| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: PC läuft recht langsam und "frißt sich manchmal fest"Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
22.05.2014, 06:53
| #1 |
 |  PC läuft recht langsam und "frißt sich manchmal fest" Guten Morgen mein PC läuft langsamer als eigentlich gewohnt. Außerdem läßt sich öfter mal der Cursor nicht mehr bewegen und nur ein Neustart hilft, um weiterarbeiten zu können - mit der jeweiligen Gefahr, Daten vorher nicht gesichert zu haben zu können. Kann da eine Malware im Spiel sein? Gruß Frusti |
|
22.05.2014, 07:09
| #2 |
| /// the machine /// TB-Ausbilder    | PC läuft recht langsam und "frißt sich manchmal fest" hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
22.05.2014, 11:57
| #3 |
| | PC läuft recht langsam und "frißt sich manchmal fest" Hallo,
__________________vielen Dank für Deine Bereitschaft, den PC auf Malware zu untersuchen. Hier der angeforderte post: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:21-05-2014
Ran by GHM (administrator) on PC on 22-05-2014 12:52:40
Running from C:\Users\GHM\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4F35AP17
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool
Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials
==================== Processes (Whitelisted) =================
(UASSOFT.COM) C:\Program Files\Silvercrest NM1005 driver\KMWDSrv.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.3.0.12\nis.exe
(Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
(Data Perceptions / PowerProgrammer) C:\Windows\System32\WebUpdateSvc4.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.3.0.12\nis.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
(X10) C:\Program Files\Common Files\X10\Common\X10nets.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe
(Wistron) C:\Program Files\Launch Manager\HotkeyApp.exe
(Wistron Corp.) C:\Program Files\Launch Manager\OSD.exe
(Wistron Corp.) C:\Program Files\Launch Manager\WButton.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(UASSOFT.COM) C:\Program Files\Silvercrest NM1005 driver\StartAutorun.exe
(UASSOFT.COM) C:\Program Files\Silvercrest NM1005 driver\KMCONFIG.exe
(UASSOFT.COM) C:\Program Files\Silvercrest NM1005 driver\KMProcess.exe
(Wistron Corp.) C:\Program Files\Launch Manager\WisLMSvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Apache Software Foundation) C:\Program Files\OpenOffice 4\program\swriter.exe
(Apache Software Foundation) C:\Program Files\OpenOffice 4\program\soffice.exe
(Apache Software Foundation) C:\Program Files\OpenOffice 4\program\soffice.bin
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil32_13_0_0_214_ActiveX.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2009-10-02] (Intel Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8546848 2010-03-17] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe [686624 2010-03-17] (Realtek Semiconductor)
HKLM\...\Run: [HotkeyApp] => C:\Program Files\Launch Manager\HotkeyApp.exe [200704 2009-12-14] (Wistron)
HKLM\...\Run: [LMgrVolOSD] => C:\Program Files\Launch Manager\OSD.exe [348960 2009-12-12] (Wistron Corp.)
HKLM\...\Run: [Wbutton] => C:\Program Files\Launch Manager\Wbutton.exe [413696 2010-01-13] (Wistron Corp.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1594664 2009-12-11] (Synaptics Incorporated)
HKLM\...\Run: [KMCONFIG] => C:\Program Files\Silvercrest NM1005 driver\StartAutorun.exe KMConfig.exe
AppInit_DLLs: C:\Windows\Jaksta\AC\x86\jaudcap.dll => C:\Windows\Jaksta\AC\x86\jaudcap.dll [264480 2013-10-31] (Jaksta Technologies Pty Ltd)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.medion.com
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {E5C4ECBB-88B4-40A1-B8E0-0220F5DD43A3} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKCU - DefaultScope {C4C2BA6A-B414-4A4C-B39B-87AF0CC54637} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {57F74961-D98B-46A0-9E3F-26E321617D3B} URL = hxxp://de.wikipedia.org/w/index.php?title=Spezial:Suche&search={searchTerms}
SearchScopes: HKCU - {C4C2BA6A-B414-4A4C-B39B-87AF0CC54637} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {E5C4ECBB-88B4-40A1-B8E0-0220F5DD43A3} URL =
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\IPS\IPSBHO.DLL (Symantec Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF [2013-11-24]
FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn\ []
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR Extension: (Google Docs) - C:\Users\GHM\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-19]
CHR Extension: (Google Drive) - C:\Users\GHM\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-19]
CHR Extension: (YouTube) - C:\Users\GHM\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-19]
CHR Extension: (Google-Suche) - C:\Users\GHM\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-19]
CHR Extension: (Google Wallet) - C:\Users\GHM\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-19]
CHR Extension: (Google Mail) - C:\Users\GHM\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-19]
CHR HKLM\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\Exts\Chrome.crx [2014-05-15]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
========================== Services (Whitelisted) =================
R2 KMWDSERVICE; C:\Program Files\Silvercrest NM1005 driver\KMWDSrv.exe [208896 2007-06-16] (UASSOFT.COM)
R2 NIS; C:\Program Files\Norton Internet Security\Engine\21.3.0.12\NIS.exe [276376 2014-05-11] (Symantec Corporation)
S3 TuneUp.Defrag; C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe [435008 2011-12-23] (TuneUp Software)
R2 TuneUp.UtilitiesSvc; C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [1052480 2011-11-21] (TuneUp Software)
R2 WebUpdate4; C:\Windows\system32\WebUpdateSvc4.exe [262360 2009-01-08] (Data Perceptions / PowerProgrammer)
R3 WisLMSvc; C:\Program Files\Launch Manager\WisLMSvc.exe [118560 2009-10-23] (Wistron Corp.)
R2 x10nets; C:\Program Files\Common Files\X10\Common\X10nets.exe [20480 2009-11-07] (X10)
==================== Drivers (Whitelisted) ====================
R1 BHDrvx86; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20140510.001\BHDrvx86.sys [1101616 2014-05-10] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NIS\1503000.00C\ccSetx86.sys [127064 2013-09-26] (Symantec Corporation)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376920 2013-11-23] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [108120 2013-11-23] (Symantec Corporation)
R1 IDSVix86; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20140521.001\IDSvix86.sys [395992 2014-03-26] (Symantec Corporation)
R3 KMWDFilter; C:\Windows\System32\Drivers\KMWDFilter.SYS [17280 2007-06-13] (Windows (R) Codename Longhorn DDK provider)
S3 mod7700; C:\Windows\System32\DRIVERS\mod7700.sys [786400 2009-08-13] (DiBcom SA)
R3 NAVENG; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140521.033\NAVENG.SYS [93272 2014-02-08] (Symantec Corporation)
R3 NAVEX15; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140521.033\NAVEX15.SYS [1612376 2014-02-08] (Symantec Corporation)
S3 Spyder3; C:\Windows\System32\DRIVERS\Spyder3.sys [12288 2008-09-08] ()
R3 SRTSP; C:\Windows\System32\Drivers\NIS\1503000.00C\SRTSP.SYS [664280 2014-02-13] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NIS\1503000.00C\SRTSPX.SYS [32344 2013-09-10] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NIS\1503000.00C\SYMDS.SYS [367704 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NIS\1503000.00C\SYMEFA.SYS [936152 2014-03-04] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142936 2013-11-24] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NIS\1503000.00C\Ironx86.SYS [206936 2013-09-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NIS\1503000.00C\SYMNETS.SYS [447704 2014-02-18] (Symantec Corporation)
R3 TuneUpUtilitiesDrv; C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [10064 2010-02-24] (TuneUp Software)
R3 X10Hid; C:\Windows\System32\Drivers\x10hid.sys [13720 2009-05-13] (X10 Wireless Technology, Inc.)
R3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [27160 2009-05-13] (X10 Wireless Technology, Inc.)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-05-22 08:29 - 2014-05-22 08:31 - 00016158 _____ () C:\Users\GHM\Desktop\2014-05-14_Anruf Fr.Seelbach-Reineck.odt
2014-05-21 16:26 - 2014-05-21 16:27 - 00009035 _____ () C:\Users\GHM\Desktop\Unbenannt 1.odt
2014-05-19 09:49 - 2014-05-19 08:40 - 00017645 _____ () C:\Users\GHM\Desktop\Gigaset Anl.odt
2014-05-19 09:49 - 2014-05-19 08:12 - 00023404 _____ () C:\Users\GHM\Desktop\Islam-Film arte.odt
2014-05-19 09:49 - 2014-05-11 08:53 - 00013975 _____ () C:\Users\GHM\Desktop\Beginn Monotheismus.odt
2014-05-16 11:00 - 2014-05-19 09:48 - 00000000 ____D () C:\Users\GHM\Desktop\aktuelle Ordner
2014-05-15 12:18 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-15 12:18 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-15 12:18 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-15 07:25 - 2014-05-09 09:06 - 00369664 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-15 07:25 - 2014-05-09 09:04 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-15 07:25 - 2014-04-12 04:15 - 00136640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-15 07:25 - 2014-04-12 04:15 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-15 07:25 - 2014-04-12 04:12 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-15 07:25 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-15 07:25 - 2014-04-12 04:12 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-15 07:25 - 2014-04-12 04:11 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-15 07:25 - 2014-04-12 04:11 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-15 07:25 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-15 07:25 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2014-05-15 07:25 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-15 07:25 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-15 07:25 - 2014-03-04 11:17 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-12 15:20 - 2014-05-12 15:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-05-12 15:20 - 2014-04-14 20:13 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-05-12 15:20 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-05-12 15:20 - 2014-04-14 20:05 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-05-12 15:20 - 2014-04-14 20:04 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-05-12 15:19 - 2014-05-12 15:20 - 00004241 _____ () C:\Windows\system32\jupdate-1.7.0_55-b14.log
2014-05-10 15:22 - 2014-05-22 07:41 - 00001512 _____ () C:\Windows\setupact.log
2014-05-10 15:22 - 2014-05-10 15:22 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-09 15:17 - 2014-05-10 09:30 - 00024311 _____ () C:\Users\GHM\Desktop\Valerianus I + Gallienus, wer ist wer.odt
2014-05-06 12:09 - 2014-05-15 13:30 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-01 08:08 - 2014-05-16 11:06 - 00000000 ____D () C:\Users\GHM\Desktop\SITUATIONS-ORDNER
2014-04-24 17:01 - 2014-04-24 17:01 - 00009229 _____ () C:\Users\GHM\Desktop\LUSTIGES.odt
2014-04-24 16:26 - 2014-04-24 16:26 - 00000000 __SHD () C:\Users\GHM\AppData\Local\EmieUserList
2014-04-24 16:26 - 2014-04-24 16:26 - 00000000 __SHD () C:\Users\GHM\AppData\Local\EmieSiteList
2014-04-24 13:20 - 2014-03-06 10:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-24 13:20 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-24 13:20 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-24 13:20 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-24 13:20 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-24 13:20 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-24 13:20 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-24 13:20 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-24 13:20 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-24 13:20 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-24 13:20 - 2014-03-06 09:38 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-24 13:20 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-24 13:20 - 2014-03-06 09:28 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-24 13:20 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-24 13:20 - 2014-03-06 09:18 - 00575488 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-24 13:20 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-24 13:20 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-24 13:20 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-24 13:20 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-24 13:20 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-24 13:20 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-24 13:20 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-24 13:20 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-24 13:20 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-23 08:21 - 2014-04-23 08:21 - 00000000 ____D () C:\Users\dub_cm_auto
2014-04-22 11:13 - 2014-04-22 11:14 - 00000000 ____D () C:\Users\GHM\Desktop\Bethel
==================== One Month Modified Files and Folders =======
2014-05-22 12:52 - 2014-04-06 09:07 - 00000000 ____D () C:\FRST
2014-05-22 12:45 - 2009-07-14 06:34 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-22 12:45 - 2009-07-14 06:34 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-22 12:40 - 2014-02-28 20:27 - 00000000 ____D () C:\Users\GHM\Desktop\TAGTÄGLICH ROUTINE-1
2014-05-22 12:03 - 2013-11-22 18:40 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-22 11:51 - 2010-06-11 00:37 - 01729694 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-22 11:50 - 2010-09-18 18:25 - 01359327 _____ () C:\Windows\WindowsUpdate.log
2014-05-22 08:31 - 2014-05-22 08:29 - 00016158 _____ () C:\Users\GHM\Desktop\2014-05-14_Anruf Fr.Seelbach-Reineck.odt
2014-05-22 07:41 - 2014-05-10 15:22 - 00001512 _____ () C:\Windows\setupact.log
2014-05-22 07:41 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-21 19:26 - 2013-11-24 10:57 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Internet Security
2014-05-21 19:26 - 2012-12-03 10:53 - 00000000 ____D () C:\Windows\system32\Drivers\NIS
2014-05-21 16:27 - 2014-05-21 16:26 - 00009035 _____ () C:\Users\GHM\Desktop\Unbenannt 1.odt
2014-05-21 14:48 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-05-19 09:48 - 2014-05-16 11:00 - 00000000 ____D () C:\Users\GHM\Desktop\aktuelle Ordner
2014-05-19 08:40 - 2014-05-19 09:49 - 00017645 _____ () C:\Users\GHM\Desktop\Gigaset Anl.odt
2014-05-19 08:12 - 2014-05-19 09:49 - 00023404 _____ () C:\Users\GHM\Desktop\Islam-Film arte.odt
2014-05-16 16:18 - 2014-02-11 22:37 - 00000000 ____D () C:\Users\GHM\Desktop\A
2014-05-16 11:10 - 2010-10-03 12:15 - 00000000 ____D () C:\Users\GHM\Desktop\Reinigung + Wdh.stellung
2014-05-16 11:06 - 2014-05-01 08:08 - 00000000 ____D () C:\Users\GHM\Desktop\SITUATIONS-ORDNER
2014-05-15 15:34 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-05-15 13:52 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-05-15 13:30 - 2014-05-06 12:09 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-15 13:30 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-05-15 12:21 - 2013-09-11 18:41 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-15 12:20 - 2010-06-11 19:09 - 90547776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-15 09:09 - 2013-11-22 18:40 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-05-15 09:09 - 2012-01-03 11:01 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-05-12 15:28 - 2014-01-20 20:46 - 00000000 ____D () C:\ProgramData\Oracle
2014-05-12 15:20 - 2014-05-12 15:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-05-12 15:20 - 2014-05-12 15:19 - 00004241 _____ () C:\Windows\system32\jupdate-1.7.0_55-b14.log
2014-05-12 15:20 - 2013-06-12 20:09 - 00000000 ____D () C:\Program Files\Java
2014-05-11 08:53 - 2014-05-19 09:49 - 00013975 _____ () C:\Users\GHM\Desktop\Beginn Monotheismus.odt
2014-05-10 15:22 - 2014-05-10 15:22 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-10 10:46 - 2011-06-13 11:09 - 00000000 ____D () C:\Program Files\CCleaner
2014-05-10 09:30 - 2014-05-09 15:17 - 00024311 _____ () C:\Users\GHM\Desktop\Valerianus I + Gallienus, wer ist wer.odt
2014-05-09 09:06 - 2014-05-15 07:25 - 00369664 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-09 09:04 - 2014-05-15 07:25 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-06 20:21 - 2010-06-11 19:01 - 00000000 ____D () C:\ProgramData\X10 Settings
2014-05-06 18:06 - 2013-11-22 19:44 - 00000000 ____D () C:\Users\GHM\AppData\Roaming\Applian FLV and Media Player
2014-05-06 05:25 - 2014-05-15 12:18 - 17382912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 05:07 - 2014-05-15 12:18 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 04:10 - 2014-05-15 12:18 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-05 08:09 - 2009-07-14 06:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-04 12:33 - 2010-09-18 18:37 - 00000000 ____D () C:\Users\GHM
2014-05-04 12:32 - 2014-03-24 20:38 - 00000000 ____D () C:\Program Files\Recuva
2014-04-24 17:01 - 2014-04-24 17:01 - 00009229 _____ () C:\Users\GHM\Desktop\LUSTIGES.odt
2014-04-24 16:26 - 2014-04-24 16:26 - 00000000 __SHD () C:\Users\GHM\AppData\Local\EmieUserList
2014-04-24 16:26 - 2014-04-24 16:26 - 00000000 __SHD () C:\Users\GHM\AppData\Local\EmieSiteList
2014-04-23 08:21 - 2014-04-23 08:21 - 00000000 ____D () C:\Users\dub_cm_auto
2014-04-22 11:14 - 2014-04-22 11:13 - 00000000 ____D () C:\Users\GHM\Desktop\Bethel
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe
[2014-05-15 07:25] - [2014-03-04 11:17] - 0304128 ____A (Microsoft Corporation) 998507B046BA314CE8245364C686FA67
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-05-19 07:37
==================== End Of Log ============================
|
|
23.05.2014, 10:58
| #4 |
| /// the machine /// TB-Ausbilder | PC läuft recht langsam und "frißt sich manchmal fest" Addition.txt fehlt noch 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
23.05.2014, 11:45
| #5 |
| | PC läuft recht langsam und "frißt sich manchmal fest" Danke für die Antwort. Ich gebe Dir das Ganze noch mal neu: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:21-05-2014
Ran by GHM (administrator) on PC on 23-05-2014 12:36:01
Running from C:\Users\GHM\Downloads
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool
Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials
==================== Processes (Whitelisted) =================
(UASSOFT.COM) C:\Program Files\Silvercrest NM1005 driver\KMWDSrv.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.3.0.12\nis.exe
(Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.3.0.12\nis.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
(Data Perceptions / PowerProgrammer) C:\Windows\System32\WebUpdateSvc4.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
(X10) C:\Program Files\Common Files\X10\Common\X10nets.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe
(Wistron) C:\Program Files\Launch Manager\HotkeyApp.exe
(Wistron Corp.) C:\Program Files\Launch Manager\OSD.exe
(Wistron Corp.) C:\Program Files\Launch Manager\WButton.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(UASSOFT.COM) C:\Program Files\Silvercrest NM1005 driver\StartAutorun.exe
(UASSOFT.COM) C:\Program Files\Silvercrest NM1005 driver\KMCONFIG.exe
(UASSOFT.COM) C:\Program Files\Silvercrest NM1005 driver\KMProcess.exe
(Wistron Corp.) C:\Program Files\Launch Manager\WisLMSvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil32_13_0_0_214_ActiveX.exe
(Farbar) C:\Users\GHM\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROL4EP7S\FRST (1).exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2009-10-02] (Intel Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8546848 2010-03-17] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe [686624 2010-03-17] (Realtek Semiconductor)
HKLM\...\Run: [HotkeyApp] => C:\Program Files\Launch Manager\HotkeyApp.exe [200704 2009-12-14] (Wistron)
HKLM\...\Run: [LMgrVolOSD] => C:\Program Files\Launch Manager\OSD.exe [348960 2009-12-12] (Wistron Corp.)
HKLM\...\Run: [Wbutton] => C:\Program Files\Launch Manager\Wbutton.exe [413696 2010-01-13] (Wistron Corp.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1594664 2009-12-11] (Synaptics Incorporated)
HKLM\...\Run: [KMCONFIG] => C:\Program Files\Silvercrest NM1005 driver\StartAutorun.exe KMConfig.exe
AppInit_DLLs: C:\Windows\Jaksta\AC\x86\jaudcap.dll => C:\Windows\Jaksta\AC\x86\jaudcap.dll [264480 2013-10-31] (Jaksta Technologies Pty Ltd)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.medion.com
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {E5C4ECBB-88B4-40A1-B8E0-0220F5DD43A3} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKCU - DefaultScope {C4C2BA6A-B414-4A4C-B39B-87AF0CC54637} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {57F74961-D98B-46A0-9E3F-26E321617D3B} URL = hxxp://de.wikipedia.org/w/index.php?title=Spezial:Suche&search={searchTerms}
SearchScopes: HKCU - {C4C2BA6A-B414-4A4C-B39B-87AF0CC54637} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {E5C4ECBB-88B4-40A1-B8E0-0220F5DD43A3} URL =
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\IPS\IPSBHO.DLL (Symantec Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF [2013-11-24]
FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn\ []
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR Extension: (Google Docs) - C:\Users\GHM\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-19]
CHR Extension: (Google Drive) - C:\Users\GHM\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-19]
CHR Extension: (YouTube) - C:\Users\GHM\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-19]
CHR Extension: (Google-Suche) - C:\Users\GHM\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-19]
CHR Extension: (Google Wallet) - C:\Users\GHM\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-19]
CHR Extension: (Google Mail) - C:\Users\GHM\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-19]
CHR HKLM\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\Exts\Chrome.crx [2014-05-15]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
========================== Services (Whitelisted) =================
R2 KMWDSERVICE; C:\Program Files\Silvercrest NM1005 driver\KMWDSrv.exe [208896 2007-06-16] (UASSOFT.COM)
R2 NIS; C:\Program Files\Norton Internet Security\Engine\21.3.0.12\NIS.exe [276376 2014-05-11] (Symantec Corporation)
S3 TuneUp.Defrag; C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe [435008 2011-12-23] (TuneUp Software)
R2 TuneUp.UtilitiesSvc; C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [1052480 2011-11-21] (TuneUp Software)
R2 WebUpdate4; C:\Windows\system32\WebUpdateSvc4.exe [262360 2009-01-08] (Data Perceptions / PowerProgrammer)
R3 WisLMSvc; C:\Program Files\Launch Manager\WisLMSvc.exe [118560 2009-10-23] (Wistron Corp.)
R2 x10nets; C:\Program Files\Common Files\X10\Common\X10nets.exe [20480 2009-11-07] (X10)
==================== Drivers (Whitelisted) ====================
R1 BHDrvx86; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20140510.001\BHDrvx86.sys [1101616 2014-05-10] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NIS\1503000.00C\ccSetx86.sys [127064 2013-09-26] (Symantec Corporation)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376920 2013-11-23] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [108120 2013-11-23] (Symantec Corporation)
R1 IDSVix86; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20140522.001\IDSvix86.sys [395992 2014-03-26] (Symantec Corporation)
R3 KMWDFilter; C:\Windows\System32\Drivers\KMWDFilter.SYS [17280 2007-06-13] (Windows (R) Codename Longhorn DDK provider)
S3 mod7700; C:\Windows\System32\DRIVERS\mod7700.sys [786400 2009-08-13] (DiBcom SA)
R3 NAVENG; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140522.025\NAVENG.SYS [93272 2014-02-08] (Symantec Corporation)
R3 NAVEX15; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140522.025\NAVEX15.SYS [1612376 2014-02-08] (Symantec Corporation)
S3 Spyder3; C:\Windows\System32\DRIVERS\Spyder3.sys [12288 2008-09-08] ()
R3 SRTSP; C:\Windows\System32\Drivers\NIS\1503000.00C\SRTSP.SYS [664280 2014-02-13] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NIS\1503000.00C\SRTSPX.SYS [32344 2013-09-10] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NIS\1503000.00C\SYMDS.SYS [367704 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NIS\1503000.00C\SYMEFA.SYS [936152 2014-03-04] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142936 2013-11-24] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NIS\1503000.00C\Ironx86.SYS [206936 2013-09-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NIS\1503000.00C\SYMNETS.SYS [447704 2014-02-18] (Symantec Corporation)
R3 TuneUpUtilitiesDrv; C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [10064 2010-02-24] (TuneUp Software)
R3 X10Hid; C:\Windows\System32\Drivers\x10hid.sys [13720 2009-05-13] (X10 Wireless Technology, Inc.)
R3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [27160 2009-05-13] (X10 Wireless Technology, Inc.)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-05-23 12:35 - 2014-05-23 12:36 - 00012598 _____ () C:\Users\GHM\Downloads\FRST.txt
2014-05-23 12:33 - 2014-05-23 12:33 - 01056768 _____ (Farbar) C:\Users\GHM\Downloads\FRST.exe
2014-05-23 12:04 - 2014-05-23 12:04 - 00038793 _____ () C:\Users\GHM\Desktop\Ashanti.odt
2014-05-22 19:25 - 2014-05-22 19:25 - 00009828 _____ () C:\Users\GHM\Desktop\ION - Dual.odt
2014-05-22 13:04 - 2014-05-22 13:05 - 00011868 _____ () C:\Users\GHM\Desktop\2014-05-21_Hr. Prokosch.odt
2014-05-22 08:29 - 2014-05-22 08:31 - 00016158 _____ () C:\Users\GHM\Desktop\2014-05-14_Anruf Fr.Seelbach-Reineck.odt
2014-05-19 09:49 - 2014-05-19 08:40 - 00017645 _____ () C:\Users\GHM\Desktop\Gigaset Anl.odt
2014-05-19 09:49 - 2014-05-19 08:12 - 00023404 _____ () C:\Users\GHM\Desktop\Islam-Film arte.odt
2014-05-19 09:49 - 2014-05-11 08:53 - 00013975 _____ () C:\Users\GHM\Desktop\Beginn Monotheismus.odt
2014-05-16 11:00 - 2014-05-19 09:48 - 00000000 ____D () C:\Users\GHM\Desktop\aktuelle Ordner
2014-05-15 12:18 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-15 12:18 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-15 12:18 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-15 07:25 - 2014-05-09 09:06 - 00369664 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-15 07:25 - 2014-05-09 09:04 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-15 07:25 - 2014-04-12 04:15 - 00136640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-15 07:25 - 2014-04-12 04:15 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-15 07:25 - 2014-04-12 04:12 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-15 07:25 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-15 07:25 - 2014-04-12 04:12 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-15 07:25 - 2014-04-12 04:11 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-15 07:25 - 2014-04-12 04:11 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-15 07:25 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-15 07:25 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2014-05-15 07:25 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-15 07:25 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-15 07:25 - 2014-03-04 11:17 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-12 15:20 - 2014-05-12 15:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-05-12 15:20 - 2014-04-14 20:13 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-05-12 15:20 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-05-12 15:20 - 2014-04-14 20:05 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-05-12 15:20 - 2014-04-14 20:04 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-05-12 15:19 - 2014-05-12 15:20 - 00004241 _____ () C:\Windows\system32\jupdate-1.7.0_55-b14.log
2014-05-10 15:22 - 2014-05-23 08:14 - 00001624 _____ () C:\Windows\setupact.log
2014-05-10 15:22 - 2014-05-10 15:22 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-09 15:17 - 2014-05-10 09:30 - 00024311 _____ () C:\Users\GHM\Desktop\Valerianus I + Gallienus, wer ist wer.odt
2014-05-06 12:09 - 2014-05-15 13:30 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-01 08:08 - 2014-05-16 11:06 - 00000000 ____D () C:\Users\GHM\Desktop\SITUATIONS-ORDNER
2014-04-24 17:01 - 2014-04-24 17:01 - 00009229 _____ () C:\Users\GHM\Desktop\LUSTIGES.odt
2014-04-24 16:26 - 2014-04-24 16:26 - 00000000 __SHD () C:\Users\GHM\AppData\Local\EmieUserList
2014-04-24 16:26 - 2014-04-24 16:26 - 00000000 __SHD () C:\Users\GHM\AppData\Local\EmieSiteList
2014-04-24 13:20 - 2014-03-06 10:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-24 13:20 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-24 13:20 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-24 13:20 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-24 13:20 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-24 13:20 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-24 13:20 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-24 13:20 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-24 13:20 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-24 13:20 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-24 13:20 - 2014-03-06 09:38 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-24 13:20 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-24 13:20 - 2014-03-06 09:28 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-24 13:20 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-24 13:20 - 2014-03-06 09:18 - 00575488 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-24 13:20 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-24 13:20 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-24 13:20 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-24 13:20 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-24 13:20 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-24 13:20 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-24 13:20 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-24 13:20 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-24 13:20 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-23 08:21 - 2014-04-23 08:21 - 00000000 ____D () C:\Users\dub_cm_auto
==================== One Month Modified Files and Folders =======
2014-05-23 12:36 - 2014-05-23 12:35 - 00012598 _____ () C:\Users\GHM\Downloads\FRST.txt
2014-05-23 12:36 - 2014-04-06 09:07 - 00000000 ____D () C:\FRST
2014-05-23 12:33 - 2014-05-23 12:33 - 01056768 _____ (Farbar) C:\Users\GHM\Downloads\FRST.exe
2014-05-23 12:25 - 2014-02-28 20:27 - 00000000 ____D () C:\Users\GHM\Desktop\TAGTÄGLICH ROUTINE-1
2014-05-23 12:04 - 2014-05-23 12:04 - 00038793 _____ () C:\Users\GHM\Desktop\Ashanti.odt
2014-05-23 12:03 - 2013-11-22 18:40 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-23 11:53 - 2010-06-11 00:37 - 01729694 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-23 11:52 - 2010-09-18 18:25 - 01385894 _____ () C:\Windows\WindowsUpdate.log
2014-05-23 08:23 - 2009-07-14 06:34 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-23 08:23 - 2009-07-14 06:34 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-23 08:14 - 2014-05-10 15:22 - 00001624 _____ () C:\Windows\setupact.log
2014-05-23 08:14 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-22 19:25 - 2014-05-22 19:25 - 00009828 _____ () C:\Users\GHM\Desktop\ION - Dual.odt
2014-05-22 13:05 - 2014-05-22 13:04 - 00011868 _____ () C:\Users\GHM\Desktop\2014-05-21_Hr. Prokosch.odt
2014-05-22 08:31 - 2014-05-22 08:29 - 00016158 _____ () C:\Users\GHM\Desktop\2014-05-14_Anruf Fr.Seelbach-Reineck.odt
2014-05-21 19:26 - 2013-11-24 10:57 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Internet Security
2014-05-21 19:26 - 2012-12-03 10:53 - 00000000 ____D () C:\Windows\system32\Drivers\NIS
2014-05-21 14:48 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-05-19 09:48 - 2014-05-16 11:00 - 00000000 ____D () C:\Users\GHM\Desktop\aktuelle Ordner
2014-05-19 08:40 - 2014-05-19 09:49 - 00017645 _____ () C:\Users\GHM\Desktop\Gigaset Anl.odt
2014-05-19 08:12 - 2014-05-19 09:49 - 00023404 _____ () C:\Users\GHM\Desktop\Islam-Film arte.odt
2014-05-16 16:18 - 2014-02-11 22:37 - 00000000 ____D () C:\Users\GHM\Desktop\A
2014-05-16 11:10 - 2010-10-03 12:15 - 00000000 ____D () C:\Users\GHM\Desktop\Reinigung + Wdh.stellung
2014-05-16 11:06 - 2014-05-01 08:08 - 00000000 ____D () C:\Users\GHM\Desktop\SITUATIONS-ORDNER
2014-05-15 15:34 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-05-15 13:52 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-05-15 13:30 - 2014-05-06 12:09 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-15 13:30 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-05-15 12:21 - 2013-09-11 18:41 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-15 12:20 - 2010-06-11 19:09 - 90547776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-15 09:09 - 2013-11-22 18:40 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-05-15 09:09 - 2012-01-03 11:01 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-05-12 15:28 - 2014-01-20 20:46 - 00000000 ____D () C:\ProgramData\Oracle
2014-05-12 15:20 - 2014-05-12 15:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-05-12 15:20 - 2014-05-12 15:19 - 00004241 _____ () C:\Windows\system32\jupdate-1.7.0_55-b14.log
2014-05-12 15:20 - 2013-06-12 20:09 - 00000000 ____D () C:\Program Files\Java
2014-05-11 08:53 - 2014-05-19 09:49 - 00013975 _____ () C:\Users\GHM\Desktop\Beginn Monotheismus.odt
2014-05-10 15:22 - 2014-05-10 15:22 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-10 10:46 - 2011-06-13 11:09 - 00000000 ____D () C:\Program Files\CCleaner
2014-05-10 09:30 - 2014-05-09 15:17 - 00024311 _____ () C:\Users\GHM\Desktop\Valerianus I + Gallienus, wer ist wer.odt
2014-05-09 09:06 - 2014-05-15 07:25 - 00369664 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-09 09:04 - 2014-05-15 07:25 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-06 20:21 - 2010-06-11 19:01 - 00000000 ____D () C:\ProgramData\X10 Settings
2014-05-06 18:06 - 2013-11-22 19:44 - 00000000 ____D () C:\Users\GHM\AppData\Roaming\Applian FLV and Media Player
2014-05-06 05:25 - 2014-05-15 12:18 - 17382912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 05:07 - 2014-05-15 12:18 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 04:10 - 2014-05-15 12:18 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-05 08:09 - 2009-07-14 06:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-04 12:33 - 2010-09-18 18:37 - 00000000 ____D () C:\Users\GHM
2014-05-04 12:32 - 2014-03-24 20:38 - 00000000 ____D () C:\Program Files\Recuva
2014-04-24 17:01 - 2014-04-24 17:01 - 00009229 _____ () C:\Users\GHM\Desktop\LUSTIGES.odt
2014-04-24 16:26 - 2014-04-24 16:26 - 00000000 __SHD () C:\Users\GHM\AppData\Local\EmieUserList
2014-04-24 16:26 - 2014-04-24 16:26 - 00000000 __SHD () C:\Users\GHM\AppData\Local\EmieSiteList
2014-04-23 08:21 - 2014-04-23 08:21 - 00000000 ____D () C:\Users\dub_cm_auto
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe
[2014-05-15 07:25] - [2014-03-04 11:17] - 0304128 ____A (Microsoft Corporation) 998507B046BA314CE8245364C686FA67
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-05-19 07:37
==================== End Of Log ============================
Additional scan result of Farbar Recovery Scan Tool (x86) Version:21-05-2014 Ran by GHM at 2014-05-23 12:36:22 Running from C:\Users\GHM\Downloads Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: Norton Internet Security (Enabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB} AS: Norton Internet Security (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466} AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: Norton Internet Security (Enabled) {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0} ==================== Installed Programs ====================== Acrobat.com (HKLM\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated) Adobe Flash Player 13 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated) Adobe Reader 9.5.5 MUI (HKLM\...\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.5.5 - Adobe Systems Incorporated) Applian FLV and Media Player 3.1.1.12 (HKLM\...\Applian FLV and Media Player) (Version: 3.1.1.12 - Applian Technologies) Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.27 - Atheros Communications Inc.) CCleaner (HKLM\...\CCleaner) (Version: 4.13 - Piriform) Cisco EAP-FAST Module (HKLM\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.) Cisco LEAP Module (HKLM\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.) Cisco PEAP Module (HKLM\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.) CorelDRAW Essentials 4 - Content (Version: 4.0 - Corel Corporation) Hidden CorelDRAW Essentials 4 - Draw (Version: 4.0 - Corel Corporation) Hidden CorelDRAW Essentials 4 - Filters (Version: 4.0 - Corel Corporation) Hidden CorelDRAW Essentials 4 - ICA (Version: 4.0 - Corel Corporation) Hidden CorelDRAW Essentials 4 - IPM - No VBA (Version: 4.0 - Corel Corporation) Hidden CorelDRAW Essentials 4 - Lang BR (Version: 4.0 - Corel Corporation) Hidden CorelDRAW Essentials 4 - Lang DE (Version: 4.0 - Corel Corporation) Hidden CorelDRAW Essentials 4 - Lang EN (Version: 4.0 - Corel Corporation) Hidden CorelDRAW Essentials 4 - Lang ES (Version: 4.0 - Corel Corporation) Hidden CorelDRAW Essentials 4 - Lang FR (Version: 4.0 - Corel Corporation) Hidden CorelDRAW Essentials 4 - Lang IT (Version: 4.0 - Corel Corporation) Hidden CorelDRAW Essentials 4 - Lang NL (Version: 4.0 - Uw bedrijfsnaam) Hidden CorelDRAW Essentials 4 - PHOTO-PAINT (Version: 4.0 - Corel Corporation) Hidden CorelDRAW Essentials 4 - Windows Shell Extension (HKLM\...\_{CF0ADC18-6D8F-4353-8EAA-DF45456B7853}) (Version: - Corel Corporation) CorelDRAW Essentials 4 - Windows Shell Extension (Version: 1.1 - Corel Corporation) Hidden CorelDRAW Essentials 4 (HKLM\...\_{C0237AA4-1BFB-46EA-860D-7B0EB365CA13}) (Version: - Corel Corporation) CorelDRAW Essentials 4 (Version: 4.0 - Corel Corporation) Hidden Freecorder 8 Applications (8.0.1.19) (HKLM\...\Freecorder 8 Applications) (Version: 8.0.1.19 - Applian Technologies) Google Earth (HKLM\...\{C768790F-04FB-11E0-9B2C-001AA037B01E}) (Version: 6.0.1.2032 - Google) Intel(R) Graphics Media Accelerator Driver (HKLM\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2092 - Intel Corporation) Intel(R) Management Engine Components (HKLM\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.5.0.1037 - Intel Corporation) Intel(R) TV Wizard (HKLM\...\TVWiz) (Version: - Intel Corporation) IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.36 - Irfan Skiljan) Java 7 Update 55 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217021FF}) (Version: 7.0.550 - Oracle) Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden Junk Mail filter update (Version: 14.0.8117.416 - Microsoft Corporation) Hidden Launch Manager V1.5.0.8 (HKLM\...\{D0846526-66DD-4DC9-A02C-98F9A2806812}) (Version: 1.5.0.8 - Wistron Corp.) Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation) Meade LPI (HKLM\...\{23484C5A-E7AE-4F59-B7DF-88D63BEF18F4}) (Version: 2.46.3.0 - ) Microsoft .NET Compact Framework 2.0 SP2 (HKLM\...\{EDDF99D9-9FE3-4871-A7DB-D1522C51EE9A}) (Version: 2.0.7045 - Microsoft Corporation) Microsoft .NET Framework 1.1 (HKLM\...\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}) (Version: 1.1.4322 - Microsoft) Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden Microsoft Choice Guard (Version: 2.0.48.0 - Microsoft Corporation) Hidden Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [DEU] (HKLM\...\{BAC80EF3-E106-4AEA-8C57-F217F9BC7358}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft Sync Framework Runtime Native v1.0 (x86) (HKLM\...\{8A74E887-8F0F-4017-AF53-CBA42211AAA5}) (Version: 1.0.1215.0 - Microsoft Corporation) Microsoft Sync Framework Services Native v1.0 (x86) (HKLM\...\{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}) (Version: 1.0.1215.0 - Microsoft Corporation) Microsoft Text-to-Speech Engine 4.0 (English) (HKLM\...\MSTTS) (Version: - ) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) MSVCRT (Version: 14.0.1468.721 - Microsoft) Hidden Norton Internet Security (HKLM\...\NIS) (Version: 21.3.0.12 - Symantec Corporation) OpenOffice 4.0.1 (HKLM\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation) PL-2303 USB-to-Serial (HKLM\...\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}) (Version: - ) PlayReady PC Runtime x86 (HKLM\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation) Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6069 - Realtek Semiconductor Corp.) Realtek USB 2.0 Card Reader (HKLM\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30117 - Realtek Semiconductor Corp.) REALTEK Wireless LAN Driver (HKLM\...\{9D3D8C60-A55F-4fed-B2B9-173F09590E16}) (Version: 1.00.0145 - REALTEK Semiconductor Corp.) Recuva (HKLM\...\Recuva) (Version: 1.51 - Piriform) Silvercrest NM1005 driver (HKLM\...\InstallShield_{1C5E457F-2009-4673-8DF4-135898ABA870}) (Version: 5.10.17 - Targa GmbH) Silvercrest NM1005 driver (Version: 5.10.17 - Targa GmbH) Hidden Software Update Wizard (Redist) 4.5 (HKLM\...\Software Update Wizard (Redist)) (Version: 4.5 - PowerProgrammer) Stellarium 0.12.4 (HKLM\...\Stellarium_is1) (Version: 0.12.4 - Stellarium team) Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 14.0.19.0 - Synaptics Incorporated) TuneUp Utilities (HKLM\...\TuneUp Utilities) (Version: 9.0.6030.1 - TuneUp Software) TuneUp Utilities (Version: 9.0.6030.1 - TuneUp Software) Hidden TuneUp Utilities Language Pack (de-DE) (Version: 9.0.6030.1 - TuneUp Software) Hidden VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN) Windows Live Anmelde-Assistent (HKLM\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation) Windows Live Call (Version: 14.0.8117.0416 - Microsoft Corporation) Hidden Windows Live Communications Platform (Version: 14.0.8117.416 - Microsoft Corporation) Hidden Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8117.0416 - Microsoft Corporation) Windows Live Essentials (Version: 14.0.8117.416 - Microsoft Corporation) Hidden Windows Live Fotogalerie (Version: 14.0.8117.416 - Microsoft Corporation) Hidden Windows Live Mail (Version: 14.0.8117.0416 - Microsoft Corporation) Hidden Windows Live Movie Maker (Version: 14.0.8117.0416 - Microsoft Corporation) Hidden Windows Live Sync (HKLM\...\{586509F0-350D-48B5-B763-9CC2F8D96C4C}) (Version: 14.0.8117.416 - Microsoft Corporation) Windows Live Writer (Version: 14.0.8117.0416 - Microsoft Corporation) Hidden Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation) X10 Hardware(TM) (HKLM\...\X10Hardware) (Version: - ) ==================== Restore Points ========================= 16-04-2014 14:25:46 Geplanter Prüfpunkt 24-04-2014 11:00:57 Geplanter Prüfpunkt 24-04-2014 11:19:52 Windows Update 01-05-2014 15:32:49 Geplanter Prüfpunkt 03-05-2014 09:48:14 Windows Update 06-05-2014 10:09:17 Windows Update 12-05-2014 13:19:16 Installed Java 7 Update 55 15-05-2014 10:17:53 Windows Update 22-05-2014 12:38:24 Geplanter Prüfpunkt ==================== Hosts content: ========================== 2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {165C5968-C88F-4A04-BDA0-84A7702F11D7} - System32\Tasks\{0CABE388-CA3B-4C03-8834-B23EA88582D2} => C:\Program Files\Meade\AutostarSuite\UNWISE.EXE [2001-09-28] () Task: {22026F00-5371-495A-8955-B942E8F60D5A} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation) Task: {22274F06-45A8-47B0-AE2F-EDB35BD03C56} - System32\Tasks\Adobe Reader and Acrobat Manager => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04] (Adobe Systems Incorporated) Task: {2BE98043-7BF6-48C7-9E74-0FF27BAC3CFA} - System32\Tasks\{EE580633-7AF9-4B99-89EB-FC30E9C48A10} => C:\Program Files\Meade\AutostarSuite\UNWISE.EXE [2001-09-28] () Task: {33948ED2-8750-4A4F-97A0-E6092E0D33CC} - System32\Tasks\{CACC66E8-773A-493F-B055-842E053CC2DD} => C:\Program Files\Norton Internet Security\Engine\21.1.0.18\uiStub.exe Task: {343D5FFE-FC8D-4C67-AEB1-4D0045F7E59C} - System32\Tasks\{525B7F42-104F-452E-8957-6B83CBA039FD} => C:\Program Files\Meade\AutostarSuite\UNWISE.EXE [2001-09-28] () Task: {43216073-228E-406F-B21E-5007D7B8260D} - System32\Tasks\{AE4EFF61-1333-44E0-B8A5-1533F4C293FF} => C:\Program Files\Meade\AutostarSuite\UNWISE.EXE [2001-09-28] () Task: {442A651C-0FCE-469A-A5A0-D35DB52ACAC4} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-04-17] (Piriform Ltd) Task: {5A965C5C-5429-4807-8939-6FA4C156E1AC} - System32\Tasks\{8981FB4E-AAEE-4A83-9B59-FD049634C066} => C:\Program Files\Meade\AutostarSuite\UNWISE.EXE [2001-09-28] () Task: {62138DA7-CEED-482E-A53E-C53E167ECE4D} - System32\Tasks\{B9144F3B-BFC7-4043-A6BE-3D103109A325} => C:\Program Files\Meade\AutostarSuite\UNWISE.EXE [2001-09-28] () Task: {6E995A92-5164-4362-8F9E-EBA604138AB2} - System32\Tasks\{941B04B0-B4A7-4E2C-AA4B-EB18D11FE7BD} => C:\Program Files\Meade\AutostarSuite\UNWISE.EXE [2001-09-28] () Task: {730CB017-45BF-4F3B-92C3-651BF800914D} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files\Norton Internet Security\Engine\21.3.0.12\SymErr.exe [2014-01-30] (Symantec Corporation) Task: {78B0D134-4F5F-4303-9BA9-A26B416CA8B3} - System32\Tasks\{2F8AE86D-C16B-494B-B128-C3AF00304684} => C:\Program Files\Meade\AutostarSuite\UNWISE.EXE [2001-09-28] () Task: {7D8473E7-3D1E-4218-958C-7A86982BE9C6} - System32\Tasks\{534F2751-BBB0-498C-B0BA-2FCACBD716E4} => C:\Program Files\Meade\AutostarSuite\UNWISE.EXE [2001-09-28] () Task: {8618C71B-1EFB-4A13-89C7-D5864FB04BAD} - System32\Tasks\{E5897B04-E0FD-4FF9-8028-D57EB918290F} => C:\Program Files\Meade\AutostarSuite\UNWISE.EXE [2001-09-28] () Task: {88938DD2-E6E5-42C7-AC74-5F8B762D46E5} - System32\Tasks\{53766444-4A8D-4CAC-A3F3-769521C26451} => C:\Program Files\Norton Internet Security\Engine\21.1.0.18\uiStub.exe Task: {9406FD08-7DAB-4FEE-84A9-C5A5C16A9639} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files\Norton Internet Security\Engine\21.3.0.12\SymErr.exe [2014-01-30] (Symantec Corporation) Task: {98800D62-F8B1-47C7-8718-0EF972BD62BF} - System32\Tasks\{873D580C-0E2D-45E2-A2C2-55A355D235B5} => C:\Program Files\Meade\AutostarSuite\UNWISE.EXE [2001-09-28] () Task: {A560798D-0BE2-4A4E-A957-952851F616BC} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-15] (Adobe Systems Incorporated) Task: {AF6A920F-FD88-42B3-9F5A-144272260B12} - System32\Tasks\{06D416FB-73D1-4AA9-AAFB-69E84EF27B2F} => C:\Program Files\Meade\AutostarSuite\UNWISE.EXE [2001-09-28] () Task: {B4DB4241-A5D0-4465-BEA8-12B6F8B3531E} - System32\Tasks\{D983DC3F-81BD-4C64-9ECC-4C2AFAEB299B} => C:\Medion\Fix Windows Update.exe [2009-11-26] () Task: {B85D4CD8-2073-40D4-91DE-313B1AD56F69} - System32\Tasks\Norton WSC Integration => C:\Program Files\Norton Internet Security\Engine\21.3.0.12\WSCStub.exe [2014-05-11] (Symantec Corporation) Task: {BF5946C2-EA02-42C6-8E4C-EC490016A363} - System32\Tasks\{29542231-EC11-4FEF-804B-18989C576D63} => C:\Program Files\Meade\AutostarSuite\UNWISE.EXE [2001-09-28] () Task: {C0DD792B-584D-445A-A4E1-28A0A30D97E8} - System32\Tasks\{1DB9D2CE-0CB9-4C4F-9468-EAB0EB7066BD} => C:\Program Files\Meade\AutostarSuite\UNWISE.EXE [2001-09-28] () Task: {CCDCEA17-158D-4666-9B1A-6D8208F0D014} - System32\Tasks\{6E87E417-7283-4E75-A527-F31AD12A67CD} => C:\Program Files\Meade\AutostarSuite\UNWISE.EXE [2001-09-28] () Task: {D80FF8E1-CFB4-4FB2-BB03-5895864A56D5} - System32\Tasks\{B5D4B8AF-20FC-48AD-9F57-7BB6AB1F2452} => C:\Program Files\Meade\AutostarSuite\UNWISE.EXE [2001-09-28] () Task: {E8A9C5A7-997A-40B0-8961-1C99079F08D1} - System32\Tasks\{0A1C68F5-34E2-4CE4-A9AB-7C52159B7D80} => C:\Program Files\Meade\AutostarSuite\UNWISE.EXE [2001-09-28] () Task: {F64CFA7A-E036-402D-88C1-61A835B612EA} - System32\Tasks\{E00BD7CB-9D61-44B1-A5DC-B723F3FC94F2} => C:\Program Files\Meade\AutostarSuite\UNWISE.EXE [2001-09-28] () Task: {F9709670-1930-4A84-997D-7A5680FF8F6E} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance => C:\Program Files\TuneUp Utilities 2010\OneClick.exe [2011-11-21] (TuneUp Software) Task: {F9E26035-D75C-4594-AC4D-850BDD3E5A1D} - System32\Tasks\{CCB33391-B9A7-4A99-A584-62895F17BE98} => C:\Program Files\Meade\AutostarSuite\UNWISE.EXE [2001-09-28] () Task: {FEC8420A-B8BC-4ADF-B894-6B92558D1476} - System32\Tasks\{25D0679D-17AA-4042-9FC4-59ACC6A628FF} => C:\Program Files\Meade\AutostarSuite\UNWISE.EXE [2001-09-28] () Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe ==================== Loaded Modules (whitelisted) ============= 2010-06-11 18:01 - 2009-10-02 22:18 - 00058880 _____ () C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll 2007-03-29 13:17 - 2007-03-29 13:17 - 00106496 _____ () C:\Program Files\Silvercrest NM1005 driver\keydll.dll 2005-05-04 20:12 - 2005-05-04 20:12 - 00028672 _____ () C:\Program Files\Silvercrest NM1005 driver\MouseHook.dll ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BsScanner => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\BsScanner => ""="Service" ==================== EXE Association (whitelisted) ============= ==================== Disabled items from MSCONFIG ============== ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (05/23/2014 09:32:52 AM) (Source: SideBySide) (EventID: 33) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"1". Die abhängige Assemblierung "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error: (05/22/2014 09:11:28 AM) (Source: SideBySide) (EventID: 33) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"1". Die abhängige Assemblierung "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error: (05/21/2014 02:54:55 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 11.0.9600.17041, Zeitstempel: 0x531807e4 Name des fehlerhaften Moduls: AcroRd32.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x518aacc2 Ausnahmecode: 0xc0000005 Fehleroffset: 0x5ecadcb1 ID des fehlerhaften Prozesses: 0xc34 Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0 Pfad der fehlerhaften Anwendung: iexplore.exe1 Pfad des fehlerhaften Moduls: iexplore.exe2 Berichtskennung: iexplore.exe3 Error: (05/21/2014 02:54:45 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 11.0.9600.17041, Zeitstempel: 0x531807e4 Name des fehlerhaften Moduls: AcroRd32.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x518aacc2 Ausnahmecode: 0xc0000005 Fehleroffset: 0x5f30f45c ID des fehlerhaften Prozesses: 0xc34 Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0 Pfad der fehlerhaften Anwendung: iexplore.exe1 Pfad des fehlerhaften Moduls: iexplore.exe2 Berichtskennung: iexplore.exe3 Error: (05/21/2014 09:26:21 AM) (Source: SideBySide) (EventID: 33) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"1". Die abhängige Assemblierung "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error: (05/20/2014 11:13:05 AM) (Source: SideBySide) (EventID: 33) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"1". Die abhängige Assemblierung "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error: (05/19/2014 07:39:48 AM) (Source: SideBySide) (EventID: 33) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"1". Die abhängige Assemblierung "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error: (05/17/2014 09:09:40 AM) (Source: SideBySide) (EventID: 33) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"1". Die abhängige Assemblierung "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error: (05/16/2014 09:01:09 AM) (Source: SideBySide) (EventID: 33) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"1". Die abhängige Assemblierung "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error: (05/15/2014 03:09:27 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 11.0.9600.17041, Zeitstempel: 0x531807e4 Name des fehlerhaften Moduls: AcroRd32.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x518aacc2 Ausnahmecode: 0xc0000005 Fehleroffset: 0x5e25dcb1 ID des fehlerhaften Prozesses: 0x1514 Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0 Pfad der fehlerhaften Anwendung: iexplore.exe1 Pfad des fehlerhaften Moduls: iexplore.exe2 Berichtskennung: iexplore.exe3 System errors: ============= Error: (05/22/2014 03:52:52 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252. Error: (05/16/2014 02:28:55 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252. Error: (05/16/2014 11:03:08 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252. Error: (05/15/2014 02:57:52 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252. Error: (05/15/2014 02:57:52 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252. Error: (05/15/2014 02:57:25 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252. Error: (05/15/2014 02:57:24 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252. Error: (05/15/2014 02:57:24 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252. Error: (05/15/2014 10:49:14 AM) (Source: DCOM) (EventID: 10010) (User: ) Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} Error: (05/13/2014 03:09:09 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252. Microsoft Office Sessions: ========================= Error: (05/23/2014 09:32:52 AM) (Source: SideBySide) (EventID: 33) (User: ) Description: UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"c:\program files\windows live\messenger\wlcsdk.exe Error: (05/22/2014 09:11:28 AM) (Source: SideBySide) (EventID: 33) (User: ) Description: UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"c:\program files\windows live\messenger\wlcsdk.exe Error: (05/21/2014 02:54:55 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: iexplore.exe11.0.9600.17041531807e4AcroRd32.dll_unloaded0.0.0.0518aacc2c00000055ecadcb1c3401cf74f288bbc40eC:\Program Files\Internet Explorer\iexplore.exeAcroRd32.dll1b2a783e-e0e7-11e3-b6f1-00262df85f3b Error: (05/21/2014 02:54:45 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: iexplore.exe11.0.9600.17041531807e4AcroRd32.dll_unloaded0.0.0.0518aacc2c00000055f30f45cc3401cf74f288bbc40eC:\Program Files\Internet Explorer\iexplore.exeAcroRd32.dll1504dbbf-e0e7-11e3-b6f1-00262df85f3b Error: (05/21/2014 09:26:21 AM) (Source: SideBySide) (EventID: 33) (User: ) Description: UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"c:\program files\windows live\messenger\wlcsdk.exe Error: (05/20/2014 11:13:05 AM) (Source: SideBySide) (EventID: 33) (User: ) Description: UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"c:\program files\windows live\messenger\wlcsdk.exe Error: (05/19/2014 07:39:48 AM) (Source: SideBySide) (EventID: 33) (User: ) Description: UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"c:\program files\windows live\messenger\wlcsdk.exe Error: (05/17/2014 09:09:40 AM) (Source: SideBySide) (EventID: 33) (User: ) Description: UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"c:\program files\windows live\messenger\wlcsdk.exe Error: (05/16/2014 09:01:09 AM) (Source: SideBySide) (EventID: 33) (User: ) Description: UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"c:\program files\windows live\messenger\wlcsdk.exe Error: (05/15/2014 03:09:27 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: iexplore.exe11.0.9600.17041531807e4AcroRd32.dll_unloaded0.0.0.0518aacc2c00000055e25dcb1151401cf703d24220803C:\Program Files\Internet Explorer\iexplore.exeAcroRd32.dll24213c47-dc32-11e3-bc3c-00262df85f3b ==================== Memory info =========================== Percentage of memory in use: 36% Total physical RAM: 3510.6 MB Available physical RAM: 2245.54 MB Total Pagefile: 7019.49 MB Available Pagefile: 5735.74 MB Total Virtual: 2047.88 MB Available Virtual: 1926.26 MB ==================== Drives ================================ Drive c: (Boot) (Fixed) (Total:424.66 GB) (Free:388.71 GB) NTFS Drive d: (Recover) (Fixed) (Total:40 GB) (Free:21.32 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 466 GB) (Disk ID: 2BD2C32A) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=425 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=40 GB) - (Type=07 NTFS) Partition 4: (Not Active) - (Size=1 GB) - (Type=12) ==================== End Of Log ============================ Gruß Frusti |
|
24.05.2014, 11:01
| #6 |
| /// the machine /// TB-Ausbilder | PC läuft recht langsam und "frißt sich manchmal fest" hi, Scan mit Combofix
__________________ --> PC läuft recht langsam und "frißt sich manchmal fest" |
|
24.05.2014, 13:42
| #7 |
| | PC läuft recht langsam und "frißt sich manchmal fest" Hallo, das hat leider nicht geklappt. Zunächst erhielt ich bei Combofix - zwei Meldungen: - Combofix hat festgestellt, daß folgende Real-Time-Scanner aktiv sind antispyware: Norton Internet Security. - Dies, obwohl abgeschaltet! dann: antispyware Norton Internet security ist immer noch aktiv - NOCHMAL: Obwohl abgeschaltet! Dann lief ca. 30 min (!) das Programm bis zu einer Mitteilung etwa: Programm 37 ist fertiggestellt. Da wußte ich nun nicht mehr, ob das nun das Ende ist, und habe beendet. Dann habe ich aber unter "C:\Combofix.txt" nichts gefunden. Hinweis von mir: Es wäre gut, wenn Du mir eine Mitteilung geben würdest, mit welcher Mitteilung mir Combofix mitteilt, daß das Programm abgeschlossen ist! Wie soll ich jetzt weiter verfahren? Gruß Frusti |
|
25.05.2014, 06:53
| #8 | |
| /// the machine /// TB-Ausbilder | PC läuft recht langsam und "frißt sich manchmal fest"Zitat:
Deinstalliere Norton, ist eh Müll.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
25.05.2014, 14:24
| #9 | |
| | PC läuft recht langsam und "frißt sich manchmal fest" Hallo Schrauber, vielen Dank für Deine Statements. Zitat:
Allerdings: Wenn man eine Sache zum 'Müll' erklärt, sollte man auch eine Alternative nennen. Denn ohne Sicherheitsprogramm zu sein, ist doch wohl sicher die schlechteste aller Möglichkeiten, oder? Ich werde 'Combofix' erneut durchführen, und Dich dann informieren. (Möglicherweise reicht die h, bis mich das Forum ausschaltet, nicht aus!) Gruß Frusti Hier nun der zweite Teil: Combofix: (Merkwürdigerweise ging es diesmal erheblich schneller!) Combofix Logfile: Code:
ATTFilter ComboFix 14-05-19.01 - GHM 25.05.2014 10:36:53.3.4 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3511.2391 [GMT 2:00]
ausgeführt von:: c:\users\GHM\Downloads\ComboFix.exe
AV: Norton Internet Security *Disabled/Updated* {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}
FW: Norton Internet Security *Disabled* {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}
SP: Norton Internet Security *Enabled/Updated* {631E4324-D31C-783F-EC5C-35AD42B18466}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-04-25 bis 2014-05-25 ))))))))))))))))))))))))))))))
.
.
2014-05-25 08:59 . 2014-05-25 08:59 -------- d-----w- c:\users\DefaultAppPool\AppData\Local\temp
2014-05-25 08:59 . 2014-05-25 08:59 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-05-15 10:18 . 2014-05-06 03:07 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2014-05-15 07:08 . 2014-05-21 17:26 -------- d-----w- c:\windows\system32\drivers\NIS\1503000.00C
2014-05-12 13:20 . 2014-04-14 18:13 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2014-05-06 10:09 . 2014-05-15 11:30 -------- d-s---w- c:\windows\system32\CompatTel
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-05-15 07:09 . 2013-11-22 16:40 692400 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-05-15 07:09 . 2012-01-03 09:01 70832 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-03-06 08:31 . 2014-04-24 11:20 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll
2014-03-06 08:02 . 2014-04-24 11:20 61952 ----a-w- c:\windows\system32\iesetup.dll
2014-03-06 08:02 . 2014-04-24 11:20 455168 ----a-w- c:\windows\system32\vbscript.dll
2014-03-06 08:01 . 2014-04-24 11:20 51200 ----a-w- c:\windows\system32\ieetwproxystub.dll
2014-03-06 07:46 . 2014-04-24 11:20 4254720 ----a-w- c:\windows\system32\jscript9.dll
2014-03-06 07:38 . 2014-04-24 11:20 112128 ----a-w- c:\windows\system32\ieUnatt.exe
2014-03-06 07:38 . 2014-04-24 11:20 108032 ----a-w- c:\windows\system32\ieetwcollector.exe
2014-03-06 07:36 . 2014-04-24 11:20 592896 ----a-w- c:\windows\system32\jscript9diag.dll
2014-03-06 07:28 . 2014-04-24 11:20 646144 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2014-03-06 07:13 . 2014-04-24 11:20 32256 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2014-03-06 06:40 . 2014-04-24 11:20 1967104 ----a-w- c:\windows\system32\inetcpl.cpl
2014-03-06 05:41 . 2014-04-24 11:20 1789440 ----a-w- c:\windows\system32\wininet.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2009-10-02 284696]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-03-17 8546848]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RtHDVBg.exe" [2010-03-17 686624]
"HotkeyApp"="c:\program files\Launch Manager\HotkeyApp.exe" [2009-12-14 200704]
"LMgrVolOSD"="c:\program files\Launch Manager\OSD.exe" [2009-12-11 348960]
"Wbutton"="c:\program files\Launch Manager\Wbutton.exe" [2010-01-13 413696]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-12-11 1594664]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 136216]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 171032]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 170520]
"KMCONFIG"="c:\program files\Silvercrest NM1005 driver\StartAutorun.exe" [2007-03-06 212992]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\Jaksta\AC\x86\jaudcap.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
.
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-03-06 108032]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys [2010-03-24 191008]
R3 Spyder3;Datacolor Spyder3;c:\windows\system32\DRIVERS\Spyder3.sys [2008-09-08 12288]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1503000.00C\SYMDS.SYS [2013-09-10 367704]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1503000.00C\SYMEFA.SYS [2014-03-04 936152]
S1 BHDrvx86;BHDrvx86;c:\program files\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20140510.001\BHDrvx86.sys [2014-05-10 1101616]
S1 ccSet_NIS;NIS Settings Manager;c:\windows\system32\drivers\NIS\1503000.00C\ccSetx86.sys [2013-09-26 127064]
S1 IDSVix86;IDSVix86;c:\program files\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20140523.001\IDSvix86.sys [2014-03-26 395992]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1503000.00C\Ironx86.SYS [2013-09-27 206936]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NIS\1503000.00C\SYMNETS.SYS [2014-02-18 447704]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2009-10-02 13336]
S2 KMWDSERVICE;Keyboard And Mouse Communication Service;c:\program files\Silvercrest NM1005 driver\KMWDSrv.exe [2007-06-16 208896]
S2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\21.3.0.12\NIS.exe [2014-05-11 276376]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [2011-11-21 1052480]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-12-10 2320920]
S2 WebUpdate4;Web Update Wizard Service V4;c:\windows\system32\WebUpdateSvc4.exe [2009-01-08 262360]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2013-11-23 108120]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-10 132352]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-01-08 232448]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2010-03-04 67624]
S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys [2010-01-19 996896]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [2010-02-24 10064]
S3 WisLMSvc;WisLMSvc;c:\program files\Launch Manager\WisLMSvc.exe [2009-10-23 118560]
S3 X10Hid;X10 Hid Device;c:\windows\System32\Drivers\x10hid.sys [2009-05-13 13720]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
iissvcs REG_MULTI_SZ w3svc was
apphost REG_MULTI_SZ apphostsvc
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Inhalt des "geplante Tasks" Ordners
.
2014-05-25 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-11-22 07:09]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
mStart Page = hxxp://www.google.com
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - Elektronik, Autos, Mode, Sammlerstücke, Gutscheine und mehr Online-Shopping | eBay
TCP: DhcpNameServer = 192.168.178.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
SafeBoot-BsScanner
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\21.3.0.12\NIS.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\21.3.0.12\diMaster.dll\" /prefetch:1"
"ImagePath"="\SystemRoot\System32\Drivers\NIS\1503000.00C\SYMNETS.SYS"
"TrustedImagePaths"="c:\program files\Norton Internet Security\Engine\21.3.0.12"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-05-25 11:00:49
ComboFix-quarantined-files.txt 2014-05-25 09:00
.
Vor Suchlauf: 13 Verzeichnis(se), 417.304.092.672 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 417.205.547.008 Bytes frei
.
- - End Of File - - C5706D86DCF367A9BDD74C9284524243
8A1C59E4DFEF87510470928550466632 Gruß Frusti Hallo, jetzt wird's mir etwas 'mulmig'. Exakt, seitdem ich 'Combofix durchgezogen habe, funktioniert die Google Suche nicht mehr richtig, eigentlich garnicht!? Kannst Du mir sagen, was da schief läuft? Gruß Frusti =================== 3. Teil-Post: Nach zwei Stunden Suche habe ich glücklicherweise den Fehler gefunden, der eindeutig vor der Verwendung von 'Combofix' nicht vorhanden war. Ein Manko Deiner Arbeit ist, daß ich nicht weiß, was die Programme machen. Eine ganz kurze Erläuterung wäre da sehr hilfreich. Uneingeschränkt klarstellen möchte ich - um Mißverständnissen vorzubeugen: Dies ist natürlich keinesfalls eine pauschale Kritik oder Skepsis an Deiner Arbeit bei/mit meinem PC, sondern eine punktuelle Kritik. Es ist auch kein Vertrauensproblem - das habe ich durchaus, sonst würde ich die Schritte nicht blindlings machen! Andererseits verunsichern natürlich solche Vorkommnisse, wenn ich sie mir nicht erklären kann! Sei so nett und gib mir eine kurze Info, was Combofix verändern kann. Gruß Frusti |
|
26.05.2014, 12:00
| #10 | |
| /// the machine /// TB-Ausbilder | PC läuft recht langsam und "frißt sich manchmal fest"Zitat:
 Das Ding ist so schlecht dass es gar nicht mehr gelistet wird. Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
27.05.2014, 11:50
| #11 |
| | PC läuft recht langsam und "frißt sich manchmal fest" [QUOTE=Frusti;1305500]Hallo Schrauber, Wenn man eine Sache zum 'Müll' erklärt, sollte man auch eine Alternative nennen. Denn ohne Sicherheitsprogramm zu sein, ist doch wohl sicher die schlechteste aller Möglichkeiten, oder? Hallo, danke für Deine Antwort. Zitat: "Wenn man eine Sache zum 'Müll' erklärt, sollte man auch eine Alternative nennen. Denn ohne Sicherheitsprogramm zu sein, ist doch wohl sicher die schlechteste aller Möglichkeiten, oder?" Der Wert einer Aussage ist sehr unzureichend, wenn man zwar eine „Sache“ verdammt, dafür aber keine Alternative anbietet, noch dazu, wo ich explizit darum gebeten hatte! Auch finde ich es nicht gut, daß ich nach gravierenden Problemen in der Nutzung des Internets ohne einen Hinweis erst mühsam nach einer Aussage suchen muß, daß „Combofix“ Einstellungen verändern kann!? ====================================== Hier die logfiles: 1.) Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 27.05.2014 Suchlauf-Zeit: 09:07:55 Logdatei: mbam.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.05.27.04 Rootkit Datenbank: v2014.05.21.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x86 Dateisystem: NTFS Benutzer: GHM Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 283140 Verstrichene Zeit: 8 Min, 30 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Warnen PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 4 PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, In Quarantäne, [461a9bbb80fb181e5dd62e01a95950b0], PUP.Optional.Freecorder.A, HKLM\SOFTWARE\CLASSES\extension.ScriptHostObject, In Quarantäne, [7fe189cdb1caad89a72871ba9270b848], PUP.Optional.Freecorder.A, HKLM\SOFTWARE\CLASSES\extension.ScriptHostObject.1, In Quarantäne, [8ad683d35526e05617b8a48721e1db25], PUP.Optional.PlusHD.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Plus-HD-4.8, In Quarantäne, [77e9d185c7b4aa8c879d4555ea1856aa], Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 0 (No malicious items detected) Physische Sektoren: 0 (No malicious items detected) (end) ============================== 2.)AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.211 - Bericht erstellt am 27/05/2014 um 12:09:18
# Aktualisiert 26/05/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (32 bits)
# Benutzername : GHM - PC
# Gestartet von : C:\Users\GHM\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YMEK6TGB\adwcleaner_3.211.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Uniblue
Ordner Gelöscht : C:\Users\GHM\AppData\Local\BrowserSafeguard
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\updatealbrechto_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\updatealbrechto_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EE95078D-518C-4FD2-8093-FD1D4E33D3CA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F9EB11AB-9384-4736-9B33-993940F88895}
Schlüssel Gelöscht : HKCU\Software\45914InstEnd
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software
Schlüssel Gelöscht : HKLM\Software\Uniblue
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17041
-\\ Google Chrome v
[ Datei : C:\Users\GHM\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Gelöscht [Search Provider] : hxxp://de.ask.com/web?q={searchTerms}
Gelöscht [Extension] : dhdepfaagokllfmhfbcfmocaeigmoebo
Gelöscht [Extension] : hphibigbodkkohoglgfkddblldpfohjl
Gelöscht [Extension] : kdcnnmifdmlmjffdgeieikcokcogpbej
Gelöscht [Extension] : kincjchfokkeneeofpeefomkikfkiedl
Gelöscht [Extension] : kkkeikdkpjenmoiicggnnodbkebafgpc
Gelöscht [Extension] : pgmfkblbflahhponhjmkcnpjinenhlnc
*************************
AdwCleaner[R0].txt - [11231 octets] - [19/01/2014 12:07:59]
AdwCleaner[R1].txt - [1236 octets] - [26/03/2014 09:19:35]
AdwCleaner[R2].txt - [1306 octets] - [28/03/2014 18:54:18]
AdwCleaner[R3].txt - [1358 octets] - [07/04/2014 07:51:23]
AdwCleaner[R4].txt - [1418 octets] - [07/04/2014 07:55:18]
AdwCleaner[R5].txt - [1478 octets] - [09/04/2014 07:11:13]
AdwCleaner[R6].txt - [2464 octets] - [27/05/2014 12:07:24]
AdwCleaner[S0].txt - [10072 octets] - [19/01/2014 12:09:00]
AdwCleaner[S1].txt - [2329 octets] - [27/05/2014 12:09:18]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [2389 octets] ##########
============================= 3.) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.1.4 (04.06.2014:1) OS: Windows 7 Home Premium x86 Ran by GHM on 27.05.2014 at 12:14:15,04 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{57F74961-D98B-46A0-9E3F-26E321617D3B} ~~~ Files Successfully deleted: [File] "C:\Users\GHM\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\user pinned\startmenu\startfenster.lnk" Successfully deleted: [File] "C:\Users\GHM\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\user pinned\taskbar\startfenster.lnk" ~~~ Folders ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 27.05.2014 at 12:17:04,44 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ====================== 4.) Frst FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:25-05-2014 02
Ran by GHM (administrator) on PC on 27-05-2014 12:20:09
Running from C:\Users\GHM\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROL4EP7S
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(UASSOFT.COM) C:\Program Files\Silvercrest NM1005 driver\KMWDSrv.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.3.0.12\nis.exe
(Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.3.0.12\nis.exe
(Data Perceptions / PowerProgrammer) C:\Windows\System32\WebUpdateSvc4.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
(X10) C:\Program Files\Common Files\X10\Common\X10nets.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe
(Wistron) C:\Program Files\Launch Manager\HotkeyApp.exe
(Wistron Corp.) C:\Program Files\Launch Manager\OSD.exe
(Wistron Corp.) C:\Program Files\Launch Manager\WButton.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(UASSOFT.COM) C:\Program Files\Silvercrest NM1005 driver\StartAutorun.exe
(UASSOFT.COM) C:\Program Files\Silvercrest NM1005 driver\KMCONFIG.exe
(UASSOFT.COM) C:\Program Files\Silvercrest NM1005 driver\KMProcess.exe
(Wistron Corp.) C:\Program Files\Launch Manager\WisLMSvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Farbar) C:\Users\GHM\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROL4EP7S\FRST (2).exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2009-10-02] (Intel Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8546848 2010-03-17] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe [686624 2010-03-17] (Realtek Semiconductor)
HKLM\...\Run: [HotkeyApp] => C:\Program Files\Launch Manager\HotkeyApp.exe [200704 2009-12-14] (Wistron)
HKLM\...\Run: [LMgrVolOSD] => C:\Program Files\Launch Manager\OSD.exe [348960 2009-12-12] (Wistron Corp.)
HKLM\...\Run: [Wbutton] => C:\Program Files\Launch Manager\Wbutton.exe [413696 2010-01-13] (Wistron Corp.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1594664 2009-12-11] (Synaptics Incorporated)
HKLM\...\Run: [KMCONFIG] => C:\Program Files\Silvercrest NM1005 driver\StartAutorun.exe KMConfig.exe
AppInit_DLLs: C:\Windows\Jaksta\AC\x86\jaudcap.dll => C:\Windows\Jaksta\AC\x86\jaudcap.dll [264480 2013-10-31] (Jaksta Technologies Pty Ltd)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {E5C4ECBB-88B4-40A1-B8E0-0220F5DD43A3} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKCU - DefaultScope {C4C2BA6A-B414-4A4C-B39B-87AF0CC54637} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {C4C2BA6A-B414-4A4C-B39B-87AF0CC54637} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {E5C4ECBB-88B4-40A1-B8E0-0220F5DD43A3} URL =
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\IPS\IPSBHO.DLL (Symantec Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF [2013-11-24]
FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn\ []
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR Extension: (Google Docs) - C:\Users\GHM\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-19]
CHR Extension: (Google Drive) - C:\Users\GHM\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-19]
CHR Extension: (YouTube) - C:\Users\GHM\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-19]
CHR Extension: (Google-Suche) - C:\Users\GHM\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-19]
CHR Extension: (Google Wallet) - C:\Users\GHM\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-19]
CHR Extension: (Google Mail) - C:\Users\GHM\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-19]
CHR HKLM\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\Exts\Chrome.crx [2014-05-15]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
========================== Services (Whitelisted) =================
R2 KMWDSERVICE; C:\Program Files\Silvercrest NM1005 driver\KMWDSrv.exe [208896 2007-06-16] (UASSOFT.COM)
R2 NIS; C:\Program Files\Norton Internet Security\Engine\21.3.0.12\NIS.exe [276376 2014-05-11] (Symantec Corporation)
S3 TuneUp.Defrag; C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe [435008 2011-12-23] (TuneUp Software)
R2 TuneUp.UtilitiesSvc; C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [1052480 2011-11-21] (TuneUp Software)
R2 WebUpdate4; C:\Windows\system32\WebUpdateSvc4.exe [262360 2009-01-08] (Data Perceptions / PowerProgrammer)
R3 WisLMSvc; C:\Program Files\Launch Manager\WisLMSvc.exe [118560 2009-10-23] (Wistron Corp.)
R2 x10nets; C:\Program Files\Common Files\X10\Common\X10nets.exe [20480 2009-11-07] (X10)
==================== Drivers (Whitelisted) ====================
R1 BHDrvx86; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20140510.001\BHDrvx86.sys [1101616 2014-05-10] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NIS\1503000.00C\ccSetx86.sys [127064 2013-09-26] (Symantec Corporation)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376920 2013-11-23] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [108120 2013-11-23] (Symantec Corporation)
R1 IDSVix86; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20140526.001\IDSvix86.sys [395992 2014-03-26] (Symantec Corporation)
R3 KMWDFilter; C:\Windows\System32\Drivers\KMWDFilter.SYS [17280 2007-06-13] (Windows (R) Codename Longhorn DDK provider)
S3 mod7700; C:\Windows\System32\DRIVERS\mod7700.sys [786400 2009-08-13] (DiBcom SA)
R3 NAVENG; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140526.022\NAVENG.SYS [93272 2014-02-08] (Symantec Corporation)
R3 NAVEX15; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140526.022\NAVEX15.SYS [1612376 2014-02-08] (Symantec Corporation)
S3 Spyder3; C:\Windows\System32\DRIVERS\Spyder3.sys [12288 2008-09-08] ()
R3 SRTSP; C:\Windows\System32\Drivers\NIS\1503000.00C\SRTSP.SYS [664280 2014-02-13] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NIS\1503000.00C\SRTSPX.SYS [32344 2013-09-10] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NIS\1503000.00C\SYMDS.SYS [367704 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NIS\1503000.00C\SYMEFA.SYS [936152 2014-03-04] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142936 2013-11-24] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NIS\1503000.00C\Ironx86.SYS [206936 2013-09-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NIS\1503000.00C\SYMNETS.SYS [447704 2014-02-18] (Symantec Corporation)
R3 TuneUpUtilitiesDrv; C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [10064 2010-02-24] (TuneUp Software)
R3 X10Hid; C:\Windows\System32\Drivers\x10hid.sys [13720 2009-05-13] (X10 Wireless Technology, Inc.)
R3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [27160 2009-05-13] (X10 Wireless Technology, Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\GHM\AppData\Local\Temp\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-05-27 12:17 - 2014-05-27 12:17 - 00001052 _____ () C:\Users\GHM\Desktop\JRT.txt
2014-05-27 12:14 - 2014-05-27 12:14 - 00000000 ____D () C:\Windows\ERUNT
2014-05-27 12:07 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-05-27 12:05 - 2014-05-27 12:05 - 00001763 _____ () C:\Users\GHM\Desktop\mbam.txt
2014-05-27 08:54 - 2014-05-27 12:03 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-27 08:54 - 2014-05-27 08:54 - 00001068 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-27 08:54 - 2014-05-27 08:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-05-27 08:54 - 2014-05-27 08:54 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-05-27 08:54 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-27 08:54 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-26 15:20 - 2014-05-26 15:20 - 00010461 _____ () C:\Users\GHM\Desktop\Der Wert.odt
2014-05-25 20:19 - 2014-05-25 20:21 - 00010996 _____ () C:\Users\GHM\Desktop\Die Mosel bei Schengen.odt
2014-05-25 11:00 - 2014-05-25 11:00 - 00009156 _____ () C:\ComboFix.txt
2014-05-25 10:33 - 2014-05-25 10:33 - 00001086 _____ () C:\Users\GHM\Desktop\ComboFix - Verknüpfung.lnk
2014-05-25 07:47 - 2014-05-27 12:10 - 00001858 _____ () C:\Windows\PFRO.log
2014-05-24 14:04 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-05-24 14:04 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-05-24 14:04 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-05-24 14:04 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-05-24 14:04 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-05-24 14:04 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-05-24 14:04 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-05-24 14:04 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-05-24 14:01 - 2014-05-25 11:00 - 00000000 ____D () C:\Windows\erdnt
2014-05-24 14:01 - 2014-05-25 11:00 - 00000000 ____D () C:\Qoobox
2014-05-24 13:59 - 2014-05-24 13:59 - 05200426 ____R (Swearware) C:\Users\GHM\Downloads\ComboFix.exe
2014-05-23 12:04 - 2014-05-23 12:04 - 00038793 _____ () C:\Users\GHM\Desktop\Ashanti.odt
2014-05-22 13:04 - 2014-05-22 13:05 - 00011868 _____ () C:\Users\GHM\Desktop\2014-05-21_Hr. Prokosch.odt
2014-05-19 09:49 - 2014-05-26 16:53 - 00022941 _____ () C:\Users\GHM\Desktop\Gigaset Anl.odt
2014-05-19 09:49 - 2014-05-19 08:12 - 00023404 _____ () C:\Users\GHM\Desktop\Islam-Film arte.odt
2014-05-19 09:49 - 2014-05-11 08:53 - 00013975 _____ () C:\Users\GHM\Desktop\Beginn Monotheismus.odt
2014-05-16 11:00 - 2014-05-27 07:27 - 00000000 ____D () C:\Users\GHM\Desktop\aktuelle Ordner
2014-05-15 12:18 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-15 12:18 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-15 12:18 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-15 07:25 - 2014-05-09 09:06 - 00369664 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-15 07:25 - 2014-05-09 09:04 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-15 07:25 - 2014-04-12 04:15 - 00136640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-15 07:25 - 2014-04-12 04:15 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-15 07:25 - 2014-04-12 04:12 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-15 07:25 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-15 07:25 - 2014-04-12 04:12 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-15 07:25 - 2014-04-12 04:11 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-15 07:25 - 2014-04-12 04:11 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-15 07:25 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-15 07:25 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2014-05-15 07:25 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-15 07:25 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-15 07:25 - 2014-03-04 11:17 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-12 15:20 - 2014-05-12 15:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-05-12 15:20 - 2014-04-14 20:13 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-05-12 15:20 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-05-12 15:20 - 2014-04-14 20:05 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-05-12 15:20 - 2014-04-14 20:04 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-05-12 15:19 - 2014-05-12 15:20 - 00004241 _____ () C:\Windows\system32\jupdate-1.7.0_55-b14.log
2014-05-10 15:22 - 2014-05-27 12:10 - 00002688 _____ () C:\Windows\setupact.log
2014-05-10 15:22 - 2014-05-10 15:22 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-09 15:17 - 2014-05-10 09:30 - 00024311 _____ () C:\Users\GHM\Desktop\Valerianus I + Gallienus, wer ist wer.odt
2014-05-06 12:09 - 2014-05-15 13:30 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-01 08:08 - 2014-05-16 11:06 - 00000000 ____D () C:\Users\GHM\Desktop\SITUATIONS-ORDNER
==================== One Month Modified Files and Folders =======
2014-05-27 12:20 - 2014-04-06 09:07 - 00000000 ____D () C:\FRST
2014-05-27 12:17 - 2014-05-27 12:17 - 00001052 _____ () C:\Users\GHM\Desktop\JRT.txt
2014-05-27 12:17 - 2009-07-14 06:34 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-27 12:17 - 2009-07-14 06:34 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-27 12:14 - 2014-05-27 12:14 - 00000000 ____D () C:\Windows\ERUNT
2014-05-27 12:10 - 2014-05-25 07:47 - 00001858 _____ () C:\Windows\PFRO.log
2014-05-27 12:10 - 2014-05-10 15:22 - 00002688 _____ () C:\Windows\setupact.log
2014-05-27 12:10 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-27 12:09 - 2014-01-19 12:07 - 00000000 ____D () C:\AdwCleaner
2014-05-27 12:09 - 2010-09-18 18:25 - 01583471 _____ () C:\Windows\WindowsUpdate.log
2014-05-27 12:05 - 2014-05-27 12:05 - 00001763 _____ () C:\Users\GHM\Desktop\mbam.txt
2014-05-27 12:03 - 2014-05-27 08:54 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-27 12:03 - 2013-11-22 18:40 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-27 11:54 - 2010-06-11 00:37 - 01729694 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-27 09:07 - 2014-02-28 20:27 - 00000000 ____D () C:\Users\GHM\Desktop\TAGTÄGLICH ROUTINE-1
2014-05-27 08:54 - 2014-05-27 08:54 - 00001068 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-27 08:54 - 2014-05-27 08:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-05-27 08:54 - 2014-05-27 08:54 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-05-27 08:54 - 2014-03-04 09:29 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-27 07:27 - 2014-05-16 11:00 - 00000000 ____D () C:\Users\GHM\Desktop\aktuelle Ordner
2014-05-26 16:53 - 2014-05-19 09:49 - 00022941 _____ () C:\Users\GHM\Desktop\Gigaset Anl.odt
2014-05-26 15:20 - 2014-05-26 15:20 - 00010461 _____ () C:\Users\GHM\Desktop\Der Wert.odt
2014-05-25 20:21 - 2014-05-25 20:19 - 00010996 _____ () C:\Users\GHM\Desktop\Die Mosel bei Schengen.odt
2014-05-25 16:40 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-05-25 11:00 - 2014-05-25 11:00 - 00009156 _____ () C:\ComboFix.txt
2014-05-25 11:00 - 2014-05-24 14:01 - 00000000 ____D () C:\Windows\erdnt
2014-05-25 11:00 - 2014-05-24 14:01 - 00000000 ____D () C:\Qoobox
2014-05-25 11:00 - 2014-04-23 08:21 - 00000000 ____D () C:\Users\dub_cm_auto
2014-05-25 11:00 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Default
2014-05-25 11:00 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-05-25 10:59 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2014-05-25 10:33 - 2014-05-25 10:33 - 00001086 _____ () C:\Users\GHM\Desktop\ComboFix - Verknüpfung.lnk
2014-05-24 13:59 - 2014-05-24 13:59 - 05200426 ____R (Swearware) C:\Users\GHM\Downloads\ComboFix.exe
2014-05-23 12:04 - 2014-05-23 12:04 - 00038793 _____ () C:\Users\GHM\Desktop\Ashanti.odt
2014-05-22 13:05 - 2014-05-22 13:04 - 00011868 _____ () C:\Users\GHM\Desktop\2014-05-21_Hr. Prokosch.odt
2014-05-21 19:26 - 2013-11-24 10:57 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Internet Security
2014-05-21 19:26 - 2012-12-03 10:53 - 00000000 ____D () C:\Windows\system32\Drivers\NIS
2014-05-19 08:12 - 2014-05-19 09:49 - 00023404 _____ () C:\Users\GHM\Desktop\Islam-Film arte.odt
2014-05-16 16:18 - 2014-02-11 22:37 - 00000000 ____D () C:\Users\GHM\Desktop\A
2014-05-16 11:10 - 2010-10-03 12:15 - 00000000 ____D () C:\Users\GHM\Desktop\Reinigung + Wdh.stellung
2014-05-16 11:06 - 2014-05-01 08:08 - 00000000 ____D () C:\Users\GHM\Desktop\SITUATIONS-ORDNER
2014-05-15 15:34 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-05-15 13:52 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-05-15 13:30 - 2014-05-06 12:09 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-15 13:30 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-05-15 12:21 - 2013-09-11 18:41 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-15 12:20 - 2010-06-11 19:09 - 90547776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-15 09:09 - 2013-11-22 18:40 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-05-15 09:09 - 2012-01-03 11:01 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-05-12 15:28 - 2014-01-20 20:46 - 00000000 ____D () C:\ProgramData\Oracle
2014-05-12 15:20 - 2014-05-12 15:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-05-12 15:20 - 2014-05-12 15:19 - 00004241 _____ () C:\Windows\system32\jupdate-1.7.0_55-b14.log
2014-05-12 15:20 - 2013-06-12 20:09 - 00000000 ____D () C:\Program Files\Java
2014-05-12 07:26 - 2014-05-27 08:54 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-12 07:25 - 2014-05-27 08:54 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-12 07:25 - 2014-03-19 08:53 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-11 08:53 - 2014-05-19 09:49 - 00013975 _____ () C:\Users\GHM\Desktop\Beginn Monotheismus.odt
2014-05-10 15:22 - 2014-05-10 15:22 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-10 10:46 - 2011-06-13 11:09 - 00000000 ____D () C:\Program Files\CCleaner
2014-05-10 09:30 - 2014-05-09 15:17 - 00024311 _____ () C:\Users\GHM\Desktop\Valerianus I + Gallienus, wer ist wer.odt
2014-05-09 09:06 - 2014-05-15 07:25 - 00369664 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-09 09:04 - 2014-05-15 07:25 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-06 20:21 - 2010-06-11 19:01 - 00000000 ____D () C:\ProgramData\X10 Settings
2014-05-06 18:06 - 2013-11-22 19:44 - 00000000 ____D () C:\Users\GHM\AppData\Roaming\Applian FLV and Media Player
2014-05-06 05:25 - 2014-05-15 12:18 - 17382912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 05:07 - 2014-05-15 12:18 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 04:10 - 2014-05-15 12:18 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-05 08:09 - 2009-07-14 06:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-04 12:33 - 2010-09-18 18:37 - 00000000 ____D () C:\Users\GHM
2014-05-04 12:32 - 2014-03-24 20:38 - 00000000 ____D () C:\Program Files\Recuva
Some content of TEMP:
====================
C:\Users\GHM\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe
[2014-05-15 07:25] - [2014-03-04 11:17] - 0304128 ____A (Microsoft Corporation) 998507B046BA314CE8245364C686FA67
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-05-19 07:37
==================== End Of Log ============================
--- --- --- --- --- --- Gruß Frusti |
|
28.05.2014, 09:31
| #12 |
| /// the machine /// TB-Ausbilder | PC läuft recht langsam und "frißt sich manchmal fest"ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
30.05.2014, 07:51
| #13 |
| | PC läuft recht langsam und "frißt sich manchmal fest" Hi, 1.) ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=a6e03170a2db53479130eb19fc27f124 # engine=17775 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2014-04-07 08:11:54 # local_time=2014-04-07 10:11:54 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=3591 16777213 100 90 668428 159454899 0 0 # compatibility_mode=5893 16776574 100 94 17936321 148489505 0 0 # scanned=141527 # found=0 # cleaned=0 # scan_time=3914 ESETSmartInstaller@High as downloader log: all ok ESETSmartInstaller@High as downloader log: Can not read file from internet.ESETSmartInstaller@High as downloader log: Can not read file from internet.Can not open internetESETSmartInstaller@High as downloader log: Can not open internetCan not open internetESETSmartInstaller@High as downloader log: Can not open internetCan not open internetESETSmartInstaller@High as downloader log: all ok ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.7587 # api_version=3.0.2 # EOSSerial=a6e03170a2db53479130eb19fc27f124 # engine=18471 # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2014-05-30 06:26:11 # local_time=2014-05-30 08:26:11 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1031 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode_1='Norton Internet Security' # compatibility_mode=3597 16777213 100 100 737946 164027756 0 0 # compatibility_mode_1='' # compatibility_mode=5893 16776574 100 94 22509178 153062362 0 0 # scanned=144245 # found=0 # cleaned=0 # scan_time=2142 ======================= 2. Results of screen317's Security Check version 0.99.83 Windows 7 Service Pack 1 x86 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Norton Internet Security WMI entry may not exist for antivirus; attempting automatic update. `````````Anti-malware/Other Utilities Check:````````` TuneUp Utilities TuneUp Utilities Language Pack (de-DE) TuneUp Utilities CCleaner Java 7 Update 55 Adobe Reader 9 Adobe Reader out of Date! ````````Process Check: objlist.exe by Laurent```````` ESET ESET Online Scanner OnlineScannerApp.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` ================= 3.) FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:30-05-2014
Ran by GHM (administrator) on PC on 30-05-2014 08:43:06
Running from C:\Users\GHM\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4F35AP17
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool
Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials
==================== Processes (Whitelisted) =================
(UASSOFT.COM) C:\Program Files\Silvercrest NM1005 driver\KMWDSrv.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.3.0.12\nis.exe
(Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
(Data Perceptions / PowerProgrammer) C:\Windows\System32\WebUpdateSvc4.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.3.0.12\nis.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
(X10) C:\Program Files\Common Files\X10\Common\X10nets.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe
(Wistron) C:\Program Files\Launch Manager\HotkeyApp.exe
(Wistron Corp.) C:\Program Files\Launch Manager\OSD.exe
(Wistron Corp.) C:\Program Files\Launch Manager\WButton.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(UASSOFT.COM) C:\Program Files\Silvercrest NM1005 driver\StartAutorun.exe
(UASSOFT.COM) C:\Program Files\Silvercrest NM1005 driver\KMCONFIG.exe
(UASSOFT.COM) C:\Program Files\Silvercrest NM1005 driver\KMProcess.exe
(Wistron Corp.) C:\Program Files\Launch Manager\WisLMSvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil32_13_0_0_214_ActiveX.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2009-10-02] (Intel Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8546848 2010-03-17] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe [686624 2010-03-17] (Realtek Semiconductor)
HKLM\...\Run: [HotkeyApp] => C:\Program Files\Launch Manager\HotkeyApp.exe [200704 2009-12-14] (Wistron)
HKLM\...\Run: [LMgrVolOSD] => C:\Program Files\Launch Manager\OSD.exe [348960 2009-12-12] (Wistron Corp.)
HKLM\...\Run: [Wbutton] => C:\Program Files\Launch Manager\Wbutton.exe [413696 2010-01-13] (Wistron Corp.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1594664 2009-12-11] (Synaptics Incorporated)
HKLM\...\Run: [KMCONFIG] => C:\Program Files\Silvercrest NM1005 driver\StartAutorun.exe KMConfig.exe
AppInit_DLLs: C:\Windows\Jaksta\AC\x86\jaudcap.dll => C:\Windows\Jaksta\AC\x86\jaudcap.dll [264480 2013-10-31] (Jaksta Technologies Pty Ltd)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Sign In
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {E5C4ECBB-88B4-40A1-B8E0-0220F5DD43A3} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKCU - DefaultScope {C4C2BA6A-B414-4A4C-B39B-87AF0CC54637} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {C4C2BA6A-B414-4A4C-B39B-87AF0CC54637} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {E5C4ECBB-88B4-40A1-B8E0-0220F5DD43A3} URL =
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\IPS\IPSBHO.DLL (Symantec Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF [2013-11-24]
FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn\ []
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR Extension: (Google Docs) - C:\Users\GHM\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-19]
CHR Extension: (Google Drive) - C:\Users\GHM\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-19]
CHR Extension: (YouTube) - C:\Users\GHM\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-19]
CHR Extension: (Google-Suche) - C:\Users\GHM\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-19]
CHR Extension: (Google Wallet) - C:\Users\GHM\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-19]
CHR Extension: (Google Mail) - C:\Users\GHM\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-19]
CHR HKLM\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\Exts\Chrome.crx [2014-05-15]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
========================== Services (Whitelisted) =================
R2 KMWDSERVICE; C:\Program Files\Silvercrest NM1005 driver\KMWDSrv.exe [208896 2007-06-16] (UASSOFT.COM)
R2 NIS; C:\Program Files\Norton Internet Security\Engine\21.3.0.12\NIS.exe [276376 2014-05-11] (Symantec Corporation)
S3 TuneUp.Defrag; C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe [435008 2011-12-23] (TuneUp Software)
R2 TuneUp.UtilitiesSvc; C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [1052480 2011-11-21] (TuneUp Software)
R2 WebUpdate4; C:\Windows\system32\WebUpdateSvc4.exe [262360 2009-01-08] (Data Perceptions / PowerProgrammer)
R3 WisLMSvc; C:\Program Files\Launch Manager\WisLMSvc.exe [118560 2009-10-23] (Wistron Corp.)
R2 x10nets; C:\Program Files\Common Files\X10\Common\X10nets.exe [20480 2009-11-07] (X10)
==================== Drivers (Whitelisted) ====================
R1 BHDrvx86; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20140510.001\BHDrvx86.sys [1101616 2014-05-10] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NIS\1503000.00C\ccSetx86.sys [127064 2013-09-26] (Symantec Corporation)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376920 2013-11-23] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [108120 2013-11-23] (Symantec Corporation)
R1 IDSVix86; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20140529.002\IDSvix86.sys [395992 2014-03-26] (Symantec Corporation)
R3 KMWDFilter; C:\Windows\System32\Drivers\KMWDFilter.SYS [17280 2007-06-13] (Windows (R) Codename Longhorn DDK provider)
S3 mod7700; C:\Windows\System32\DRIVERS\mod7700.sys [786400 2009-08-13] (DiBcom SA)
R3 NAVENG; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140529.016\NAVENG.SYS [93272 2014-02-08] (Symantec Corporation)
R3 NAVEX15; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140529.016\NAVEX15.SYS [1612376 2014-02-08] (Symantec Corporation)
S3 Spyder3; C:\Windows\System32\DRIVERS\Spyder3.sys [12288 2008-09-08] ()
R3 SRTSP; C:\Windows\System32\Drivers\NIS\1503000.00C\SRTSP.SYS [664280 2014-02-13] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NIS\1503000.00C\SRTSPX.SYS [32344 2013-09-10] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NIS\1503000.00C\SYMDS.SYS [367704 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NIS\1503000.00C\SYMEFA.SYS [936152 2014-03-04] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142936 2013-11-24] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NIS\1503000.00C\Ironx86.SYS [206936 2013-09-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NIS\1503000.00C\SYMNETS.SYS [447704 2014-02-18] (Symantec Corporation)
R3 TuneUpUtilitiesDrv; C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [10064 2010-02-24] (TuneUp Software)
R3 X10Hid; C:\Windows\System32\Drivers\x10hid.sys [13720 2009-05-13] (X10 Wireless Technology, Inc.)
R3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [27160 2009-05-13] (X10 Wireless Technology, Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\GHM\AppData\Local\Temp\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-05-30 07:26 - 2014-05-30 07:27 - 02347384 _____ (ESET) C:\Users\GHM\Downloads\esetsmartinstaller_deu.exe
2014-05-27 12:22 - 2014-05-27 12:22 - 00027707 _____ () C:\Users\GHM\Desktop\Frst.odt
2014-05-27 12:17 - 2014-05-27 12:17 - 00001052 _____ () C:\Users\GHM\Desktop\JRT.txt
2014-05-27 12:14 - 2014-05-27 12:14 - 00000000 ____D () C:\Windows\ERUNT
2014-05-27 12:07 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-05-27 12:05 - 2014-05-27 12:05 - 00001763 _____ () C:\Users\GHM\Desktop\mbam.txt
2014-05-27 08:54 - 2014-05-27 12:03 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-27 08:54 - 2014-05-27 08:54 - 00001068 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-27 08:54 - 2014-05-27 08:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-05-27 08:54 - 2014-05-27 08:54 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-05-27 08:54 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-27 08:54 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-25 20:19 - 2014-05-25 20:21 - 00010996 _____ () C:\Users\GHM\Desktop\Die Mosel bei Schengen.odt
2014-05-25 11:00 - 2014-05-25 11:00 - 00009156 _____ () C:\ComboFix.txt
2014-05-25 11:00 - 2014-05-25 11:00 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-05-25 11:00 - 2014-05-25 11:00 - 00000000 ____D () C:\Users\dub_cm_auto\AppData\Local\temp
2014-05-25 11:00 - 2014-05-25 11:00 - 00000000 ____D () C:\Users\DefaultAppPool\AppData\Local\temp
2014-05-25 11:00 - 2014-05-25 11:00 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-05-25 11:00 - 2014-05-25 11:00 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-05-25 10:33 - 2014-05-25 10:33 - 00001086 _____ () C:\Users\GHM\Desktop\ComboFix - Verknüpfung.lnk
2014-05-25 07:47 - 2014-05-27 12:10 - 00001858 _____ () C:\Windows\PFRO.log
2014-05-24 14:04 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-05-24 14:04 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-05-24 14:04 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-05-24 14:04 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-05-24 14:04 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-05-24 14:04 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-05-24 14:04 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-05-24 14:04 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-05-24 14:01 - 2014-05-25 11:00 - 00000000 ____D () C:\Windows\erdnt
2014-05-24 14:01 - 2014-05-25 11:00 - 00000000 ____D () C:\Qoobox
2014-05-24 13:59 - 2014-05-24 13:59 - 05200426 ____R (Swearware) C:\Users\GHM\Downloads\ComboFix.exe
2014-05-23 12:04 - 2014-05-23 12:04 - 00038793 _____ () C:\Users\GHM\Desktop\Ashanti.odt
2014-05-22 13:04 - 2014-05-22 13:05 - 00011868 _____ () C:\Users\GHM\Desktop\2014-05-21_Hr. Prokosch.odt
2014-05-19 09:49 - 2014-05-19 08:12 - 00023404 _____ () C:\Users\GHM\Desktop\Islam-Film arte.odt
2014-05-19 09:49 - 2014-05-11 08:53 - 00013975 _____ () C:\Users\GHM\Desktop\Beginn Monotheismus.odt
2014-05-16 11:00 - 2014-05-28 09:29 - 00000000 ____D () C:\Users\GHM\Desktop\aktuelle Ordner
2014-05-15 12:18 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-15 12:18 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-15 12:18 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-15 07:25 - 2014-05-09 09:06 - 00369664 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-15 07:25 - 2014-05-09 09:04 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-15 07:25 - 2014-04-12 04:15 - 00136640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-15 07:25 - 2014-04-12 04:15 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-15 07:25 - 2014-04-12 04:12 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-15 07:25 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-15 07:25 - 2014-04-12 04:12 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-15 07:25 - 2014-04-12 04:11 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-15 07:25 - 2014-04-12 04:11 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-15 07:25 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-15 07:25 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2014-05-15 07:25 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-15 07:25 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-15 07:25 - 2014-03-04 11:17 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-15 07:25 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-12 15:20 - 2014-05-12 15:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-05-12 15:20 - 2014-04-14 20:13 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-05-12 15:20 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-05-12 15:20 - 2014-04-14 20:05 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-05-12 15:20 - 2014-04-14 20:04 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-05-12 15:19 - 2014-05-12 15:20 - 00004241 _____ () C:\Windows\system32\jupdate-1.7.0_55-b14.log
2014-05-10 15:22 - 2014-05-30 06:38 - 00002968 _____ () C:\Windows\setupact.log
2014-05-10 15:22 - 2014-05-10 15:22 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-09 15:17 - 2014-05-10 09:30 - 00024311 _____ () C:\Users\GHM\Desktop\Valerianus I + Gallienus, wer ist wer.odt
2014-05-06 12:09 - 2014-05-15 13:30 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-01 08:08 - 2014-05-16 11:06 - 00000000 ____D () C:\Users\GHM\Desktop\SITUATIONS-ORDNER
==================== One Month Modified Files and Folders =======
2014-05-30 08:43 - 2014-04-06 09:07 - 00000000 ____D () C:\FRST
2014-05-30 08:43 - 2010-09-18 18:37 - 00000000 ____D () C:\Users\GHM\AppData\Local\Temp
2014-05-30 08:10 - 2010-10-03 12:15 - 00000000 ____D () C:\Users\GHM\Desktop\Reinigung + Wdh.stellung
2014-05-30 08:03 - 2013-11-22 18:40 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-30 07:45 - 2010-09-18 18:25 - 01656774 _____ () C:\Windows\WindowsUpdate.log
2014-05-30 07:27 - 2014-05-30 07:26 - 02347384 _____ (ESET) C:\Users\GHM\Downloads\esetsmartinstaller_deu.exe
2014-05-30 07:24 - 2010-06-11 00:37 - 01729694 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-30 06:46 - 2009-07-14 06:34 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-30 06:46 - 2009-07-14 06:34 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-30 06:38 - 2014-05-10 15:22 - 00002968 _____ () C:\Windows\setupact.log
2014-05-30 06:38 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-29 20:37 - 2014-02-28 20:27 - 00000000 ____D () C:\Users\GHM\Desktop\TAGTÄGLICH ROUTINE-1
2014-05-28 09:29 - 2014-05-16 11:00 - 00000000 ____D () C:\Users\GHM\Desktop\aktuelle Ordner
2014-05-27 12:22 - 2014-05-27 12:22 - 00027707 _____ () C:\Users\GHM\Desktop\Frst.odt
2014-05-27 12:17 - 2014-05-27 12:17 - 00001052 _____ () C:\Users\GHM\Desktop\JRT.txt
2014-05-27 12:14 - 2014-05-27 12:14 - 00000000 ____D () C:\Windows\ERUNT
2014-05-27 12:10 - 2014-05-25 07:47 - 00001858 _____ () C:\Windows\PFRO.log
2014-05-27 12:09 - 2014-01-19 12:07 - 00000000 ____D () C:\AdwCleaner
2014-05-27 12:05 - 2014-05-27 12:05 - 00001763 _____ () C:\Users\GHM\Desktop\mbam.txt
2014-05-27 12:03 - 2014-05-27 08:54 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-27 08:54 - 2014-05-27 08:54 - 00001068 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-27 08:54 - 2014-05-27 08:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-05-27 08:54 - 2014-05-27 08:54 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-05-27 08:54 - 2014-03-04 09:29 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-25 20:21 - 2014-05-25 20:19 - 00010996 _____ () C:\Users\GHM\Desktop\Die Mosel bei Schengen.odt
2014-05-25 16:40 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-05-25 11:00 - 2014-05-25 11:00 - 00009156 _____ () C:\ComboFix.txt
2014-05-25 11:00 - 2014-05-25 11:00 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-05-25 11:00 - 2014-05-25 11:00 - 00000000 ____D () C:\Users\dub_cm_auto\AppData\Local\temp
2014-05-25 11:00 - 2014-05-25 11:00 - 00000000 ____D () C:\Users\DefaultAppPool\AppData\Local\temp
2014-05-25 11:00 - 2014-05-25 11:00 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-05-25 11:00 - 2014-05-25 11:00 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-05-25 11:00 - 2014-05-24 14:01 - 00000000 ____D () C:\Windows\erdnt
2014-05-25 11:00 - 2014-05-24 14:01 - 00000000 ____D () C:\Qoobox
2014-05-25 11:00 - 2014-04-23 08:21 - 00000000 ____D () C:\Users\dub_cm_auto
2014-05-25 11:00 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Default
2014-05-25 11:00 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-05-25 10:59 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2014-05-25 10:33 - 2014-05-25 10:33 - 00001086 _____ () C:\Users\GHM\Desktop\ComboFix - Verknüpfung.lnk
2014-05-24 13:59 - 2014-05-24 13:59 - 05200426 ____R (Swearware) C:\Users\GHM\Downloads\ComboFix.exe
2014-05-23 12:04 - 2014-05-23 12:04 - 00038793 _____ () C:\Users\GHM\Desktop\Ashanti.odt
2014-05-22 13:05 - 2014-05-22 13:04 - 00011868 _____ () C:\Users\GHM\Desktop\2014-05-21_Hr. Prokosch.odt
2014-05-21 19:26 - 2013-11-24 10:57 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Internet Security
2014-05-21 19:26 - 2012-12-03 10:53 - 00000000 ____D () C:\Windows\system32\Drivers\NIS
2014-05-19 08:12 - 2014-05-19 09:49 - 00023404 _____ () C:\Users\GHM\Desktop\Islam-Film arte.odt
2014-05-16 16:18 - 2014-02-11 22:37 - 00000000 ____D () C:\Users\GHM\Desktop\A
2014-05-16 11:06 - 2014-05-01 08:08 - 00000000 ____D () C:\Users\GHM\Desktop\SITUATIONS-ORDNER
2014-05-15 15:34 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-05-15 13:52 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-05-15 13:30 - 2014-05-06 12:09 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-15 13:30 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-05-15 12:21 - 2013-09-11 18:41 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-15 12:20 - 2010-06-11 19:09 - 90547776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-15 09:09 - 2013-11-22 18:40 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-05-15 09:09 - 2012-01-03 11:01 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-05-12 15:28 - 2014-01-20 20:46 - 00000000 ____D () C:\ProgramData\Oracle
2014-05-12 15:20 - 2014-05-12 15:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-05-12 15:20 - 2014-05-12 15:19 - 00004241 _____ () C:\Windows\system32\jupdate-1.7.0_55-b14.log
2014-05-12 15:20 - 2013-06-12 20:09 - 00000000 ____D () C:\Program Files\Java
2014-05-12 07:26 - 2014-05-27 08:54 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-12 07:25 - 2014-05-27 08:54 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-12 07:25 - 2014-03-19 08:53 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-11 08:53 - 2014-05-19 09:49 - 00013975 _____ () C:\Users\GHM\Desktop\Beginn Monotheismus.odt
2014-05-10 15:22 - 2014-05-10 15:22 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-10 10:46 - 2011-06-13 11:09 - 00000000 ____D () C:\Program Files\CCleaner
2014-05-10 09:30 - 2014-05-09 15:17 - 00024311 _____ () C:\Users\GHM\Desktop\Valerianus I + Gallienus, wer ist wer.odt
2014-05-09 09:06 - 2014-05-15 07:25 - 00369664 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-09 09:04 - 2014-05-15 07:25 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-06 20:21 - 2010-06-11 19:01 - 00000000 ____D () C:\ProgramData\X10 Settings
2014-05-06 18:06 - 2013-11-22 19:44 - 00000000 ____D () C:\Users\GHM\AppData\Roaming\Applian FLV and Media Player
2014-05-06 05:25 - 2014-05-15 12:18 - 17382912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 05:07 - 2014-05-15 12:18 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 04:10 - 2014-05-15 12:18 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-05 08:09 - 2009-07-14 06:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-04 12:33 - 2010-09-18 18:37 - 00000000 ____D () C:\Users\GHM
2014-05-04 12:32 - 2014-03-24 20:38 - 00000000 ____D () C:\Program Files\Recuva
Some content of TEMP:
====================
C:\Users\GHM\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe
[2014-05-15 07:25] - [2014-03-04 11:17] - 0304128 ____A (Microsoft Corporation) 998507B046BA314CE8245364C686FA67
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-05-29 09:07
==================== End Of Log ============================
Gruß |
|
30.05.2014, 22:13
| #14 |
| /// the machine /// TB-Ausbilder | PC läuft recht langsam und "frißt sich manchmal fest" Adobe updaten. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
31.05.2014, 06:53
| #15 |
| | PC läuft recht langsam und "frißt sich manchmal fest" "Adobe updaten." --> Antwort: Es gibt kein neues Update ====================================== Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:Alles auswählenAufklappen CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet). Starte nun FRST erneut und klicke den Fix Button. Das Tool erstellt eine Fixlog.txt. Poste mir deren Inhalt. --> Antwort: "No fixlist.txt found. The fixlist.txt should be in the same Folder the tool is located. Gruß Frusti |
|
| Themen zu PC läuft recht langsam und "frißt sich manchmal fest" |
| cursor, daten, gefahr, guten, hilft, langsam, langsamer, malware, neustart, nicht mehr, pc läuft, recht, spiel, öfter |
WARNUNG an die MITLESER: 
