| |
| |||||||
Log-Analyse und Auswertung: Ständig nervige Popups und langsames InternetWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
10.03.2014, 16:53
| #3 |
 |  Ständig nervige Popups und langsames Internet Ich war jetzt glaub ich erst mal zu schnell. Hab erst gepostet und dann die Grundprogramme laufen lassen. Hier die Logfiles von FRST:
__________________FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-03-2014 02
Ran by WIN (administrator) on WIN-PC on 10-03-2014 16:26:42
Running from C:\Users\WIN\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files (x86)\NewPlayer\NewPlayerUpdaterService.exe
(Protexis Inc.) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Iminent) C:\Program Files (x86)\Common Files\Umbrella\umbrella.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesApp64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Iminent) C:\Program Files (x86)\Iminent\Iminent.Messengers.exe
(Crawler.com) C:\Program Files (x86)\PCPowerSpeed\PCPowerTray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
(Iminent) C:\Program Files (x86)\Iminent\Iminent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
() C:\Users\WIN\Desktop\Defogger.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12673128 2011-08-16] (Realtek Semiconductor)
HKLM-x32\...\Run: [CLMLServer] - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [107816 2010-08-04] (CyberLink)
HKLM-x32\...\Run: [ControlCenter4] - C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [139264 2011-04-20] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [IminentMessenger] - C:\Program Files (x86)\Iminent\Iminent.Messengers.exe [884784 2013-10-29] (Iminent)
HKLM-x32\...\Run: [InboxToolbar] - C:\Program Files (x86)\Inbox Toolbar\Inbox.exe [1380288 2014-01-13] (Xacti, LLC)
HKLM-x32\...\Run: [PCPowerSpeed] - C:\Program Files (x86)\PCPowerSpeed\PCPowerTray.exe [383336 2014-02-28] (Crawler.com)
HKU\S-1-5-21-3184401558-10003487-3650169653-1001\...\Run: [BackgroundContainer] - "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\WIN\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun <===== ATTENTION
HKU\S-1-5-21-3184401558-10003487-3650169653-1001\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2013-02-05] (Google Inc.)
IFEO\bitguard.exe: [Debugger] tasklist.exe
IFEO\bprotect.exe: [Debugger] tasklist.exe
IFEO\bpsvc.exe: [Debugger] tasklist.exe
IFEO\browsemngr.exe: [Debugger] tasklist.exe
IFEO\browserdefender.exe: [Debugger] tasklist.exe
IFEO\browsermngr.exe: [Debugger] tasklist.exe
IFEO\browserprotect.exe: [Debugger] tasklist.exe
IFEO\browsersafeguard.exe: [Debugger] tasklist.exe
IFEO\bundlesweetimsetup.exe: [Debugger] tasklist.exe
IFEO\cltmngsvc.exe: [Debugger] tasklist.exe
IFEO\delta babylon.exe: [Debugger] tasklist.exe
IFEO\delta tb.exe: [Debugger] tasklist.exe
IFEO\delta2.exe: [Debugger] tasklist.exe
IFEO\deltainstaller.exe: [Debugger] tasklist.exe
IFEO\deltasetup.exe: [Debugger] tasklist.exe
IFEO\deltatb.exe: [Debugger] tasklist.exe
IFEO\deltatb_2501-c733154b.exe: [Debugger] tasklist.exe
IFEO\dprotectsvc.exe: [Debugger] tasklist.exe
IFEO\iminentsetup.exe: [Debugger] tasklist.exe
IFEO\protectedsearch.exe: [Debugger] tasklist.exe
IFEO\rjatydimofu.exe: [Debugger] tasklist.exe
IFEO\searchprotection.exe: [Debugger] tasklist.exe
IFEO\searchprotector.exe: [Debugger] tasklist.exe
IFEO\snapdo.exe: [Debugger] tasklist.exe
IFEO\stinst32.exe: [Debugger] tasklist.exe
IFEO\stinst64.exe: [Debugger] tasklist.exe
IFEO\sweetimsetup.exe: [Debugger] tasklist.exe
IFEO\tbdelta.exetoolbar783881609.exe: [Debugger] tasklist.exe
IFEO\utiljumpflip.exe: [Debugger] tasklist.exe
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?publisher=AdKnowledgeYB&dpid=AdKnowledgeYB&co=DE&userid=0c975f8c-e63d-a644-8ea0-7138087bdbf4&searchtype=ds&q={searchTerms}&installDate=09/12/2013
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.search.ask.com/?o=APN10646A&gct=hp&d=102-304&v=n11496-275&t=4
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1386440405&from=tugs&uid=HitachiXHDS721010DLE630_MSK5235H1KE6TG1KE6TGX
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snapdo.com/?publisher=AdKnowledgeYB&dpid=AdKnowledgeYB&co=DE&userid=0c975f8c-e63d-a644-8ea0-7138087bdbf4&searchtype=ds&q={searchTerms}&installDate=09/12/2013
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1386440405&from=tugs&uid=HitachiXHDS721010DLE630_MSK5235H1KE6TG1KE6TGX&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1386440405&from=tugs&uid=HitachiXHDS721010DLE630_MSK5235H1KE6TG1KE6TGX
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.mysearchdial.com/?f=1&a=irmsd1103&cd=2XzuyEtN2Y1L1Qzuzz0Czzzy0AyD0AyE0A0FtAtAtA0C0CtDtN0D0Tzu0SyBtCtDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=789621803&ir=
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1386440405&from=tugs&uid=HitachiXHDS721010DLE630_MSK5235H1KE6TG1KE6TGX&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1386440405&from=tugs&uid=HitachiXHDS721010DLE630_MSK5235H1KE6TG1KE6TGX&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1386440405&from=tugs&uid=HitachiXHDS721010DLE630_MSK5235H1KE6TG1KE6TGX
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.mysearchdial.com/?f=1&a=irmsd1103&cd=2XzuyEtN2Y1L1Qzuzz0Czzzy0AyD0AyE0A0FtAtAtA0C0CtDtN0D0Tzu0SyBtCtDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=789621803&ir=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1386440405&from=tugs&uid=HitachiXHDS721010DLE630_MSK5235H1KE6TG1KE6TGX&q={searchTerms}
URLSearchHook: HKLM-x32 - (No Name) - {61f0d019-b016-4d56-9dae-7b7706cd6755} - No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.nationzoom.com/?type=sc&ts=1386440405&from=tugs&uid=HitachiXHDS721010DLE630_MSK5235H1KE6TG1KE6TGX
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1386440405&from=tugs&uid=HitachiXHDS721010DLE630_MSK5235H1KE6TG1KE6TGX&q={searchTerms}
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1386440405&from=tugs&uid=HitachiXHDS721010DLE630_MSK5235H1KE6TG1KE6TGX&q={searchTerms}
SearchScopes: HKLM - {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL =
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=304&systemid=102&v=n11496-275&apn_uid=2847480795334261&apn_dtid=BND102&o=APN10646&apn_ptnrs=AG7&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=AdKnowledgeYB&dpid=AdKnowledgeYB&co=DE&userid=0c975f8c-e63d-a644-8ea0-7138087bdbf4&searchtype=ds&q={searchTerms}&installDate=09/12/2013
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=AdKnowledgeYB&dpid=AdKnowledgeYB&co=DE&userid=0c975f8c-e63d-a644-8ea0-7138087bdbf4&searchtype=ds&q={searchTerms}&installDate=09/12/2013
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=304&systemid=102&v=n11496-275&apn_uid=2847480795334261&apn_dtid=BND102&o=APN10646&apn_ptnrs=AG7&q={searchTerms}
SearchScopes: HKLM-x32 - {BFFED5CA-8BDF-47CC-AED0-23F4E6D77732} URL = hxxp://start.iminent.com/?appId=52F72B4D-9F4F-4A5C-BD21-BD2995817FA4&ref=toolbox&q={searchTerms}
SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.trovigo.com/Results.aspx?gd=&ctid=CT3317933&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPF4F3D494-905D-42CF-AE6E-BE4374AD6FC3&q={searchTerms}&SSPV=
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd1103&cd=2XzuyEtN2Y1L1Qzuzz0Czzzy0AyD0AyE0A0FtAtAtA0C0CtDtN0D0Tzu0SyBtCtDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=789621803&ir=
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.trovigo.com/Results.aspx?gd=&ctid=CT3317933&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPF4F3D494-905D-42CF-AE6E-BE4374AD6FC3&q={searchTerms}&SSPV=
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKCU - {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = hxxp://feed.snapdo.com/?publisher=AdKnowledgeYB&dpid=AdKnowledgeYB&co=DE&userid=0c975f8c-e63d-a644-8ea0-7138087bdbf4&searchtype=ds&q={searchTerms}&installDate=09/12/2013
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=304&systemid=102&v=n11496-275&apn_uid=2847480795334261&apn_dtid=BND102&o=APN10646&apn_ptnrs=AG7&q={searchTerms}
SearchScopes: HKCU - {BFFED5CA-8BDF-47CC-AED0-23F4E6D77732} URL = hxxp://start.iminent.com/?appId=52F72B4D-9F4F-4A5C-BD21-BD2995817FA4&ref=toolbox&q={searchTerms}
BHO: media enhance - {11111111-1111-1111-1111-110411411150} - C:\Program Files (x86)\media enhance\media enhance-bho64.dll (feven)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: IMinent WebBooster (BHO) - {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - C:\Program Files (x86)\Iminent\Minibar.InternetExplorer.BHOx64.dll (SIEN)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Inbox Toolbar - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\Program Files (x86)\Inbox Toolbar\Inbox64.dll (Xacti, LLC)
BHO-x32: media enhance - {11111111-1111-1111-1111-110411411150} - C:\Program Files (x86)\media enhance\media enhance-bho.dll (feven)
BHO-x32: SaveSense - {71e129ff-6c2a-4984-818c-7e2c998b8d99} - C:\Users\WIN\AppData\Local\SaveSense\SaveSenseIE.dll (SaveSense)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: IMinent WebBooster (BHO) - {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - C:\Program Files (x86)\Iminent\Minibar.InternetExplorer.BHOx86.dll (SIEN)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKLM - &Inbox Toolbar - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - C:\Program Files (x86)\Inbox Toolbar\Inbox64.dll (Xacti, LLC)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU - No Name - {61F0D019-B016-4D56-9DAE-7B7706CD6755} - No File
DPF: HKLM-x32 {4FF78044-96B4-4312-A5B7-FDA3CB328095}
Handler: inbox - {37540F19-DD4C-478B-B2DF-C19281BCAF27} - C:\Program Files (x86)\Inbox Toolbar\Inbox64.dll (Xacti, LLC)
Handler-x32: inbox - {37540F19-DD4C-478B-B2DF-C19281BCAF27} - C:\Program Files (x86)\Inbox Toolbar\Inbox.dll (Xacti, LLC)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\WIN\AppData\Roaming\Mozilla\Firefox\Profiles\lp6fqsqi.default
FF user.js: detected! => C:\Users\WIN\AppData\Roaming\Mozilla\Firefox\Profiles\lp6fqsqi.default\user.js
FF DefaultSearchEngine: Mysearchdial
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_70.dll ()
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll ()
FF Plugin-x32: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.updaterss.com/SaveSenseLive Update;version=3 - C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll (SaveSense)
FF Plugin-x32: @tools.updaterss.com/SaveSenseLive Update;version=9 - C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll (SaveSense)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\WIN\AppData\Roaming\Mozilla\Firefox\Profiles\lp6fqsqi.default\searchplugins\Mysearchdial.xml
FF SearchPlugin: C:\Users\WIN\AppData\Roaming\Mozilla\Firefox\Profiles\lp6fqsqi.default\searchplugins\Web Search.xml
FF Extension: media enhance - C:\Users\WIN\AppData\Roaming\Mozilla\Firefox\Profiles\lp6fqsqi.default\Extensions\0c822a17-a68f-4066-9257-d229458d21ca@9c178d17-dc61-4aaf-b2da-1425ac7300ac.com [2014-03-06]
FF Extension: vis - C:\Users\WIN\AppData\Roaming\Mozilla\Firefox\Profiles\lp6fqsqi.default\Extensions\EFGLQA@78ETGYN-0W7FN789T87.COM [2013-10-31]
FF Extension: SaveSense - C:\Users\WIN\AppData\Roaming\Mozilla\Firefox\Profiles\lp6fqsqi.default\Extensions\{2d7886a0-85bb-4bf2-b684-ba92b4b21d23} [2014-02-02]
FF Extension: Value Apps - C:\Users\WIN\AppData\Roaming\Mozilla\Firefox\Profiles\lp6fqsqi.default\Extensions\{94cd2cc3-083f-49ba-a218-4cda4b4829fd} [2014-01-30]
FF Extension: MySearchDial NewTab - C:\Users\WIN\AppData\Roaming\Mozilla\Firefox\Profiles\lp6fqsqi.default\Extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8} [2013-12-11]
FF Extension: GMX MailCheck - C:\Users\WIN\AppData\Roaming\Mozilla\Firefox\Profiles\lp6fqsqi.default\Extensions\toolbar@gmx.net.xpi [2013-11-02]
FF Extension: Iminent - C:\Users\WIN\AppData\Roaming\Mozilla\Firefox\Profiles\lp6fqsqi.default\Extensions\webbooster@iminent.com.xpi [2013-10-31]
FF HKLM-x32\...\Firefox\Extensions: [ext@VideoPlayerV3beta7944.net] - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta7944\ff
FF Extension: Video Player - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta7944\ff [2014-01-18]
FF HKLM-x32\...\Firefox\Extensions: [ext@MediaPlayerV1alpha713.net] - C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha713\ff
FF Extension: Media Player - C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha713\ff [2014-01-30]
FF HKLM-x32\...\Firefox\Extensions: [ext@MediaViewV1alpha4510.net] - C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha4510\ff
FF Extension: Media View - C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha4510\ff [2014-03-03]
Chrome:
=======
CHR HomePage: hxxp://www.inbox.com/homepage.aspx?tbid=80742&iwk=297&lng=de
CHR DefaultSearchKeyword: inbox.com
CHR DefaultSearchProvider: Inbox
CHR DefaultSearchURL: hxxp://www2.inbox.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=80742&iwk=297&lng=de
CHR DefaultNewTabURL:
CHR Extension: (Google Docs) - C:\Users\WIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-02-02]
CHR Extension: (Google Drive) - C:\Users\WIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-02-02]
CHR Extension: (Inbox Toolbar) - C:\Users\WIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\apgjagobplilmcdfelodhgefiidomnfl [2014-03-06]
CHR Extension: (Media Player) - C:\Users\WIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\apjanoognlbkmkfjpeihpajidgfpomkl [2014-02-02]
CHR Extension: (YouTube) - C:\Users\WIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-02-02]
CHR Extension: (Google-Suche) - C:\Users\WIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-02-02]
CHR Extension: (media enhance) - C:\Users\WIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo [2014-03-06]
CHR Extension: (Video Player) - C:\Users\WIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\mbdibdlgbekocnodcjhjhfofjddomibm [2014-01-18]
CHR Extension: (Media View) - C:\Users\WIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\ncipodljkefmhlnniibmkjbbccmmknff [2014-03-03]
CHR Extension: (Google Wallet) - C:\Users\WIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-06]
CHR Extension: (Google Mail) - C:\Users\WIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-02-02]
CHR HKLM\...\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - C:\Users\WIN\AppData\Local\mysearchdial-speeddial.crx [2013-12-11]
CHR HKCU\...\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - C:\Users\WIN\AppData\Local\mysearchdial-speeddial.crx [2013-12-11]
CHR HKLM-x32\...\Chrome\Extension: [apgjagobplilmcdfelodhgefiidomnfl] - C:\Program Files (x86)\Inbox Toolbar\Chrome\ibxtoolbar_chr.crx [2014-02-28]
CHR HKLM-x32\...\Chrome\Extension: [ifohbjbgfchkkfhphahclmkpgejiplfo] - C:\Users\WIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtab.crx [2013-12-07]
CHR HKLM-x32\...\Chrome\Extension: [mbdibdlgbekocnodcjhjhfofjddomibm] - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta7944\ch\VideoPlayerV3beta7944.crx [2014-01-10]
CHR HKLM-x32\...\Chrome\Extension: [ncipodljkefmhlnniibmkjbbccmmknff] - C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha4510\ch\MediaViewV1alpha4510.crx [2014-02-27]
CHR HKLM-x32\...\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - C:\Users\WIN\AppData\Local\mysearchdial-speeddial.crx [2013-12-11]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 NewPlayerUpdaterService; C:\Program Files (x86)\NewPlayer\NewPlayerUpdaterService.exe [11776 2014-02-25] ()
R2 SProtection; C:\Program Files (x86)\Common Files\Umbrella\umbrella.exe [2922304 2014-03-04] (Iminent)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [2412344 2014-01-28] (TuneUp Software)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-19] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-19] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-28] (Avira Operations GmbH & Co. KG)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [11880 2012-11-16] (TuneUp Software)
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-03-10 16:26 - 2014-03-10 16:27 - 00022440 _____ () C:\Users\WIN\Desktop\FRST.txt
2014-03-10 16:26 - 2014-03-10 16:26 - 00000468 _____ () C:\Users\WIN\Desktop\defogger_disable.log
2014-03-10 16:26 - 2014-03-10 16:26 - 00000000 ____D () C:\FRST
2014-03-10 16:26 - 2014-03-10 16:26 - 00000000 _____ () C:\Users\WIN\defogger_reenable
2014-03-10 16:24 - 2014-03-10 16:24 - 00380416 _____ () C:\Users\WIN\Desktop\Gmer-19357.exe
2014-03-10 16:23 - 2014-03-10 16:23 - 02157056 _____ (Farbar) C:\Users\WIN\Desktop\FRST64.exe
2014-03-10 16:23 - 2014-03-10 16:23 - 00050477 _____ () C:\Users\WIN\Desktop\Defogger.exe
2014-03-10 16:00 - 2014-03-10 16:00 - 00013272 _____ () C:\Users\WIN\Documents\Fch E1.odt
2014-03-06 09:03 - 2014-03-10 13:25 - 00000168 _____ () C:\Windows\setupact.log
2014-03-06 09:03 - 2014-03-06 09:03 - 00000998 _____ () C:\Windows\PFRO.log
2014-03-06 09:03 - 2014-03-06 09:03 - 00000000 _____ () C:\Windows\setuperr.log
2014-03-06 09:01 - 2014-03-06 09:01 - 00000000 ___RD () C:\Users\WIN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-03-06 08:55 - 2014-03-06 08:56 - 00000378 _____ () C:\Windows\Tasks\APSnotifierCA.job
2014-03-06 08:55 - 2014-03-06 08:55 - 00003160 _____ () C:\Windows\System32\Tasks\APSnotifierCA
2014-03-06 08:55 - 2014-03-06 08:55 - 00000000 ____D () C:\Users\WIN\AppData\Local\Tuguu_SL
2014-03-06 08:53 - 2014-03-06 08:53 - 00001345 _____ () C:\Users\WIN\AppData\Roaming\aps.scan.results
2014-03-06 08:53 - 2014-03-06 08:53 - 00000605 _____ () C:\Users\WIN\AppData\Roaming\aps.scan.quick.results
2014-03-06 08:53 - 2014-03-06 08:53 - 00000000 ____D () C:\Users\WIN\AppData\Local\newplayer
2014-03-06 08:52 - 2014-03-10 14:52 - 00001572 _____ () C:\Windows\Tasks\media enhance-updater.job
2014-03-06 08:52 - 2014-03-10 14:52 - 00001526 _____ () C:\Windows\Tasks\media enhance-codedownloader.job
2014-03-06 08:52 - 2014-03-10 14:52 - 00001426 _____ () C:\Windows\Tasks\media enhance-enabler.job
2014-03-06 08:52 - 2014-03-06 08:52 - 00004602 _____ () C:\Windows\System32\Tasks\media enhance-updater
2014-03-06 08:52 - 2014-03-06 08:52 - 00004556 _____ () C:\Windows\System32\Tasks\media enhance-codedownloader
2014-03-06 08:52 - 2014-03-06 08:52 - 00004456 _____ () C:\Windows\System32\Tasks\media enhance-enabler
2014-03-06 08:52 - 2014-03-06 08:52 - 00001117 _____ () C:\Users\Public\Desktop\NewPlayer.lnk
2014-03-06 08:52 - 2014-03-06 08:52 - 00000000 ____D () C:\Program Files (x86)\NewPlayer
2014-03-06 08:51 - 2014-03-10 14:51 - 00003096 _____ () C:\Windows\Tasks\media enhance-chromeinstaller.job
2014-03-06 08:51 - 2014-03-10 14:51 - 00002350 _____ () C:\Windows\Tasks\media enhance-firefoxinstaller.job
2014-03-06 08:51 - 2014-03-06 08:52 - 00000000 ____D () C:\Program Files (x86)\media enhance
2014-03-06 08:51 - 2014-03-06 08:52 - 00000000 ____D () C:\Program Files (x86)\AnyProtectEx
2014-03-06 08:51 - 2014-03-06 08:51 - 01122960 _____ (AnyProtect.com) C:\Users\WIN\AppData\Local\nssAA06.tmp
2014-03-06 08:50 - 2014-03-06 08:50 - 00397800 _____ () C:\Users\WIN\Downloads\Setup (1).exe
2014-03-06 08:50 - 2014-03-06 08:50 - 00000000 ____D () C:\Users\WIN\AppData\Local\SearchProtect
2014-03-06 08:48 - 2014-03-06 08:48 - 00000000 ____D () C:\Users\WIN\AppData\Roaming\PCPowerSpeed
2014-03-06 08:48 - 2014-03-06 08:48 - 00000000 ____D () C:\ProgramData\PCPowerSpeed
2014-03-06 08:48 - 2014-03-06 08:48 - 00000000 ____D () C:\Program Files (x86)\PCPowerSpeed
2014-03-06 08:48 - 2014-03-06 08:48 - 00000000 ____D () C:\Program Files (x86)\Inbox Toolbar
2014-03-06 08:47 - 2014-03-06 08:47 - 02692000 _____ (Xacti, LLC ) C:\Users\WIN\Downloads\EmailNotifierSetup (1).exe
2014-03-04 08:57 - 2014-03-04 08:57 - 00220456 _____ (Fusion Install ) C:\Users\WIN\Downloads\Player-Chrome.exe
2014-03-03 08:33 - 2014-03-03 08:33 - 00000000 ____D () C:\Program Files (x86)\MediaViewV1
2014-03-03 08:11 - 2014-03-03 08:11 - 00000000 ____D () C:\ProgramData\BrowserProtect
2014-03-03 08:11 - 2014-03-03 08:11 - 00000000 ____D () C:\ProgramData\Browser Manager
2014-03-03 08:11 - 2014-03-03 08:11 - 00000000 ____D () C:\ProgramData\BitGuard
2014-03-03 07:38 - 2014-03-03 07:38 - 00862112 _____ (AirInstaller ) C:\Users\WIN\Downloads\setup.exe
2014-03-03 07:30 - 2014-03-03 07:36 - 00000000 ____D () C:\Users\WIN\AppData\Local\Torch
2014-03-03 07:30 - 2014-03-03 07:35 - 00000000 ____D () C:\Users\WIN\AppData\Local\jZip
2014-03-03 07:26 - 2014-03-03 07:27 - 01441952 _____ (Bandoo Media Inc) C:\Users\WIN\Downloads\jZipSetup-r304-n-bc.exe
2014-02-20 18:17 - 2014-03-05 08:36 - 00000000 ____D () C:\Users\WIN\Downloads\FC Holzheim - Fußballverein bei fussball-im-verein.de_files
2014-02-20 18:17 - 2014-02-20 18:17 - 00214686 _____ () C:\Users\WIN\Downloads\FC Holzheim - Fußballverein bei fussball-im-verein.de.htm
2014-02-14 21:10 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-14 21:10 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-02-14 21:09 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-14 21:09 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-14 21:09 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-14 21:09 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-14 21:09 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-14 21:09 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-14 21:09 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-14 21:09 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-14 21:09 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-14 21:09 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-14 21:09 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-14 21:09 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-14 21:09 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-14 21:09 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-14 21:09 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-14 21:09 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-14 21:09 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-14 21:09 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-14 21:09 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-14 21:09 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-14 21:09 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-14 21:09 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-14 21:09 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-14 21:09 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-14 21:09 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-14 21:09 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-14 21:09 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-14 21:09 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-14 21:09 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-14 21:09 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-14 21:09 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-14 21:09 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-14 21:09 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-14 21:09 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-14 21:09 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-14 21:09 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-14 21:09 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-14 21:09 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-14 21:09 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-14 09:09 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-02-14 09:09 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-02-14 09:09 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-02-14 09:09 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-02-14 09:09 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-14 09:09 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-02-14 09:09 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-02-14 09:09 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-02-14 09:09 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-02-14 09:09 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-02-14 09:09 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-02-14 09:09 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-02-14 09:09 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-02-14 09:09 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-02-14 09:09 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-02-14 09:09 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-02-14 09:09 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-02-14 09:09 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-02-14 09:09 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-02-14 09:09 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-02-14 09:09 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-02-14 09:09 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-02-14 09:09 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-02-14 09:09 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-02-14 09:09 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-02-14 09:09 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-02-14 09:09 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-02-14 09:09 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
==================== One Month Modified Files and Folders =======
2014-03-10 16:27 - 2014-03-10 16:26 - 00022440 _____ () C:\Users\WIN\Desktop\FRST.txt
2014-03-10 16:26 - 2014-03-10 16:26 - 00000468 _____ () C:\Users\WIN\Desktop\defogger_disable.log
2014-03-10 16:26 - 2014-03-10 16:26 - 00000000 ____D () C:\FRST
2014-03-10 16:26 - 2014-03-10 16:26 - 00000000 _____ () C:\Users\WIN\defogger_reenable
2014-03-10 16:26 - 2013-02-05 16:52 - 00000000 ____D () C:\Users\WIN
2014-03-10 16:24 - 2014-03-10 16:24 - 00380416 _____ () C:\Users\WIN\Desktop\Gmer-19357.exe
2014-03-10 16:24 - 2009-07-14 05:45 - 00017152 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-10 16:24 - 2009-07-14 05:45 - 00017152 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-10 16:23 - 2014-03-10 16:23 - 02157056 _____ (Farbar) C:\Users\WIN\Desktop\FRST64.exe
2014-03-10 16:23 - 2014-03-10 16:23 - 00050477 _____ () C:\Users\WIN\Desktop\Defogger.exe
2014-03-10 16:08 - 2013-02-15 21:33 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-03-10 16:00 - 2014-03-10 16:00 - 00013272 _____ () C:\Users\WIN\Documents\Fch E1.odt
2014-03-10 15:31 - 2014-02-06 09:02 - 00000348 _____ () C:\Windows\Tasks\AmiUpdXp.job
2014-03-10 15:29 - 2013-02-05 16:47 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-03-10 14:52 - 2014-03-06 08:52 - 00001572 _____ () C:\Windows\Tasks\media enhance-updater.job
2014-03-10 14:52 - 2014-03-06 08:52 - 00001526 _____ () C:\Windows\Tasks\media enhance-codedownloader.job
2014-03-10 14:52 - 2014-03-06 08:52 - 00001426 _____ () C:\Windows\Tasks\media enhance-enabler.job
2014-03-10 14:51 - 2014-03-06 08:51 - 00003096 _____ () C:\Windows\Tasks\media enhance-chromeinstaller.job
2014-03-10 14:51 - 2014-03-06 08:51 - 00002350 _____ () C:\Windows\Tasks\media enhance-firefoxinstaller.job
2014-03-10 13:45 - 2013-02-05 16:45 - 01102123 _____ () C:\Windows\WindowsUpdate.log
2014-03-10 13:26 - 2013-02-05 16:47 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-03-10 13:25 - 2014-03-06 09:03 - 00000168 _____ () C:\Windows\setupact.log
2014-03-10 13:25 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-09 12:43 - 2014-01-02 23:03 - 00000340 _____ () C:\Windows\Tasks\bench-sys.job
2014-03-06 09:03 - 2014-03-06 09:03 - 00000998 _____ () C:\Windows\PFRO.log
2014-03-06 09:03 - 2014-03-06 09:03 - 00000000 _____ () C:\Windows\setuperr.log
2014-03-06 09:01 - 2014-03-06 09:01 - 00000000 ___RD () C:\Users\WIN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-03-06 08:56 - 2014-03-06 08:55 - 00000378 _____ () C:\Windows\Tasks\APSnotifierCA.job
2014-03-06 08:56 - 2014-01-30 09:43 - 00000000 ____D () C:\Users\WIN\Documents\Optimizer Pro
2014-03-06 08:55 - 2014-03-06 08:55 - 00003160 _____ () C:\Windows\System32\Tasks\APSnotifierCA
2014-03-06 08:55 - 2014-03-06 08:55 - 00000000 ____D () C:\Users\WIN\AppData\Local\Tuguu_SL
2014-03-06 08:53 - 2014-03-06 08:53 - 00001345 _____ () C:\Users\WIN\AppData\Roaming\aps.scan.results
2014-03-06 08:53 - 2014-03-06 08:53 - 00000605 _____ () C:\Users\WIN\AppData\Roaming\aps.scan.quick.results
2014-03-06 08:53 - 2014-03-06 08:53 - 00000000 ____D () C:\Users\WIN\AppData\Local\newplayer
2014-03-06 08:52 - 2014-03-06 08:52 - 00004602 _____ () C:\Windows\System32\Tasks\media enhance-updater
2014-03-06 08:52 - 2014-03-06 08:52 - 00004556 _____ () C:\Windows\System32\Tasks\media enhance-codedownloader
2014-03-06 08:52 - 2014-03-06 08:52 - 00004456 _____ () C:\Windows\System32\Tasks\media enhance-enabler
2014-03-06 08:52 - 2014-03-06 08:52 - 00001117 _____ () C:\Users\Public\Desktop\NewPlayer.lnk
2014-03-06 08:52 - 2014-03-06 08:52 - 00000000 ____D () C:\Program Files (x86)\NewPlayer
2014-03-06 08:52 - 2014-03-06 08:51 - 00000000 ____D () C:\Program Files (x86)\media enhance
2014-03-06 08:52 - 2014-03-06 08:51 - 00000000 ____D () C:\Program Files (x86)\AnyProtectEx
2014-03-06 08:52 - 2013-02-28 18:04 - 00000000 ____D () C:\Windows\Minidump
2014-03-06 08:51 - 2014-03-06 08:51 - 01122960 _____ (AnyProtect.com) C:\Users\WIN\AppData\Local\nssAA06.tmp
2014-03-06 08:50 - 2014-03-06 08:50 - 00397800 _____ () C:\Users\WIN\Downloads\Setup (1).exe
2014-03-06 08:50 - 2014-03-06 08:50 - 00000000 ____D () C:\Users\WIN\AppData\Local\SearchProtect
2014-03-06 08:50 - 2013-03-08 19:36 - 00000000 _____ () C:\END
2014-03-06 08:48 - 2014-03-06 08:48 - 00000000 ____D () C:\Users\WIN\AppData\Roaming\PCPowerSpeed
2014-03-06 08:48 - 2014-03-06 08:48 - 00000000 ____D () C:\ProgramData\PCPowerSpeed
2014-03-06 08:48 - 2014-03-06 08:48 - 00000000 ____D () C:\Program Files (x86)\PCPowerSpeed
2014-03-06 08:48 - 2014-03-06 08:48 - 00000000 ____D () C:\Program Files (x86)\Inbox Toolbar
2014-03-06 08:47 - 2014-03-06 08:47 - 02692000 _____ (Xacti, LLC ) C:\Users\WIN\Downloads\EmailNotifierSetup (1).exe
2014-03-05 08:36 - 2014-02-20 18:17 - 00000000 ____D () C:\Users\WIN\Downloads\FC Holzheim - Fußballverein bei fussball-im-verein.de_files
2014-03-04 08:57 - 2014-03-04 08:57 - 00220456 _____ (Fusion Install ) C:\Users\WIN\Downloads\Player-Chrome.exe
2014-03-03 08:34 - 2014-01-02 23:03 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-03-03 08:33 - 2014-03-03 08:33 - 00000000 ____D () C:\Program Files (x86)\MediaViewV1
2014-03-03 08:31 - 2014-02-02 21:17 - 00000214 _____ () C:\Windows\system32\.crusader
2014-03-03 08:11 - 2014-03-03 08:11 - 00000000 ____D () C:\ProgramData\BrowserProtect
2014-03-03 08:11 - 2014-03-03 08:11 - 00000000 ____D () C:\ProgramData\Browser Manager
2014-03-03 08:11 - 2014-03-03 08:11 - 00000000 ____D () C:\ProgramData\BitGuard
2014-03-03 07:38 - 2014-03-03 07:38 - 00862112 _____ (AirInstaller ) C:\Users\WIN\Downloads\setup.exe
2014-03-03 07:36 - 2014-03-03 07:30 - 00000000 ____D () C:\Users\WIN\AppData\Local\Torch
2014-03-03 07:35 - 2014-03-03 07:30 - 00000000 ____D () C:\Users\WIN\AppData\Local\jZip
2014-03-03 07:27 - 2014-03-03 07:26 - 01441952 _____ (Bandoo Media Inc) C:\Users\WIN\Downloads\jZipSetup-r304-n-bc.exe
2014-02-23 11:39 - 2013-10-31 20:00 - 00000000 ____D () C:\Program Files (x86)\Iminent
2014-02-23 10:39 - 2014-02-02 21:07 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-02-23 10:08 - 2013-02-15 21:33 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-23 10:08 - 2013-02-15 21:33 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-23 10:08 - 2011-12-01 22:26 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-20 18:17 - 2014-02-20 18:17 - 00214686 _____ () C:\Users\WIN\Downloads\FC Holzheim - Fußballverein bei fussball-im-verein.de.htm
2014-02-20 17:55 - 2013-08-15 10:06 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-20 17:53 - 2011-07-18 21:31 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-02-15 11:50 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-02-14 21:11 - 2013-02-08 09:34 - 01594028 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-02-14 21:11 - 2011-05-16 15:04 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2014-02-14 21:11 - 2011-05-16 15:04 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2014-02-14 21:11 - 2009-07-14 06:13 - 01594028 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-14 09:24 - 2013-02-05 16:47 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-02-14 09:24 - 2013-02-05 16:47 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-02-09 08:41 - 2014-01-02 23:04 - 00000000 ____D () C:\Users\WIN\AppData\Roaming\newnext.me
Some content of TEMP:
====================
C:\Users\WIN\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-03-04 09:24
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- Gmer und Log File von Avira folgen noch Hier noch die Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 09-03-2014 02
Ran by WIN at 2014-03-10 16:27:28
Running from C:\Users\WIN\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Corel Graphics - Windows Shell Extension 64 Bit (Version: 15.2.686 - Corel Corporation) Hidden
FLV Player (HKCU\...\FLV Player) (Version: - )
Lollipop (HKCU\...\lollipop) (Version: - Lollipop Network, S.L.) <==== ATTENTION
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
NVIDIA Control Panel 285.93 (Version: 285.93 - NVIDIA Corporation) Hidden
NVIDIA Graphics Driver 285.93 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 285.93 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.109.718 - NVIDIA Corporation) Hidden
NVIDIA PhysX System Software 9.11.1111 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.11.1111 - NVIDIA Corporation)
NVIDIA Update 1.5.20 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.5.20 - NVIDIA Corporation)
NVIDIA Update Components (Version: 1.5.20 - NVIDIA Corporation) Hidden
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
==================== Restore Points =========================
09-02-2014 18:00:28 Windows-Sicherung
14-02-2014 20:09:03 Windows Update
18-02-2014 08:59:50 Windows-Sicherung
20-02-2014 16:52:12 Windows Update
26-02-2014 07:33:50 Windows-Sicherung
03-03-2014 06:17:24 Windows-Sicherung
10-03-2014 12:36:20 Windows-Sicherung
==================== Hosts content: ==========================
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {02138C40-ED17-4C62-AFA4-9C624A937EF7} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\TuneUp Utilities 2013\OneClick.exe [2014-01-28] (TuneUp Software)
Task: {17ACB186-EA2E-46ED-974D-EED518A9D2BD} - System32\Tasks\media enhance-chromeinstaller => C:\Program Files (x86)\media enhance\media enhance-chromeinstaller.exe [2014-03-06] (feven)
Task: {1BA3ED1A-1609-40F5-9670-5AA68BA3D96C} - System32\Tasks\BackgroundContainer Startup Task => Rundll32.exe "C:\Users\WIN\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun <==== ATTENTION
Task: {4BC164F9-5CA4-48BC-A8DB-F2B9CBC1B24E} - System32\Tasks\AffiliatedUpdate => C:\Users\WIN\AppData\Roaming\AFFILI~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {4C357CBD-26B6-4FCC-BE88-21FAF257AFA6} - System32\Tasks\RegistryDr_Start => C:\Program Files (x86)\Registry Dr\RegistryDr.exe <==== ATTENTION
Task: {5C99BCFA-02F5-4687-B29C-006EB568E9EB} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21] (Adobe Systems Incorporated)
Task: {5EBAD8D4-D153-4A09-B282-8D5009F09085} - System32\Tasks\media enhance-firefoxinstaller => C:\Program Files (x86)\media enhance\media enhance-firefoxinstaller.exe [2014-03-06] (feven)
Task: {5F383A17-8E8C-4181-80B5-7E940EDC7A33} - System32\Tasks\DealPly => C:\Users\WIN\AppData\Roaming\DealPly\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {5F5E9F14-EBDB-450E-8F1A-742030A6BDA0} - System32\Tasks\media enhance-codedownloader => C:\Program Files (x86)\media enhance\media enhance-codedownloader.exe [2014-03-06] (feven)
Task: {7267BB9F-3723-47D6-91EC-353636711924} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-02-05] (Google Inc.)
Task: {796C644E-1BB4-4667-8762-4F32C64B8959} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
Task: {7D60D6E8-3D33-4A9B-B798-AC56C41C47F3} - System32\Tasks\bench-sys => C:\Program Files (x86)\Bench\Updater\updater.exe [2013-12-20] () <==== ATTENTION
Task: {81F158BA-3324-45D3-B319-3C3BD088B7B4} - System32\Tasks\MySearchDial => C:\Users\WIN\AppData\Roaming\MYSEAR~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {915FBCCA-F9A9-4514-A8DD-1E66C7A6906C} - System32\Tasks\RegistryDr_Popup => C:\Program Files (x86)\Registry Dr\Splash.exe <==== ATTENTION
Task: {93DEA818-A789-4D00-9636-AABE7D127E10} - System32\Tasks\media enhance-updater => C:\Program Files (x86)\media enhance\media enhance-updater.exe [2014-03-06] (feven)
Task: {9536D4BA-AE8C-4B64-B384-BD7C70927653} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-23] (Adobe Systems Incorporated)
Task: {96174ED6-B1B4-4205-BBE7-E85D042F2C0A} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {9EF64820-37F5-463B-BF33-10EE7C6CEB9B} - System32\Tasks\APSnotifierCA => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe [2014-03-06] (AnyProtect by CMI)
Task: {A1C2B11C-14BD-460C-BA64-BEC017E15194} - System32\Tasks\AmiUpdXp => C:\Users\WIN\AppData\Local\SwvUpdater\Updater.exe [2014-02-06] () <==== ATTENTION
Task: {E1383062-05FD-4288-A8C1-7F21928E5F25} - System32\Tasks\media enhance-enabler => C:\Program Files (x86)\media enhance\media enhance-enabler.exe [2014-03-06] (feven) <==== ATTENTION
Task: {F1C3C5AD-C9E8-4BA2-B499-71B0D735FE81} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-02-05] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\AmiUpdXp.job => C:\Users\WIN\AppData\Local\SwvUpdater\Updater.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierCA.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe
Task: C:\Windows\Tasks\bench-sys.job => C:\Program Files (x86)\Bench\Updater\updater.exe <==== ATTENTION
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\media enhance-chromeinstaller.job => C:\Program Files (x86)\media enhance\media enhance-chromeinstaller.exe
Task: C:\Windows\Tasks\media enhance-codedownloader.job => C:\Program Files (x86)\media enhance\media enhance-codedownloader.exe
Task: C:\Windows\Tasks\media enhance-enabler.job => C:\Program Files (x86)\media enhance\media enhance-enabler.exe <==== ATTENTION
Task: C:\Windows\Tasks\media enhance-firefoxinstaller.job => C:\Program Files (x86)\media enhance\media enhance-firefoxinstaller.exe
Task: C:\Windows\Tasks\media enhance-updater.job => C:\Program Files (x86)\media enhance\media enhance-updater.exe
==================== Loaded Modules (whitelisted) =============
2014-02-25 16:00 - 2014-02-25 16:00 - 00011776 _____ () C:\Program Files (x86)\NewPlayer\NewPlayerUpdaterService.exe
2013-02-12 16:20 - 2005-04-22 05:36 - 00143360 ____R () C:\Windows\system32\BrSNMP64.dll
2014-01-28 09:37 - 2014-01-28 09:37 - 00741176 _____ () C:\Program Files (x86)\TuneUp Utilities 2013\avgrepliba.dll
2014-03-10 16:23 - 2014-03-10 16:23 - 00050477 _____ () C:\Users\WIN\Desktop\Defogger.exe
2013-02-19 19:00 - 2013-02-19 18:58 - 00397704 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2013-02-12 16:19 - 2009-02-27 16:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\Temp:373E1720
==================== Safe Mode (whitelisted) ===================
==================== Disabled items from MSCONFIG ==============
MSCONFIG\startupreg: BrStsMon00 => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe /AUTORUN
MSCONFIG\startupreg: IAStorIcon => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
MSCONFIG\startupreg: Iminent => C:\Program Files (x86)\Iminent\Iminent.exe /warmup "F77F87E5-A6BD-4922-A530-EDF63D7E9F8C"
MSCONFIG\startupreg: PaperPort PTD => "C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe"
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (03/10/2014 01:38:32 PM) (Source: Windows Backup) (User: )
Description: Die Sicherung war nicht erfolgreich. Fehler: "Am Sicherungsspeicherort ist nicht genügend freier Speicherplatz verfügbar, um die Daten zu sichern. (0x80780048)"
Error: (03/10/2014 01:26:18 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: taskeng.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce79d2c
Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeb033f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000027de
ID des fehlerhaften Prozesses: 0x4dc
Startzeit der fehlerhaften Anwendung: 0xtaskeng.exe0
Pfad der fehlerhaften Anwendung: taskeng.exe1
Pfad des fehlerhaften Moduls: taskeng.exe2
Berichtskennung: taskeng.exe3
Error: (03/09/2014 01:48:01 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: taskeng.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce79d2c
Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeb033f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000027de
ID des fehlerhaften Prozesses: 0xea8
Startzeit der fehlerhaften Anwendung: 0xtaskeng.exe0
Pfad der fehlerhaften Anwendung: taskeng.exe1
Pfad des fehlerhaften Moduls: taskeng.exe2
Berichtskennung: taskeng.exe3
Error: (03/06/2014 09:03:54 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: taskeng.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce79d2c
Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeb033f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000027de
ID des fehlerhaften Prozesses: 0x4ec
Startzeit der fehlerhaften Anwendung: 0xtaskeng.exe0
Pfad der fehlerhaften Anwendung: taskeng.exe1
Pfad des fehlerhaften Moduls: taskeng.exe2
Berichtskennung: taskeng.exe3
Error: (03/06/2014 08:45:49 AM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Die Daten sind unzulässig.
.
Error: (03/06/2014 08:45:46 AM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Die Daten sind unzulässig.
.
Error: (03/06/2014 08:44:41 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: taskeng.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce79d2c
Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeb033f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000027de
ID des fehlerhaften Prozesses: 0x510
Startzeit der fehlerhaften Anwendung: 0xtaskeng.exe0
Pfad der fehlerhaften Anwendung: taskeng.exe1
Pfad des fehlerhaften Moduls: taskeng.exe2
Berichtskennung: taskeng.exe3
Error: (03/05/2014 08:14:33 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: taskeng.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce79d2c
Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeb033f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000027de
ID des fehlerhaften Prozesses: 0x578
Startzeit der fehlerhaften Anwendung: 0xtaskeng.exe0
Pfad der fehlerhaften Anwendung: taskeng.exe1
Pfad des fehlerhaften Moduls: taskeng.exe2
Berichtskennung: taskeng.exe3
Error: (03/04/2014 05:22:01 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: taskeng.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce79d2c
Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeb033f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000027de
ID des fehlerhaften Prozesses: 0xb6c
Startzeit der fehlerhaften Anwendung: 0xtaskeng.exe0
Pfad der fehlerhaften Anwendung: taskeng.exe1
Pfad des fehlerhaften Moduls: taskeng.exe2
Berichtskennung: taskeng.exe3
Error: (03/04/2014 01:22:00 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: taskeng.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce79d2c
Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeb033f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000027de
ID des fehlerhaften Prozesses: 0xd80
Startzeit der fehlerhaften Anwendung: 0xtaskeng.exe0
Pfad der fehlerhaften Anwendung: taskeng.exe1
Pfad des fehlerhaften Moduls: taskeng.exe2
Berichtskennung: taskeng.exe3
System errors:
=============
Error: (03/09/2014 00:31:08 PM) (Source: Microsoft-Windows-Kernel-General) (User: NT-AUTORITÄT)
Description: 0x8000002a171\??\Volume{14522d5d-6ff6-11e2-9026-806e6f6e6963}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{813C80FC-695A-4ECF-BA90-0710FCC2BBD8}
Error: (03/09/2014 00:30:33 PM) (Source: Microsoft-Windows-Kernel-General) (User: NT-AUTORITÄT)
Description: 0x8000002a171\??\Volume{14522d5d-6ff6-11e2-9026-806e6f6e6963}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{8836FFCD-0140-4445-8491-6E03EE83A9C6}
Error: (03/04/2014 09:35:15 AM) (Source: Microsoft-Windows-Kernel-General) (User: NT-AUTORITÄT)
Description: 0x8000002a171\??\Volume{14522d5d-6ff6-11e2-9026-806e6f6e6963}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{1554BA53-2FCA-4754-899B-3314BEF61BDF}
Error: (03/04/2014 09:34:35 AM) (Source: Microsoft-Windows-Kernel-General) (User: NT-AUTORITÄT)
Description: 0x8000002a171\??\Volume{14522d5d-6ff6-11e2-9026-806e6f6e6963}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{41095225-8D1D-4913-8965-B5985724E908}
Error: (03/03/2014 08:32:27 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "HitmanPro 3.7 Crusader (Boot)" wurde mit folgendem dienstspezifischem Fehler beendet: %%0.
Error: (03/03/2014 07:43:02 AM) (Source: bowser) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{5FDEDADD-6F28-4D36-BCAE-1F7B6B0DE51A}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
Error: (03/03/2014 07:31:46 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Torch Crash Handler" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (03/03/2014 07:27:56 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Datamngr Coordinator" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (02/18/2014 00:05:32 PM) (Source: Service Control Manager) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Start" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Error: (02/18/2014 00:05:32 PM) (Source: Service Control Manager) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Start" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Microsoft Office Sessions:
=========================
Error: (03/10/2014 01:38:32 PM) (Source: Windows Backup)(User: )
Description: Am Sicherungsspeicherort ist nicht genügend freier Speicherplatz verfügbar, um die Daten zu sichern. (0x80780048)
Error: (03/10/2014 01:26:18 PM) (Source: Application Error)(User: )
Description: taskeng.exe6.1.7601.175144ce79d2cmsvcrt.dll7.0.7601.177444eeb033fc000000500000000000027de4dc01cf3c5bdfc1ad5dC:\Windows\system32\taskeng.exeC:\Windows\system32\msvcrt.dll2dde0d35-a84f-11e3-b3e2-8c89a5a4af33
Error: (03/09/2014 01:48:01 PM) (Source: Application Error)(User: )
Description: taskeng.exe6.1.7601.175144ce79d2cmsvcrt.dll7.0.7601.177444eeb033fc000000500000000000027deea801cf3b95cd735d4dC:\Windows\system32\taskeng.exeC:\Windows\system32\msvcrt.dll0c427ee8-a789-11e3-b828-8c89a5a4af33
Error: (03/06/2014 09:03:54 AM) (Source: Application Error)(User: )
Description: taskeng.exe6.1.7601.175144ce79d2cmsvcrt.dll7.0.7601.177444eeb033fc000000500000000000027de4ec01cf3912934dd67cC:\Windows\system32\taskeng.exeC:\Windows\system32\msvcrt.dlldc0d6843-a505-11e3-bda0-8c89a5a4af33
Error: (03/06/2014 08:45:49 AM) (Source: Microsoft-Windows-CAPI2)(User: )
Description: hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabDie Daten sind unzulässig.
Error: (03/06/2014 08:45:46 AM) (Source: Microsoft-Windows-CAPI2)(User: )
Description: hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabDie Daten sind unzulässig.
Error: (03/06/2014 08:44:41 AM) (Source: Application Error)(User: )
Description: taskeng.exe6.1.7601.175144ce79d2cmsvcrt.dll7.0.7601.177444eeb033fc000000500000000000027de51001cf390fe58ab937C:\Windows\system32\taskeng.exeC:\Windows\system32\msvcrt.dll2cdfcde7-a503-11e3-b8b9-8c89a5a4af33
Error: (03/05/2014 08:14:33 AM) (Source: Application Error)(User: )
Description: taskeng.exe6.1.7601.175144ce79d2cmsvcrt.dll7.0.7601.177444eeb033fc000000500000000000027de57801cf384284a07a44C:\Windows\system32\taskeng.exeC:\Windows\system32\msvcrt.dllccdf81bc-a435-11e3-8258-8c89a5a4af33
Error: (03/04/2014 05:22:01 PM) (Source: Application Error)(User: )
Description: taskeng.exe6.1.7601.175144ce79d2cmsvcrt.dll7.0.7601.177444eeb033fc000000500000000000027deb6c01cf37c5de9e3fa8C:\Windows\system32\taskeng.exeC:\Windows\system32\msvcrt.dll1d62b2e2-a3b9-11e3-83b1-8c89a5a4af33
Error: (03/04/2014 01:22:00 PM) (Source: Application Error)(User: )
Description: taskeng.exe6.1.7601.175144ce79d2cmsvcrt.dll7.0.7601.177444eeb033fc000000500000000000027ded8001cf37a4578c4620C:\Windows\system32\taskeng.exeC:\Windows\system32\msvcrt.dll95b95b4f-a397-11e3-83b1-8c89a5a4af33
==================== Memory info ===========================
Percentage of memory in use: 36%
Total physical RAM: 4077.64 MB
Available physical RAM: 2602.57 MB
Total Pagefile: 8153.46 MB
Available Pagefile: 6555.18 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: (Boot) (Fixed) (Total:880.41 GB) (Free:833.5 GB) NTFS
Drive d: (Recover) (Fixed) (Total:50 GB) (Free:14.53 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 932 GB) (Disk ID: 58F6BA5B)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=880 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=50 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=1 GB) - (Type=12)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-03-10 16:39:51
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Hitachi_HDS721010DLE630 rev.MS2OA600 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\WIN\AppData\Local\Temp\pftdqpow.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff800033c1000 45 bytes [00, 00, 15, 02, 46, 69, 6C, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575 fffff800033c102f 16 bytes [00, 00, 00, 00, 00, 00, 00, ...]
.text C:\Windows\System32\win32k.sys!W32pServiceTable fffff96000163e00 7 bytes [00, 96, F3, FF, 01, A1, F0]
.text C:\Windows\System32\win32k.sys!W32pServiceTable + 8 fffff96000163e08 3 bytes [C0, 06, 02]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Common Files\Umbrella\umbrella.exe[1908] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075751465 2 bytes [75, 75]
.text C:\Program Files (x86)\Common Files\Umbrella\umbrella.exe[1908] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000757514bb 2 bytes [75, 75]
.text ... * 2
.text C:\Users\WIN\Desktop\Defogger.exe[3636] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075751465 2 bytes [75, 75]
.text C:\Users\WIN\Desktop\Defogger.exe[3636] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000757514bb 2 bytes [75, 75]
.text ... * 2
---- User IAT/EAT - GMER 2.1 ----
IAT C:\Windows\system32\winlogon.exe[712] @ C:\Windows\system32\uxtheme.dll[KERNEL32.dll!GetProcAddress] [7fefb0e2960] c:\windows\system32\uxtuneup.dll
IAT C:\Windows\system32\winlogon.exe[712] @ C:\Windows\system32\uxtheme.dll[KERNEL32.dll!ReadFile] [7fefb0e2840] c:\windows\system32\uxtuneup.dll
IAT C:\Windows\system32\winlogon.exe[712] @ C:\Windows\system32\themeservice.dll[KERNEL32.dll!GetProcAddress] [7fefb0e2960] c:\windows\system32\uxtuneup.dll
IAT C:\Windows\system32\winlogon.exe[712] @ C:\Windows\system32\themeservice.dll[KERNEL32.dll!ReadFile] [7fefb0e2840] c:\windows\system32\uxtuneup.dll
IAT C:\Windows\system32\svchost.exe[456] @ c:\windows\system32\themeservice.dll[KERNEL32.dll!GetProcAddress] [7fefb0e2960] c:\windows\system32\uxtuneup.dll
IAT C:\Windows\system32\svchost.exe[456] @ c:\windows\system32\themeservice.dll[KERNEL32.dll!ReadFile] [7fefb0e2840] c:\windows\system32\uxtuneup.dll
IAT C:\Windows\system32\svchost.exe[456] @ C:\Windows\system32\uxtheme.dll[KERNEL32.dll!GetProcAddress] [7fefb0e2960] c:\windows\system32\uxtuneup.dll
IAT C:\Windows\system32\svchost.exe[456] @ C:\Windows\system32\uxtheme.dll[KERNEL32.dll!ReadFile] [7fefb0e2840] c:\windows\system32\uxtuneup.dll
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
|
| Themen zu Ständig nervige Popups und langsames Internet |
| adware/adware.gen, adware/adware.gen2, adware/adware.gen7, adware/agentcv.a.164, cpu, hoffe, home premium, inter, internet, langsames, langsames internet, mobogenie, mobogenie entfernen, nationzoom, nationzoom entfernen, popups, premium, spyhunter, spyhunter entfernen, ständige, surfe, tagen, verschiedene |
Baum-Darstellung