![]() |
|
Log-Analyse und Auswertung: BProtector auf Windows 7 - mal wieder...Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
![]() | #1 |
| ![]() BProtector auf Windows 7 - mal wieder... Guten morgen, auch bei mir gibt es das Problem mit BProtector. Alle Logs habe ich mal angehängt. Gibt es noch eine Möglichkeit, überhaupt zu helfen ? Danke schon mal im voraus, Philipp Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1) Log created at 09:24 on 30/03/2014 (Philipp) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014 Ran by Philipp (administrator) on PHILIPP-PC on 30-03-2014 08:54:03 Running from C:\Users\Philipp\Downloads Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 9 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\system32\atiesrxx.exe (AMD) C:\Windows\system32\atieclxx.exe (337 Technology Limited.) C:\Program Files (x86)\Desk 365\deskSvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (France Telecom SA) C:\Program Files (x86)\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe (Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (SafeNet Inc.) C:\Windows\system32\hasplms.exe (HP) C:\Windows\system32\HPSIsvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe (NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (Samsung Electronics Co., Ltd.) C:\Windows\system32\spool\drivers\x64\3\NetFaxServer64.exe (Acer Group) C:\Program Files\Acer\Acer Updater\UpdaterService.exe (cake bake) C:\Program Files (x86)\Betcat\WBDesktop.Updater.1.0.0.16.exe (Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrl.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Bake Cake) C:\Users\Philipp\AppData\Roaming\Betcat\WebCakeDesktop.exe (337 Technology Limited.) C:\Program Files (x86)\Desk 365\desk365.exe (Smartbar) C:\Users\Philipp\AppData\Local\Smartbar\Application\QuickShare.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\NaturallySpeaking10\Program\natspeak.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\Widgets\YahooWidgets.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Mindjet) C:\Program Files (x86)\Mindjet\MindManager 7\MmReminderService.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe (France Telecom SA) C:\Program Files (x86)\CardDetector\HUAWEI1752_1552\CardDetector.exe () C:\Windows\Samsung\PanelMgr\SSMMgr.exe (Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (InstallShield Software Corporation) C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe () C:\Windows\Samsung\PanelMgr\caller64.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Microsoft Corporation) C:\Windows\System32\alg.exe (Nuance Communications, Inc.) C:\Program Files (x86)\Common Files\Nuance\NaturallySpeaking10\dgnuiasvr.exe (ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe (TOSHIBA CORPORATION) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (Nuance Communications, Inc.) C:\Program Files (x86)\Common Files\Nuance\NaturallySpeaking10\dgnuiasvr_x64.exe () C:\Users\Philipp\AppData\Local\Smartbar\Application\Lrcnta.exe (TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe (TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe (TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe (TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtBty.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\avscan.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Users\Philipp\Downloads\IE11-Windows6.1.exe (Microsoft Corporation) C:\Windows\system32\dism.exe (Microsoft Corporation) C:\Users\Philipp\AppData\Local\Temp\0764230C-9E3B-4D36-9DA8-D9EF001BAF31\dismhost.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Ipswitch) C:\Program Files (x86)\Ipswitch\WS_FTP 12\WsftpCOMHelper.exe (Microsoft Corporation) C:\Windows\sysWow64\SearchProtocolHost.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [mwlDaemon] - C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552 2010-05-27] (Egis Technology Inc.) HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10920552 2010-06-22] (Realtek Semiconductor) HKLM\...\Run: [ETDWare] - C:\Program Files\Elantech\ETDCtrl.exe [649608 2010-04-13] (ELAN Microelectronic Corp.) HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [861216 2010-06-11] (Acer Incorporated) HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation) HKLM-x32\...\Run: [SuiteTray] - C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [337264 2010-05-27] (Egis Technology Inc.) HKLM-x32\...\Run: [EgisUpdate] - C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [201584 2010-03-11] (Egis Technology Inc.) HKLM-x32\...\Run: [EgisTecPMMUpdate] - C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [407920 2010-03-11] (Egis Technology Inc.) HKLM-x32\...\Run: [Norton Online Backup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-02] (Symantec Corporation) HKLM-x32\...\Run: [BackupManagerTray] - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [265984 2010-06-29] (NewTech Infosystems, Inc.) HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [975952 2010-08-10] (Dritek System Inc.) HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-08-25] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2011-01-30] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [843712 2012-01-03] (Adobe Systems Incorporated) HKLM-x32\...\Run: [MMReminderService] - C:\Program Files (x86)\Mindjet\MindManager 7\MMReminderService.exe [37392 2007-05-18] (Mindjet) HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2010-11-29] (Apple Inc.) HKLM-x32\...\Run: [ITSecMng] - C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [83336 2009-07-22] (TOSHIBA CORPORATION) HKLM-x32\...\Run: [MyApplication] - svehost.exe HKLM-x32\...\Run: [CardDetectorHUAWEI1752_1552] - C:\Program Files (x86)\CardDetector\HUAWEI1752_1552\CardDetector.exe [287472 2009-11-12] (France Telecom SA) HKLM-x32\...\Run: [BEWINTERNET-CHSessionManager] - C:\Program Files (x86)\Internet Everywhere\IEWCH_8.0\SessionManager\SessionManager.exe [140016 2009-11-12] (France Telecom SA) HKLM-x32\...\Run: [Samsung PanelMgr] - C:\Windows\Samsung\PanelMgr\ssmmgr.exe [618496 2010-06-07] () HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-02-19] (Geek Software GmbH) HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [SSBkgdUpdate] - C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [210472 2006-10-25] (Nuance Communications, Inc.) HKLM-x32\...\Run: [ISUSScheduler] - C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [81920 2005-02-16] (InstallShield Software Corporation) HKLM-x32\...\Run: [DNS7reminder] - C:\Program Files (x86)\Nuance\NaturallySpeaking10\Ereg\Ereg.exe [259624 2007-04-16] (Nuance Communications, Inc.) HKLM-x32\...\Run: [IATSKY] - C:\Program Files (x86)\ELV Mini-Sound-Modul\iatsky.exe HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation) HKU\.DEFAULT\...\RunOnce: [SPReview] - C:\Windows\System32\SPReview\SPReview.exe [301568 2013-03-20] (Microsoft Corporation) HKU\S-1-5-21-2499104989-183997506-3760272782-1000\...\Run: [{36C52FD9-9B1F-C5E1-5D3D-FCD4F943678F}] - C:\Users\Philipp\AppData\Roaming\Enp\lyufpiy.exe HKU\S-1-5-21-2499104989-183997506-3760272782-1000\...\Run: [] - [X] HKU\S-1-5-21-2499104989-183997506-3760272782-1000\...\Run: [NoteTaker] - -silent HKU\S-1-5-21-2499104989-183997506-3760272782-1000\...\Run: [ISUSPM Startup] - C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe [221184 2005-02-16] (InstallShield Software Corporation) HKU\S-1-5-21-2499104989-183997506-3760272782-1000\...\Run: [WebCake Desktop] - C:\Users\Philipp\AppData\Roaming\Betcat\WebCakeDesktop.exe [52504 2013-08-11] (Bake Cake) HKU\S-1-5-21-2499104989-183997506-3760272782-1000\...\Run: [Desk 365] - C:\Program Files (x86)\Desk 365\desk365.exe [1011792 2013-10-19] (337 Technology Limited.) HKU\S-1-5-21-2499104989-183997506-3760272782-1000\...\Run: [Browser Infrastructure Helper] - C:\Users\Philipp\AppData\Local\Smartbar\Application\QuickShare.exe [26904 2014-03-09] (Smartbar) HKU\S-1-5-21-2499104989-183997506-3760272782-1000\...\MountPoints2: E - E:\AutoRun.exe HKU\S-1-5-21-2499104989-183997506-3760272782-1000\...\MountPoints2: F - F:\AutoRun.exe HKU\S-1-5-21-2499104989-183997506-3760272782-1000\...\MountPoints2: {01f994b1-b077-11e1-be96-1c75081ddbad} - E:\MicroLauncher.exe HKU\S-1-5-21-2499104989-183997506-3760272782-1000\...\MountPoints2: {173dbd17-3ad2-11e3-9095-1c75081ddbad} - E:\laucher.exe HKU\S-1-5-21-2499104989-183997506-3760272782-1000\...\MountPoints2: {74edd735-dcf1-11e0-b0ba-1c75081ddbad} - E:\AutoRun.exe HKU\S-1-5-21-2499104989-183997506-3760272782-1000\...\MountPoints2: {74edd738-dcf1-11e0-b0ba-1c75081ddbad} - E:\AutoRun.exe HKU\S-1-5-21-2499104989-183997506-3760272782-1000\...\MountPoints2: {74edd744-dcf1-11e0-b0ba-1c75081ddbad} - E:\AutoRun.exe HKU\S-1-5-21-2499104989-183997506-3760272782-1000\...\MountPoints2: {74edd747-dcf1-11e0-b0ba-1c75081ddbad} - E:\AutoRun.exe HKU\S-1-5-21-2499104989-183997506-3760272782-1000\...\MountPoints2: {972d0e19-377b-11e0-bce6-1c75081ddbad} - F:\AutoRun.exe HKU\S-1-5-21-2499104989-183997506-3760272782-1000\...\MountPoints2: {a9fea487-2e29-11e1-9845-46ac4c3b72a0} - E:\TING.EXE HKU\S-1-5-21-2499104989-183997506-3760272782-1000\...\MountPoints2: {ac757c00-265f-11e0-ad85-1c75081ddbad} - E:\AutoRun.exe HKU\S-1-5-21-2499104989-183997506-3760272782-1000\...\MountPoints2: {ac757c05-265f-11e0-ad85-1c75081ddbad} - F:\AutoRun.exe HKU\S-1-5-21-2499104989-183997506-3760272782-1000\...\MountPoints2: {b85f3449-28ee-11e1-a821-5cac4c3b72a0} - E:\AutoRun.exe HKU\S-1-5-21-2499104989-183997506-3760272782-1000\...\MountPoints2: {b85f344e-28ee-11e1-a821-5cac4c3b72a0} - E:\AutoRun.exe HKU\S-1-5-21-2499104989-183997506-3760272782-1000\...\MountPoints2: {c372d44f-27d1-11e1-a792-1c75081ddbad} - E:\AutoRun.exe HKU\S-1-5-21-2499104989-183997506-3760272782-1000\...\MountPoints2: {dbf6bcc5-1147-11e1-9c2e-1c75081ddbad} - E:\AutoRun.exe HKU\S-1-5-21-2499104989-183997506-3760272782-1000\...409d6c4515e9\InprocServer32: [Default-shell32] C:\$Recycle.Bin\S-1-5-21-2499104989-183997506-3760272782-1000\$26a64402086a4e27670db5795d3e8ffb\n. ATTENTION! ====> ZeroAccess? AppInit_DLLs: c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll => C:\ProgramData\BitGuard\2.7.1832.68\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\loader.dll [1958880 2013-11-18] () AppInit_DLLs: c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll => c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll File Not Found Startup: C:\Users\Philipp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dragon NaturallySpeaking.lnk ShortcutTarget: Dragon NaturallySpeaking.lnk -> C:\Program Files (x86)\Nuance\NaturallySpeaking10\Program\natspeak.exe (Nuance Communications, Inc.) Startup: C:\Users\Philipp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation) Startup: C:\Users\Philipp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () Startup: C:\Users\Philipp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Yahoo! Widgets.lnk ShortcutTarget: Yahoo! Widgets.lnk -> C:\Program Files (x86)\Yahoo!\Widgets\YahooWidgets.exe (Yahoo! Inc.) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbHdKIqgRJyMidKuvnhDCuxhZjwitu2603iO2DKCmN--NXUfc66EsMGTES9LK2_gvfgsYMxCRLASIE52qtxpPB9-FwXRSP4kuAQf_bOXybdR-8dodUq4-NEvP0q3zlTVUC5HJo6KyO0okXUC1wh8uToKGxNCB53Tzk0DqX68wXqvMytPqiA, HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbHdKIqgRJyMidKuvnhDCuxhZjwitu2603iO2DKCmN--NXUfc66EsMGTES9LK2_gvfgsYMxCRLASIE52qtxpPB9-FwXRSP4kuAQf_bOXybdR-8dodUq49DaaRXVl_ASqZAYLVNapwsBEobjyxEi0G5GaUFkneQZi0Sl46Vdwo6FMS1gTBoQ,&q={searchTerms} HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://www.opti-page.com/?babsrc=HP_ss&mntrId=3C3246AC4C3B72A0&affID=126473&tsp=5040 HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbHdKIqgRJyMidKuvnhDCuxhZjwitu2603iO2DKCmN--NXUfc66EsMGTES9LK2_gvfgsYMxCRLASIE52qtxpPB9-FwXRSP4kuAQf_bOXybdR-8dodUq49DaaRXVl_ASqZAYLVNapwsBEobjyxEi0G5GaUFkneQZi0Sl46Vdwo6FMS1gTBoQ,&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer.msn.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer.msn.com StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbHdKIqgRJyMidKuvnhDCuxhZjwitu2603iO2DKCmN--NXUfc66EsMGTES9LK2_gvfgsYMxCRLASIE52qtxpPB9-FwXRSP4kuAQf_bOXybdR-8dodUq49DaaRXVl_ASqZAYLVNapwsBEobjyxEi0G5GaUFkneQZi0Sl46Vdwo6FMS1gTBoQ,&q={searchTerms} SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbHdKIqgRJyMidKuvnhDCuxhZjwitu2603iO2DKCmN--NXUfc66EsMGTES9LK2_gvfgsYMxCRLASIE52qtxpPB9-FwXRSP4kuAQf_bOXybdR-8dodUq49DaaRXVl_ASqZAYLVNapwsBEobjyxEi0G5GaUFkneQZi0Sl46Vdwo6FMS1gTBoQ,&q={searchTerms} SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: QuickShare WidgetEngine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - C:\Windows\system32\mscoree.dll (Microsoft Corporation) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: CmjBrowserHelperObject Object - {07A11D74-9D25-4fea-A833-8B0D76A5577A} - C:\Program Files (x86)\Mindjet\MindManager 7\Mm7InternetExplorer.dll (Mindjet) BHO-x32: PriceGong - Price Comparison - {1631550F-191D-4826-B069-D9439253D926} - C:\Program Files (x86)\PriceGong\2.6.11\PriceGongIE.dll (PriceGong) BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: Babylon toolbar helper - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.8.11.10\bh\BabylonToolbar.dll (Babylon BHO) BHO-x32: QuickShare WidgetEngine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation) BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: delta Helper Object - {C1AF5FA5-852C-4C90-812E-A7F75E011D87} - C:\Program Files (x86)\Delta\delta\1.8.21.0\bh\delta.dll (Delta-search.com) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: optitoolbar Helper Object - {F498380A-7935-4DC7-88B1-C158321DF79E} - C:\Program Files (x86)\Opti Toolbar\optitoolbar\1.8.26.9\bh\optitoolbar.dll (Opti Toolbar) Toolbar: HKLM - QuickShare Widget - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll (Microsoft Corporation) Toolbar: HKLM-x32 - loadtbs - {DFEFCDEE-CF1A-4FC8-88AD-129872198372} - C:\Users\Philipp\AppData\Roaming\loadtbs\toolbar.dll (InfiniAd GmbH) Toolbar: HKLM-x32 - Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.8.11.10\BabylonToolbarTlbr.dll (Babylon Ltd.) Toolbar: HKLM-x32 - Delta Toolbar - {82E1477C-B154-48D3-9891-33D83C26BCD3} - C:\Program Files (x86)\Delta\delta\1.8.21.0\deltaTlbr.dll (Delta-search.com) Toolbar: HKLM-x32 - optitoolbar Toolbar - {FE560166-CBE3-4A0D-80B5-A3B216F93EEA} - C:\Program Files (x86)\Opti Toolbar\optitoolbar\1.8.26.9\optitoolbarTlbr.dll (Opti Toolbar) Toolbar: HKLM-x32 - QuickShare Widget - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation) Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: HKLM-x32 {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files (x86)\Yahoo!\Common\Yinsthelper.dll DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Philipp\AppData\Roaming\Mozilla\Firefox\Profiles\vgwogyzf.default FF user.js: detected! => C:\Users\Philipp\AppData\Roaming\Mozilla\Firefox\Profiles\vgwogyzf.default\user.js FF NewTab: hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbHdKIqgRJyMidKuvnhDCuxhZjwitu2603iO2DKCmN--NXUfc66EsMGTES9LK2_gvfgsYMxCRLASIE52qtxpPB9-FwXRSP4kuAQf_bOXybdR-8dodUq4_kEdIDhxNS7GKdBLJsLxdPX-uzD4dbJQVIss0Cn4PpxOD2n0yyrveB2BeNbKQyc, FF DefaultSearchEngine: Ask.com FF SearchEngineOrder.1: Opti Page Search FF SelectedSearchEngine: Web Search FF Homepage: hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbHdKIqgRJyMidKuvnhDCuxhZjwitu2603iO2DKCmN--NXUfc66EsMGTES9LK2_gvfgsYMxCRLASIE52qtxpPB9-FwXRSP4kuAQf_bOXybdR-8dodUq4-NEvP0q3zlTVUC5HJo6KyO0okXUC1wh8uToKGxNCB53Tzk0DqX68wXqvMytPqiA, FF Keyword.URL: hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbHdKIqgRJyMidKuvnhDCuxhZjwitu2603iO2DKCmN--NXUfc66EsMGTES9LK2_gvfgsYMxCRLASIE52qtxpPB9-FwXRSP4kuAQf_bOXybdR-8dodUq49DaaRXVl_ASqZAYLVNapwsBEobjyxEi0G5GaUFkneQZi0Sl46Vdwo6FMS1gTBoQ,&q= FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1207148.dll (Adobe Systems, Inc.) FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: yaxmpb@yahoo.com/YahooActiveXPluginBridge;version=1.0.0.1 - C:\Program Files (x86)\Mozilla Firefox\plugins\npyaxmpb.dll (Yahoo! Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npmieze.dll (InfiniAd GmbH) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFFICE.DLL (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npyaxmpb.dll (Yahoo! Inc.) FF SearchPlugin: C:\Users\Philipp\AppData\Roaming\Mozilla\Firefox\Profiles\vgwogyzf.default\searchplugins\Web Search.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml FF Extension: SuperLyrics-16 - C:\Users\Philipp\AppData\Roaming\Mozilla\Firefox\Profiles\vgwogyzf.default\Extensions\58ad0086-1cfb-48bb-8ad2-33a8905572bc@5715d2be-69b9-4930-8f7e-64bdeb961cfd.com [2013-10-19] FF Extension: Delta Toolbar - C:\Users\Philipp\AppData\Roaming\Mozilla\Firefox\Profiles\vgwogyzf.default\Extensions\ffxtlbr@delta.com [2013-05-17] FF Extension: optitoolbar.com - C:\Users\Philipp\AppData\Roaming\Mozilla\Firefox\Profiles\vgwogyzf.default\Extensions\ffxtlbr@optitoolbar.com [2013-10-19] FF Extension: loadtbs - C:\Users\Philipp\AppData\Roaming\Mozilla\Firefox\Profiles\vgwogyzf.default\Extensions\software@loadtubes.com [2012-03-17] FF Extension: No Name - C:\Users\Philipp\AppData\Roaming\Mozilla\Firefox\Profiles\vgwogyzf.default\Extensions\staged [2013-10-19] FF Extension: QuickShare Widget - C:\Users\Philipp\AppData\Roaming\Mozilla\Firefox\Profiles\vgwogyzf.default\Extensions\{5fd0fa19-ca5e-b8ad-376d-9544e0c894dc} [2014-03-11] FF Extension: PriceGong - C:\Users\Philipp\AppData\Roaming\Mozilla\Firefox\Profiles\vgwogyzf.default\Extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829} [2013-04-01] FF Extension: M2k Downloader - C:\Users\Philipp\AppData\Roaming\Mozilla\Firefox\Profiles\vgwogyzf.default\Extensions\m2k@m2kdownloader.com.xpi [2013-04-08] FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Philipp\AppData\Roaming\Mozilla\Firefox\Profiles\vgwogyzf.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012-11-21] FF HKCU\...\Firefox\Extensions: [coollrcs@coolzone.co] - C:\Program Files (x86)\CoolLyrics\FF\ FF Extension: Cool Lyrics - C:\Program Files (x86)\CoolLyrics\FF\ [] Chrome: ======= CHR HomePage: hxxp://www.opti-page.com/?babsrc=HP_ss&mntrId=3C3246AC4C3B72A0&affID=126473&tsp=5040 CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\PepperFlash\pepflashplayer.dll () CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\pdf.dll () CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (Microsoft00AE Windows Media Player Firefox Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation) CHR Plugin: (LoadTubes Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\npmieze.dll (InfiniAd GmbH) CHR Plugin: (Microsoft Office 2003) - C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFFICE.DLL (Microsoft Corporation) CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll (Apple Inc.) CHR Plugin: (Yahoo! activeX Plug-in Bridge) - C:\Program Files (x86)\Mozilla Firefox\plugins\npyaxmpb.dll (Yahoo! Inc.) CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll No File CHR Plugin: (Java(TM) Platform SE 7 U7) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) CHR Plugin: (Windows Live00AE Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () CHR Plugin: (Java Deployment Toolkit 7.0.70.11) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll No File CHR Extension: (Google Drive) - C:\Users\Philipp\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-06-23] CHR Extension: (YouTube) - C:\Users\Philipp\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-06-23] CHR Extension: (Google-Suche) - C:\Users\Philipp\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-06-23] CHR Extension: (Google Wallet) - C:\Users\Philipp\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22] CHR Extension: (Google Mail) - C:\Users\Philipp\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-06-23] CHR HKLM-x32\...\Chrome\Extension: [bkomkajifikmkfnjgphkjcfeepbnojok] - C:\Program Files (x86)\PriceGong\2.6.11\pricegong.crx [2013-03-04] CHR HKLM-x32\...\Chrome\Extension: [clffglkbddffcdnehidjiimmoiphomid] - C:\Program Files (x86)\CoolLyrics\Chrome.crx [2013-06-12] CHR HKLM-x32\...\Chrome\Extension: [eooncjejnppfjjklapaamhcdmjbilmde] - C:\Users\Philipp\AppData\Roaming\BabSolution\CR\Delta.crx [2013-05-17] CHR HKLM-x32\...\Chrome\Extension: [fjoijdanhaiflhibkljeklcghcmmfffh] - C:\Program Files (x86)\WebCakeLayers.crx [2013-05-17] CHR HKLM-x32\...\Chrome\Extension: [lbbbdmbjkgojacipgefbifkiebpcdjhn] - C:\Program Files (x86)\Movie2KDownloader.com\m2kDownloader10.crx [2013-04-08] CHR HKLM-x32\...\Chrome\Extension: [ncoodlkjimgohlngmapmpnbfaoifkhnd] - C:\Users\Philipp\AppData\Roaming\BabSolution\CR\Opti.crx [2013-10-19] ==================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG) R2 desksvc; C:\Program Files (x86)\Desk 365\deskSvc.exe [424016 2013-10-19] (337 Technology Limited.) R2 FTRTSVC; C:\Program Files (x86)\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe [90112 2009-11-12] (France Telecom SA) R2 hasplms; C:\Windows\system32\hasplms.exe [4180576 2010-09-27] (SafeNet Inc.) S3 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-05-27] (Egis Technology Inc.) R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation) R2 Samsung Network Fax Server; C:\Windows\system32\spool\drivers\x64\3\NetFaxServer64.exe [216576 2010-03-08] (Samsung Electronics Co., Ltd.) R2 WebCake Desktop Updater; C:\Program Files (x86)\Betcat\WBDesktop.Updater.1.0.0.16.exe [51992 2013-08-19] (cake bake) ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-19] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-19] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-28] (Avira Operations GmbH & Co. KG) S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [53816 2009-07-13] (Samsung Electronics Co., Ltd.) S3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [20480 2010-03-06] (Marvell Semiconductor, Inc.) S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.) R2 SSPORT; C:\Windows\SysWOW64\Drivers\SSPORT.sys [11576 2009-07-12] (Samsung Electronics) S3 toshidpt; C:\Windows\System32\drivers\Toshidpt.sys [9608 2009-06-19] (TOSHIBA Corporation.) R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] () ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-03-30 08:54 - 2014-03-30 08:54 - 00035683 _____ () C:\Users\Philipp\Downloads\FRST.txt 2014-03-30 08:53 - 2014-03-30 08:54 - 00000000 ____D () C:\FRST 2014-03-30 08:53 - 2014-03-30 08:53 - 02157056 _____ (Farbar) C:\Users\Philipp\Downloads\FRST64.exe 2014-03-30 08:44 - 2014-03-30 08:48 - 00007273 _____ () C:\Windows\IE11_main.log 2014-03-30 08:43 - 2014-03-30 08:44 - 02077392 _____ (Microsoft Corporation) C:\Users\Philipp\Downloads\IE11-Windows6.1.exe 2014-03-27 22:41 - 2014-03-27 22:41 - 00000165 ____H () C:\Users\Philipp\Desktop\~$temp log.xlsx 2014-03-18 07:57 - 2014-03-18 07:57 - 03956224 _____ () C:\Users\Philipp\Desktop\AADDüsseldorf2011.ppt 2014-03-15 22:33 - 2014-03-19 23:19 - 08092301 _____ () C:\Users\Philipp\Desktop\villa AAD 20140320.pptx 2014-03-12 23:24 - 2014-03-12 23:24 - 00000000 ____D () C:\Users\Philipp\Documents\Der_Neue_Karolus_6 2014-03-12 23:21 - 2014-03-12 23:23 - 72033779 _____ (Veris GfB mbH) C:\Users\Philipp\Downloads\Der_Neue_Karolus_6_Demo.exe 2014-03-11 21:51 - 2014-03-11 21:51 - 00000000 ____D () C:\Users\Philipp\AppData\Local\LPT 2014-03-01 15:33 - 2014-03-01 15:33 - 00002141 _____ () C:\Users\Philipp\Downloads\pubmed_result (1).txt 2014-03-01 15:30 - 2014-03-01 15:30 - 00001728 _____ () C:\Users\Philipp\Downloads\pubmed_result.txt ==================== One Month Modified Files and Folders ======= 2014-03-30 08:54 - 2014-03-30 08:54 - 00035683 _____ () C:\Users\Philipp\Downloads\FRST.txt 2014-03-30 08:54 - 2014-03-30 08:53 - 00000000 ____D () C:\FRST 2014-03-30 08:53 - 2014-03-30 08:53 - 02157056 _____ (Farbar) C:\Users\Philipp\Downloads\FRST64.exe 2014-03-30 08:48 - 2014-03-30 08:44 - 00007273 _____ () C:\Windows\IE11_main.log 2014-03-30 08:44 - 2014-03-30 08:43 - 02077392 _____ (Microsoft Corporation) C:\Users\Philipp\Downloads\IE11-Windows6.1.exe 2014-03-30 08:43 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-03-30 08:43 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-03-30 08:41 - 2011-07-24 08:13 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-03-30 08:40 - 2010-10-28 23:25 - 00654166 _____ () C:\Windows\system32\perfh007.dat 2014-03-30 08:40 - 2010-10-28 23:25 - 00130006 _____ () C:\Windows\system32\perfc007.dat 2014-03-30 08:40 - 2009-07-14 07:13 - 01498506 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-03-30 08:38 - 2013-10-19 11:35 - 00000000 ____D () C:\Program Files (x86)\Desk 365 2014-03-30 08:36 - 2013-08-11 07:50 - 00000000 ____D () C:\Users\Philipp\AppData\Roaming\Betcat 2014-03-30 08:36 - 2012-04-29 12:33 - 00000374 _____ () C:\Windows\system32\Drivers\etc\hosts.ics 2014-03-30 08:35 - 2013-10-12 17:56 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cec763a7b6520b.job 2014-03-30 08:35 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-03-30 08:35 - 2009-07-14 06:51 - 00153334 _____ () C:\Windows\setupact.log 2014-03-30 08:30 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-03-30 08:14 - 2010-10-28 13:33 - 01243660 _____ () C:\Windows\WindowsUpdate.log 2014-03-27 23:22 - 2014-02-27 23:42 - 00038788 _____ () C:\Users\Philipp\Desktop\temp log.xlsx 2014-03-27 22:41 - 2014-03-27 22:41 - 00000165 ____H () C:\Users\Philipp\Desktop\~$temp log.xlsx 2014-03-26 21:47 - 2013-03-23 22:27 - 00000528 _____ () C:\Windows\Tasks\NatSpeak Periodic Language Model Optimization.job 2014-03-23 22:06 - 2012-08-17 20:17 - 00000099 _____ () C:\Users\Public\LMDebug.log 2014-03-23 22:06 - 2011-03-28 13:47 - 00000000 ____D () C:\Users\Philipp\Documents\Privat 2014-03-19 23:19 - 2014-03-15 22:33 - 08092301 _____ () C:\Users\Philipp\Desktop\villa AAD 20140320.pptx 2014-03-18 07:57 - 2014-03-18 07:57 - 03956224 _____ () C:\Users\Philipp\Desktop\AADDüsseldorf2011.ppt 2014-03-15 22:53 - 2013-10-21 21:13 - 00000000 ____D () C:\Users\Philipp\Desktop\villantenunterricht 20131022 2014-03-15 18:54 - 2013-06-23 10:42 - 00002179 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-03-14 07:27 - 2011-01-11 21:52 - 00000000 ____D () C:\ProgramData\boost_interprocess 2014-03-12 23:24 - 2014-03-12 23:24 - 00000000 ____D () C:\Users\Philipp\Documents\Der_Neue_Karolus_6 2014-03-12 23:23 - 2014-03-12 23:21 - 72033779 _____ (Veris GfB mbH) C:\Users\Philipp\Downloads\Der_Neue_Karolus_6_Demo.exe 2014-03-11 21:51 - 2014-03-11 21:51 - 00000000 ____D () C:\Users\Philipp\AppData\Local\LPT 2014-03-11 21:51 - 2013-10-19 11:37 - 00000000 ____D () C:\Users\Philipp\AppData\Local\Smartbar 2014-03-07 23:23 - 2013-10-16 10:45 - 00000000 ____D () C:\Users\Philipp\Desktop\NL 2014-03-05 21:02 - 2013-04-09 22:47 - 00000000 ____D () C:\Users\Philipp\Documents\Temp WPT 2014-03-01 15:33 - 2014-03-01 15:33 - 00002141 _____ () C:\Users\Philipp\Downloads\pubmed_result (1).txt 2014-03-01 15:30 - 2014-03-01 15:30 - 00001728 _____ () C:\Users\Philipp\Downloads\pubmed_result.txt ZeroAccess: C:\$Recycle.Bin\S-1-5-21-2499104989-183997506-3760272782-1000\$26a64402086a4e27670db5795d3e8ffb Some content of TEMP: ==================== C:\Users\Philipp\AppData\Local\Temp\118099870.exe C:\Users\Philipp\AppData\Local\Temp\2564500.exe C:\Users\Philipp\AppData\Local\Temp\avgnt.exe C:\Users\Philipp\AppData\Local\Temp\COMAP.EXE C:\Users\Philipp\AppData\Local\Temp\DataCard_Setup64.exe C:\Users\Philipp\AppData\Local\Temp\FP_PL_PFS_INSTALLER.exe C:\Users\Philipp\AppData\Local\Temp\fvJcrgR.exe C:\Users\Philipp\AppData\Local\Temp\Installer.exe C:\Users\Philipp\AppData\Local\Temp\InstallFlashPlayer.exe C:\Users\Philipp\AppData\Local\Temp\Java.exe C:\Users\Philipp\AppData\Local\Temp\msimg32.dll C:\Users\Philipp\AppData\Local\Temp\MSNFB7F.exe C:\Users\Philipp\AppData\Local\Temp\ose00000.exe C:\Users\Philipp\AppData\Local\Temp\ResetDevice.exe C:\Users\Philipp\AppData\Local\Temp\restorer1.0.0.1.exe C:\Users\Philipp\AppData\Local\Temp\setup_fsu_cid.exe C:\Users\Philipp\AppData\Local\Temp\sHID.dll C:\Users\Philipp\AppData\Local\Temp\siinst.exe C:\Users\Philipp\AppData\Local\Temp\strings.dll C:\Users\Philipp\AppData\Local\Temp\_is2779.exe C:\Users\Philipp\AppData\Local\Temp\_is6E68.exe C:\Users\Philipp\AppData\Local\Temp\_isBC67.exe C:\Users\Philipp\AppData\Local\Temp\_isCA6C.exe C:\Users\Philipp\AppData\Local\Temp\_isF4B6.exe C:\Users\Philipp\AppData\Local\Temp\_isFB79.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-02-26 22:35 ==================== End Of Log ============================ --- --- --- --- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014 Ran by Philipp at 2014-03-30 08:56:16 Running from C:\Users\Philipp\Downloads Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C} AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691} AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== Acer Backup Manager (HKLM-x32\...\InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}) (Version: 2.0.0.68 - NewTech Infosystems) Acer Crystal Eye webcam (HKLM-x32\...\{51F026FA-5146-4232-A8BA-1364740BD053}) (Version: 1.0.4.3 - Liteon) Acer ePower Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 5.00.3005 - Acer Incorporated) Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3013 - Acer Incorporated) Acer Registration (HKLM-x32\...\Acer Registration) (Version: 1.03.3003 - Acer Incorporated) Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 1.1.0707.2010 - Acer Incorporated) Acer Updater (HKLM-x32\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.02.3001 - Acer Incorporated) Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated) Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.) Adobe AIR (x32 Version: 1.5.0.7220 - Adobe Systems Inc.) Hidden Adobe Digital Editions (HKLM-x32\...\Digital Editions) (Version: - ) Adobe Flash Player 10 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 10.2.152.32 - Adobe Systems Incorporated) Adobe Flash Player 11 ActiveX 64-bit (HKLM\...\Adobe Flash Player ActiveX) (Version: 11.1.102.55 - Adobe Systems Incorporated) Adobe Reader X (10.0.1) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA0000000001}) (Version: 10.0.1 - Adobe Systems Incorporated) Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.7.148 - Adobe Systems, Inc.) Amazon Kindle (HKCU\...\Amazon Kindle) (Version: - Amazon) Apple Application Support (HKLM-x32\...\{EE6097DD-05F4-4178-9719-D3170BF098E8}) (Version: 1.4.1 - Apple Inc.) Apple Software Update (HKLM-x32\...\{6956856F-B6B3-4BE0-BA0B-8F495BE32033}) (Version: 2.1.1.116 - Apple Inc.) ATI Catalyst Install Manager (HKLM\...\{BAF4695F-7867-D8B2-528A-A1EF2EE0A9EF}) (Version: 3.0.778.0 - ATI Technologies, Inc.) Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira) Babylon toolbar (HKLM-x32\...\BabylonToolbar) (Version: 1.8.11.10 - BabylonToolbar) <==== ATTENTION Backup Manager Basic (x32 Version: 2.0.0.68 - NewTech Infosystems) Hidden BitGuard (HKLM-x32\...\{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693}) (Version: - MediaTechSoft Inc.) <==== ATTENTION Bluetooth Stack for Windows by Toshiba (HKLM\...\{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}) (Version: v7.10.12 - TOSHIBA CORPORATION) Blu-ray Rip & Copy 3 (HKLM-x32\...\{0D3F1A54-DB78-49D8-B091-61336B66D135}_is1) (Version: 5.0.0.0 - Leawo Software) Broadcom Gigabit NetLink Controller (HKLM\...\{A84DB02B-9C2B-4272-9D2D-A80E00A56513}) (Version: 14.0.2.3 - Broadcom Corporation) Cake Mania (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111199750}) (Version: - Oberon Media) Card Detector for Huawei E1752 and E1552 (HKLM-x32\...\CardDetectorHUAWEI1752_1552) (Version: 1.1.2.0 - ) Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0825.2205.37769 - ATI) Hidden Catalyst Control Center InstallProxy (x32 Version: 2010.0825.2205.37769 - ATI Technologies, Inc.) Hidden Catalyst Control Center Localization All (x32 Version: 2010.0825.2205.37769 - ATI) Hidden CCC Help Chinese Standard (x32 Version: 2010.0825.2204.37769 - ATI) Hidden CCC Help Chinese Traditional (x32 Version: 2010.0825.2204.37769 - ATI) Hidden CCC Help Czech (x32 Version: 2010.0825.2204.37769 - ATI) Hidden CCC Help Danish (x32 Version: 2010.0825.2204.37769 - ATI) Hidden CCC Help Dutch (x32 Version: 2010.0825.2204.37769 - ATI) Hidden CCC Help English (x32 Version: 2010.0825.2204.37769 - ATI) Hidden CCC Help Finnish (x32 Version: 2010.0825.2204.37769 - ATI) Hidden CCC Help French (x32 Version: 2010.0825.2204.37769 - ATI) Hidden CCC Help German (x32 Version: 2010.0825.2204.37769 - ATI) Hidden CCC Help Greek (x32 Version: 2010.0825.2204.37769 - ATI) Hidden CCC Help Hungarian (x32 Version: 2010.0825.2204.37769 - ATI) Hidden CCC Help Italian (x32 Version: 2010.0825.2204.37769 - ATI) Hidden CCC Help Japanese (x32 Version: 2010.0825.2204.37769 - ATI) Hidden CCC Help Korean (x32 Version: 2010.0825.2204.37769 - ATI) Hidden CCC Help Norwegian (x32 Version: 2010.0825.2204.37769 - ATI) Hidden CCC Help Polish (x32 Version: 2010.0825.2204.37769 - ATI) Hidden CCC Help Portuguese (x32 Version: 2010.0825.2204.37769 - ATI) Hidden CCC Help Russian (x32 Version: 2010.0825.2204.37769 - ATI) Hidden CCC Help Spanish (x32 Version: 2010.0825.2204.37769 - ATI) Hidden CCC Help Swedish (x32 Version: 2010.0825.2204.37769 - ATI) Hidden CCC Help Thai (x32 Version: 2010.0825.2204.37769 - ATI) Hidden CCC Help Turkish (x32 Version: 2010.0825.2204.37769 - ATI) Hidden ccc-core-static (x32 Version: 2010.0825.2205.37769 - Ihr Firmenname) Hidden ccc-utility64 (Version: 2010.0825.2205.37769 - ATI) Hidden Cherry ST-1530 (HKLM-x32\...\{1A0F15FE-F707-4DCA-8C42-93BEE43EB23F}) (Version: 1.0.0.0 - Cherry) Cool Lyrics (HKLM-x32\...\coollrcs@coolzone.co) (Version: - CoolZone) <==== ATTENTION CyberLink PowerDVD 9 (HKLM-x32\...\InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}) (Version: 9.0.3216.50 - CyberLink Corp.) CyberLink PowerDVD 9 (x32 Version: 9.0.3216.50 - CyberLink Corp.) Hidden Delta Chrome Toolbar (HKLM-x32\...\Delta Chrome Toolbar) (Version: - Visual Tools) <==== ATTENTION Delta toolbar (HKLM-x32\...\delta) (Version: 1.8.21.0 - Delta) <==== ATTENTION Desk 365 (HKLM-x32\...\Desk 365) (Version: 1.14.20 - 337 Technology Limited.) <==== ATTENTION DMUninstaller (HKLM-x32\...\DMUninstaller) (Version: - ) <==== ATTENTION Dragon NaturallySpeaking 10 (HKLM-x32\...\{E7712E53-7A7F-46EB-AA13-70D5987D30F2}) (Version: 10.10.0 - Nuance Communications Inc.) Dream Day First Home (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110}) (Version: - Oberon Media) Easy note taker 3.0 (HKLM-x32\...\{4A19E752-56D4-4B22-BACC-256B491E8756}) (Version: 3.0.1.0 - Yifang Digital) ELV Mini-Sound-Modul (HKLM-x32\...\ELV Mini-Sound-Modul) (Version: 1.1 - ELV Elektronik AG) ELV Mini-Sound-Modul (x32 Version: 1.1 - ELV Elektronik AG) Hidden eSobi v2 (HKLM-x32\...\InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}) (Version: 2.0.4.000274 - esobi Inc.) eSobi v2 (x32 Version: 2.0.4.000274 - esobi Inc.) Hidden ETDWare PS/2-x64 7.0.6.5_WHQL (HKLM\...\Elantech) (Version: 7.0.6.5 - ELAN Microelectronics Corp.) Europa Universalis - Rome (HKLM-x32\...\{7FD14A8A-FBCC-4442-ACAC-A0E9EC223AED}) (Version: - ) Firstload (HKLM-x32\...\Firstload) (Version: - Lumaris.net) Free Audio Converter version 5.0.23.320 (HKLM-x32\...\Free Audio Converter_is1) (Version: 5.0.23.320 - DVDVideoSoft Ltd.) Free YouTube Download version 3.2.1.320 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.1.320 - DVDVideoSoft Ltd.) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 33.0.1750.154 - Google Inc.) Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google) Google Update Helper (x32 Version: 1.3.22.5 - Google Inc.) Hidden HP LaserJet Professional P1100-P1560-P1600 Series (HKLM\...\HP LaserJet Professional P1100-P1560-P1600 Series) (Version: - ) IBM SPSS Statistics 22 (HKLM-x32\...\{104875A1-D083-4A34-BC4F-3F635B7F8EF7}) (Version: 22.0.0.0 - IBM Corp) Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3003 - Acer Incorporated) Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.2.1001 - Intel Corporation) Intel(R) Turbo Boost Technology Driver (HKLM-x32\...\{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}) (Version: 01.02.00.1002 - Intel Corporation) Internet Everywhere deinstallieren (HKLM-x32\...\{BEWINTERNET-CH}.UninstallSuite) (Version: - ) Ipswitch WS_FTP 12 (HKLM-x32\...\{AD88355B-A4E0-4DA1-BAC3-EA4FEA930691}) (Version: 12.3 - Ipswitch) IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.28 - Irfan Skiljan) Japanese Fonts Support For Adobe Reader X (HKLM-x32\...\{AC76BA86-7AD7-5760-0000-A00000000003}) (Version: 10.0.0 - Adobe Systems Incorporated) Java 7 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.250 - Oracle) Java Auto Updater (x32 Version: 2.1.9.5 - Sun Microsystems, Inc.) Hidden Java(TM) 6 Update 23 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216023FF}) (Version: 6.0.230 - Oracle) Junk Mail filter update (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden Launch Manager (HKLM-x32\...\LManager) (Version: 4.0.14 - Acer Inc.) loadtbs-2.1 (HKLM-x32\...\loadtbs-2.1) (Version: - ) Lumac (HKLM-x32\...\InstallShield_{5DE11949-2B11-4F13-BAD5-1C237122CFDB}) (Version: 1.1.86.0 - Firstload) Lumac (x32 Version: 1.1.86.0 - Firstload) Hidden MATLAB R2008a (HKLM\...\MatlabR2008a) (Version: 7.6 - The MathWorks, Inc.) Med7 (HKLM-x32\...\{1AC9A8F0-A373-4329-892A-5062032408BD}) (Version: 7.93.0022 - Bitron GmbH) Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office Office 64-bit Components 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden Microsoft Office Office 64-bit Components 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office Outlook 2007 (HKLM-x32\...\OUTLOOKR) (Version: 12.0.4518.1014 - Microsoft Corporation) Microsoft Office Outlook 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office Professional 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.4763.1000 - Microsoft Corporation) Microsoft Office Project Standard 2003 (HKLM-x32\...\{913A0407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.5614.0 - Microsoft Corporation) Microsoft Office Proof (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden Microsoft Office Proof (English) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (French) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden Microsoft Office Proof (French) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden Microsoft Office Proof (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office Single Image 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20513.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Mindjet MindManager Pro 7 (HKLM-x32\...\{3CDFEE23-66D2-4DB0-8269-12634E871725}) (Version: 7.0.429 - Mindjet LLC) Mobile Partner (HKLM-x32\...\Mobile Partner) (Version: 11.002.03.27.40 - Huawei Technologies Co.,Ltd) Movie2KDownloader (HKLM-x32\...\1ClickDownload) (Version: 2.1 Build 26473 - Movie2KDownloader.com) Mozilla Firefox 16.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 16.0.2 (x86 de)) (Version: 16.0.2 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 16.0.2 - Mozilla) MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden MyScript Notes Lite (HKLM-x32\...\{A82E3AFE-0BD9-4A17-9A58-9112B5C679C5}) (Version: 2.2.0.0 - Vision Objects) MyWinLocker (x32 Version: 3.1.212.0 - Egis Technology Inc.) Hidden MyWinLocker Suite (HKLM-x32\...\InstallShield_{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}) (Version: 3.1.212.0 - Egis Technology Inc.) MyWinLocker Suite (x32 Version: 3.1.212.0 - Egis Technology Inc.) Hidden Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.1.17869 - Symantec Corporation) NTI Media Maker 9 (HKLM-x32\...\InstallShield_{D3D5C4E8-040F-4C6F-8105-41D43CF94F44}) (Version: 9.0.2.8928 - NTI Corporation) NTI Media Maker 9 (x32 Version: 9.0.2.8928 - NTI Corporation) Hidden OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation) Opti Chrome Toolbar (HKLM-x32\...\Opti Chrome Toolbar) (Version: - Opti Toolbar) Opti toolbar (HKLM-x32\...\optitoolbar) (Version: 1.8.26.9 - Opti Toolbar) PDF24 Creator 5.3.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org) PDF-XChange 3 (HKLM-x32\...\PDF-XChange 3_is1) (Version: - Tracker Software) Personal Backup 5.4 (HKLM-x32\...\Personal Backup 5_is1) (Version: 5.3 - J. Rathlev) PriceGong 2.6.11 (HKLM-x32\...\PriceGong) (Version: 2.6.11 - PriceGong) <==== ATTENTION PSPP (HKLM-x32\...\B426B849-6071-5684-6429-7BE6B77DAB5B) (Version: 20111111 - GNU) PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden QuickShare (HKLM-x32\...\{11D4FAA0-A577-4FA8-B24E-D24283D861D1}) (Version: 11.24.60.15709 - Linkury Inc.) <==== ATTENTION QuickTime (HKLM-x32\...\{57752979-A1C9-4C02-856B-FBB27AC4E02C}) (Version: 7.69.80.9 - Apple Inc.) Readiris Pro 10 (HKLM-x32\...\{14D08502-FEE4-40E5-90D3-8A967A1D8BA2}) (Version: - ) Realtek HDMI Audio Driver for ATI (HKLM-x32\...\{5449FB4F-1802-4D5B-A6D8-087DB1142147}) (Version: 6.0.1.6034 - Realtek Semiconductor Corp.) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6141 - Realtek Semiconductor Corp.) Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30122 - Realtek Semiconductor Corp.) Ruff-Tech (HKLM-x32\...\Ruff-FTP_is1) (Version: 2.61 prof. - Ruff-Tech) Samsung Network PC Fax (HKLM-x32\...\{80078570-6C67-486C-8CF0-B0D778FC69B5}) (Version: 1.4.29.0 - Samsung Electronics Co., Ltd.) Scan Assistant (HKLM-x32\...\{BF6CF460-40C3-49BA-800A-4B934B6498B1}) (Version: 1.01.013 - Samsung Electronics Co., Ltd.) Scan2PDF 1.6 (HKLM-x32\...\Scan2PDF_is1) (Version: - Koma-Code) Sentinel HASP Run-time (HKLM-x32\...\{2A414CBE-CDF3-48C6-A91B-D3D4522F8EB5}) (Version: 5.0.1.14210 - SafeNet Inc.) Shredder (Version: 2.0.8.3 - Egis Technology Inc.) Hidden Shredder (x32 Version: 2.0.8.3 - Egis Technology Inc.) Hidden SmarThru 4 (HKLM-x32\...\{90F1943D-EA4A-4460-B59F-30023F3BA69A}) (Version: - Samsung Electronics Co., Ltd.) SopCast 3.4.0 (HKLM-x32\...\SopCast) (Version: 3.4.0 - www.sopcast.com) SpeedUpMyPC (HKLM-x32\...\{E55B3271-7CA8-4D0C-AE06-69A24856E996}_is1) (Version: 5.3.11.2 - Uniblue Systems Ltd) SPSS Statistics 17.0 (HKLM-x32\...\{46B65150-F8AA-42F2-94FB-2729A8AE5F7E}) (Version: 17.0.0 - SPSS Inc.) SuperLyrics-16 (HKLM-x32\...\SuperLyrics-16) (Version: 1.29.153.0 - PassWizard) <==== ATTENTION swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden Überwachungstool für die Intel® Turbo-Boost-Technik (HKLM\...\{39F4C6F9-618A-4E5B-8FB2-6BD661174E32}) (Version: 1.0.186.6 - Intel) Uninstall 1.0.0.1 (HKLM-x32\...\Uninstall_is1) (Version: - ) Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2473228) (Version: 1 - Microsoft Corporation) Visual C++ Runtime for Dragon NaturallySpeaking 64bit (x64) (HKLM\...\{4A5A427F-BA39-4BF0-9A47-7777FBE60C9F}) (Version: 10.00.800.228 - Nuance Communications Inc.) VLC media player 2.0.8 (HKLM-x32\...\VLC media player) (Version: 2.0.8 - VideoLAN) Wartung Samsung CLX-3180 Series (HKLM-x32\...\Samsung CLX-3180 Series) (Version: - Samsung Electronics Co., Ltd.) Wav Sample Rate Converter version 1.0.0.1 (HKLM-x32\...\Wav Sample Rate Converter_is1) (Version: - ) WebCake 3.00 (HKLM\...\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}) (Version: 3.00 - WebCake LLC) <==== ATTENTION Welcome Center (HKLM-x32\...\Acer Welcome Center) (Version: 1.02.3004 - Acer Incorporated) Windows Live Anmelde-Assistent (HKLM-x32\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation) Windows Live Call (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden Windows Live Communications Platform (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8117.0416 - Microsoft Corporation) Windows Live Essentials (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden Windows Live Fotogalerie (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden Windows Live Mail (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden Windows Live Messenger (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden Windows Live Movie Maker (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden Windows Live Sync (HKLM-x32\...\{586509F0-350D-48B5-B763-9CC2F8D96C4C}) (Version: 14.0.8117.416 - Microsoft Corporation) Windows Live Writer (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation) Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp) WinRAR 4.00 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.00.0 - win.rar GmbH) WinZip 14.5 (HKLM-x32\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240BD}) (Version: 14.5.9095 - WinZip Computing, S.L. ) Yahoo! Install Manager (HKLM-x32\...\YInstHelper) (Version: - ) Yahoo! Widgets (HKLM-x32\...\Yahoo! Widget Engine) (Version: 4.5.2.0 - Yahoo! Inc.) Zahlenbuch 1 (HKLM-x32\...\Zahlenbuch 1) (Version: - ) ==================== Restore Points ========================= 24-11-2013 18:47:00 Geplanter Prüfpunkt 30-03-2014 06:46:52 Windows Modules Installer ==================== Hosts content: ========================== 2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {013EA161-DC47-4960-90EE-24E9160F7222} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe [2009-07-14] (Microsoft Corporation) Task: {0159A561-EE2D-480A-9006-99949393620E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-07-24] (Google Inc.) Task: {0F5DFAFA-C319-4F0D-AC4D-A0EA7A442529} - System32\Tasks\BitGuard => Sc.exe start BitGuard <==== ATTENTION Task: {6CD2E245-54DF-4A53-9AD7-3659BD1E5D65} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-07-24] (Google Inc.) Task: {6E8CE0E2-1D04-4384-AEDF-B3575345014E} - System32\Tasks\BrowserProtect => Sc.exe start BrowserProtect <==== ATTENTION Task: {8ED2DECA-CF12-4B3E-98D5-8CECC88EE26D} - System32\Tasks\NatSpeak Periodic Acoustic Optimization => C:\Program Files (x86)\Nuance\NaturallySpeaking10\Program\schedmgr.exe [2009-04-09] (Nuance Communications, Inc.) Task: {9EAF2326-F522-4A3B-8E41-AABDA1E8EB82} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2008-07-30] (Apple Inc.) Task: {A7F72C5B-DBA7-4373-9293-7DAE29009BA3} - System32\Tasks\EPUpdater => C:\Users\Philipp\AppData\Roaming\BabSolution\Shared\BabMaint.exe [2013-09-01] () <==== ATTENTION Task: {A95B6FE1-88C8-45B3-8262-0C8386685D7E} - System32\Tasks\GoogleUpdateTaskMachineCore1cec763a7b6520b => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-07-24] (Google Inc.) Task: {B95707E5-9F4F-485E-83BC-6FD229F6A89F} - System32\Tasks\AdobeFlashPlayerUpdate 2 => C:\Windows\SysWOW64\FlashPlayerUpdateService.exe Task: {D793399C-626C-4ABC-9B1C-A51147D454C4} - \SidebarExecute No Task File Task: {D7C30BB7-CF50-42A8-B421-8E6A2475C23A} - System32\Tasks\AdobeFlashPlayerUpdate => C:\Windows\SysWOW64\FlashPlayerUpdateService.exe Task: {FC3F2AE7-B8C2-4FA8-BBF4-2EACF7193058} - System32\Tasks\NatSpeak Periodic Language Model Optimization => C:\Program Files (x86)\Nuance\NaturallySpeaking10\Program\schedmgr.exe [2009-04-09] (Nuance Communications, Inc.) Task: C:\Windows\Tasks\Desk 365 RunAsStdUser.job => C:\Program Files (x86)\Desk 365\desk365.exe <==== ATTENTION Task: C:\Windows\Tasks\EPUpdater.job => C:\Users\Philipp\AppData\Roaming\BABSOL~1\Shared\BabMaint.exe <==== ATTENTION Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cec763a7b6520b.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\NatSpeak Periodic Acoustic Optimization.job => C:\Program Files (x86)\Nuance\NaturallySpeaking10\Program\schedmgr.exe Task: C:\Windows\Tasks\NatSpeak Periodic Language Model Optimization.job => C:\Program Files (x86)\Nuance\NaturallySpeaking10\Program\schedmgr.exe Task: C:\Windows\Tasks\SpeedUpMyPC.job => C:\Program Files (x86)\Uniblue\SpeedUpMyPC\sump.exe Task: C:\Windows\Tasks\SuperLyrics-16-chromeinstaller.job => C:\Program Files (x86)\SuperLyrics-16\SuperLyrics-16-chromeinstaller.exe <==== ATTENTION Task: C:\Windows\Tasks\SuperLyrics-16-codedownloader.job => C:\Program Files (x86)\SuperLyrics-16\SuperLyrics-16-codedownloader.exe <==== ATTENTION Task: C:\Windows\Tasks\SuperLyrics-16-firefoxinstaller.job => C:\Program Files (x86)\SuperLyrics-16\SuperLyrics-16-firefoxinstaller.exe <==== ATTENTION ==================== Loaded Modules (whitelisted) ============= 2013-11-21 22:35 - 2013-11-18 16:32 - 01958880 _____ () C:\ProgramData\BitGuard\2.7.1832.68\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\loader.dll 2008-09-08 11:19 - 2008-09-08 11:19 - 00022016 _____ () C:\Windows\System32\cl31cl6.dll 2011-03-18 09:28 - 2010-03-04 17:56 - 00289280 _____ () C:\Windows\System32\HP1100LM.DLL 2012-08-17 20:05 - 2009-08-27 11:25 - 00027648 _____ () C:\Windows\System32\sst2cl6.dll 2011-03-18 09:28 - 2010-03-04 17:56 - 00074240 _____ () C:\Windows\system32\spool\PRTPROCS\x64\HP1100PP.DLL 2011-06-22 10:43 - 2011-06-22 10:43 - 00826880 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\sst2cdu.dll 2012-12-15 12:49 - 2010-10-28 19:55 - 06550136 _____ () C:\Program Files\ipswitch\WS_FTP 12\res0409.dll 2011-03-21 22:58 - 2011-03-02 13:40 - 00164864 _____ () C:\Program Files (x86)\WinRAR\rarext64.dll 2012-08-17 20:03 - 2010-06-07 12:17 - 00618496 _____ () C:\Windows\Samsung\PanelMgr\SSMMgr.exe 2012-08-17 20:04 - 2009-09-29 11:47 - 00306688 _____ () C:\Windows\Samsung\PanelMgr\caller64.exe 2014-03-09 19:42 - 2014-03-09 19:42 - 00021784 _____ () C:\Users\Philipp\AppData\Local\Smartbar\Application\Lrcnta.exe 2013-10-19 11:35 - 2013-10-19 11:35 - 00612432 _____ () C:\Program Files (x86)\Desk 365\sqlite3.dll 2013-03-11 07:51 - 2013-03-10 22:25 - 00397704 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll 2010-06-29 00:20 - 2010-06-29 00:20 - 00465576 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll 2010-06-29 00:12 - 2010-06-29 00:12 - 01081600 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\ACE.dll 2013-10-19 11:35 - 2013-10-19 11:35 - 00232016 _____ () C:\Program Files (x86)\Desk 365\edeskcmn.dll 2013-10-19 11:35 - 2013-10-19 11:35 - 00181840 _____ () C:\Program Files (x86)\Desk 365\libpng.dll 2013-10-19 11:35 - 2013-10-19 11:35 - 00073296 _____ () C:\Program Files (x86)\Desk 365\libpopdlg.dll 2013-10-19 11:35 - 2013-10-19 11:35 - 00099408 _____ () C:\Program Files (x86)\Desk 365\mbdet.dll 2013-10-19 11:35 - 2013-10-19 11:35 - 00146512 _____ () C:\Program Files (x86)\Desk 365\enotify.dll 2014-03-09 19:42 - 2014-03-09 19:42 - 00045848 _____ () C:\Users\Philipp\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Core.dll 2014-03-09 19:43 - 2014-03-09 19:43 - 00067864 _____ () C:\Users\Philipp\AppData\Local\Smartbar\Application\srau.dll 2014-03-09 19:42 - 2014-03-09 19:42 - 00164632 _____ () C:\Users\Philipp\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Utilities.dll 2014-03-09 19:42 - 2014-03-09 19:42 - 02281752 _____ () C:\Users\Philipp\AppData\Local\Smartbar\Application\Smartbar.GUI.MainClient.dll 2014-03-09 19:43 - 2014-03-09 19:43 - 00065816 _____ () C:\Users\Philipp\AppData\Local\Smartbar\Application\spbl.dll 2014-03-09 19:43 - 2014-03-09 19:43 - 00153880 _____ () C:\Users\Philipp\AppData\Local\Smartbar\Application\Smartbar.Resources.HistoryAndStatsWrapper.dll 2014-03-09 19:42 - 2014-03-09 19:42 - 00013592 _____ () C:\Users\Philipp\AppData\Local\Smartbar\Application\siem.dll 2014-03-09 19:43 - 2014-03-09 19:43 - 00060184 _____ () C:\Users\Philipp\AppData\Local\Smartbar\Application\sppsm.dll 2014-03-09 19:42 - 2014-03-09 19:42 - 00695576 _____ () C:\Users\Philipp\AppData\Local\Smartbar\Application\Smartbar.GUI.Controls.dll 2014-03-09 19:42 - 2014-03-09 19:42 - 00014104 _____ () C:\Users\Philipp\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.BusinessEntities.dll 2014-03-09 19:42 - 2014-03-09 19:42 - 00077592 _____ () C:\Users\Philipp\AppData\Local\Smartbar\Application\Smartbar.GUI.Docking.dll 2014-03-09 19:43 - 2014-03-09 19:43 - 00026392 _____ () C:\Users\Philipp\AppData\Local\Smartbar\Application\Smartbar.Personalization.Common.dll 2014-03-09 19:43 - 2014-03-09 19:43 - 00055576 _____ () C:\Users\Philipp\AppData\Local\Smartbar\Application\srut.dll 2014-03-09 19:43 - 2014-03-09 19:43 - 00028440 _____ () C:\Users\Philipp\AppData\Local\Smartbar\Application\srsbs.dll 2014-03-09 19:42 - 2014-03-09 19:42 - 00064280 _____ () C:\Users\Philipp\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.InternetExplorerLocalPlugin.dll 2014-03-09 19:43 - 2014-03-09 19:43 - 00029976 _____ () C:\Users\Philipp\AppData\Local\Smartbar\Application\srom.dll 2014-03-09 19:43 - 2014-03-09 19:43 - 00029976 _____ () C:\Users\Philipp\AppData\Local\Smartbar\Application\smtu.dll 2014-03-09 19:43 - 2014-03-09 19:43 - 00038168 _____ () C:\Users\Philipp\AppData\Local\Smartbar\Application\smta.dll 2014-03-09 19:42 - 2014-03-09 19:42 - 00023320 _____ () C:\Users\Philipp\AppData\Local\Smartbar\Application\sgml.dll 2014-03-09 19:43 - 2014-03-09 19:43 - 00042776 _____ () C:\Users\Philipp\AppData\Local\Smartbar\Application\srbu.dll 2014-03-09 19:43 - 2014-03-09 19:43 - 00060696 _____ () C:\Users\Philipp\AppData\Local\Smartbar\Application\Smartbar.Resources.LanguageSettings.dll 2014-03-09 19:43 - 2014-03-09 19:43 - 00023832 _____ () C:\Users\Philipp\AppData\Local\Smartbar\Application\srpdm.dll 2014-03-09 19:42 - 2014-03-09 19:42 - 00042264 _____ () C:\Users\Philipp\AppData\Local\Smartbar\Application\MACTrackBarLib.dll 2014-03-09 19:41 - 2014-03-09 19:41 - 00025880 _____ () C:\Users\Philipp\AppData\Local\Smartbar\Application\de\Smartbar.Resources.LanguageSettings.resources.dll 2014-03-09 19:43 - 2014-03-09 19:43 - 00034584 _____ () C:\Users\Philipp\AppData\Local\Smartbar\Application\Smartbar.Resources.SocialNetsSharer.dll 2014-03-09 19:43 - 2014-03-09 19:43 - 00254232 _____ () C:\Users\Philipp\AppData\Local\Smartbar\Application\srns.dll 2008-01-09 00:50 - 2008-01-09 00:50 - 00349147 _____ () C:\Program Files (x86)\Yahoo!\Widgets\sqlite3.dll 2008-03-19 02:21 - 2008-03-19 02:21 - 00512000 _____ () C:\Program Files (x86)\Yahoo!\Widgets\js32.dll 2008-03-19 02:21 - 2008-03-19 02:21 - 00094208 _____ () C:\Program Files (x86)\Yahoo!\Widgets\jsd.dll 2010-08-30 11:45 - 2009-05-20 08:02 - 00072200 _____ () C:\Program Files (x86)\Launch Manager\CdDirIo.dll 2012-08-10 17:51 - 2012-08-10 17:51 - 00985088 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll 2007-05-18 01:05 - 2007-05-18 01:05 - 00116240 ____R () C:\Program Files (x86)\Mindjet\MindManager 7\zlib.dll 2014-03-09 19:42 - 2014-03-09 19:42 - 00029464 _____ () C:\Users\Philipp\AppData\Local\Smartbar\Application\lrcnt.dll 2013-03-21 20:51 - 2013-03-21 20:51 - 00170496 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\939daa9c24a14d0673e781725dcf0b9d\IsdiInterop.ni.dll 2010-08-30 11:03 - 2010-04-13 18:52 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll 2014-03-15 18:54 - 2014-03-15 02:50 - 00051016 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\chrome_elf.dll 2014-03-15 18:54 - 2014-03-15 02:50 - 00716616 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\libglesv2.dll 2014-03-15 18:54 - 2014-03-15 02:50 - 00100168 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\libegl.dll 2013-03-11 07:51 - 2013-03-10 22:25 - 00397704 _____ () c:\program files (x86)\avira\antivir desktop\sqlite3.dll 2014-03-15 18:54 - 2014-03-15 02:50 - 04061000 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\pdf.dll 2014-03-15 18:54 - 2014-03-15 02:50 - 00394568 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll 2014-03-15 18:54 - 2014-03-15 02:50 - 01647432 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\ffmpegsumo.dll 2014-03-15 18:54 - 2014-03-15 02:50 - 13637448 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\PepperFlash\pepflashplayer.dll 2012-12-15 12:49 - 2010-10-28 19:52 - 00948496 _____ () C:\Program Files (x86)\Ipswitch\WS_FTP 12\LIBEAY32.dll 2012-12-15 12:49 - 2010-10-28 19:52 - 00153360 _____ () C:\Program Files (x86)\Ipswitch\WS_FTP 12\SSLEAY32.dll ==================== Alternate Data Streams (whitelisted) ========= AlternateDataStreams: C:\ProgramData\Temp:CDFF58FE AlternateDataStreams: C:\ProgramData\Temp:F35A93AD AlternateDataStreams: C:\Users\Philipp\Documents\UCB .pdf:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} ==================== Safe Mode (whitelisted) =================== ==================== Disabled items from MSCONFIG ============== ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (03/30/2014 08:35:17 AM) (Source: Microsoft-Windows-CAPI2) (User: ) Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei. . Error: (03/30/2014 08:25:09 AM) (Source: Microsoft-Windows-CAPI2) (User: ) Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei. . Error: (03/30/2014 07:52:43 AM) (Source: Application Hang) (User: ) Description: Programm avscan.exe, Version 14.0.3.332 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 12fc Startzeit: 01cf4bdabca7ecfc Endzeit: 60000 Anwendungspfad: c:\program files (x86)\avira\antivir desktop\avscan.exe Berichts-ID: 510d0ff2-b7cf-11e3-968d-1c75081ddbad Error: (03/30/2014 07:39:01 AM) (Source: Microsoft-Windows-CAPI2) (User: ) Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei. . Error: (03/27/2014 10:34:02 PM) (Source: Microsoft-Windows-CAPI2) (User: ) Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei. . Error: (03/22/2014 10:51:49 PM) (Source: Application Hang) (User: ) Description: Programm iexplore.exe, Version 9.0.8112.16421 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 1e58 Startzeit: 01cf45f8c587a0b2 Endzeit: 279 Anwendungspfad: C:\Program Files (x86)\Internet Explorer\iexplore.exe Berichts-ID: Error: (03/21/2014 08:19:43 AM) (Source: Microsoft-Windows-CAPI2) (User: ) Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei. . Error: (03/20/2014 07:36:01 AM) (Source: Microsoft-Windows-CAPI2) (User: ) Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei. . Error: (03/18/2014 10:56:20 PM) (Source: Microsoft-Windows-CAPI2) (User: ) Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei. . Error: (03/15/2014 09:58:11 PM) (Source: Application Hang) (User: ) Description: Programm iexplore.exe, Version 9.0.8112.16421 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 2374 Startzeit: 01cf4088cf184486 Endzeit: 14 Anwendungspfad: C:\Program Files (x86)\Internet Explorer\iexplore.exe Berichts-ID: System errors: ============= Error: (03/30/2014 08:35:10 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: %%20 Error: (03/30/2014 08:35:08 AM) (Source: EventLog) (User: ) Description: Das System wurde zuvor am 30.03.2014 um 08:29:47 unerwartet heruntergefahren. Error: (03/30/2014 08:24:58 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: %%20 Error: (03/30/2014 08:24:56 AM) (Source: EventLog) (User: ) Description: Das System wurde zuvor am 30.03.2014 um 08:14:45 unerwartet heruntergefahren. Error: (03/30/2014 07:41:23 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (03/30/2014 07:41:23 AM) (Source: Service Control Manager) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Media Player-Netzwerkfreigabedienst erreicht. Error: (03/30/2014 07:40:50 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Gatewaydienst auf Anwendungsebene" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (03/30/2014 07:40:47 AM) (Source: Service Control Manager) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Gatewaydienst auf Anwendungsebene erreicht. Error: (03/30/2014 07:38:55 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: %%20 Error: (03/30/2014 07:38:51 AM) (Source: EventLog) (User: ) Description: Das System wurde zuvor am 27.03.2014 um 22:27:10 unerwartet heruntergefahren. Microsoft Office Sessions: ========================= ==================== Memory info =========================== Percentage of memory in use: 58% Total physical RAM: 3958.71 MB Available physical RAM: 1637.97 MB Total Pagefile: 7915.62 MB Available Pagefile: 5251.72 MB Total Virtual: 8192 MB Available Virtual: 8191.8 MB ==================== Drives ================================ Drive c: (Acer) (Fixed) (Total:452.66 GB) (Free:288.49 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: E9984595) Partition: GPT Partition Type. ==================== End Of Log ============================ Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2014-03-30 09:22:49 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.PB4O 465,76GB Running: Gmer-19357.exe; Driver: C:\Users\Philipp\AppData\Local\Temp\awliyfod.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2008] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075671465 2 bytes [67, 75] .text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2008] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000756714bb 2 bytes [67, 75] .text ... * 2 .text C:\Program Files (x86)\Desk 365\desk365.exe[2728] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075671465 2 bytes [67, 75] .text C:\Program Files (x86)\Desk 365\desk365.exe[2728] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000756714bb 2 bytes [67, 75] .text ... * 2 .text C:\Users\Philipp\AppData\Local\Smartbar\Application\QuickShare.exe[3064] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000075671465 2 bytes [67, 75] .text C:\Users\Philipp\AppData\Local\Smartbar\Application\QuickShare.exe[3064] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000756714bb 2 bytes [67, 75] .text ... * 2 .text C:\Program Files (x86)\Launch Manager\LManager.exe[3292] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075671465 2 bytes [67, 75] .text C:\Program Files (x86)\Launch Manager\LManager.exe[3292] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000756714bb 2 bytes [67, 75] .text ... * 2 .text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3324] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075671465 2 bytes [67, 75] .text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3324] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000756714bb 2 bytes [67, 75] .text ... * 2 .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3380] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075671465 2 bytes [67, 75] .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3380] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000756714bb 2 bytes [67, 75] .text ... * 2 ---- Processes - GMER 2.1 ---- Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Windows\system32\wininit.exe [552](2013-11-21 20:35:59) 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Windows\system32\services.exe [616](2013-11-21 20:35:59) 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Windows\system32\lsass.exe [632](2013-11-21 20:35:59) 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Windows\system32\svchost.exe [744](2013-11-21 20:35:59) 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Windows\system32\winlogon.exe [844](2013-11-21 20:35:59) 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Windows\system32\svchost.exe [872](2013-11-21 20:35:59) 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Windows\system32\atiesrxx.exe [920](2013-11-21 20:35:59) 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Windows\System32\svchost.exe [284](2013-11-21 20:35:59) 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Windows\System32\svchost.exe [496](2013-11-21 20:35:59) 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Windows\system32\svchost.exe [492](2013-11-21 20:35:59) 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Windows\system32\svchost.exe [1048](2013-11-21 20:35:59) 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Windows\system32\atieclxx.exe [1084](2013-11-21 20:35:59) 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Windows\system32\svchost.exe [1248](2013-11-21 20:35:59) 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Windows\System32\spoolsv.exe [1516](2013-11-21 20:35:59) 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Windows\system32\svchost.exe [1568](2013-11-21 20:35:59) 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [1772](2013-11-21 20:35:59) 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Windows\system32\HPSIsvc.exe [1884](2013-11-21 20:35:59) 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [1948](2013-11-21 20:35:59) 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Windows\system32\taskeng.exe [1976](2013-11-21 20:35:59) 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Windows\system32\spool\drivers\x64\3\NetFaxServer64.exe [1128](2013-11-21 20:35:59) 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Windows\system32\svchost.exe [1492](2013-11-21 20:35:59) 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Windows\system32\taskhost.exe [2868](2013-11-21 20:35:59) 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Windows\system32\Dwm.exe [2996](2013-11-21 20:35:59) 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Windows\Explorer.EXE [3032](2013-11-21 20:35:59) 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2324] 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Program Files\Elantech\ETDCtrl.exe [2412](2013-11-21 20:35:59 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [2600](2013-11-21 20:35:59) 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Windows\system32\wbem\unsecapp.exe [3444](2013-11-21 20:35:59 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Windows\system32\wbem\wmiprvse.exe [3524](2013-11-21 20:35:59 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe [3624](2013-11-21 20:35:59) 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe [3952](2013-11-21 20:35:59) 000007fefda00000 Library c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (*** suspicious ***) @ C:\Windows\Samsung\PanelMgr\caller64.exe [3392](2013-11-21 20 000007fefda00000 ---- EOF - GMER 2.1 ---- Geändert von holliday4350 (30.03.2014 um 08:40 Uhr) Grund: Einfügen der Logfiles |