] ()
Task: {941A857E-EDE3-4C2A-AFBE-F533752EF8E1} - System32\Tasks\{4D5E49AB-077C-4CD5-BDFC-904CD4D8F707} => E:\setup.exe [2010-07-29] ()
Task: {AA915C61-2492-4229-95AC-2756009DCCC6} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2012-07-03] (Sun Microsystems, Inc.)
Task: {B7C0A2BE-A9B4-453D-9231-DA226BED8789} - System32\Tasks\{152CC412-26DF-444C-8A0F-3F032C335705} => E:\setup.exe [2010-07-29] ()
Task: {BC78EC34-CD65-4E45-8A95-8B03FF5AE7FA} - System32\Tasks\{9F4B3EB1-B092-4EF1-BAB2-BC9D8FAC011F} => E:\setup.exe [2010-07-29] ()
Task: {C19126C8-4302-405F-A717-73BB1221C43C} - System32\Tasks\{1F555623-59C6-461C-BBFB-45B9CDAF949E} => C:\Program Files (x86)\Skype\Phone\Skype.exe
Task: {C25ED4B6-13AE-4D05-8DCA-BE94150EA698} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-03-27] (Google Inc.)
Task: {C8456ED2-BFFE-485B-8AF0-01E52D57BD5A} - System32\Tasks\{21AFF277-0441-41C7-9CAF-46955FF3518D} => E:\setup.exe [2010-07-29] ()
Task: {C87E8480-91C7-46B8-96DE-D828B8F95D51} - System32\Tasks\{76FA9C47-6582-4AC6-8FBF-05F639673C7B} => E:\setup.exe [2010-07-29] ()
Task: {CD7B7E49-73F0-4BAB-A252-1428277D5952} - System32\Tasks\{C197E3FA-9DBD-43D9-AB0D-846A731E8591} => E:\setup.exe [2010-07-29] ()
Task: {CE7BAF67-5AFB-4DF6-BFB3-9F5657EBE3B2} - System32\Tasks\{17F959C1-13D3-46DE-8396-69D81F9D0450} => E:\setup.exe [2010-07-29] ()
Task: {D165AEB1-8779-42E3-A36F-DEB89C7E3C78} - System32\Tasks\Egis technology-Online-Aktualisierungsprogramm => C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe [2009-08-04] (Egis Technology Inc.)
Task: {D5B0A6A2-71AB-483E-8F26-C0E1AEA4F9D4} - System32\Tasks\Recovery Management\Burn Notification => C:\Program Files\Acer\Acer eRecovery Management\NotificationCenter\Notification.exe [2009-10-01] (Acer)
Task: {E0EB90D6-6282-44E5-ACC8-A6298FD95CCC} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-03-27] (Google Inc.)
Task: {E7BEF584-A19C-4D02-9337-9AFEFCBB90F9} - System32\Tasks\{5A22E025-4C32-4070-910D-2CE134510836} => E:\setup.exe [2010-07-29] ()
Task: {FB043AC2-D4DC-4780-BA96-86A4188FD61A} - System32\Tasks\AmiUpdXp => C:\Users\User\AppData\Local\SwvUpdater\Updater.exe [2013-10-17] (Amonetizé Ltd) <==== ATTENTION
Task: {FF2BA9EB-62FD-4E3B-BEE8-35E25E452249} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-11] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\AmiUpdXp.job => C:\Users\User\AppData\Local\SwvUpdater\Updater.exe <==== ATTENTION
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2011-12-02 19:15 - 2011-12-02 19:15 - 00118784 _____ () C:\Program Files\Logitech Gaming Software\plugins\DevMgr-8.12.077\DevMgr.dll
2011-12-02 19:15 - 2011-12-02 19:15 - 00705536 _____ () C:\Program Files\Logitech Gaming Software\plugins\MainUI-8.12.179\MainUI.dll
2011-12-02 19:15 - 2011-12-02 19:15 - 00123904 _____ () C:\Program Files\Logitech Gaming Software\plugins\DevBusBulk-8.12.076\DevBusBulk.dll
2011-12-02 19:15 - 2011-12-02 19:15 - 00125952 _____ () C:\Program Files\Logitech Gaming Software\plugins\DevBusHid-8.12.078\DevBusHid.dll
2011-12-02 19:15 - 2011-12-02 19:15 - 00098304 _____ () C:\Program Files\Logitech Gaming Software\plugins\SimInput-8.12.068\SimInput.dll
2011-12-02 19:15 - 2011-12-02 19:15 - 00272384 _____ () C:\Program Files\Logitech Gaming Software\plugins\G13Device-8.12.155\G13Device.dll
2011-12-02 19:15 - 2011-12-02 19:15 - 00297984 _____ () C:\Program Files\Logitech Gaming Software\plugins\G19Device-8.12.147\G19Device.dll
2011-12-02 19:15 - 2011-12-02 19:15 - 00034304 _____ () C:\Program Files\Logitech Gaming Software\plugins\PnpGamePanelDevices-8.12.049\PnpGamePanelDevices.dll
2013-07-31 11:41 - 2013-07-31 11:41 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2011-09-27 07:23 - 2011-09-27 07:23 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2011-09-27 07:22 - 2011-09-27 07:22 - 01242472 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2009-02-03 02:33 - 2009-02-03 02:33 - 00460199 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll
2008-09-29 02:55 - 2008-09-29 02:55 - 01076224 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\ACE.dll
2012-12-13 10:28 - 2007-08-24 14:59 - 00030016 _____ () C:\Program Files (x86)\Enhanced Wheel Mouse\MouFilt.dll
2012-12-13 10:28 - 2007-08-24 14:59 - 00054592 _____ () C:\Program Files (x86)\Enhanced Wheel Mouse\UsbDesc.dll
2009-08-18 08:31 - 2009-08-18 08:31 - 00163840 _____ () C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyHook.dll
2013-12-14 17:48 - 2013-12-14 17:48 - 00017920 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\PSIClient\0998b7edc9ead7e597cf9aac6a1940d7\PSIClient.ni.dll
2013-12-20 12:46 - 2013-12-20 12:46 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-12-11 07:23 - 2013-12-11 07:23 - 16242056 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\Temp:0B9176C0
AlternateDataStreams: C:\ProgramData\Temp:4CF61E54
AlternateDataStreams: C:\ProgramData\Temp:4D066AD2
AlternateDataStreams: C:\ProgramData\Temp:5D7E5A8F
AlternateDataStreams: C:\ProgramData\Temp:7FB6A46D
AlternateDataStreams: C:\ProgramData\Temp:8173A019
AlternateDataStreams: C:\ProgramData\Temp:93DE1838
AlternateDataStreams: C:\ProgramData\Temp:ABE89FFE
AlternateDataStreams: C:\ProgramData\Temp:E1F04E8D
AlternateDataStreams: C:\ProgramData\Temp:E3C56885
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"
==================== Faulty Device Manager Devices =============
Name: Standardtastatur (PS/2)
Description: Standardtastatur (PS/2)
Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standardtastaturen)
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
Name: Elan 4D Mouse Filter
Description: Elan 4D Mouse Filter
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Elan 4D Mouse Filter
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Event log errors: =========================
Application errors:
==================
Error: (01/10/2014 09:47:18 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 24308793
Error: (01/10/2014 09:47:18 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 24308793
Error: (01/10/2014 09:47:18 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (01/10/2014 09:47:03 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 24293879
Error: (01/10/2014 09:47:03 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 24293879
Error: (01/10/2014 09:47:03 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (01/10/2014 09:46:53 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 24283630
Error: (01/10/2014 09:46:53 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 24283630
Error: (01/10/2014 09:46:53 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (01/10/2014 09:46:43 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 24273630
System errors:
=============
Error: (01/10/2014 06:15:05 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (01/10/2014 06:15:05 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht.
Error: (01/10/2014 07:26:49 AM) (Source: volmgr) (User: )
Description: Das System konnte den Treiber für das Speicherabbild nicht laden.
Error: (01/10/2014 06:11:04 AM) (Source: volmgr) (User: )
Description: Das System konnte den Treiber für das Speicherabbild nicht laden.
Error: (01/10/2014 05:40:49 AM) (Source: volmgr) (User: )
Description: Das System konnte den Treiber für das Speicherabbild nicht laden.
Error: (01/10/2014 04:50:05 AM) (Source: volmgr) (User: )
Description: Das System konnte den Treiber für das Speicherabbild nicht laden.
Error: (01/10/2014 04:19:49 AM) (Source: volmgr) (User: )
Description: Das System konnte den Treiber für das Speicherabbild nicht laden.
Error: (01/10/2014 03:32:20 AM) (Source: volmgr) (User: )
Description: Das System konnte den Treiber für das Speicherabbild nicht laden.
Error: (01/10/2014 03:02:15 AM) (Source: volmgr) (User: )
Description: Das System konnte den Treiber für das Speicherabbild nicht laden.
Error: (01/09/2014 09:51:58 AM) (Source: volmgr) (User: )
Description: Das System konnte den Treiber für das Speicherabbild nicht laden.
Microsoft Office Sessions:
=========================
Error: (08/13/2013 06:59:29 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 134 seconds with 120 seconds of active time. This session ended with a crash.
Error: (05/22/2013 07:00:02 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 4 seconds with 0 seconds of active time. This session ended with a crash.
Error: (01/13/2013 00:58:55 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 5 seconds with 0 seconds of active time. This session ended with a crash.
Error: (01/13/2013 00:58:41 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 6 seconds with 0 seconds of active time. This session ended with a crash.
Error: (01/13/2013 00:58:26 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 9 seconds with 0 seconds of active time. This session ended with a crash.
Error: (02/25/2012 03:15:09 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6654.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 6 seconds with 0 seconds of active time. This session ended with a crash.
Error: (02/25/2012 03:14:54 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6654.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 6 seconds with 0 seconds of active time. This session ended with a crash.
Error: (01/30/2011 04:17:30 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 2, Application Name: Microsoft Office Access, Application Version: 12.0.6535.5005, Microsoft Office Version: 12.0.6425.1000. This session lasted 24 seconds with 0 seconds of active time. This session ended with a crash.
Error: (01/30/2011 04:16:56 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 2, Application Name: Microsoft Office Access, Application Version: 12.0.6535.5005, Microsoft Office Version: 12.0.6425.1000. This session lasted 110 seconds with 60 seconds of active time. This session ended with a crash.
CodeIntegrity Errors:
===================================
Date: 2011-07-13 12:14:03.004
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\atikmpag.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2011-07-13 12:14:02.957
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\atikmpag.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2010-11-23 14:08:40.146
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2010-11-23 14:08:40.130
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2010-11-23 14:08:38.820
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2010-11-23 14:08:38.804
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2010-11-23 03:28:59.772
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2010-11-23 03:28:59.772
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2010-11-23 03:28:59.382
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2010-11-23 03:28:59.366
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 45%
Total physical RAM: 4055.06 MB
Available physical RAM: 2217.8 MB
Total Pagefile: 8108.3 MB
Available Pagefile: 5682.23 MB
Total Virtual: 8192 MB
Available Virtual: 8191.78 MB
==================== Drives ================================
Drive c: (Acer) (Fixed) (Total:458.45 GB) (Free:133.98 GB) NTFS
Drive d: (DATA) (Fixed) (Total:458.96 GB) (Free:438.66 GB) NTFS
Drive e: (Patrician IV) (CDROM) (Total:2.99 GB) (Free:0 GB) UDF
Drive f: (MobileWiFi) (CDROM) (Total:0.01 GB) (Free:0 GB) CDFS
Drive g: (Iomega HDD) (Fixed) (Total:1397.26 GB) (Free:540.99 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: C5BA9D19)
Partition 1: (Not Active) - (Size=14 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=458 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=459 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 1397 GB) (Disk ID: 27E9BFE8)
Partition 1: (Not Active) - (Size=-698723990528) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-01-2014
Ran by User (administrator) on USER-PC on 10-01-2014 20:51:55
Running from C:\Users\User\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe
(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
() C:\OEM\USBDECTION\USBS3S4Detection.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesApp64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Samsung) D:\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Steganos Software GmbH) C:\Program Files (x86)\Steganos Safe 14\SteganosBrowserMonitor.exe
() C:\Program Files (x86)\Enhanced Wheel Mouse\MouCon.exe
() C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
(Steganos Software GmbH) C:\Program Files (x86)\Steganos Safe 14\SteganosHotKeyService.exe
(Steganos Software GmbH) C:\Program Files (x86)\Steganos Safe 14\fredirstarter.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Ocs_SM] - C:\Users\User\AppData\Roaming\OCS\SM\SearchAnonymizer.exe [106496 2011-08-31] (OCS)
HKLM\...\Run: [Launch LCore] - C:\Program Files\Logitech Gaming Software\LCore.exe [110360 2011-09-29] (Logitech Inc.)
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM-x32\...\Run: [JMB36X IDE Setup] - C:\Windows\RaidTool\xInsIDE.exe [36864 2007-03-20] ()
HKLM-x32\...\Run: [Hotkey Utility] - C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [629280 2009-08-18] ()
HKLM-x32\...\Run: [ArcadeDeluxeAgent] - C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [128296 2009-11-16] (CyberLink Corp.)
HKLM-x32\...\Run: [AppleSyncNotifier] - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-11-02] (Apple Inc.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-05-30] (Apple Inc.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [277504 2012-03-12] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Steganos HotKeys] - C:\Program Files (x86)\Steganos Safe 14\SteganosHotKeyService.exe [103424 2013-05-16] (Steganos Software GmbH)
HKLM-x32\...\Run: [SAFE14 File Redirection Starter] - C:\Program Files (x86)\Steganos Safe 14\fredirstarter.exe [17408 2013-05-16] (Steganos Software GmbH)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-12] (Avira Operations GmbH & Co. KG)
HKCU\...\Run: [My Driver Updater] - C:\Program Files (x86)\Large Software\My Driver Updater\MDULauncher.exe [388240 2012-03-06] (Large Software)
HKCU\...\Run: [] - D:\Kies\External\FirmwareUpdate\KiesPDLR.exe [844144 2013-04-23] (Samsung)
HKCU\...\Run: [SAFE14 Browser Monitor] - C:\Program Files (x86)\Steganos Safe 14\SteganosBrowserMonitor.exe [73216 2013-05-16] (Steganos Software GmbH)
HKCU\...0c966feabec1\InprocServer32: [Default-shell32] C:\Users\User\AppData\Local\{250af3ee-cb75-2e9b-3f50-c4e07a8074a8}\n. ATTENTION! ====> ZeroAccess?
MountPoints2: E - E:\Autorun.exe
MountPoints2: F - F:\AutoRun.exe
MountPoints2: H - H:\AutoRun.exe
MountPoints2: K - K:\AutoRun.exe
MountPoints2: L - L:\AutoRun.exe
MountPoints2: {01bae5c6-5321-11df-b5a3-90fba647330b} - L:\AutoRun.exe
MountPoints2: {01bae5d1-5321-11df-b5a3-90fba647330b} - L:\AutoRun.exe
MountPoints2: {0bcb1cb0-450d-11e2-a95c-806e6f6e6963} - E:\Autorun.exe
MountPoints2: {267f2fe3-c36b-11e1-bd11-806e6f6e6963} - F:\AutoRun.exe
MountPoints2: {37c9b069-2ee5-11e3-81db-806e6f6e6963} - F:\AutoRun.exe
MountPoints2: {3cfa638b-39be-11df-8fed-90fba647330b} - L:\AutoRun.exe
MountPoints2: {401f27e4-2ee9-11e3-9c50-c43dc7bc097f} - F:\AutoRun.exe
MountPoints2: {401f2822-2ee9-11e3-9c50-90fba647330b} - F:\AutoRun.exe
MountPoints2: {4adda77b-46a0-11e2-be49-c43dc7bc097f} - F:\AutoRun.exe
MountPoints2: {6a9e531a-1b8a-11e3-b890-90fba647330b} - H:\AutoRun.exe
MountPoints2: {7b2b407e-165a-11df-8415-806e6f6e6963} - E:\Autorun.exe
MountPoints2: {808a3182-39bb-11df-8c81-90fba647330b} - L:\AutoRun.exe
MountPoints2: {82eae830-9601-11e1-ac0a-90fba647330b} - F:\AutoRun.exe
MountPoints2: {aadd18b3-a4f0-11e1-9499-90fba647330b} - F:\AutoRun.exe
MountPoints2: {c1bcea7d-5ca9-11df-968d-90fba647330b} - K:\AutoRun.exe
MountPoints2: {c1bcea8a-5ca9-11df-968d-90fba647330b} - K:\AutoRun.exe
MountPoints2: {c23580f3-a109-11e2-903b-806e6f6e6963} - F:\AutoRun.exe
MountPoints2: {d865a7c3-4291-11e2-b3b7-806e6f6e6963} - F:\AutoRun.exe
MountPoints2: {e72f9652-74f1-11e2-91c1-806e6f6e6963} - H:\AutoRun.exe
MountPoints2: {eac33148-5d42-11e3-b9a2-90fba647330b} - F:\AutoRun.exe
MountPoints2: {f0ad4680-b384-11e1-b60c-90fba647330b} - F:\AutoRun.exe
MountPoints2: {f9e56348-6a06-11e2-825b-c43dc7bc097f} - F:\AutoRun.exe
MountPoints2: {f9e5634f-6a06-11e2-825b-c43dc7bc097f} - F:\AutoRun.exe
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [162336 2009-07-22] ()
HKU\postgres\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [162336 2009-07-22] ()
AppInit_DLLs: [ ] ()
AppInit_DLLs-x32: [ ] ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.at/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0c07&m=aspire_m5811&r=17360310m905pe426v185w4491u28o
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?publisher=Vittalia&dpid=Vittalia&co=AT&userid=fc495aa5-5103-2a32-ea3f-a67d0f1e7362&searchtype=ds&q={searchTerms}&installDate=13/12/2013
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snapdo.com/?publisher=Vittalia&dpid=Vittalia&co=AT&userid=fc495aa5-5103-2a32-ea3f-a67d0f1e7362&searchtype=ds&q={searchTerms}&installDate=13/12/2013
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=Vittalia&dpid=Vittalia&co=AT&userid=fc495aa5-5103-2a32-ea3f-a67d0f1e7362&searchtype=ds&q={searchTerms}&installDate=13/12/2013
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=Vittalia&dpid=Vittalia&co=AT&userid=fc495aa5-5103-2a32-ea3f-a67d0f1e7362&searchtype=ds&q={searchTerms}&installDate=13/12/2013
SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=Vittalia&dpid=Vittalia&co=AT&userid=fc495aa5-5103-2a32-ea3f-a67d0f1e7362&searchtype=ds&q={searchTerms}&installDate=13/12/2013
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=Vittalia&dpid=Vittalia&co=AT&userid=fc495aa5-5103-2a32-ea3f-a67d0f1e7362&searchtype=ds&q={searchTerms}&installDate=13/12/2013
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\ae8kv44d.default
FF NewTab: about:blank
FF DefaultSearchEngine: Web Search
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Web Search
FF Homepage: hxxp://google.at/
FF Keyword.URL: hxxp://feed.snapdo.com/?publisher=Vittalia&dpid=Vittalia&co=AT&userid=fc495aa5-5103-2a32-ea3f-a67d0f1e7362&searchtype=ds&installDate={installDate}&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll No File
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll No File
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.17.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.17.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\User\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: RSS Icon In Awesombar - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\ae8kv44d.default\Extensions\rssicon@jasnapaka.com.xpi
FF Extension: NoScript - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\ae8kv44d.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: Adblock Plus - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\ae8kv44d.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF HKLM-x32\...\Firefox\Extensions: [xz123@ya456.com] - C:\Program Files (x86)\BetterSurf\ff
FF Extension: BetterSurf - C:\Program Files (x86)\BetterSurf\ff
FF HKLM-x32\...\Firefox\Extensions: [12x3q@3244516.com] - C:\Program Files (x86)\Better-Surf\ff
FF Extension: Better-Surf - C:\Program Files (x86)\Better-Surf\ff
FF HKLM-x32\...\Firefox\Extensions: [ext@WebexpEnhancedV1alpha422.net] - C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha422\ff
FF Extension: Webexp Enhanced - C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha422\ff
FF HKLM-x32\...\Firefox\Extensions: [ext@VideoPlayerV3beta321.net] - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta321\ff
FF Extension: Video Player - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta321\ff
Chrome:
=======
CHR Extension: (BittorrentBar_DE) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\hempmfkijmahkaddljkmchcmjbojoedl\2.0.1.4_0
CHR HKLM-x32\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx
CHR HKLM-x32\...\Chrome\Extension: [bikgopnjkdkacjcldjgbonccfdibbafc] - C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha422\ch\WebexpEnhancedV1alpha422.crx
CHR HKLM-x32\...\Chrome\Extension: [dedmngkbaffkenlfdcbganndoghblmap] - C:\Program Files (x86)\BetterSurf\ch\Chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [hempmfkijmahkaddljkmchcmjbojoedl] - C:\Users\User\AppData\Local\Temp\crx1FF4.tmp
CHR HKLM-x32\...\Chrome\Extension: [lbaimmpbelciohjddmihnhmbbgjbpecj] - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta321\ch\VideoPlayerV3beta321.crx
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx
CHR HKLM-x32\...\Chrome\Extension: [poheodfamflhhhdcmjfeggbgigeefaco] - C:\Program Files (x86)\Better-Surf\ch\Chrome.crx
==================== Services (Whitelisted) =================
R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-12] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-12] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-10-23] (APN LLC.)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
S4 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-10] (Egis Technology Inc.)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2012-07-31] ()
S4 SearchAnonymizer; C:\Users\User\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe [40960 2011-08-31] ()
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [2409272 2013-12-10] (TuneUp Software)
R2 USBS3S4Detection; C:\OEM\USBDECTION\USBS3S4Detection.exe [76320 2009-12-09] ()
S4 watchmi; C:\Program Files (x86)\watchmi\TvdService.exe [70144 2012-01-31] ()
==================== Drivers (Whitelisted) ====================
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2010-11-23] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-12] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-12] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-19] (Avira Operations GmbH & Co. KG)
S3 elanmouf; C:\Windows\System32\DRIVERS\elanmouf.sys [16512 2008-06-04] (Windows (R) Codename Longhorn DDK provider)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [24344 2012-03-12] (Intel Corporation)
S3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [66328 2011-12-02] (Logitech Inc.)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2010-11-23] ()
R1 SLEE_18_DRIVER; C:\Windows\Sleen1864.sys [108648 2012-07-24] (Softwareentwicklung Remus - ArchiCrypt - )
S3 TrojanKillerDriver; C:\Windows\System32\DRIVERS\gtkdrv.sys [16640 2013-11-13] (Windows (R) Win 7 DDK provider)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [11880 2012-09-19] (TuneUp Software)
R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-08-06] ()
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-10 20:51 - 2014-01-10 20:52 - 00019565 _____ C:\Users\User\Downloads\FRST.txt
2014-01-10 20:51 - 2014-01-10 20:51 - 00000000 ____D C:\FRST
2014-01-10 20:50 - 2014-01-10 20:51 - 01932166 _____ (Farbar) C:\Users\User\Downloads\FRST64.exe
2014-01-10 20:48 - 2014-01-10 20:48 - 00000470 _____ C:\Users\User\Downloads\defogger_disable.log
2014-01-10 20:48 - 2014-01-10 20:48 - 00000000 _____ C:\Users\User\defogger_reenable
2014-01-10 20:47 - 2014-01-10 20:47 - 00050477 _____ C:\Users\User\Downloads\Defogger.exe
2014-01-10 02:52 - 2014-01-10 02:52 - 00000000 ____D C:\Program Files (x86)\VideoPlayerV3
2013-12-20 17:52 - 2013-12-20 17:52 - 00000000 ____D C:\Program Files (x86)\WebexpEnhancedV1
2013-12-20 12:46 - 2013-12-20 12:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-16 02:13 - 2013-12-16 02:13 - 00002176 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-12-14 17:22 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-14 17:22 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-14 17:22 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-14 17:22 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-14 17:21 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-14 17:21 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-14 17:21 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-12-14 17:21 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-14 17:21 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-14 17:21 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-12-14 17:21 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-14 17:21 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-14 17:21 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-14 17:21 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-14 17:21 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-14 17:21 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-12-14 17:21 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-12-14 17:21 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-12-14 17:21 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-14 17:21 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-14 17:21 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-14 17:21 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-14 17:21 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-14 17:21 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-12-14 17:21 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-14 17:21 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-12-14 17:21 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-14 17:21 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-12-14 17:21 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-14 17:21 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-14 17:21 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-14 17:21 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-12-14 17:21 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-12-14 17:21 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-14 17:21 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-14 17:17 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-14 17:17 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-14 17:17 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-14 17:17 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-14 17:17 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-14 17:17 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-14 17:17 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-14 17:17 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-14 17:17 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-14 17:17 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-14 17:17 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-14 17:17 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2013-12-14 17:17 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-14 17:17 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-14 17:17 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-14 17:17 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-14 17:17 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-14 17:17 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-14 17:17 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-14 13:09 - 2013-12-14 13:09 - 04646635 _____ C:\Users\User\Downloads\hoi3_tfh(2).zip
2013-12-14 11:08 - 2013-12-10 18:43 - 00026936 _____ (TuneUp Software) C:\Windows\system32\authuitu.dll
2013-12-14 11:08 - 2013-12-10 18:43 - 00022328 _____ (TuneUp Software) C:\Windows\SysWOW64\authuitu.dll
2013-12-14 10:50 - 2013-12-14 11:24 - 00000000 ____D C:\Program Files\GridinSoft Trojan Killer
2013-12-14 10:50 - 2013-12-14 10:50 - 00000948 _____ C:\Users\Public\Desktop\Trojan Killer.lnk
2013-12-14 10:31 - 2013-12-14 10:31 - 00001124 _____ C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2013-12-13 02:37 - 2013-12-13 02:37 - 08661537 _____ C:\Users\User\Downloads\Patch-AHOI-Mod-TFH-402c.zip
2013-12-13 01:02 - 2013-12-13 01:02 - 00000000 ____D C:\Users\User\AppData\Local\WinZip
2013-12-13 01:01 - 2013-12-13 01:01 - 00002265 _____ C:\Users\Public\Desktop\WinZip.lnk
2013-12-13 01:01 - 2013-12-13 01:01 - 00000000 ____D C:\Program Files\WinZip
2013-12-11 07:23 - 2013-12-11 07:23 - 09272200 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
==================== One Month Modified Files and Folders =======
2014-01-10 20:52 - 2014-01-10 20:51 - 00019565 _____ C:\Users\User\Downloads\FRST.txt
2014-01-10 20:51 - 2014-01-10 20:51 - 00000000 ____D C:\FRST
2014-01-10 20:51 - 2014-01-10 20:50 - 01932166 _____ (Farbar) C:\Users\User\Downloads\FRST64.exe
2014-01-10 20:48 - 2014-01-10 20:48 - 00000470 _____ C:\Users\User\Downloads\defogger_disable.log
2014-01-10 20:48 - 2014-01-10 20:48 - 00000000 _____ C:\Users\User\defogger_reenable
2014-01-10 20:47 - 2014-01-10 20:47 - 00050477 _____ C:\Users\User\Downloads\Defogger.exe
2014-01-10 20:44 - 2009-07-14 05:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-10 20:44 - 2009-07-14 05:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-10 20:40 - 2010-02-10 16:44 - 01876192 _____ C:\Windows\WindowsUpdate.log
2014-01-10 20:36 - 2013-10-17 15:45 - 00000352 _____ C:\Windows\Tasks\AmiUpdXp.job
2014-01-10 20:36 - 2013-10-07 02:37 - 00012691 _____ C:\Windows\setupact.log
2014-01-10 20:36 - 2010-03-27 18:30 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-10 20:36 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-10 20:23 - 2012-04-04 22:11 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-10 20:20 - 2011-04-19 11:23 - 00000000 ____D C:\Program Files (x86)\Steam
2014-01-10 20:12 - 2010-03-27 18:30 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-10 18:27 - 2011-09-17 06:50 - 00280792 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2014-01-10 18:27 - 2011-09-17 06:40 - 00280792 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2014-01-10 18:16 - 2011-09-17 06:40 - 00281032 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2014-01-10 18:09 - 2013-09-25 23:02 - 00000000 ____D C:\Users\User\Documents\FIFA 14
2014-01-10 16:51 - 2013-05-21 12:06 - 00000000 ____D C:\Program Files (x86)\Origin
2014-01-10 14:37 - 2013-06-16 01:29 - 00000000 ____D C:\Users\User\AppData\Local\PokerStars
2014-01-10 02:52 - 2014-01-10 02:52 - 00000000 ____D C:\Program Files (x86)\VideoPlayerV3
2014-01-09 10:32 - 2010-02-04 22:10 - 00714610 _____ C:\Windows\system32\perfh007.dat
2014-01-09 10:32 - 2010-02-04 22:10 - 00156044 _____ C:\Windows\system32\perfc007.dat
2014-01-09 10:32 - 2009-07-14 06:13 - 01662242 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-09 10:26 - 2013-10-07 02:36 - 00108916 _____ C:\Windows\PFRO.log
2014-01-09 01:31 - 2010-03-27 18:14 - 00000000 ____D C:\Users\User\AppData\Local\Microsoft Help
2013-12-31 07:15 - 2013-11-28 20:09 - 00004096 _____ C:\Users\Public\Documents\00001726.LCS
2013-12-29 11:30 - 2013-07-05 14:50 - 00000000 ____D C:\Users\postgres
2013-12-29 11:30 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2013-12-29 11:30 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\AppCompat
2013-12-21 06:36 - 2012-05-25 11:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-20 17:52 - 2013-12-20 17:52 - 00000000 ____D C:\Program Files (x86)\WebexpEnhancedV1
2013-12-20 12:46 - 2013-12-20 12:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-18 11:37 - 2011-02-24 15:05 - 01635586 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-12-16 02:13 - 2013-12-16 02:13 - 00002176 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-12-16 02:13 - 2009-11-18 22:56 - 00000000 ____D C:\Program Files (x86)\Google
2013-12-14 19:09 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-14 17:26 - 2013-10-07 02:37 - 00442232 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-14 17:22 - 2009-11-18 22:48 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-14 17:20 - 2013-07-24 17:19 - 00000000 ____D C:\Windows\system32\MRT
2013-12-14 17:18 - 2010-03-27 18:16 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-14 13:09 - 2013-12-14 13:09 - 04646635 _____ C:\Users\User\Downloads\hoi3_tfh(2).zip
2013-12-14 11:24 - 2013-12-14 10:50 - 00000000 ____D C:\Program Files\GridinSoft Trojan Killer
2013-12-14 11:08 - 2012-12-10 07:31 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2013
2013-12-14 10:50 - 2013-12-14 10:50 - 00000948 _____ C:\Users\Public\Desktop\Trojan Killer.lnk
2013-12-14 10:32 - 2013-11-17 02:52 - 00000000 ____D C:\Program Files (x86)\BetterSurf
2013-12-14 10:31 - 2013-12-14 10:31 - 00001124 _____ C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2013-12-14 10:28 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2013-12-13 02:37 - 2013-12-13 02:37 - 08661537 _____ C:\Users\User\Downloads\Patch-AHOI-Mod-TFH-402c.zip
2013-12-13 01:02 - 2013-12-13 01:02 - 00000000 ____D C:\Users\User\AppData\Local\WinZip
2013-12-13 01:02 - 2013-07-04 19:23 - 00000000 ____D C:\ProgramData\WinZip
2013-12-13 01:01 - 2013-12-13 01:01 - 00002265 _____ C:\Users\Public\Desktop\WinZip.lnk
2013-12-13 01:01 - 2013-12-13 01:01 - 00000000 ____D C:\Program Files\WinZip
2013-12-13 00:54 - 2011-12-15 18:26 - 00000000 ____D C:\ProgramData\eMule
2013-12-12 13:29 - 2013-07-31 17:47 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-12-12 13:29 - 2013-07-31 11:41 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-12-12 13:29 - 2013-07-31 11:41 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-12-11 07:23 - 2013-12-11 07:23 - 09272200 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2013-12-11 07:23 - 2012-04-04 22:11 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-11 07:23 - 2012-04-04 22:11 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-12-11 07:23 - 2011-07-02 01:18 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
ZeroAccess:
C:\Users\User\AppData\Local\{250af3ee-cb75-2e9b-3f50-c4e07a8074a8}
C:\Users\User\AppData\Local\{250af3ee-cb75-2e9b-3f50-c4e07a8074a8}\@
C:\Users\User\AppData\Local\{250af3ee-cb75-2e9b-3f50-c4e07a8074a8}\U\00000004.@
C:\Users\User\AppData\Local\{250af3ee-cb75-2e9b-3f50-c4e07a8074a8}\U\00000008.@
C:\Users\User\AppData\Local\{250af3ee-cb75-2e9b-3f50-c4e07a8074a8}\U\000000cb.@
Files to move or delete:
====================
C:\ProgramData\31g7.pad
C:\ProgramData\7g13.dat
C:\ProgramData\z7_0ytr.pad
C:\ProgramData\zak_lo0i7g.pad
C:\Users\User\AppData\Roaming\skype.dat
Some content of TEMP:
====================
C:\Users\User\AppData\Local\Temp\avgnt.exe
C:\Users\User\AppData\Local\Temp\Setup1.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-09 04:46
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2014-01-10 21:30:18
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000073 ATA_____ rev.0A01 931,51GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\User\AppData\Local\Temp\kwldapob.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff800035af000 45 bytes [00, 00, 00, 00, 00, 00, 00, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575 fffff800035af02f 17 bytes {ADD [RAX], AL; SHL BYTE [RAX-0x57ff455], 0xff; JMP QWORD [RAX-0x7ff45461]}
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1924] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074c31465 2 bytes [C3, 74]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1924] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074c314bb 2 bytes [C3, 74]
.text ... * 2
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2168] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074c31465 2 bytes [C3, 74]
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2168] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074c314bb 2 bytes [C3, 74]
.text ... * 2
.text C:\Windows\SysWOW64\PnkBstrA.exe[2252] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 0000000072d31a22 2 bytes [D3, 72]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2252] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 0000000072d31ad0 2 bytes [D3, 72]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2252] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 0000000072d31b08 2 bytes [D3, 72]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2252] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 0000000072d31bba 2 bytes [D3, 72]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2252] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 0000000072d31bda 2 bytes [D3, 72]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2252] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074c31465 2 bytes [C3, 74]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2252] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074c314bb 2 bytes [C3, 74]
.text ... * 2
.text D:\Kies\External\FirmwareUpdate\KiesPDLR.exe[3496] C:\Windows\SysWOW64\ntdll.dll!DbgBreakPoint 00000000770b000c 1 byte [C3]
.text D:\Kies\External\FirmwareUpdate\KiesPDLR.exe[3496] C:\Windows\SysWOW64\ntdll.dll!DbgUiRemoteBreakin 000000007713f8ea 5 bytes JMP 00000001770ed5c1
---- EOF - GMER 2.1 ----
Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 20:48 on 10/01/2014 (User)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Die Datei 'C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta321\ie\VideoPlayerV3beta321.dll'
enthielt einen Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen' [adware].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '59690712.qua' verschoben!
In der Datei 'C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta321\ie\VideoPlayerV3beta321.dll'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen' [adware] gefunden.
Ausgeführte Aktion: Übergeben an Scanner
In der Datei 'C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta321\ie\VideoPlayerV3beta321.dll'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen' [adware] gefunden.
Ausgeführte Aktion: Zugriff verweigern
Die Datei 'C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha422\ie\WebexpEnhancedV1alpha422.dll'
enthielt einen Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen' [adware].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '57fa3de8.qua' verschoben!
In der Datei 'C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha422\ie\WebexpEnhancedV1alpha422.dll'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen' [adware] gefunden.
Ausgeführte Aktion: Übergeben an Scanner
In der Datei 'C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha422\ie\WebexpEnhancedV1alpha422.dll'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen' [adware] gefunden.
Ausgeführte Aktion: Zugriff verweigern
Die Datei 'C:\Program Files (x86)\BetterSurf\ie\BetterSurf.dll'
enthielt einen Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen' [adware].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5d00ea93.qua' verschoben!
Der Registrierungseintrag <HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6E3C6B04-08FE-43BC-8E50-F90285024DEA}> wurde erfolgreich repariert.
In der Datei 'C:\Program Files (x86)\BetterSurf\ie\BetterSurf.dll'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen' [adware] gefunden.
Ausgeführte Aktion: Zugriff verweigern
In der Datei 'C:\Program Files (x86)\BetterSurf\ie\BetterSurf.dll'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen' [adware] gefunden.
Ausgeführte Aktion: Zugriff verweigern
Die Datei 'C:\Program Files (x86)\Better-Surf\ff\chrome\content\better-surf.js'
enthielt einen Virus oder unerwünschtes Programm 'JS/Redirect.GV' [virus].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5a22ba37.qua' verschoben!
In der Datei 'C:\Program Files (x86)\Better-Surf\ff\chrome\content\better-surf.js'
wurde ein Virus oder unerwünschtes Programm 'JS/Redirect.GV' [virus] gefunden.
Ausgeführte Aktion: Zugriff verweigern
Die Datei 'C:\Users\User\AppData\Local\Temp\BetterSurfPlusInstaller.exe'
enthielt einen Virus oder unerwünschtes Programm 'Adware/BetterSurf.A.4' [adware].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5a74b6c8.qua' verschoben!
In der Datei 'C:\Users\User\AppData\Local\Temp\BetterSurfPlusInstaller.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/BetterSurf.A.3' [adware] gefunden.
Ausgeführte Aktion: Zugriff verweigern
|
| Themen zu Werbefenster öffnet sich im Firefox |
| .com, adblock, adware/adware.gen, adware/bettersurf.a.3, adware/bettersurf.a.4, branding, converter, desktop, email, entfernen, excel, firefox, help, helper, js/redirect.gv, launch, newtab, ntdll.dll, plug-in, problem, registry, server, software, svchost.exe, usb, werbefenster, windows, windows xp |
Baum-Darstellung