Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Mediaplayer lehnt DVDs als Gebietsfremd ab

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 30.08.2014, 21:03   #1
Fellefant
 
Mediaplayer lehnt DVDs als Gebietsfremd ab - Standard

Mediaplayer lehnt DVDs als Gebietsfremd ab



Und monatlich grüßt das Murmeltier..,

Hallo Schrauber ich versorge Dich gleich mal mit den frst-logs aber vermutlich werde ich die GMER evtl. nachliefern müssen weil sonst die Kapazität überschritten wird.
Aber schaumermal..
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:30-08-2014 01
Ran by Rollostoimetz (administrator) on ROLLOSTOIMETZ-P on 30-08-2014 21:53:50
Running from C:\Users\Rollostoimetz\Desktop
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe
(Symantec Corporation) C:\Program Files\Norton 360\Engine\21.5.0.19\n360.exe
(Symantec Corporation) C:\Program Files\Norton Identity Safe\Engine\2014.7.6.15\nst.exe
(Secunia) C:\Program Files\Secunia\PSI\psia.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
(BillP Studios) C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
(Symantec Corporation) C:\Program Files\Norton Identity Safe\Engine\2014.7.6.15\nst.exe
(Symantec Corporation) C:\Program Files\Norton 360\Engine\21.5.0.19\n360.exe
() C:\Users\Rollostoimetz\AppData\Local\Amazon Music\Amazon Music Helper.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPoint\SetPoint.exe
(Secunia) C:\Program Files\Secunia\PSI\psi_tray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.24.15\GoogleCrashHandler.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2014-05-08] (Adobe Systems Incorporated)
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] => C:\Windows\KHALMNPR.EXE [55824 2009-06-17] (Logitech, Inc.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\S-1-5-21-1442112818-2063436954-1665047480-1001\...\Run: [WinPatrol] => C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe [1128000 2014-06-03] (BillP Studios)
HKU\S-1-5-21-1442112818-2063436954-1665047480-1001\...\Run: [Amazon Music] => C:\Users\Rollostoimetz\AppData\Local\Amazon Music\Amazon Music Helper.exe [3356480 2014-07-22] ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Logitech SetPoint.lnk
ShortcutTarget: Logitech SetPoint.lnk -> C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia)
ShellIconOverlayIdentifiers: OverlayExcluded -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files\Norton 360\Engine\21.5.0.19\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayPending -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files\Norton 360\Engine\21.5.0.19\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayProtected -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files\Norton 360\Engine\21.5.0.19\buShell.dll (Symantec Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xC34A27FF5C78CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files\Norton 360\Engine\21.5.0.19\coIEPlg.dll (Symantec Corporation)
BHO: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files\Norton 360\Engine\21.5.0.19\IPS\IPSBHO.DLL (Symantec Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\21.5.0.19\coIEPlg.dll (Symantec Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Rollostoimetz\AppData\Roaming\Mozilla\Firefox\Profiles\5jr4tkmt.default
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_179.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\Rollostoimetz\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Ghostery - C:\Users\Rollostoimetz\AppData\Roaming\Mozilla\Firefox\Profiles\5jr4tkmt.default\Extensions\firefox@ghostery.com.xpi [2014-05-26]
FF Extension: NoScript - C:\Users\Rollostoimetz\AppData\Roaming\Mozilla\Firefox\Profiles\5jr4tkmt.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-05-26]
FF HKLM\...\Firefox\Extensions: [{F04D2D30-776C-4d02-8627-8E4385ECA58D}] - C:\ProgramData\Norton\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST_2014.7.3.12\coFFPlgn
FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.4.0.13\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.4.0.13\coFFPlgn [2014-08-30]

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files\Norton 360\Engine\21.5.0.19\Exts\Chrome.crx [2014-08-11]
CHR HKLM\...\Chrome\Extension: [nppllibpnmahfaklnpggkibhkapjkeob] - C:\Program Files\Norton Identity Safe\Engine\2014.7.6.15\Exts\Chrome.crx [2014-08-07]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdobeActiveFileMonitor8.0; C:\Program Files\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [169312 2009-10-09] (Adobe Systems Incorporated)
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 N360; C:\Program Files\Norton 360\Engine\21.5.0.19\N360.exe [265040 2014-07-31] (Symantec Corporation)
R2 NCO; C:\Program Files\Norton Identity Safe\Engine\2014.7.6.15\NST.exe [130104 2014-07-31] (Symantec Corporation)
R2 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
S2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 BHDrvx86; C:\Program Files\Norton 360\NortonData\21.4.0.13\Definitions\BASHDefs\20140821.007\BHDrvx86.sys [1138480 2014-08-19] (Symantec Corporation)
R1 ccSet_N360; C:\Windows\system32\drivers\N360\1505000.013\ccSetx86.sys [127064 2014-02-21] (Symantec Corporation)
R1 ccSet_NST; C:\Windows\system32\drivers\NST\7DE07060.00F\ccSetx86.sys [127064 2013-09-27] (Symantec Corporation)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [377648 2014-07-21] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [109872 2014-07-21] (Symantec Corporation)
R1 IDSVix86; C:\Program Files\Norton 360\NortonData\21.4.0.13\Definitions\IPSDefs\20140829.001\IDSvix86.sys [476888 2014-08-29] (Symantec Corporation)
R3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [28560 2009-06-17] (Logitech, Inc.)
R1 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [74456 2014-05-12] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-08-30] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
R3 NAVENG; C:\Program Files\Norton 360\NortonData\21.4.0.13\Definitions\VirusDefs\20140829.018\NAVENG.SYS [95704 2014-08-21] (Symantec Corporation)
R3 NAVEX15; C:\Program Files\Norton 360\NortonData\21.4.0.13\Definitions\VirusDefs\20140829.018\NAVEX15.SYS [1636696 2014-08-21] (Symantec Corporation)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_x86.sys [16024 2013-12-06] (Secunia)
R3 SRTSP; C:\Windows\System32\Drivers\N360\1505000.013\SRTSP.SYS [664280 2014-02-13] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360\1505000.013\SRTSPX.SYS [32344 2013-10-30] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\N360\1505000.013\SYMDS.SYS [367704 2013-10-30] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360\1505000.013\SYMEFA.SYS [936152 2014-03-04] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142936 2014-07-21] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360\1505000.013\Ironx86.SYS [206936 2013-10-30] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\N360\1505000.013\SYMNETS.SYS [447704 2014-02-18] (Symantec Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\ROLLOS~1\AppData\Local\Temp\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-30 21:53 - 2014-08-30 21:54 - 00012306 _____ () C:\Users\Rollostoimetz\Desktop\FRST.txt
2014-08-30 21:53 - 2014-08-30 21:53 - 00000000 ____D () C:\FRST
2014-08-30 21:51 - 2014-08-30 21:51 - 01095680 _____ (Farbar) C:\Users\Rollostoimetz\Desktop\frst.exe
2014-08-30 21:50 - 2014-08-30 21:51 - 00380416 _____ () C:\Users\Rollostoimetz\Desktop\Gmer-19357(1).exe
2014-08-30 21:49 - 2014-08-30 21:50 - 00000488 _____ () C:\Users\Rollostoimetz\Downloads\defogger_disable.log
2014-08-30 21:49 - 2014-08-30 21:49 - 00000000 _____ () C:\Users\Rollostoimetz\defogger_reenable
2014-08-30 21:48 - 2014-08-30 21:48 - 00050477 _____ () C:\Users\Rollostoimetz\Downloads\Defogger.exe
2014-08-29 23:33 - 2014-08-29 23:33 - 00001175 _____ () C:\Users\Rollostoimetz\Desktop\Amazon Music.lnk
2014-08-29 23:28 - 2014-08-29 23:31 - 38603216 _____ (Amazon) C:\Users\Rollostoimetz\Downloads\AmazonMusicInstaller.exe
2014-08-28 19:27 - 2014-08-28 19:27 - 00000795 _____ () C:\Users\Rollostoimetz\Desktop\JRT.txt
2014-08-28 18:38 - 2014-08-28 18:38 - 01016261 _____ (Thisisu) C:\Users\Rollostoimetz\Downloads\JRT.exe
2014-08-27 20:47 - 2014-08-23 03:46 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-27 20:47 - 2014-08-23 02:42 - 02352640 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-27 20:29 - 2014-08-27 20:34 - 00000000 ____D () C:\AdwCleaner
2014-08-27 20:19 - 2014-08-27 20:19 - 01364531 _____ () C:\Users\Rollostoimetz\Downloads\adwcleaner_3.308.exe
2014-08-22 17:55 - 2014-05-14 18:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-22 17:55 - 2014-05-14 18:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-22 17:55 - 2014-05-14 18:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-22 17:55 - 2014-05-14 18:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-22 17:54 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-22 17:54 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-22 17:54 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-22 17:53 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-22 17:53 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-16 12:52 - 2014-08-21 21:55 - 00000000 ____D () C:\Users\Rollostoimetz\Documents\PDFs
2014-08-13 18:06 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-13 18:06 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-13 18:06 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-13 18:05 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-13 15:48 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-13 15:48 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-13 15:48 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-13 15:48 - 2014-07-25 15:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-13 15:48 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-13 15:48 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-13 15:48 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-13 15:48 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-13 15:48 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-13 15:48 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-13 15:48 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-13 15:48 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-13 15:48 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-13 15:48 - 2014-07-25 14:10 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-13 15:48 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-13 15:48 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-13 15:48 - 2014-07-25 13:59 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-13 15:48 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-13 15:48 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-13 15:48 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-13 15:48 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-13 15:48 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-13 15:48 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-13 15:48 - 2014-07-25 13:09 - 00663040 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-13 15:48 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-13 15:48 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-13 15:48 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-13 15:48 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-13 15:48 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-13 15:48 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-13 15:48 - 2014-07-14 03:42 - 00654336 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-13 15:48 - 2014-06-16 03:44 - 00730048 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-13 15:48 - 2014-06-16 03:44 - 00219072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2014-08-13 15:48 - 2014-06-16 03:40 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2014-08-13 15:45 - 2014-08-07 03:43 - 00412160 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-13 15:45 - 2014-08-07 03:39 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-13 15:45 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-13 15:45 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-13 15:45 - 2014-06-03 11:30 - 00101824 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-13 15:45 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-13 15:45 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-13 15:45 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-13 15:44 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-08-13 15:44 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-08-13 15:44 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-08-13 15:44 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-08-13 15:44 - 2014-07-09 03:29 - 00005632 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-08-13 15:44 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-08-13 01:00 - 2014-08-13 01:00 - 04575232 _____ (Google Inc.) C:\Windows\system32\GPhotos.scr
2014-08-11 19:03 - 2014-08-11 19:03 - 00000000 ___HD () C:\Users\Rollostoimetz\Downloads\.picasaoriginals
2014-08-11 18:57 - 2014-08-11 19:00 - 38754210 _____ () C:\Users\Rollostoimetz\Downloads\crab.tif
2014-08-09 10:35 - 2014-08-09 10:35 - 00000522 _____ () C:\DelFix.txt
2014-07-31 23:57 - 2014-07-31 23:57 - 00002180 _____ () C:\Users\Rollostoimetz\Documents\Giftgas.txt

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-30 21:54 - 2014-08-30 21:53 - 00012306 _____ () C:\Users\Rollostoimetz\Desktop\FRST.txt
2014-08-30 21:53 - 2014-08-30 21:53 - 00000000 ____D () C:\FRST
2014-08-30 21:51 - 2014-08-30 21:51 - 01095680 _____ (Farbar) C:\Users\Rollostoimetz\Desktop\frst.exe
2014-08-30 21:51 - 2014-08-30 21:50 - 00380416 _____ () C:\Users\Rollostoimetz\Desktop\Gmer-19357(1).exe
2014-08-30 21:50 - 2014-08-30 21:49 - 00000488 _____ () C:\Users\Rollostoimetz\Downloads\defogger_disable.log
2014-08-30 21:49 - 2014-08-30 21:49 - 00000000 _____ () C:\Users\Rollostoimetz\defogger_reenable
2014-08-30 21:49 - 2014-05-25 23:00 - 00000000 ____D () C:\Users\Rollostoimetz
2014-08-30 21:48 - 2014-08-30 21:48 - 00050477 _____ () C:\Users\Rollostoimetz\Downloads\Defogger.exe
2014-08-30 21:43 - 2014-07-10 17:34 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-30 21:30 - 2014-05-28 19:04 - 00001152 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1442112818-2063436954-1665047480-1001UA.job
2014-08-30 21:01 - 2014-06-23 23:30 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-30 20:57 - 2014-05-27 07:44 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-30 20:56 - 2014-05-27 07:44 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-30 20:51 - 2014-05-29 23:47 - 01444277 _____ () C:\Windows\WindowsUpdate.log
2014-08-30 20:50 - 2009-07-14 06:34 - 00028720 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-30 20:50 - 2009-07-14 06:34 - 00028720 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-30 20:39 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-30 20:39 - 2009-07-14 06:39 - 00046282 _____ () C:\Windows\setupact.log
2014-08-30 15:40 - 2014-05-26 13:37 - 00007601 _____ () C:\Users\Rollostoimetz\AppData\Local\Resmon.ResmonCfg
2014-08-30 15:31 - 2010-11-20 23:48 - 02351122 _____ () C:\Windows\PFRO.log
2014-08-29 23:33 - 2014-08-29 23:33 - 00001175 _____ () C:\Users\Rollostoimetz\Desktop\Amazon Music.lnk
2014-08-29 23:31 - 2014-08-29 23:28 - 38603216 _____ (Amazon) C:\Users\Rollostoimetz\Downloads\AmazonMusicInstaller.exe
2014-08-29 18:38 - 2014-07-10 18:51 - 00000000 ____D () C:\Users\Rollostoimetz\AppData\Local\CrashDumps
2014-08-28 19:50 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-08-28 19:27 - 2014-08-28 19:27 - 00000795 _____ () C:\Users\Rollostoimetz\Desktop\JRT.txt
2014-08-28 18:38 - 2014-08-28 18:38 - 01016261 _____ (Thisisu) C:\Users\Rollostoimetz\Downloads\JRT.exe
2014-08-27 20:52 - 2009-07-14 06:33 - 00336832 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-27 20:34 - 2014-08-27 20:29 - 00000000 ____D () C:\AdwCleaner
2014-08-27 20:19 - 2014-08-27 20:19 - 01364531 _____ () C:\Users\Rollostoimetz\Downloads\adwcleaner_3.308.exe
2014-08-26 19:22 - 2010-11-20 23:01 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-23 10:54 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-08-23 03:46 - 2014-08-27 20:47 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 02:42 - 2014-08-27 20:47 - 02352640 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-21 21:55 - 2014-08-16 12:52 - 00000000 ____D () C:\Users\Rollostoimetz\Documents\PDFs
2014-08-20 21:35 - 2014-05-26 08:34 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-08-19 19:23 - 2014-07-21 21:39 - 00000000 ____D () C:\Windows\system32\Drivers\N360
2014-08-19 19:21 - 2014-07-21 21:39 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360
2014-08-17 15:29 - 2014-05-28 19:04 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1442112818-2063436954-1665047480-1001Core.job
2014-08-17 11:45 - 2014-06-23 23:29 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-08-14 01:32 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-08-13 18:44 - 2014-07-10 17:34 - 00699568 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-08-13 18:44 - 2014-07-10 17:34 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-08-13 18:44 - 2014-06-12 19:19 - 00002958 _____ () C:\Windows\SecuniaPackage.log
2014-08-13 18:21 - 2014-05-27 18:37 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-08-13 18:18 - 2014-05-26 13:40 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-08-13 18:17 - 2014-05-26 21:52 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-13 18:13 - 2014-05-26 21:51 - 96303304 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-13 01:00 - 2014-08-13 01:00 - 04575232 _____ (Google Inc.) C:\Windows\system32\GPhotos.scr
2014-08-12 09:42 - 2014-07-21 21:21 - 00000000 ____D () C:\Windows\system32\Drivers\NST
2014-08-12 09:41 - 2014-07-21 21:21 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Identity Safe
2014-08-11 19:03 - 2014-08-11 19:03 - 00000000 ___HD () C:\Users\Rollostoimetz\Downloads\.picasaoriginals
2014-08-11 19:03 - 2014-06-14 21:18 - 00000125 ____H () C:\Users\Rollostoimetz\Downloads\.picasa.ini
2014-08-11 19:00 - 2014-08-11 18:57 - 38754210 _____ () C:\Users\Rollostoimetz\Downloads\crab.tif
2014-08-09 10:35 - 2014-08-09 10:35 - 00000522 _____ () C:\DelFix.txt
2014-08-07 03:43 - 2014-08-13 15:45 - 00412160 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-07 03:39 - 2014-08-13 15:45 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-05 09:16 - 2014-07-22 17:54 - 00000000 ____D () C:\Users\Rollostoimetz\AppData\Local\Adobe
2014-08-04 21:45 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-08-01 01:16 - 2014-08-13 15:48 - 00307384 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-31 23:57 - 2014-07-31 23:57 - 00002180 _____ () C:\Users\Rollostoimetz\Documents\Giftgas.txt

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-08 15:11

==================== End Of Log ============================
         
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x86) Version:30-08-2014 01
Ran by Rollostoimetz at 2014-08-30 21:55:45
Running from C:\Users\Rollostoimetz\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Norton 360 (Enabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}
AS: Norton 360 (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Norton 360 (Enabled) {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 14 Plugin (HKLM\...\{16E20D9D-E7E2-4951-A944-6FFC40870AD4}) (Version: 14.0.0.179 - Adobe Systems Incorporated)
Adobe Photoshop Elements 8.0 (HKLM\...\Adobe Photoshop Elements 8.0) (Version: 8.0 - Adobe Systems Incorporated)
Adobe Photoshop Elements 8.0 (Version: 8.0 - Adobe Systems Incorporated) Hidden
Adobe Reader XI (11.0.08) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Amazon Music (HKCU\...\Amazon Amazon Music) (Version: 3.2.0.591 - Amazon Services LLC)
Camera RAW Plug-In for EPSON Creativity Suite (HKLM\...\{93EA9C3E-BDFD-4309-A605-9B5BBC0CCEFD}) (Version: 2.2.0.0 - SEIKO EPSON CORPORATION)
CDDRV_Installer (Version: 4.60 - Logitech) Hidden
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Diablo II (HKLM\...\Diablo II) (Version:  - Blizzard Entertainment)
EPSON Attach To Email (HKLM\...\InstallShield_{20C45B32-5AB6-46A4-94EF-58950CAF05E5}) (Version: 1.01.0000 - SEIKO EPSON)
EPSON Attach To Email (Version: 1.01.0000 - SEIKO EPSON) Hidden
EPSON Copy Utility 3 (HKLM\...\{67EDD823-135A-4D59-87BD-950616D6E857}) (Version: 3.3.0.0 - )
EPSON Easy Photo Print (HKLM\...\{3D78F2A2-C893-4ABD-B5FE-AD7011837755}) (Version: 1.5.0.0 - SEIKO EPSON CORPORATION)
EPSON File Manager (HKLM\...\{2EB81825-E9EE-44F4-8F51-1240C3898DC6}) (Version: 1.3.0.0 - )
EPSON Print CD (HKLM\...\{FF477885-5EA8-40D0-ADF3-D4C1B86FAEA4}) (Version: 1.60.000 - )
EPSON Scan (HKLM\...\EPSON Scanner) (Version:  - )
EPSON Scan Assistant (HKLM\...\{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}) (Version: 1.10.00 - )
EPSON Stylus Photo RX585_RX610 Handbuch (HKLM\...\EPSON Stylus Photo RX585_RX610 Benutzerhandbuch) (Version:  - )
EPSON-Drucker-Software (HKLM\...\EPSON Printer and Utilities) (Version:  - )
erLT (Version: 1.20.0137 - Logitech, Inc.) Hidden
ESET Online Scanner v3 (HKLM\...\ESET Online Scanner) (Version:  - )
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden
Google+ Auto Backup (HKCU\...\Google+ Auto Backup) (Version: 1.0.26.151 - Google, Inc.)
KhalInstallWrapper (Version: 2.00.0000 - Logitech) Hidden
Logitech SetPoint (HKLM\...\{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}) (Version: 4.80 - Logitech)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Mozilla Firefox 31.0 (x86 de) (HKLM\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 31.0 - Mozilla)
Norton 360 (HKLM\...\N360) (Version: 21.5.0.19 - Symantec Corporation)
Norton Identity Safe (HKLM\...\NST) (Version: 2014.7.6.15 - Symantec Corporation)
NVIDIA Grafiktreiber 307.83 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 307.83 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.109.706 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 307.83 (Version: 307.83 - NVIDIA Corporation) Hidden
NVIDIA Update 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.10.8 - NVIDIA Corporation)
NVIDIA Update Components (Version: 1.10.8 - NVIDIA Corporation) Hidden
Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Secunia PSI (3.0.0.9016) (HKLM\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
Skype™ 6.16 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
WinPatrol (HKLM\...\{84481A87-2316-4923-8FAB-3BA8CA29323D}) (Version: 31.0.2014.0 - BillP Studios)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1001_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Users\Rollostoimetz\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1001_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> "C:\Users\Rollostoimetz\AppData\Local\Google\Update\1.3.24.7\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1001_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> "C:\Users\Rollostoimetz\AppData\Local\Google\Update\1.3.24.7\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1001_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> "C:\Users\Rollostoimetz\AppData\Local\Google\Update\1.3.24.7\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1001_Classes\CLSID\{A45426FB-E444-42B2-AA56-419F8FBEEC61}\InprocServer32 -> C:\Users\Rollostoimetz\AppData\Local\Google\Update\1.3.22.3\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1001_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Users\Rollostoimetz\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1001_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Users\Rollostoimetz\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1001_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> "C:\Users\Rollostoimetz\AppData\Local\Google\Update\1.3.24.7\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Rollostoimetz\AppData\Local\Google\Update\1.3.24.7\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1001_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Rollostoimetz\AppData\Local\Google\Update\1.3.24.7\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1003_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Users\Rollostoimetz\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1003_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> "C:\Users\Rollostoimetz\AppData\Local\Google\Update\1.3.24.7\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1003_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> "C:\Users\Rollostoimetz\AppData\Local\Google\Update\1.3.24.7\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1003_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> "C:\Users\Rollostoimetz\AppData\Local\Google\Update\1.3.24.7\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1003_Classes\CLSID\{A45426FB-E444-42B2-AA56-419F8FBEEC61}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Local\Google\Update\1.3.22.3\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1003_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1003_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1003_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> "C:\Users\Rollostoimetz\AppData\Local\Google\Update\1.3.24.7\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1003_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Local\Google\Update\1.3.24.7\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-1442112818-2063436954-1665047480-1003_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Local\Google\Update\1.3.24.7\psuser.dll No File

==================== Restore Points  =========================


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {03B16A37-75B8-41AA-A9C3-0C075DEF4919} - System32\Tasks\Norton WSC Integration => C:\Program Files\Norton 360\Engine\21.5.0.19\WSCStub.exe [2014-07-31] (Symantec Corporation)
Task: {3BD9C85A-C677-4068-82F1-87ACF046DD21} - System32\Tasks\Norton Identity Safe\Norton Error Analyzer => C:\Program Files\Norton Identity Safe\Engine\2014.7.6.15\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {4BCB4833-D069-454D-AD40-715C22738C33} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1442112818-2063436954-1665047480-1001UA => C:\Users\Rollostoimetz\AppData\Local\Google\Update\GoogleUpdate.exe [2014-05-28] (Google Inc.)
Task: {599540F6-338F-4BA5-8CDE-03C7DAEFD29E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-08-13] (Adobe Systems Incorporated)
Task: {75B830A5-64F0-4FB5-877E-11B7ACA3992B} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1442112818-2063436954-1665047480-1001Core => C:\Users\Rollostoimetz\AppData\Local\Google\Update\GoogleUpdate.exe [2014-05-28] (Google Inc.)
Task: {89FA4D25-ADF4-49E3-859A-3E1CB9C4E16C} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {A2EBAC0E-E1F1-4B3D-852A-7108162A558D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-05-27] (Google Inc.)
Task: {A3CD02CE-4D49-4544-BB41-290A72073576} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-05-27] (Google Inc.)
Task: {B386F51F-7CF7-41DF-B185-27484FAA103B} - System32\Tasks\Norton 360\Norton Error Processor => C:\Program Files\Norton 360\Engine\21.5.0.19\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {B6872783-7B6B-4F2B-BDB2-D75443FF6286} - System32\Tasks\Norton Identity Safe\Norton Error Processor => C:\Program Files\Norton Identity Safe\Engine\2014.7.6.15\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {B94B76F2-CAF4-4EA7-96D0-34D48E7AAAFF} - System32\Tasks\Norton 360\Norton Error Analyzer => C:\Program Files\Norton 360\Engine\21.5.0.19\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {FF0DD0F9-4661-43E8-B9A1-C4A4EBBDF19B} - System32\Tasks\Und Tschüß => Herunterfahren

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1442112818-2063436954-1665047480-1001Core.job => C:\Users\Rollostoimetz\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1442112818-2063436954-1665047480-1001UA.job => C:\Users\Rollostoimetz\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-05-25 23:29 - 2013-01-31 11:00 - 00079648 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax.dll
2014-08-29 23:33 - 2014-07-22 22:46 - 03356480 _____ () C:\Users\Rollostoimetz\AppData\Local\Amazon Music\Amazon Music Helper.exe
2014-05-27 08:51 - 2009-07-20 12:27 - 00017936 _____ () C:\Program Files\Logitech\SetPoint\khalwrapper.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============

Name: RAID-Controller
Description: RAID-Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (08/30/2014 08:41:20 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/30/2014 03:32:54 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/29/2014 08:26:01 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/29/2014 06:38:12 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: perfmon.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce78d0c
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea91c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00052d37
ID des fehlerhaften Prozesses: 0x16dc
Startzeit der fehlerhaften Anwendung: 0xperfmon.exe0
Pfad der fehlerhaften Anwendung: perfmon.exe1
Pfad des fehlerhaften Moduls: perfmon.exe2
Berichtskennung: perfmon.exe3

Error: (08/29/2014 06:09:55 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (08/30/2014 08:54:57 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "NOBBI",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{27528427-AF88-4ACF-8E65-7DE46F0C84C1-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (08/30/2014 03:46:43 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "NOBBI",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{27528427-AF88-4ACF-8E65-7DE46F0C84C1-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (08/30/2014 03:39:50 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" ist vom Dienst "Peernetzwerkidentitäts-Manager" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1053

Error: (08/30/2014 03:39:50 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peernetzwerkidentitäts-Manager" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1053

Error: (08/30/2014 03:39:50 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Peernetzwerkidentitäts-Manager" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (08/30/2014 03:39:50 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Peernetzwerkidentitäts-Manager erreicht.

Error: (08/30/2014 03:37:54 PM) (Source: WMPNetworkSvc) (EventID: 14332) (User: )
Description: WMPNetworkSvc0x80004005

Error: (08/29/2014 11:50:26 PM) (Source: WMPNetworkSvc) (EventID: 14365) (User: )
Description: 0x80004004-1

Error: (08/29/2014 08:28:58 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "NOBBI",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{27528427-AF88-4ACF-8E65-7DE46F0C84C1-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (08/29/2014 07:56:21 PM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz
Percentage of memory in use: 41%
Total physical RAM: 2047.54 MB
Available physical RAM: 1198.11 MB
Total Pagefile: 4095.08 MB
Available Pagefile: 2991.58 MB
Total Virtual: 2047.88 MB
Available Virtual: 1914.16 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:57.26 GB) (Free:30.16 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:146.48 GB) (Free:44.66 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 57.3 GB) (Disk ID: 8CA84EF1)
Partition 1: (Active) - (Size=57.3 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 149.1 GB) (Disk ID: 424CBF9C)
Partition 1: (Active) - (Size=146.5 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         
Gruß Fellefant

Alt 30.08.2014, 21:38   #2
schrauber
/// the machine
/// TB-Ausbilder
 

Mediaplayer lehnt DVDs als Gebietsfremd ab - Standard

Mediaplayer lehnt DVDs als Gebietsfremd ab



hi,

keine Malware. Was sind das für DVDs?
__________________

__________________

Alt 30.08.2014, 21:51   #3
Fellefant
 
Mediaplayer lehnt DVDs als Gebietsfremd ab - Standard

Mediaplayer lehnt DVDs als Gebietsfremd ab



Startrek "Voyager". The full Journey. Zuvor "the next Generation" Gleiches Problem.
Über weite Strecken und unzählige DVDs überhaupt keine Mätzchen. Dann plötzlich die Meldung dass die DVDs für das Gebiet nicht zugelassen seien.

Ich lasse Adwarecleaner
Code:
ATTFilter
# AdwCleaner v3.308 - Bericht erstellt am 30/08/2014 um 23:03:54
# Aktualisiert 20/08/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (32 bits)
# Benutzername : Rollostoimetz - ROLLOSTOIMETZ-P
# Gestartet von : C:\Users\Rollostoimetz\Downloads\adwcleaner_3.308.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17239


-\\ Mozilla Firefox v31.0 (x86 de)

[ Datei : C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\a4er7z10.default\prefs.js ]


[ Datei : C:\Users\Rollostoimetz\AppData\Roaming\Mozilla\Firefox\Profiles\5jr4tkmt.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [971 octets] - [30/08/2014 22:56:20]
AdwCleaner[S0].txt - [893 octets] - [30/08/2014 23:03:54]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [952 octets] ##########
         
und JRT durchlaufen
Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.3 (03.23.2014:1)
OS: Windows 7 Home Premium x86
Ran by Rollostoimetz on 28.08.2014 at 18:58:57,47
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: C:\Users\Rollostoimetz\AppData\Roaming\mozilla\firefox\profiles\5jr4tkmt.default\minidumps [9 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 28.08.2014 at 19:27:48,64
Computer was rebooted
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         
Danach geht's wieder für eine Folge - und eine Folge später bricht das Programm wieder ab.

Hier übrigens noch das gmer
Code:
ATTFilter
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-08-30 22:37:14
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Maxtor_6Y060L0 rev.YAR41VW0 57,27GB
Running: Gmer-19357(1).exe; Driver: C:\Users\ROLLOS~1\AppData\Local\Temp\uftdrpob.sys


---- System - GMER 2.1 ----

SSDT    863EFCD8                                                                                                               ZwAlertResumeThread
SSDT    863EFD70                                                                                                               ZwAlertThread
SSDT    8617A5A8                                                                                                               ZwAllocateVirtualMemory
SSDT    85D03DF0                                                                                                               ZwAlpcConnectPort
SSDT    863EF750                                                                                                               ZwAssignProcessToJobObject
SSDT    863EFB00                                                                                                               ZwCreateMutant
SSDT    863EF548                                                                                                               ZwCreateSymbolicLinkObject
SSDT    8617A900                                                                                                               ZwCreateThread
SSDT    863EF5F0                                                                                                               ZwCreateThreadEx
SSDT    863EF7E8                                                                                                               ZwDebugActiveProcess
SSDT    8617A6E8                                                                                                               ZwDuplicateObject
SSDT    8617A438                                                                                                               ZwFreeVirtualMemory
SSDT    863EFBA8                                                                                                               ZwImpersonateAnonymousToken
SSDT    863EFC40                                                                                                               ZwImpersonateThread
SSDT    85D0CF10                                                                                                               ZwLoadDriver
SSDT    8617A380                                                                                                               ZwMapViewOfSection
SSDT    863EFA68                                                                                                               ZwOpenEvent
SSDT    8617A838                                                                                                               ZwOpenProcess
SSDT    8617A650                                                                                                               ZwOpenProcessToken
SSDT    863EF938                                                                                                               ZwOpenSection
SSDT    8617A790                                                                                                               ZwOpenThread
SSDT    863EF6A8                                                                                                               ZwProtectVirtualMemory
SSDT    863EF4A0                                                                                                               ZwQueueApcThread
SSDT    863EF3F8                                                                                                               ZwQueueApcThreadEx
SSDT    863EFE08                                                                                                               ZwResumeThread
SSDT    863EFFD0                                                                                                               ZwSetContextThread
SSDT    8617A240                                                                                                               ZwSetInformationProcess
SSDT    863EF880                                                                                                               ZwSetSystemInformation
SSDT    863EF9D0                                                                                                               ZwSuspendProcess
SSDT    863EFEA0                                                                                                               ZwSuspendThread
SSDT    8617A9B8                                                                                                               ZwTerminateProcess
SSDT    863EFF38                                                                                                               ZwTerminateThread
SSDT    8617A2E8                                                                                                               ZwUnmapViewOfSection
SSDT    8617A4E0                                                                                                               ZwWriteVirtualMemory

Code    \??\C:\Windows\system32\drivers\mbamchameleon.sys (Malwarebytes Chameleon Protection Driver/Malwarebytes Corporation)  KeInsertQueueApc

---- Kernel code sections - GMER 2.1 ----

.text   ntoskrnl.exe!ZwRollbackEnlistment + 1409                                                                               82C499A5 1 Byte  [06]
.text   ntoskrnl.exe!KiDispatchInterrupt + 5A2                                                                                 82C69512 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text   ntoskrnl.exe!KeRemoveQueueEx + 13A3                                                                                    82C70998 8 Bytes  [D8, FC, 3E, 86, 70, FD, 3E, ...]
.text   ntoskrnl.exe!KeRemoveQueueEx + 13BB                                                                                    82C709B0 4 Bytes  [A8, A5, 17, 86]
.text   ntoskrnl.exe!KeRemoveQueueEx + 13C7                                                                                    82C709BC 4 Bytes  [F0, 3D, D0, 85]
.text   ntoskrnl.exe!KeRemoveQueueEx + 141B                                                                                    82C70A10 4 Bytes  [50, F7, 3E, 86]
.text   ntoskrnl.exe!KeRemoveQueueEx + 1497                                                                                    82C70A8C 4 Bytes  [00, FB, 3E, 86]
.text   ...                                                                                                                    
.text   ntoskrnl.exe!KeInsertQueueApc                                                                                          82CB8723 5 Bytes  JMP 89C05662 \??\C:\Windows\system32\drivers\mbamchameleon.sys (Malwarebytes Chameleon Protection Driver/Malwarebytes Corporation)

---- Threads - GMER 2.1 ----

Thread  System [4:720]                                                                                                         927EEE50

---- EOF - GMER 2.1 ----
         
__________________

Geändert von Fellefant (30.08.2014 um 22:13 Uhr)

Alt 31.08.2014, 11:27   #4
schrauber
/// the machine
/// TB-Ausbilder
 

Mediaplayer lehnt DVDs als Gebietsfremd ab - Standard

Mediaplayer lehnt DVDs als Gebietsfremd ab



Mit welchem Programm spielst du die ab?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 31.08.2014, 13:24   #5
Fellefant
 
Mediaplayer lehnt DVDs als Gebietsfremd ab - Standard

Mediaplayer lehnt DVDs als Gebietsfremd ab



Mit dem 0815 Windows Media Player meines schönen neuen Windows 7.

Und das war die Lösung - wie ich soeben herausfand Die Probleme treten ausschließlich beim Mediaplayer auf. Über das Mediacenter läuft alles reibungslos.

Also vielen Dank für Deine Mühe - ich beende damit diese Sitzung

Fellefant


Geändert von Fellefant (31.08.2014 um 14:22 Uhr)

Alt 31.08.2014, 17:07   #6
schrauber
/// the machine
/// TB-Ausbilder
 

Mediaplayer lehnt DVDs als Gebietsfremd ab - Standard

Mediaplayer lehnt DVDs als Gebietsfremd ab



ok
__________________
--> Mediaplayer lehnt DVDs als Gebietsfremd ab

Antwort

Themen zu Mediaplayer lehnt DVDs als Gebietsfremd ab
adobe, adware, browser, cpu, defender, email, error, excel, explorer, flash player, google, home, homepage, mozilla, registry, rundll, scan, security, services.exe, software, svchost.exe, symantec, system, temp, windows



Ähnliche Themen: Mediaplayer lehnt DVDs als Gebietsfremd ab


  1. Es werden keine Windows-DVDs mehr gelesen/ kein Booten möglich
    Alles rund um Windows - 23.04.2014 (4)
  2. Einige DVDs werden verpixelt und mit Tonaussetzern dargestellt (Win7 mit WinDVD, WMP)
    Alles rund um Windows - 21.03.2013 (3)
  3. Skuril, DVD-Laufwerk erkennt keine DVDs mehr
    Netzwerk und Hardware - 28.03.2011 (4)
  4. Justizministerin lehnt "digitalen Radiergummi" ab
    Nachrichten - 22.03.2011 (0)
  5. Langsamer Laptop + Brenner brennt keine DVDs
    Log-Analyse und Auswertung - 09.06.2010 (2)
  6. DVD-Laufwerk erkennt leere DVDs/CDs nicht
    Log-Analyse und Auswertung - 21.12.2009 (5)
  7. Software auf Heft-CDs/DVDs von Zeitschriften
    Diskussionsforum - 25.04.2007 (10)
  8. samsund sh-s162l brennt keine dvds
    Netzwerk und Hardware - 02.03.2007 (3)
  9. Brenner erkennt keine Double Layer DVDs
    Netzwerk und Hardware - 01.02.2007 (6)
  10. DVD-CD-ROM-Laufwerk liest nur noch DVDs
    Netzwerk und Hardware - 30.08.2006 (5)
  11. Daten DVDs werden nicht erkannt!
    Netzwerk und Hardware - 21.08.2006 (9)
  12. Sony Rootkit bei DVDs?
    Plagegeister aller Art und deren Bekämpfung - 25.05.2006 (1)
  13. dvds brennen
    Alles rund um Windows - 14.05.2005 (10)
  14. Mediaplayer
    Alles rund um Windows - 16.10.2003 (6)
  15. Win-Mediaplayer
    Alles rund um Windows - 02.06.2003 (16)
  16. Von DVDs, Notebook und Kabeln :(
    Netzwerk und Hardware - 06.02.2003 (8)

Zum Thema Mediaplayer lehnt DVDs als Gebietsfremd ab - Und monatlich grüßt das Murmeltier.., Hallo Schrauber ich versorge Dich gleich mal mit den frst-logs aber vermutlich werde ich die GMER evtl. nachliefern müssen weil sonst die Kapazität überschritten wird. - Mediaplayer lehnt DVDs als Gebietsfremd ab...
Archiv
Du betrachtest: Mediaplayer lehnt DVDs als Gebietsfremd ab auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.