| |
| |||||||
Log-Analyse und Auswertung: Windows 7: Reinigung des Rechners nach Viren-/Trojanerbefall, bitte um Prüfung.Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
28.10.2014, 15:34
| #1 |
| |  Windows 7: Reinigung des Rechners nach Viren-/Trojanerbefall, bitte um Prüfung. Hallo Leute, nachdem meine Frau ihren Laptop durch das Öffnen eines gefakten Emailanhangs lahmgelegt hat, habe ich diesen meiner Meinung nach wieder bereinigt. Dennoch möchte ich auf Nummer sicher gehehen und euch bitten die LOGs durchzuschauen. Defogger Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 15:00 on 28/10/2014 (luka)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-10-2014 01
Ran by luka (administrator) on LUKA-PC on 28-10-2014 15:05:31
Running from C:\Users\luka\Desktop
Loaded Profile: luka (Available profiles: luka)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2294568 2010-09-03] (Synaptics Incorporated)
HKLM\...\Run: [Lenovo EE Boot Optimizer] => C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe [114688 2011-12-25] (Lenovo)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [9753024 2011-12-25] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [5908928 2011-12-25] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-08-10] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2010-07-26] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePRCShortCut] => C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe [222504 2009-05-13] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-09] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [165168 2014-09-23] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-2600533189-3057213749-2189000725-1002\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22734160 2014-08-08] (Google)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\luka\AppData\Roaming\Mozilla\Firefox\Profiles\ofaxp0po.default
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira Browser Safety - C:\Users\luka\AppData\Roaming\Mozilla\Firefox\Profiles\ofaxp0po.default\Extensions\abs@avira.com [2014-09-30]
FF Extension: Adblock Plus - C:\Users\luka\AppData\Roaming\Mozilla\Firefox\Profiles\ofaxp0po.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-12-17]
Chrome:
=======
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [365568 2011-08-10] (Advanced Micro Devices, Inc.) [File not signed]
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-10-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-10-09] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160560 2014-09-23] (Avira Operations GmbH & Co. KG)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-01] (Avira Operations GmbH & Co. KG)
U3 BcmSqlStartupSvc; No ImagePath
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
U2 CLKMSVC10_3A60B698; No ImagePath
U2 CLKMSVC10_C3B3B687; No ImagePath
S3 clwvd; system32\DRIVERS\clwvd.sys [X]
U2 DriverService; No ImagePath
U2 IAStorDataMgrSvc; No ImagePath
U2 iATAgentService; No ImagePath
U2 idealife Update Service; No ImagePath
U3 IGRS; No ImagePath
U2 IviRegMgr; No ImagePath
S3 MFE_RR; \??\C:\Users\luka\AppData\Local\Temp\mfe_rr.sys [X]
U2 nvUpdatusService; No ImagePath
U2 Oasis2Service; No ImagePath
U2 PCCarerService; No ImagePath
U2 ReadyComm.DirectRouter; No ImagePath
U2 RichVideo; No ImagePath
U2 RtLedService; No ImagePath
U2 SeaPort; No ImagePath
U2 SoftwareService; No ImagePath
U3 SQLWriter; No ImagePath
U2 Stereo Service; No ImagePath
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-28 15:06 - 2014-10-28 15:06 - 00380416 _____ () C:\Users\luka\Desktop\Gmer-19357.exe
2014-10-28 15:05 - 2014-10-28 15:06 - 00009751 _____ () C:\Users\luka\Desktop\FRST.txt
2014-10-28 15:05 - 2014-10-28 15:05 - 00000000 ____D () C:\FRST
2014-10-28 15:01 - 2014-10-28 15:01 - 02113024 _____ (Farbar) C:\Users\luka\Desktop\FRST64.exe
2014-10-28 15:00 - 2014-10-28 15:00 - 00000470 _____ () C:\Users\luka\Desktop\defogger_disable.log
2014-10-28 15:00 - 2014-10-28 15:00 - 00000000 _____ () C:\Users\luka\defogger_reenable
2014-10-28 14:59 - 2014-10-28 14:59 - 00050477 _____ () C:\Users\luka\Desktop\Defogger.exe
2014-10-28 14:42 - 2014-10-28 14:43 - 00001112 _____ () C:\DelFix.txt
2014-10-28 14:42 - 2014-10-28 14:42 - 00000000 ____D () C:\windows\ERUNT
2014-10-28 11:54 - 2014-10-28 14:38 - 00000000 ____D () C:\windows\erdnt
2014-10-28 11:49 - 2014-10-28 11:49 - 00000000 ____D () C:\ProgramData\Energy Management
2014-10-28 11:27 - 2014-09-13 02:58 - 00077312 _____ (Microsoft Corporation) C:\windows\system32\packager.dll
2014-10-28 11:27 - 2014-09-13 02:40 - 00067072 _____ (Microsoft Corporation) C:\windows\SysWOW64\packager.dll
2014-10-15 03:57 - 2014-10-15 03:57 - 04714656 _____ (Avira Operations GmbH & Co. KG) C:\Users\luka\Downloads\avira_de_av___ws(1).exe
2014-10-15 03:56 - 2014-10-15 03:56 - 04714656 _____ (Avira Operations GmbH & Co. KG) C:\Users\luka\Downloads\avira_de_av___ws.exe
2014-10-14 23:28 - 2014-10-14 23:30 - 00000310 _____ () C:\Users\luka\Downloads\RootkitRemover_20141015_002828.log
2014-10-14 23:27 - 2014-10-14 23:28 - 00783120 _____ (McAfee, Inc.) C:\Users\luka\Downloads\rootkitremover.exe
2014-10-14 22:38 - 2014-10-15 03:59 - 00001137 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-10-14 18:56 - 2014-10-14 23:54 - 00000000 ____D () C:\Kaspersky Rescue Disk 10.0
2014-10-14 13:10 - 2014-10-15 09:03 - 00000000 ___HD () C:\Users\luka\AppData\Roaming\Cfowgjgh
2014-10-14 11:16 - 2014-10-14 13:11 - 00000000 ___HD () C:\Users\luka\AppData\Local\Hmyfne
2014-10-14 08:04 - 2014-10-14 11:16 - 00000000 ___HD () C:\Users\luka\AppData\Local\Quovvlypna
2014-10-13 18:42 - 2014-10-14 08:04 - 00000000 ___HD () C:\Users\luka\AppData\Local\Snhljcdly
2014-10-13 14:16 - 2014-10-28 11:34 - 00000000 ____D () C:\ProgramData\gvwpty
2014-10-13 06:57 - 2014-10-14 19:15 - 00000000 ___HD () C:\Users\luka\AppData\Roaming\Npxuftjw
2014-10-13 06:57 - 2014-10-14 19:10 - 00000000 ___HD () C:\Users\luka\AppData\Local\Cdlbg
2014-10-12 16:35 - 2014-10-14 19:11 - 00000000 ___HD () C:\Users\luka\AppData\Local\Ykeldgiwdn
2014-10-12 16:04 - 2014-10-13 06:57 - 00000000 ___HD () C:\Users\luka\AppData\Local\Saaqtlv
2014-10-12 16:03 - 2014-10-14 19:13 - 00000000 ___HD () C:\Users\luka\AppData\Roaming\Jvcscuiimc
2014-10-10 12:08 - 2014-10-10 12:09 - 00000000 ____D () C:\Users\luka\Desktop\Sonstiges
2014-10-01 06:26 - 2014-09-25 03:08 - 00371712 _____ (Microsoft Corporation) C:\windows\system32\qdvd.dll
2014-10-01 06:26 - 2014-09-25 02:40 - 00519680 _____ (Microsoft Corporation) C:\windows\SysWOW64\qdvd.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-28 15:07 - 2012-08-10 23:27 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-10-28 15:06 - 2011-12-25 08:48 - 01323858 _____ () C:\windows\WindowsUpdate.log
2014-10-28 15:03 - 2013-08-25 22:23 - 00000000 ____D () C:\windows\system32\MRT
2014-10-28 15:00 - 2012-08-10 21:10 - 00000000 ____D () C:\Users\luka
2014-10-28 14:56 - 2012-08-10 22:01 - 103265616 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-10-28 14:56 - 2009-07-14 05:45 - 00028704 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-28 14:56 - 2009-07-14 05:45 - 00028704 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-28 14:52 - 2013-02-08 12:38 - 01620684 _____ () C:\windows\system32\PerfStringBackup.INI
2014-10-28 14:52 - 2011-12-25 00:35 - 00699682 _____ () C:\windows\system32\perfh007.dat
2014-10-28 14:52 - 2011-12-25 00:35 - 00149790 _____ () C:\windows\system32\perfc007.dat
2014-10-28 14:46 - 2013-07-30 19:26 - 00000000 ___RD () C:\Users\luka\Google Drive
2014-10-28 14:45 - 2013-07-30 19:23 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-28 14:45 - 2011-12-25 09:50 - 00126623 _____ () C:\windows\system32\fastboot.set
2014-10-28 14:44 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-10-28 14:44 - 2009-07-14 05:51 - 00071533 _____ () C:\windows\setupact.log
2014-10-28 14:42 - 2013-07-30 19:23 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-28 14:24 - 2012-08-10 21:10 - 00000000 ____D () C:\Users\luka\AppData\Local\Tempo
2014-10-28 12:22 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2014-10-28 12:16 - 2009-07-14 03:34 - 00000215 _____ () C:\windows\system.ini
2014-10-28 12:14 - 2010-11-21 04:47 - 00324640 _____ () C:\windows\PFRO.log
2014-10-28 11:48 - 2012-10-15 22:29 - 18494250 _____ () C:\windows\system32\PsBoot.log
2014-10-28 11:48 - 2012-10-15 22:29 - 00000000 _____ () C:\windows\system32\defragLog.log
2014-10-28 11:37 - 2013-07-30 19:23 - 00004106 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-10-28 11:37 - 2013-07-30 19:23 - 00003854 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-10-14 22:38 - 2014-08-21 22:29 - 00000000 ____D () C:\ProgramData\Package Cache
2014-10-14 22:38 - 2013-06-11 17:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-10-14 22:38 - 2013-06-11 17:55 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-10-14 08:16 - 2014-06-12 14:56 - 00000000 ____D () C:\Users\luka\Desktop\Geburtstagsbilder
2014-10-13 10:36 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\rescache
2014-10-13 06:56 - 2012-08-10 21:11 - 00000000 ____D () C:\Users\luka\AppData\Local\VirtualStore
2014-10-09 10:18 - 2013-06-11 17:57 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2014-10-09 10:18 - 2013-06-11 17:55 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2014-10-09 10:18 - 2013-06-11 17:55 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2014-10-02 15:53 - 2010-11-21 04:27 - 00278152 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2014-10-02 07:01 - 2012-08-10 21:36 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-10-01 14:15 - 2014-06-12 14:57 - 00000000 ____D () C:\Users\luka\Desktop\Bücher
2014-10-01 14:15 - 2012-10-04 13:46 - 00867840 ___SH () C:\Users\luka\Desktop\Thumbs.db
Some content of TEMP:
====================
C:\Users\luka\AppData\Local\Temp\avgnt.exe
C:\Users\luka\AppData\Local\Temp\icqsetup.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-10-28 11:17
==================== End Of Log ============================
Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-10-2014 01
Ran by luka at 2014-10-28 15:07:12
Running from C:\Users\luka\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader X (10.1.12) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)
ALDI NORD Bestellsoftware 4.12.2 (HKLM-x32\...\ALDI NORD Bestellsoftware) (Version: 4.12.2 - ORWO Net)
AMD APP SDK Runtime (Version: 2.4.650.9 - Advanced Micro Devices Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.60810.0551 - ATI Technologies Inc.) Hidden
AMD VISION Engine Control Center (x32 Version: 2011.0810.604.8985 - Ihr Firmenname) Hidden
Atheros Client Installation Program (HKLM-x32\...\{D3694B69-6F8C-42D3-8A0A-EB2AB528C02C}) (Version: 7.0 - Atheros)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.33 - Atheros Communications Inc.)
ATI AVIVO64 Codecs (Version: 11.6.0.10810 - ATI Technologies Inc.) Hidden
ATI Catalyst Install Manager (HKLM\...\{42C76910-6CD4-EC68-FB78-0D3DE411AD63}) (Version: 3.0.829.0 - ATI Technologies, Inc.)
Avira (HKLM-x32\...\{9bd9b85e-7792-483b-a318-cc51ff0877ed}) (Version: 1.1.22.50000 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.22.50000 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.306 - Avira)
Benutzerhandbuch (x32 Version: 1.0.0.6 - Lenovo) Hidden
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.54.4.50 - Conexant)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Energy Management (HKLM-x32\...\InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}) (Version: 6.0.2.0 - Lenovo)
Energy Management (x32 Version: 6.0.2.0 - Lenovo) Hidden
Fotogalerie (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Google Drive (HKLM-x32\...\{C6640705-7479-4EE5-BC86-879F05F65E74}) (Version: 1.17.7290.4094 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.25.5 - Google Inc.) Hidden
Grundschule Lernspass mit Albert E. Mathematik Klasse 3+4 (HKLM-x32\...\Grundschule Lernspass mit Albert E. Mathematik Klasse 3+4) (Version: - )
Lenovo EE Boot Optimizer (HKLM\...\Lenovo EE Boot Optimizer) (Version: 0.0.1.6 - Lenovo)
Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 7.0.1628 - CyberLink Corp.)
Lenovo OneKey Recovery (Version: 7.0.1628 - CyberLink Corp.) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Mozilla Firefox 32.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 24.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.6.0 (x86 de)) (Version: 24.6.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1108.0727 - Microsoft) Hidden
Photo Common (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Power2Go (HKLM-x32\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.0.7303 - CyberLink Corp.)
PowerXpressHybrid (x32 Version: 1.00.0000 - ATI) Hidden
Realtek USB 2.0 Reader Driver (HKLM-x32\...\{62BBB2F0-E220-4821-A564-730807D2C34D}) (Version: 6.1.7600.10003 - Realtek Semiconductor Corp.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.1.12.0 - Synaptics Incorporated)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
UserGuide (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 1.0.0.6 - Lenovo)
VLC media player 2.1.2 (HKLM-x32\...\VLC media player) (Version: 2.1.2 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3503.0728 - Microsoft Corporation)
Windows-Treiberpaket - Lenovo (ACPIVPC) System (12/02/2010 6.1.0.1) (HKLM\...\EA12B1FB53CE4E387C31A85236C41EF559B5E392) (Version: 12/02/2010 6.1.0.1 - Lenovo)
WinRAR 4.20 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
28-10-2014 13:42:46 Ende der Bereinigung
28-10-2014 13:54:53 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2014-10-28 12:13 - 00000027 ____A C:\windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {448B50ED-3D1A-4128-B334-2D74F400FC70} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-30] (Google Inc.)
Task: {49DC444F-46C5-489F-B462-D3D359AE5931} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-30] (Google Inc.)
Task: {8C4C6B61-3ACD-4C36-8079-15244FCAB179} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-10] (Adobe Systems Incorporated)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2006-12-04 01:26 - 2006-12-04 01:26 - 00022016 _____ () C:\windows\System32\sugs2l6.dll
2011-08-10 06:59 - 2011-08-10 06:59 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2008-12-20 04:20 - 2011-12-25 09:53 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\HookLib.dll
2008-12-20 04:20 - 2011-12-25 09:53 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\kbdhook.dll
2011-08-10 06:59 - 2011-08-10 06:59 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2011-03-14 15:21 - 2011-03-14 15:21 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2011-08-10 07:02 - 2011-08-10 07:02 - 00243712 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-10-28 14:45 - 2014-10-28 14:45 - 00098816 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\win32api.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 00110080 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\pywintypes27.dll
2014-10-28 14:45 - 2014-10-28 14:45 - 00364544 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\pythoncom27.dll
2014-10-28 14:45 - 2014-10-28 14:45 - 00045568 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\_socket.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 01160704 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\_ssl.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 00320512 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\win32com.shell.shell.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 00713216 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\_hashlib.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 01175040 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\wx._core_.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 00805888 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\wx._gdi_.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 00811008 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\wx._windows_.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 01062400 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\wx._controls_.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 00735232 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\wx._misc_.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 00128512 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\_elementtree.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 00127488 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\pyexpat.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 00557056 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\pysqlite2._sqlite.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 00007168 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\hashobjs_ext.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 00087552 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\_ctypes.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 00119808 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\win32file.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 00108544 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\win32security.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 00018432 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\win32event.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 00038912 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\win32inet.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 00070656 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\wx._html2.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 00167936 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\win32gui.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 00011264 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\win32crypt.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 00027136 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\_multiprocessing.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 00686080 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\unicodedata.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 00122368 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\wx._wizard.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 00010240 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\select.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 00024064 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\win32pipe.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 00025600 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\win32pdh.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 00525640 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\windows._lib_cacheinvalidation.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 00035840 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\win32process.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 00017408 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\win32profile.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 00022528 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\win32ts.pyd
2014-10-28 14:45 - 2014-10-28 14:45 - 00078336 _____ () C:\Users\luka\AppData\Local\Temp\_MEI27122\wx._animate.pyd
2014-09-25 06:57 - 2014-09-25 06:57 - 03715184 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-2600533189-3057213749-2189000725-500 - Administrator - Disabled)
Gast (S-1-5-21-2600533189-3057213749-2189000725-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2600533189-3057213749-2189000725-1003 - Limited - Enabled)
luka (S-1-5-21-2600533189-3057213749-2189000725-1002 - Administrator - Enabled) => C:\Users\luka
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (10/28/2014 02:46:42 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (10/28/2014 00:44:25 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (10/28/2014 00:44:20 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (10/28/2014 00:27:45 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (10/28/2014 00:16:29 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (10/28/2014 11:50:27 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (10/28/2014 11:30:06 AM) (Source: Google Update) (EventID: 1) (User: NT-AUTORITÄT)
Description: Google Update has encountered a fatal error.
ver=1.3.24.15;lang=de;guid=;is_machine=1;oop=0;upload=0;minidump=C:\Program Files (x86)\Google\CrashReports\6d2e23be-036b-4fa0-89dd-9461d9d1df96.dmp
Error: (10/14/2014 10:35:02 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc100
Name des fehlerhaften Moduls: netprofm.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4a5bda75
Ausnahmecode: 0xc0000005
Fehleroffset: 0x636c2505
ID des fehlerhaften Prozesses: 0x814
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe0
Pfad der fehlerhaften Anwendung: svchost.exe1
Pfad des fehlerhaften Moduls: svchost.exe2
Berichtskennung: svchost.exe3
Error: (10/14/2014 10:31:33 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (10/14/2014 01:25:10 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 32.0.3.5379, Zeitstempel: 0x54224e6b
Name des fehlerhaften Moduls: mozalloc.dll, Version: 32.0.3.5379, Zeitstempel: 0x54221b67
Ausnahmecode: 0x80000003
Fehleroffset: 0x0000141b
ID des fehlerhaften Prozesses: 0x1ea8
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
System errors:
=============
Error: (10/28/2014 02:44:03 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Error: (10/28/2014 02:38:52 PM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy6" den Befehl "chkdsk" aus.
Error: (10/28/2014 02:38:48 PM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy4" den Befehl "chkdsk" aus.
Error: (10/28/2014 02:38:41 PM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy3" den Befehl "chkdsk" aus.
Error: (10/28/2014 02:38:37 PM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy2" den Befehl "chkdsk" aus.
Error: (10/28/2014 02:38:32 PM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy1" den Befehl "chkdsk" aus.
Error: (10/28/2014 00:26:57 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Avira Service Host erreicht.
Error: (10/28/2014 00:25:16 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Error: (10/28/2014 00:13:58 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Error: (10/28/2014 00:13:46 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Microsoft Office Sessions:
=========================
CodeIntegrity Errors:
===================================
Date: 2014-10-28 12:11:35.360
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-10-28 12:11:34.736
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Processor: AMD E-450 APU with Radeon(tm) HD Graphics
Percentage of memory in use: 55%
Total physical RAM: 3690.9 MB
Available physical RAM: 1643.99 MB
Total Pagefile: 7379.98 MB
Available Pagefile: 4816.93 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:421.81 GB) (Free:368.63 GB) NTFS
Drive d: (LENOVO) (Fixed) (Total:29 GB) (Free:26.85 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 3BFF9B40)
Partition 1: (Active) - (Size=200 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=421.8 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=29 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=14.8 GB) - (Type=12)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-10-28 15:32:43
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000066 ST950032 rev.0003 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\luka\AppData\Local\Temp\kxldapow.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff80002fa8000 47 bytes [2B, D9, F6, 47, 0A, 01, 44, ...]
INITKDBG C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 689 fffff80002fa80a1 31 bytes [44, 0F, B7, 77, 0A, 48, 8B, ...]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[2892] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076be1465 2 bytes [BE, 76]
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[2892] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076be14bb 2 bytes [BE, 76]
.text ... * 2
---- Threads - GMER 2.1 ----
Thread C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3276:3412] 0000000077087587
Thread C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3276:3484] 0000000063e47712
Thread C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3276:3752] 0000000077e22e65
Thread C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3276:4120] 0000000077e23e85
Thread C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3276:3708] 0000000077e23e85
Thread C:\windows\SoftwareDistribution\Download\Install\NDP45-KB2972107-x64.exe [2820:3404] 0000000077e22e65
Thread C:\windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe [3880:4220] 0000000077e22e65
Thread C:\windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe [3880:4840] 0000000077e23e85
Thread C:\windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe [3880:5016] 0000000077e23e85
Thread C:\windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe [3880:2332] 000000007683d864
Thread C:\windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe [3880:4788] 0000000063e35a21
Thread C:\windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe [3880:1548] 0000000063e35a21
Thread C:\windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe [3880:4620] 0000000077e23e85
---- Processes - GMER 2.1 ----
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\python27.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892] (Python Core/Python Software Foundation)(2014-10-28 13:45:41) 000000001e000000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\win32api.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 000000001e8c0000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\pywintypes27.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 000000001e7a0000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\pythoncom27.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 0000000000330000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\_socket.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 0000000000240000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\_ssl.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 0000000010000000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\win32com.shell.shell.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 000000001e800000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\_hashlib.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 0000000002090000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\wx._core_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 0000000003100000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\wxbase294u_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892] (wxWidgets for MSW/wxWidgets development team)(2014-10-28 13:45:41) 0000000003230000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\wxbase294u_net_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892] (wxWidgets for MSW/wxWidgets development team)(2014-10-28 13:45:41) 0000000000280000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\wxmsw294u_core_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892] (wxWidgets for MSW/wxWidgets development team)(2014-10-28 13:45:41) 0000000003420000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\wxmsw294u_adv_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892] (wxWidgets for MSW/wxWidgets development team)(2014-10-28 13:45:41) 00000000038c0000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\wx._gdi_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:41) 0000000003b00000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\wx._windows_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 0000000003bd0000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\wxmsw294u_html_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892] (wxWidgets for MSW/wxWidgets development team)(2014-10-28 13:45:41) 0000000002860000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\wx._controls_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 0000000004690000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\wx._misc_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 00000000047a0000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\_elementtree.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 000000001d100000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\pyexpat.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 00000000004a0000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\pysqlite2._sqlite.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 0000000001da0000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\hashobjs_ext.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:41) 00000000004d0000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\_ctypes.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 000000001d1a0000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\win32file.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 000000001ea10000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\win32security.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 000000001ec80000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\win32event.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 000000001e9b0000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\win32inet.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 000000001eaa0000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\wx._html2.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 00000000004f0000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\wxmsw294u_webview_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892] (wxWidgets for MSW/wxWidgets development team)(2014-10-28 13:45:41) 0000000000530000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\win32gui.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 000000001ea40000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\win32crypt.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 000000001e980000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\_multiprocessing.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:41) 0000000000560000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\unicodedata.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 0000000005980000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\wx._wizard.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 0000000005930000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\select.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 0000000001f70000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\win32pipe.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 000000001eb90000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\win32pdh.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 000000001eb60000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\win32process.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 000000001ebf0000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\win32profile.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 000000001ec20000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\win32ts.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 000000001ed40000
Library C:\Users\luka\AppData\Local\Temp\_MEI27122\wx._animate.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2892](2014-10-28 13:45:40) 0000000005af0000
Library C:\a0f68fa5096131e941\Setup.exe (*** suspicious ***) @ C:\a0f68fa5096131e941\Setup.exe [4180] 0000000000920000
Library C:\windows\Installer\MSI7F8C.tmp (*** suspicious ***) @ C:\Windows\syswow64\MsiExec.exe [4392] 0000000063f80000
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0c6076fc1a13
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0c6076fc1a13 (not active ControlSet)
---- EOF - GMER 2.1 ----
 LG Vita |
|
28.10.2014, 16:26
| #2 |
| Ruhe in Frieden † 2019     | Windows 7: Reinigung des Rechners nach Viren-/Trojanerbefall, bitte um Prüfung. Mein Name ist Sandra und ich werde Dir bei Deinem Problem behilflich sein.
Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der schnellere und bei einem Befall durch Malware immer der sicherste Weg. Adware lässt sich in den allermeisten Fällen problemlos entfernen. Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Dir jemand vom Team sagt, dass Du clean bist. Ich seh da noch Reste, bitte ändere zudem noch alle Passwörter entweder von einem anderen PC oder nach Ende der Bereinigung von diesem PC aus Schritt 1 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Users\luka\AppData\Roaming\Cfowgjgh
C:\Users\luka\AppData\Local\Hmyfne
C:\Users\luka\AppData\Local\Quovvlypna
C:\Users\luka\AppData\Local\Snhljcdly
C:\ProgramData\gvwpty
C:\Users\luka\AppData\Roaming\Npxuftjw
C:\Users\luka\AppData\Local\Cdlbg
C:\Users\luka\AppData\Local\Ykeldgiwdn
C:\Users\luka\AppData\Local\Saaqtlv
C:\Users\luka\AppData\Roaming\Jvcscuiimc
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Schritt 2 Downloade Dir bitte Malwarebytes Anti-Malware
Schritt 3 Da der Scan mit Eset sehr gründlich ist, kann er unter Umständen mehrere Stunden dauern  ESET Online Scanner
Schritt 4 Starte noch einmal FRST.
__________________ |
|
28.10.2014, 21:18
| #3 |
| | Windows 7: Reinigung des Rechners nach Viren-/Trojanerbefall, bitte um Prüfung. Hallo Sandra,
__________________ich habe das jetzt genauso durchgeführt wie du es gesagt hast. Meiner Meinung ist alles sauber. Schritt 1. Fixlog.txt: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 27-10-2014 01
Ran by luka at 2014-10-28 16:41:02 Run:1
Running from C:\Users\luka\Desktop
Loaded Profile: luka (Available profiles: luka)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
C:\Users\luka\AppData\Roaming\Cfowgjgh
C:\Users\luka\AppData\Local\Hmyfne
C:\Users\luka\AppData\Local\Quovvlypna
C:\Users\luka\AppData\Local\Snhljcdly
C:\ProgramData\gvwpty
C:\Users\luka\AppData\Roaming\Npxuftjw
C:\Users\luka\AppData\Local\Cdlbg
C:\Users\luka\AppData\Local\Ykeldgiwdn
C:\Users\luka\AppData\Local\Saaqtlv
C:\Users\luka\AppData\Roaming\Jvcscuiimc
*****************
C:\Users\luka\AppData\Roaming\Cfowgjgh => Moved successfully.
C:\Users\luka\AppData\Local\Hmyfne => Moved successfully.
C:\Users\luka\AppData\Local\Quovvlypna => Moved successfully.
C:\Users\luka\AppData\Local\Snhljcdly => Moved successfully.
C:\ProgramData\gvwpty => Moved successfully.
C:\Users\luka\AppData\Roaming\Npxuftjw => Moved successfully.
C:\Users\luka\AppData\Local\Cdlbg => Moved successfully.
C:\Users\luka\AppData\Local\Ykeldgiwdn => Moved successfully.
C:\Users\luka\AppData\Local\Saaqtlv => Moved successfully.
C:\Users\luka\AppData\Roaming\Jvcscuiimc => Moved successfully.
==== End of Fixlog ====
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 28.10.2014 Suchlauf-Zeit: 16:45:30 Logdatei: mbam.txt Administrator: Ja Version: 2.00.3.1025 Malware Datenbank: v2014.10.28.04 Rootkit Datenbank: v2014.10.22.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: luka Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 323440 Verstrichene Zeit: 33 Min, 55 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente erkannt) Module: 0 (Keine schädliche Elemente erkannt) Registrierungsschlüssel: 0 (Keine schädliche Elemente erkannt) Registrierungswerte: 0 (Keine schädliche Elemente erkannt) Registrierungsdaten: 0 (Keine schädliche Elemente erkannt) Ordner: 0 (Keine schädliche Elemente erkannt) Dateien: 0 (Keine schädliche Elemente erkannt) Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=d73893e4f80d324b9a8f87565a84e2bd
# engine=20819
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-10-28 08:06:12
# local_time=2014-10-28 09:06:12 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 17316 159078950 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 21824 166156622 0 0
# scanned=202310
# found=0
# cleaned=0
# scan_time=12742
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-10-2014 01
Ran by luka (administrator) on LUKA-PC on 28-10-2014 21:08:07
Running from C:\Users\luka\Desktop
Loaded Profile: luka (Available profiles: luka)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2294568 2010-09-03] (Synaptics Incorporated)
HKLM\...\Run: [Lenovo EE Boot Optimizer] => C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe [114688 2011-12-25] (Lenovo)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [9753024 2011-12-25] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [5908928 2011-12-25] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-08-10] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2010-07-26] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePRCShortCut] => C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe [222504 2009-05-13] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-09] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [165168 2014-09-23] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-2600533189-3057213749-2189000725-1002\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22734160 2014-08-08] (Google)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\luka\AppData\Roaming\Mozilla\Firefox\Profiles\ofaxp0po.default
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira Browser Safety - C:\Users\luka\AppData\Roaming\Mozilla\Firefox\Profiles\ofaxp0po.default\Extensions\abs@avira.com [2014-09-30]
FF Extension: Adblock Plus - C:\Users\luka\AppData\Roaming\Mozilla\Firefox\Profiles\ofaxp0po.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-12-17]
Chrome:
=======
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [365568 2011-08-10] (Advanced Micro Devices, Inc.) [File not signed]
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-10-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-10-09] (Avira Operations GmbH & Co. KG)
S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160560 2014-09-23] (Avira Operations GmbH & Co. KG)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-01] (Avira Operations GmbH & Co. KG)
U3 BcmSqlStartupSvc; No ImagePath
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
U2 CLKMSVC10_3A60B698; No ImagePath
U2 CLKMSVC10_C3B3B687; No ImagePath
S3 clwvd; system32\DRIVERS\clwvd.sys [X]
U2 DriverService; No ImagePath
U2 IAStorDataMgrSvc; No ImagePath
U2 iATAgentService; No ImagePath
U2 idealife Update Service; No ImagePath
U3 IGRS; No ImagePath
U2 IviRegMgr; No ImagePath
S3 MFE_RR; \??\C:\Users\luka\AppData\Local\Temp\mfe_rr.sys [X]
U2 nvUpdatusService; No ImagePath
U2 Oasis2Service; No ImagePath
U2 PCCarerService; No ImagePath
U2 ReadyComm.DirectRouter; No ImagePath
U2 RichVideo; No ImagePath
U2 RtLedService; No ImagePath
U2 SeaPort; No ImagePath
U2 SoftwareService; No ImagePath
U3 SQLWriter; No ImagePath
U2 Stereo Service; No ImagePath
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-28 17:29 - 2014-10-28 17:29 - 02347384 _____ (ESET) C:\Users\luka\Desktop\esetsmartinstaller_deu.exe
2014-10-28 17:29 - 2014-10-28 17:29 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-10-28 17:22 - 2014-10-28 17:22 - 00001202 _____ () C:\Users\luka\Desktop\mbam.txt
2014-10-28 16:44 - 2014-10-28 16:44 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-28 16:44 - 2014-10-28 16:44 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-28 16:44 - 2014-10-28 16:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-10-28 16:43 - 2014-10-28 16:44 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-10-28 16:43 - 2014-10-28 16:43 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-10-28 16:43 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-10-28 16:43 - 2014-10-01 11:11 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-10-28 16:43 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-10-28 15:32 - 2014-10-28 15:32 - 00016497 _____ () C:\Users\luka\Desktop\gmer.log
2014-10-28 15:07 - 2014-10-28 15:08 - 00025461 _____ () C:\Users\luka\Desktop\Addition.txt
2014-10-28 15:06 - 2014-10-28 15:06 - 00380416 _____ () C:\Users\luka\Desktop\Gmer-19357.exe
2014-10-28 15:05 - 2014-10-28 21:09 - 00009654 _____ () C:\Users\luka\Desktop\FRST.txt
2014-10-28 15:05 - 2014-10-28 21:08 - 00000000 ____D () C:\FRST
2014-10-28 15:01 - 2014-10-28 15:01 - 02113024 _____ (Farbar) C:\Users\luka\Desktop\FRST64.exe
2014-10-28 15:00 - 2014-10-28 15:00 - 00000470 _____ () C:\Users\luka\Desktop\defogger_disable.log
2014-10-28 15:00 - 2014-10-28 15:00 - 00000000 _____ () C:\Users\luka\defogger_reenable
2014-10-28 14:59 - 2014-10-28 14:59 - 00050477 _____ () C:\Users\luka\Desktop\Defogger.exe
2014-10-28 14:42 - 2014-10-28 14:43 - 00001112 _____ () C:\DelFix.txt
2014-10-28 14:42 - 2014-10-28 14:42 - 00000000 ____D () C:\windows\ERUNT
2014-10-28 11:54 - 2014-10-28 14:38 - 00000000 ____D () C:\windows\erdnt
2014-10-28 11:49 - 2014-10-28 11:49 - 00000000 ____D () C:\ProgramData\Energy Management
2014-10-28 11:33 - 2014-10-10 03:05 - 00507392 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-10-28 11:33 - 2014-10-10 03:05 - 00276480 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2014-10-28 11:33 - 2014-10-10 03:00 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-10-28 11:33 - 2014-10-07 03:54 - 00378552 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2014-10-28 11:33 - 2014-10-07 03:04 - 00331448 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2014-10-28 11:33 - 2014-09-29 01:58 - 03198976 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-10-28 11:33 - 2014-09-25 23:50 - 13619200 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-10-28 11:33 - 2014-09-25 23:46 - 00365056 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2014-10-28 11:33 - 2014-09-25 23:46 - 00243200 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2014-10-28 11:33 - 2014-09-25 23:46 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-10-28 11:33 - 2014-09-25 23:43 - 11807232 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-10-28 11:33 - 2014-09-25 23:32 - 02017280 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-10-28 11:33 - 2014-09-25 23:31 - 02108416 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-10-28 11:33 - 2014-09-19 03:25 - 23631360 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-10-28 11:33 - 2014-09-19 02:56 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-10-28 11:33 - 2014-09-19 02:55 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-10-28 11:33 - 2014-09-19 02:44 - 17484800 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-10-28 11:33 - 2014-09-19 02:41 - 02796032 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-10-28 11:33 - 2014-09-19 02:40 - 00547328 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2014-10-28 11:33 - 2014-09-19 02:40 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-10-28 11:33 - 2014-09-19 02:39 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-10-28 11:33 - 2014-09-19 02:38 - 00083968 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2014-10-28 11:33 - 2014-09-19 02:36 - 05829632 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-10-28 11:33 - 2014-09-19 02:31 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-10-28 11:33 - 2014-09-19 02:30 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-10-28 11:33 - 2014-09-19 02:27 - 00595968 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-10-28 11:33 - 2014-09-19 02:26 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-10-28 11:33 - 2014-09-19 02:25 - 04201472 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-10-28 11:33 - 2014-09-19 02:25 - 00758272 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-10-28 11:33 - 2014-09-19 02:25 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-10-28 11:33 - 2014-09-19 02:18 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-10-28 11:33 - 2014-09-19 02:14 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-10-28 11:33 - 2014-09-19 02:14 - 00446464 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-10-28 11:33 - 2014-09-19 02:06 - 00072704 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2014-10-28 11:33 - 2014-09-19 02:02 - 00454656 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2014-10-28 11:33 - 2014-09-19 02:01 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-10-28 11:33 - 2014-09-19 02:01 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-10-28 11:33 - 2014-09-19 02:01 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2014-10-28 11:33 - 2014-09-19 02:00 - 00085504 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-10-28 11:33 - 2014-09-19 01:59 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2014-10-28 11:33 - 2014-09-19 01:58 - 00289280 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-10-28 11:33 - 2014-09-19 01:55 - 02187264 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-10-28 11:33 - 2014-09-19 01:54 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-10-28 11:33 - 2014-09-19 01:53 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-10-28 11:33 - 2014-09-19 01:51 - 00440320 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2014-10-28 11:33 - 2014-09-19 01:50 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2014-10-28 11:33 - 2014-09-19 01:49 - 00597504 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2014-10-28 11:33 - 2014-09-19 01:42 - 00731136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-10-28 11:33 - 2014-09-19 01:42 - 00710656 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-10-28 11:33 - 2014-09-19 01:40 - 01249280 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2014-10-28 11:33 - 2014-09-19 01:36 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-10-28 11:33 - 2014-09-19 01:33 - 02309632 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-10-28 11:33 - 2014-09-19 01:32 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-10-28 11:33 - 2014-09-19 01:20 - 00607744 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-10-28 11:33 - 2014-09-19 01:18 - 01068032 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2014-10-28 11:33 - 2014-09-19 01:14 - 01447936 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-10-28 11:33 - 2014-09-19 00:59 - 01810944 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-10-28 11:33 - 2014-09-19 00:59 - 00775168 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-10-28 11:33 - 2014-09-19 00:53 - 01190400 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-10-28 11:33 - 2014-09-19 00:52 - 00678400 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2014-10-28 11:33 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDYAK.DLL
2014-10-28 11:33 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDTAT.DLL
2014-10-28 11:33 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDRU1.DLL
2014-10-28 11:33 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDBASH.DLL
2014-10-28 11:33 - 2014-07-09 03:03 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\KBDRU.DLL
2014-10-28 11:33 - 2014-07-09 02:31 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDYAK.DLL
2014-10-28 11:33 - 2014-07-09 02:31 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDTAT.DLL
2014-10-28 11:33 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDRU1.DLL
2014-10-28 11:33 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDRU.DLL
2014-10-28 11:33 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDBASH.DLL
2014-10-28 11:33 - 2014-07-08 23:38 - 00419992 _____ () C:\windows\system32\locale.nls
2014-10-28 11:33 - 2014-07-08 23:30 - 00419992 _____ () C:\windows\SysWOW64\locale.nls
2014-10-28 11:33 - 2014-06-18 23:23 - 01943696 _____ (Microsoft Corporation) C:\windows\system32\dfshim.dll
2014-10-28 11:33 - 2014-06-18 23:23 - 01131664 _____ (Microsoft Corporation) C:\windows\SysWOW64\dfshim.dll
2014-10-28 11:33 - 2014-06-18 23:23 - 00156824 _____ (Microsoft Corporation) C:\windows\SysWOW64\mscorier.dll
2014-10-28 11:33 - 2014-06-18 23:23 - 00156312 _____ (Microsoft Corporation) C:\windows\system32\mscorier.dll
2014-10-28 11:33 - 2014-06-18 23:23 - 00081560 _____ (Microsoft Corporation) C:\windows\SysWOW64\mscories.dll
2014-10-28 11:33 - 2014-06-18 23:23 - 00073880 _____ (Microsoft Corporation) C:\windows\system32\mscories.dll
2014-10-28 11:29 - 2014-09-18 03:00 - 03241472 _____ (Microsoft Corporation) C:\windows\system32\msi.dll
2014-10-28 11:29 - 2014-09-18 02:32 - 02363904 _____ (Microsoft Corporation) C:\windows\SysWOW64\msi.dll
2014-10-28 11:29 - 2014-09-04 06:23 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\rastls.dll
2014-10-28 11:29 - 2014-09-04 06:04 - 00372736 _____ (Microsoft Corporation) C:\windows\SysWOW64\rastls.dll
2014-10-28 11:28 - 2014-07-17 03:07 - 03722240 _____ (Microsoft Corporation) C:\windows\system32\mstscax.dll
2014-10-28 11:28 - 2014-07-17 03:07 - 01118720 _____ (Microsoft Corporation) C:\windows\system32\mstsc.exe
2014-10-28 11:28 - 2014-07-17 03:07 - 00681984 _____ (Microsoft Corporation) C:\windows\system32\termsrv.dll
2014-10-28 11:28 - 2014-07-17 03:07 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\winlogon.exe
2014-10-28 11:28 - 2014-07-17 03:07 - 00235520 _____ (Microsoft Corporation) C:\windows\system32\winsta.dll
2014-10-28 11:28 - 2014-07-17 03:07 - 00150528 _____ (Microsoft Corporation) C:\windows\system32\rdpcorekmts.dll
2014-10-28 11:28 - 2014-07-17 03:07 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2014-10-28 11:28 - 2014-07-17 03:07 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2014-10-28 11:28 - 2014-07-17 02:40 - 00157696 _____ (Microsoft Corporation) C:\windows\SysWOW64\winsta.dll
2014-10-28 11:28 - 2014-07-17 02:39 - 03221504 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstscax.dll
2014-10-28 11:28 - 2014-07-17 02:39 - 01051136 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstsc.exe
2014-10-28 11:28 - 2014-07-17 02:39 - 00131584 _____ (Microsoft Corporation) C:\windows\SysWOW64\aaclient.dll
2014-10-28 11:28 - 2014-07-17 02:39 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2014-10-28 11:28 - 2014-07-17 02:39 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2014-10-28 11:28 - 2014-07-17 02:21 - 00212480 _____ (Microsoft Corporation) C:\windows\system32\Drivers\rdpwd.sys
2014-10-28 11:28 - 2014-07-17 02:21 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tssecsrv.sys
2014-10-28 11:27 - 2014-09-13 02:58 - 00077312 _____ (Microsoft Corporation) C:\windows\system32\packager.dll
2014-10-28 11:27 - 2014-09-13 02:40 - 00067072 _____ (Microsoft Corporation) C:\windows\SysWOW64\packager.dll
2014-10-14 22:38 - 2014-10-15 03:59 - 00001137 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-10-14 18:56 - 2014-10-14 23:54 - 00000000 ____D () C:\Kaspersky Rescue Disk 10.0
2014-10-10 12:08 - 2014-10-10 12:09 - 00000000 ____D () C:\Users\luka\Desktop\Sonstiges
2014-10-01 06:26 - 2014-09-25 03:08 - 00371712 _____ (Microsoft Corporation) C:\windows\system32\qdvd.dll
2014-10-01 06:26 - 2014-09-25 02:40 - 00519680 _____ (Microsoft Corporation) C:\windows\SysWOW64\qdvd.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-28 21:07 - 2012-08-10 23:27 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-10-28 20:42 - 2013-07-30 19:23 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-28 17:33 - 2009-07-14 05:45 - 00028704 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-28 17:33 - 2009-07-14 05:45 - 00028704 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-28 17:32 - 2011-12-25 08:48 - 01478649 _____ () C:\windows\WindowsUpdate.log
2014-10-28 17:30 - 2013-02-08 12:38 - 01620684 _____ () C:\windows\system32\PerfStringBackup.INI
2014-10-28 17:30 - 2011-12-25 00:35 - 00699682 _____ () C:\windows\system32\perfh007.dat
2014-10-28 17:30 - 2011-12-25 00:35 - 00149790 _____ () C:\windows\system32\perfc007.dat
2014-10-28 17:25 - 2013-07-30 19:26 - 00000000 ___RD () C:\Users\luka\Google Drive
2014-10-28 17:25 - 2011-12-25 09:50 - 00543761 _____ () C:\windows\system32\fastboot.set
2014-10-28 17:24 - 2013-07-30 19:23 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-28 17:24 - 2010-11-21 04:47 - 00325020 _____ () C:\windows\PFRO.log
2014-10-28 17:24 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-10-28 17:24 - 2009-07-14 05:51 - 00071645 _____ () C:\windows\setupact.log
2014-10-28 15:41 - 2009-07-14 05:45 - 00337720 _____ () C:\windows\system32\FNTCACHE.DAT
2014-10-28 15:39 - 2014-05-07 10:51 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-10-28 15:11 - 2012-09-23 14:07 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-28 15:03 - 2013-08-25 22:23 - 00000000 ____D () C:\windows\system32\MRT
2014-10-28 15:00 - 2012-08-10 21:10 - 00000000 ____D () C:\Users\luka
2014-10-28 14:56 - 2012-08-10 22:01 - 103265616 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-10-28 12:22 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2014-10-28 12:16 - 2009-07-14 03:34 - 00000215 _____ () C:\windows\system.ini
2014-10-28 11:48 - 2012-10-15 22:29 - 18494250 _____ () C:\windows\system32\PsBoot.log
2014-10-28 11:48 - 2012-10-15 22:29 - 00000000 _____ () C:\windows\system32\defragLog.log
2014-10-28 11:37 - 2013-07-30 19:23 - 00004106 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-10-28 11:37 - 2013-07-30 19:23 - 00003854 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-10-14 22:38 - 2014-08-21 22:29 - 00000000 ____D () C:\ProgramData\Package Cache
2014-10-14 22:38 - 2013-06-11 17:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-10-14 22:38 - 2013-06-11 17:55 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-10-14 08:16 - 2014-06-12 14:56 - 00000000 ____D () C:\Users\luka\Desktop\Geburtstagsbilder
2014-10-13 10:36 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\rescache
2014-10-13 06:56 - 2012-08-10 21:11 - 00000000 ____D () C:\Users\luka\AppData\Local\VirtualStore
2014-10-09 10:18 - 2013-06-11 17:57 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2014-10-09 10:18 - 2013-06-11 17:55 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2014-10-09 10:18 - 2013-06-11 17:55 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2014-10-02 15:53 - 2010-11-21 04:27 - 00278152 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2014-10-02 07:01 - 2012-08-10 21:36 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-10-01 14:15 - 2014-06-12 14:57 - 00000000 ____D () C:\Users\luka\Desktop\Bücher
2014-10-01 14:15 - 2012-10-04 13:46 - 00867840 ___SH () C:\Users\luka\Desktop\Thumbs.db
Some content of TEMP:
====================
C:\Users\luka\AppData\Local\Temp\avgnt.exe
C:\Users\luka\AppData\Local\Temp\icqsetup.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-10-28 11:17
==================== End Of Log ============================
Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-10-2014 01
Ran by luka at 2014-10-28 21:10:10
Running from C:\Users\luka\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader X (10.1.12) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)
ALDI NORD Bestellsoftware 4.12.2 (HKLM-x32\...\ALDI NORD Bestellsoftware) (Version: 4.12.2 - ORWO Net)
AMD APP SDK Runtime (Version: 2.4.650.9 - Advanced Micro Devices Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.60810.0551 - ATI Technologies Inc.) Hidden
AMD VISION Engine Control Center (x32 Version: 2011.0810.604.8985 - Ihr Firmenname) Hidden
Atheros Client Installation Program (HKLM-x32\...\{D3694B69-6F8C-42D3-8A0A-EB2AB528C02C}) (Version: 7.0 - Atheros)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.33 - Atheros Communications Inc.)
ATI AVIVO64 Codecs (Version: 11.6.0.10810 - ATI Technologies Inc.) Hidden
ATI Catalyst Install Manager (HKLM\...\{42C76910-6CD4-EC68-FB78-0D3DE411AD63}) (Version: 3.0.829.0 - ATI Technologies, Inc.)
Avira (HKLM-x32\...\{9bd9b85e-7792-483b-a318-cc51ff0877ed}) (Version: 1.1.22.50000 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.22.50000 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.306 - Avira)
Benutzerhandbuch (x32 Version: 1.0.0.6 - Lenovo) Hidden
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.54.4.50 - Conexant)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Energy Management (HKLM-x32\...\InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}) (Version: 6.0.2.0 - Lenovo)
Energy Management (x32 Version: 6.0.2.0 - Lenovo) Hidden
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
Fotogalerie (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Google Drive (HKLM-x32\...\{C6640705-7479-4EE5-BC86-879F05F65E74}) (Version: 1.17.7290.4094 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.25.5 - Google Inc.) Hidden
Grundschule Lernspass mit Albert E. Mathematik Klasse 3+4 (HKLM-x32\...\Grundschule Lernspass mit Albert E. Mathematik Klasse 3+4) (Version: - )
Lenovo EE Boot Optimizer (HKLM\...\Lenovo EE Boot Optimizer) (Version: 0.0.1.6 - Lenovo)
Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 7.0.1628 - CyberLink Corp.)
Lenovo OneKey Recovery (Version: 7.0.1628 - CyberLink Corp.) Hidden
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Mozilla Firefox 32.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 24.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.6.0 (x86 de)) (Version: 24.6.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1108.0727 - Microsoft) Hidden
Photo Common (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Power2Go (HKLM-x32\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.0.7303 - CyberLink Corp.)
PowerXpressHybrid (x32 Version: 1.00.0000 - ATI) Hidden
Realtek USB 2.0 Reader Driver (HKLM-x32\...\{62BBB2F0-E220-4821-A564-730807D2C34D}) (Version: 6.1.7600.10003 - Realtek Semiconductor Corp.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.1.12.0 - Synaptics Incorporated)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
UserGuide (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 1.0.0.6 - Lenovo)
VLC media player 2.1.2 (HKLM-x32\...\VLC media player) (Version: 2.1.2 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3503.0728 - Microsoft Corporation)
Windows-Treiberpaket - Lenovo (ACPIVPC) System (12/02/2010 6.1.0.1) (HKLM\...\EA12B1FB53CE4E387C31A85236C41EF559B5E392) (Version: 12/02/2010 6.1.0.1 - Lenovo)
WinRAR 4.20 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
28-10-2014 13:42:46 Ende der Bereinigung
28-10-2014 13:54:53 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2014-10-28 12:13 - 00000027 ____A C:\windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {448B50ED-3D1A-4128-B334-2D74F400FC70} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-30] (Google Inc.)
Task: {49DC444F-46C5-489F-B462-D3D359AE5931} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-30] (Google Inc.)
Task: {8C4C6B61-3ACD-4C36-8079-15244FCAB179} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-10] (Adobe Systems Incorporated)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2006-12-04 01:26 - 2006-12-04 01:26 - 00022016 _____ () C:\windows\System32\sugs2l6.dll
2011-08-10 06:59 - 2011-08-10 06:59 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2008-12-20 04:20 - 2011-12-25 09:53 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\HookLib.dll
2008-12-20 04:20 - 2011-12-25 09:53 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\kbdhook.dll
2011-08-10 06:59 - 2011-08-10 06:59 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2011-03-14 15:21 - 2011-03-14 15:21 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2011-08-10 07:02 - 2011-08-10 07:02 - 00243712 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-10-28 17:25 - 2014-10-28 17:25 - 00098816 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\win32api.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 00110080 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\pywintypes27.dll
2014-10-28 17:25 - 2014-10-28 17:25 - 00364544 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\pythoncom27.dll
2014-10-28 17:25 - 2014-10-28 17:25 - 00045568 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\_socket.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 01160704 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\_ssl.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 00320512 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\win32com.shell.shell.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 00713216 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\_hashlib.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 01175040 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\wx._core_.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 00805888 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\wx._gdi_.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 00811008 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\wx._windows_.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 01062400 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\wx._controls_.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 00735232 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\wx._misc_.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 00128512 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\_elementtree.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 00127488 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\pyexpat.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 00557056 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\pysqlite2._sqlite.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 00007168 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\hashobjs_ext.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 00087552 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\_ctypes.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 00119808 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\win32file.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 00108544 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\win32security.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 00018432 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\win32event.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 00038912 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\win32inet.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 00070656 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\wx._html2.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 00167936 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\win32gui.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 00011264 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\win32crypt.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 00027136 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\_multiprocessing.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 00686080 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\unicodedata.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 00122368 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\wx._wizard.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 00010240 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\select.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 00024064 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\win32pipe.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 00025600 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\win32pdh.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 00525640 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\windows._lib_cacheinvalidation.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 00035840 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\win32process.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 00017408 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\win32profile.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 00022528 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\win32ts.pyd
2014-10-28 17:25 - 2014-10-28 17:25 - 00078336 _____ () C:\Users\luka\AppData\Local\Temp\_MEI23562\wx._animate.pyd
2014-09-25 06:57 - 2014-09-25 06:57 - 03715184 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-2600533189-3057213749-2189000725-500 - Administrator - Disabled)
Gast (S-1-5-21-2600533189-3057213749-2189000725-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2600533189-3057213749-2189000725-1003 - Limited - Enabled)
luka (S-1-5-21-2600533189-3057213749-2189000725-1002 - Administrator - Enabled) => C:\Users\luka
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (10/28/2014 09:07:03 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (10/28/2014 05:29:48 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (10/28/2014 05:29:41 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (10/28/2014 05:29:39 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (10/28/2014 05:29:35 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (10/28/2014 05:26:25 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (10/28/2014 05:13:37 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm avscan.exe, Version 14.0.7.266 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: b60
Startzeit: 01cff2be3163bf32
Endzeit: 60000
Anwendungspfad: C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe
Berichts-ID: 2520a5dc-5ebd-11e4-808c-dc0ea16aaea8
Error: (10/28/2014 03:42:17 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (10/28/2014 02:46:42 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (10/28/2014 00:44:25 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
System errors:
=============
Error: (10/28/2014 05:25:24 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Avira Service Host erreicht.
Error: (10/28/2014 05:23:38 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Error: (10/28/2014 03:38:53 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Error: (10/28/2014 02:44:03 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Error: (10/28/2014 02:38:52 PM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy6" den Befehl "chkdsk" aus.
Error: (10/28/2014 02:38:48 PM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy4" den Befehl "chkdsk" aus.
Error: (10/28/2014 02:38:41 PM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy3" den Befehl "chkdsk" aus.
Error: (10/28/2014 02:38:37 PM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy2" den Befehl "chkdsk" aus.
Error: (10/28/2014 02:38:32 PM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy1" den Befehl "chkdsk" aus.
Error: (10/28/2014 00:26:57 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Avira Service Host erreicht.
Microsoft Office Sessions:
=========================
CodeIntegrity Errors:
===================================
Date: 2014-10-28 12:11:35.360
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-10-28 12:11:34.736
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Processor: AMD E-450 APU with Radeon(tm) HD Graphics
Percentage of memory in use: 44%
Total physical RAM: 3690.9 MB
Available physical RAM: 2050.87 MB
Total Pagefile: 7379.98 MB
Available Pagefile: 5451.73 MB
Total Virtual: 8192 MB
Available Virtual: 8191.86 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:421.81 GB) (Free:370.25 GB) NTFS
Drive d: (LENOVO) (Fixed) (Total:29 GB) (Free:26.85 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 3BFF9B40)
Partition 1: (Active) - (Size=200 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=421.8 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=29 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=14.8 GB) - (Type=12)
==================== End Of Log ============================
Eine kurze Frage zum Abschluss: Kann der Trojaner auch in die Firefox-Passwortdtei zugreifen. Sonst muss ich sämtliche abgespeicherten Foren-Passwörter ändern. LG Vita |
|
28.10.2014, 22:53
| #4 |
| Ruhe in Frieden † 2019 | Windows 7: Reinigung des Rechners nach Viren-/Trojanerbefall, bitte um Prüfung. Hallo, ja das sieht doch gut aus  OK So wie ich es sehe, haben wir damit alles Schadhafte entfernt. Deine Logs sind sauber. Abschließend räumen wir noch etwas auf, führen Updates durch und dann bekommst du noch etwas Lesestoff von mir. Schritt 1 Falls Du Malwarebytes-Antimalware und den ESET-Onlinescan nicht mehr benötigst, kannst Du beide Programme einfach über die Programmdeinstallation deinstallieren. Ich empfehle Dir aber zumindest Malwarebytes zu behalten, und damit einmal die Woche einen Kontrollscan zu machen. Schritt 2 Downloade dir bitte delfix auf deinen Desktop.
Updates / Programme aktualisieren
Deinstalliere Deinen Reader und lade Dir die neueste Version von hier herunter. Schaue, ob sich noch etwas mit installieren möchte und entferne den Haken gegebenenfalls.
Stelle sicher, dass dein FlashPlayer nach Updates sucht. Den FlashPlayer kann man direkt bei der Installation so konfigurieren, dass er nach Updates automatisch sucht, nachträglich kann man das über folgenden Link machen: Adobe - Flash Player: Einstellungsmanager - Globale Benachrichtigungseinstellungen
Lade dir bitte von hier den aktuellen Firefox herunter. Nun zum Schluss noch ein paar Tipps zur Absicherung deines Systems. Ändere regelmäßig alle deine Passwörter, jetzt, nach der Bereinigung ist ein idealer Zeitpunkt dafür
Aktualität des Systems Es ist extrem wichtig, dass sowohl dein System als auch die darauf installierte sicherheitsrelevante Software (Flash Player, PDF-Reader und besonders Java, sofern vorhanden) aktuell sind.
Antivirensoftware
Zusätzlicher Schutz
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der Internet Explorer, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Systemleistung Lösche regelmäßig deine temporären Dateien. Ich empfehle hierzu die Datenträgerbereinigung von Windows. Windows Vista
Windows 7
Windows 8
Halte dich fern von jeglichen Registry Cleanern. Diese schaden deinem System mehr als dass sie es schneller machen. Verhaltensregeln zum sichereren Surfen
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen. Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind. Falls Du Lob oder Kritik abgeben möchtest, kannst Du das sehr gerne hier tun. Wenn Du etwas für das Forum und unsere Arbeit spenden möchtest, so kannst Du das hier tun. |
|
28.10.2014, 23:45
| #5 |
| | Windows 7: Reinigung des Rechners nach Viren-/Trojanerbefall, bitte um Prüfung. Hallo Sandra und vielen Dank für deine Tipps: Habe wie von dir beschrieben alles aktualisiert und werde die Tipps beherzigen. Vielen Dank für deine Hilfe! |
|
29.10.2014, 22:46
| #6 |
| Ruhe in Frieden † 2019 | Windows 7: Reinigung des Rechners nach Viren-/Trojanerbefall, bitte um Prüfung. Hallo Vitalik, es freut mich, dass ich dir helfen konnte, alles Gute. Somit ist dieses Thema erledigt, falls du noch Fragen haben solltest oder es Probleme gibt, so schicke mir bitte eine PN Jeder andere bitte hier klicken und einen eigenen Thread erstellen
__________________ --> Windows 7: Reinigung des Rechners nach Viren-/Trojanerbefall, bitte um Prüfung. |
|
| Themen zu Windows 7: Reinigung des Rechners nach Viren-/Trojanerbefall, bitte um Prüfung. |
| adware, antivir, antivirus, avira, branding, browser, combofix, device driver, excel, fehler, firefox, flash player, google, home, iexplore.exe, installation, kaspersky, mozilla, msiexec.exe, registry, scan, security, services.exe, software, svchost.exe, system, usb, windows |
