| |
| |||||||
Log-Analyse und Auswertung: urlzone2 Infektion Meldung von abuse telekomWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
30.10.2014, 19:53
| #1 |
| |  urlzone2 Infektion Meldung von abuse telekom Einen wunderschönen guten Tag, ich bin Gewerbetreibender - bin aber ohne IT-Abteilung. Dummerweise habe ich eine einer Email anhängende Zip-Datei geöffnet. 28.10.2014 ca. 10.30 Uhr. Avast hat einen Scan vor dem Öffnen durchgeführt. Ich habe nicht bemerkt, dass seitens Avast etwas erkannt wurde. Unten ein Auszug der Datei Eventlog von Avast. 1. Direkt im Anschluss habe ich eine Kopie der Zip-Datei in mein Download Verzeichnis kopiert. 2. Dann habe ich einen vollständigen Scan mit Avast Free Virus durchgeführt. Keine Funde. 3. Download von Malwarebytes 4. Scan mit Malwarebytes Logfile unten 5. Eingang einer Mail mit Absender abuse@telekom.de am 30.10.2014 mit dem Inhalt: Zeitangabe: 28.10.2014, 10:48:59 (MEZ) Infektion: urlzone2 6. Download und Installation von avira eu cleaner und hitmanpro_x64 avira eu cleaner hat 6 Infektionen gemeldet. Leider finde ich kein Protokoll dazu. Die Infektionen waren alle in Email-Anhängen, die älter sind als 2 Jahre. hitmanpro hat lediglich Cookies gemeldet. 7. Dann habe ich Euch gefunden und hoffe nun auf Hilfe. Eventlog Avast (das müsste der Zeitpunkt sein, an dem ich den Anhang öffnen wollte. Code:
ATTFilter 28.10.2014 10:32:12 *SF.AAVM: Trying to start instrumentation, 00000000
28.10.2014 10:32:13 *SF.RT [04d0:1df0]: Runtime is starting process for (C:\Users\Besitzer\AppData\Local\Temp\Temp1_verfügungen_sg_28.10.2014__docx.zip\verfügungen_sg_28.10.2014__docx.exe)
28.10.2014 10:32:13 *SF.RT [04d0:1df0]: Runtime version: 163535
28.10.2014 10:32:13 *SF.RT [04d0:1df0]: Runtime is starting first thread
28.10.2014 10:32:13 *SF.RT [04d0:1df0]: New thread is about to start
28.10.2014 10:32:13 *SF.MACHINE [04d0:1df0]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\kernel32.dll at 76C60000 - 76D9FFFF
28.10.2014 10:32:13 *SF.MACHINE [04d0:1df0]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\KernelBase.dll at 767C0000 - 7688FFFF
28.10.2014 10:32:13 *SF.MACHINE [04d0:1df0]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\apphelp.dll at 720D0000 - 72168FFF
28.10.2014 10:32:13 *SF.MACHINE [04d0:1df0]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\shell32.dll at 75140000 - 762F6FFF
28.10.2014 10:32:13 *SF.MACHINE [04d0:1df0]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\msvcrt.dll at 768A0000 - 7695DFFF
28.10.2014 10:32:13 *SF.MACHINE [04d0:1df0]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\combase.dll at 74EF0000 - 7503DFFF
28.10.2014 10:32:13 *SF.MACHINE [04d0:1df0]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\user32.dll at 76FA0000 - 770EEFFF
28.10.2014 10:32:13 *SF.MACHINE [04d0:1df0]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\shlwapi.dll at 770F0000 - 77130FFF
28.10.2014 10:32:13 *SF.MACHINE [04d0:1df0]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\gdi32.dll at 77140000 - 77246FFF
28.10.2014 10:32:13 *SF.MACHINE [04d0:1df0]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\rpcrt4.dll at 76530000 - 765DFFFF
28.10.2014 10:32:13 *SF.MACHINE [04d0:1df0]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\sspicli.dll at 74ED0000 - 74EECFFF
28.10.2014 10:32:13 *SF.MACHINE [04d0:1df0]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\cryptbase.dll at 74EC0000 - 74EC8FFF
28.10.2014 10:32:13 *SF.MACHINE [04d0:1df0]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\sechost.dll at 76780000 - 767BDFFF
28.10.2014 10:32:13 *SF.MACHINE [04d0:1df0]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\bcryptprimitives.dll at 74E60000 - 74EB1FFF
28.10.2014 10:32:13 *SF.MACHINE [04d0:1df0]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\imm32.dll at 75110000 - 75134FFF
28.10.2014 10:32:13 *SF.MACHINE [04d0:1df0]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\msctf.dll at 76660000 - 76756FFF
28.10.2014 10:32:13 !SF.RT [04d0:1df0]: Trampoline address lost from ESP in NtCallBackReturn, instead there is: 774EC5F0 !
28.10.2014 10:32:13 *SF.MM.NOUNMAP [04d0:1df0]: VirtualQuery on memory in shadow memory [0040684a (N/A)] class 0
28.10.2014 10:32:13 *SF.MM.NOUNMAP [04d0:1df0]: VirtualQuery on memory in shadow memory [0040684a (N/A)] class 3
28.10.2014 10:32:13 *SF.MM.NOUNMAP [04d0:1df0]: VirtualQuery on memory in shadow memory [0040684a (N/A)] class 2
28.10.2014 10:32:13 *SF.MACHINE [04d0:1df0]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\psapi.dll at 76960000 - 76965FFF
28.10.2014 10:32:29 *SF.AAVM: Instrumentation has been torn down., 00000000
28.10.2014 10:32:33 *SF.AAVM: Trying to start instrumentation, 00000000
28.10.2014 10:32:34 *SF.RT [22d0:2264]: Runtime is starting process for (C:\Users\Besitzer\AppData\Local\Temp\Temp1_verfügungen_sg_28.10.2014__docx.zip\verfügungen_sg_28.10.2014__docx.exe)
28.10.2014 10:32:34 *SF.RT [22d0:2264]: Runtime version: 163535
28.10.2014 10:32:34 *SF.RT [22d0:2264]: Runtime is starting first thread
28.10.2014 10:32:34 *SF.RT [22d0:2264]: New thread is about to start
28.10.2014 10:32:34 *SF.MACHINE [22d0:2264]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\kernel32.dll at 76C60000 - 76D9FFFF
28.10.2014 10:32:34 *SF.MACHINE [22d0:2264]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\KernelBase.dll at 767C0000 - 7688FFFF
28.10.2014 10:32:34 *SF.MACHINE [22d0:2264]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\shell32.dll at 75140000 - 762F6FFF
28.10.2014 10:32:34 *SF.MACHINE [22d0:2264]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\msvcrt.dll at 768A0000 - 7695DFFF
28.10.2014 10:32:34 *SF.MACHINE [22d0:2264]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\combase.dll at 74EF0000 - 7503DFFF
28.10.2014 10:32:34 *SF.MACHINE [22d0:2264]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\user32.dll at 76FA0000 - 770EEFFF
28.10.2014 10:32:34 *SF.MACHINE [22d0:2264]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\shlwapi.dll at 770F0000 - 77130FFF
28.10.2014 10:32:34 *SF.MACHINE [22d0:2264]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\gdi32.dll at 77140000 - 77246FFF
28.10.2014 10:32:34 *SF.MACHINE [22d0:2264]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\rpcrt4.dll at 76530000 - 765DFFFF
28.10.2014 10:32:34 *SF.MACHINE [22d0:2264]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\sspicli.dll at 74ED0000 - 74EECFFF
28.10.2014 10:32:34 *SF.MACHINE [22d0:2264]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\cryptbase.dll at 74EC0000 - 74EC8FFF
28.10.2014 10:32:34 *SF.MACHINE [22d0:2264]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\sechost.dll at 76780000 - 767BDFFF
28.10.2014 10:32:34 *SF.MACHINE [22d0:2264]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\bcryptprimitives.dll at 74E60000 - 74EB1FFF
28.10.2014 10:32:34 *SF.MACHINE [22d0:2264]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\imm32.dll at 75110000 - 75134FFF
28.10.2014 10:32:34 *SF.MACHINE [22d0:2264]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\msctf.dll at 76660000 - 76756FFF
28.10.2014 10:32:34 !SF.RT [22d0:2264]: Trampoline address lost from ESP in NtCallBackReturn, instead there is: 774EC5F0 !
28.10.2014 10:32:34 *SF.MM.NOUNMAP [22d0:2264]: VirtualQuery on memory in shadow memory [0040684a (N/A)] class 0
28.10.2014 10:32:34 *SF.MM.NOUNMAP [22d0:2264]: VirtualQuery on memory in shadow memory [0040684a (N/A)] class 3
28.10.2014 10:32:34 *SF.MM.NOUNMAP [22d0:2264]: VirtualQuery on memory in shadow memory [0040684a (N/A)] class 2
28.10.2014 10:32:34 *SF.MACHINE [22d0:2264]: Loading module \Device\HarddiskVolume5\Windows\SysWOW64\psapi.dll at 76960000 - 76965FFF
28.10.2014 10:32:50 *SF.AAVM: Instrumentation has been torn down., 00000000
2
Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 18:33 on 30/10/2014 (Besitzer)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST.txt Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-10-2014 Ran by Besitzer (administrator) on SONNE on 30-10-2014 18:35:06 Running from C:\Users\Besitzer\Downloads Loaded Profiles: Besitzer & Administrator (Available profiles: Besitzer & Administrator) Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe (DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkUserAgent.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (Conexant Systems, Inc.) C:\Program Files\CONEXANT\SA3\CxUtilSvc.exe (CyberLink) C:\Program Files (x86)\CyberLink Corp\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe (CyberLink) C:\Program Files (x86)\CyberLink Corp\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (SoftThinks SAS) C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe (Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe (DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkUI.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Conexant Systems, Inc.) C:\Program Files\CONEXANT\SA3\SmartAudio3.exe (Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDGesture.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe (Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\BrccMCtl.exe (Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe (Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe (CyberLink Corp.) C:\Program Files (x86)\CyberLink Corp\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Marek Jasinski) C:\Program Files (x86)\FreeCommander XE\FreeCommander.exe (SoftThinks - Dell) C:\Program Files (x86)\Dell Backup and Recovery\Toaster.exe (SoftThinks - Dell) C:\Program Files (x86)\Dell Backup and Recovery\Components\DBRUpdate\DBRUpd.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe (Apache Software Foundation) C:\xampp\apache\bin\httpd.exe () C:\xampp\mysql\bin\mysqld.exe (Apache Software Foundation) C:\xampp\apache\bin\httpd.exe (All-Inkl.com) C:\Program Files\ALL-INKL WebDisk\ALL-INKL WebDisk.exe (The OpenVPN Project) C:\Program Files\ALL-INKL WebDisk\openvpn.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Marek Jasinski) C:\Program Files (x86)\FreeCommander XE\FcContextMenu64.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2774864 2013-01-09] (ELAN Microelectronics Corp.) HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SA3\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.) HKLM\...\Run: [IntelTBRunOnce] => wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" HKLM\...\Run: [QuickSet] => C:\Program Files\Dell\QuickSet\QuickSet.exe [5762408 2013-02-01] (Dell Inc.) HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-11-19] (Intel Corporation) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-08-06] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [663552 2007-03-23] (Brother Industries, Ltd.) HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [65536 2007-01-26] (Brother Industries, Ltd.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [PowerDVD12Agent] => C:\Program Files (x86)\CyberLink Corp\PowerDVD12\PowerDVD12Agent.exe [377880 2013-11-29] (CyberLink Corp.) HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-07-31] (AVAST Software) Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation) ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://dell13.msn.com HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://dell13.msn.com SearchScopes: HKLM - DefaultScope {7F41E0D8-FAC8-4212-A90A-22380C2F1B6B} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MDDCJS SearchScopes: HKLM - {7F41E0D8-FAC8-4212-A90A-22380C2F1B6B} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MDDCJS SearchScopes: HKLM-x32 - DefaultScope {7F41E0D8-FAC8-4212-A90A-22380C2F1B6B} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MDDCJS SearchScopes: HKLM-x32 - {7F41E0D8-FAC8-4212-A90A-22380C2F1B6B} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MDDCJS SearchScopes: HKCU - DefaultScope {7F41E0D8-FAC8-4212-A90A-22380C2F1B6B} URL = SearchScopes: HKCU - {7F41E0D8-FAC8-4212-A90A-22380C2F1B6B} URL = BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File FireFox: ======== FF ProfilePath: C:\Users\Besitzer\AppData\Roaming\Mozilla\Firefox\Profiles\f2w9ccev.default FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_15_0_0_189.dll () FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_189.dll () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-11-29] FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK Chrome: ======= CHR Profile: C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Docs) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-03-17] CHR Extension: (Google Drive) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-03-17] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-18] CHR Extension: (YouTube) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-03-17] CHR Extension: (Google-Suche) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-03-17] CHR Extension: (Google Wallet) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-02] CHR Extension: (Google Mail) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-03-17] CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-07-04] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-07-04] (AVAST Software) R2 CLHNServiceForPowerDVD12; C:\Program Files (x86)\CyberLink Corp\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe [89864 2013-11-29] (CyberLink Corp.) R2 CxUtilSvc; C:\Program Files\Conexant\SA3\CxUtilSvc.exe [109184 2012-08-06] (Conexant Systems, Inc.) R2 CyberLink PowerDVD 12 Media Server Monitor Service; C:\Program Files (x86)\CyberLink Corp\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [77576 2013-11-29] (CyberLink) R2 CyberLink PowerDVD 12 Media Server Service; C:\Program Files (x86)\CyberLink Corp\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [294664 2013-11-29] (CyberLink) R2 DisplayLinkService; C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe [10571056 2014-07-09] (DisplayLink Corp.) R2 Intel(R) Wireless Bluetooth(R) 4.0 Radio Management; C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe [157128 2013-09-18] (Intel Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation) S3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [44032 2013-08-22] (Microsoft Corporation) S3 lfsvc; C:\Windows\SysWOW64\GeofenceMonitorService.dll [357376 2014-03-14] (Microsoft Corporation) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation) S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272176 2012-07-18] () S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [688640 2014-03-06] (Microsoft Corporation) R2 SftService; C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe [1914728 2012-11-26] (SoftThinks SAS) S3 smphost; C:\Windows\SysWOW64\smphost.dll [11776 2013-08-22] (Microsoft Corporation) S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18944 2013-08-22] (Microsoft Corporation) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation) R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2699568 2012-07-18] (Intel® Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-07-04] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-07-04] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-07-04] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-07-04] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-07-04] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-07-04] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-07-04] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-07-04] () R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation) R3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [140600 2013-07-22] (Motorola Solutions, Inc.) R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1390904 2013-09-05] (Motorola Solutions, Inc.) S3 DellRbtn; C:\Windows\System32\drivers\DellRbtn.sys [10752 2012-08-05] (OSR Open Systems Resources, Inc.) R3 DisplayLinkUsbIo_x64; C:\Windows\system32\DRIVERS\DisplayLinkUsbIo_x64_7.6.56275.0.sys [46384 2014-07-10] () R3 dlusbaudio; C:\Windows\system32\DRIVERS\dlusbaudio_x64.sys [206128 2014-07-09] (DisplayLink Corp.) S3 iscFlash; C:\Users\Besitzer\AppData\Local\Temp\7zS9F37.tmp\iscflashx64.sys [58464 2012-07-12] (Insyde Software) R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2014-10-30] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-10-01] (Malwarebytes Corporation) R3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3345376 2013-09-04] (Intel Corporation) R2 ntk_PowerDVD12; C:\Program Files (x86)\CyberLink Corp\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys [84168 2013-03-15] (Cyberlink Corp.) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation) R2 {73526619-C24F-470B-9BED-53D455FBB5C6}; C:\Program Files (x86)\CyberLink Corp\PowerDVD12\Common\NavFilter\000.fcl [32456 2013-11-29] (CyberLink Corp.) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-10-30 18:35 - 2014-10-30 18:35 - 00018829 _____ () C:\Users\Besitzer\Downloads\FRST.txt 2014-10-30 18:33 - 2014-10-30 18:33 - 00000478 _____ () C:\Users\Besitzer\Downloads\defogger_disable.log 2014-10-30 18:33 - 2014-10-30 18:33 - 00000000 _____ () C:\Users\Besitzer\defogger_reenable 2014-10-30 18:25 - 2014-10-30 18:25 - 00050477 _____ () C:\Users\Besitzer\Downloads\Defogger.exe 2014-10-30 14:58 - 2014-10-30 18:35 - 00000000 ____D () C:\FRST 2014-10-30 12:12 - 2014-10-30 14:54 - 00000000 ____D () C:\ProgramData\HitmanPro 2014-10-30 12:11 - 2014-10-30 12:13 - 11222744 _____ (SurfRight B.V.) C:\Users\Besitzer\Downloads\hitmanpro_x64.exe 2014-10-30 11:58 - 2014-10-30 11:58 - 02209056 _____ () C:\Users\Besitzer\Downloads\avira-eu-cleaner_de.exe 2014-10-30 11:58 - 2014-10-30 11:58 - 00002089 _____ () C:\Users\Besitzer\Desktop\Entfernen des Avira EU-Cleaners.lnk 2014-10-30 11:58 - 2014-10-30 11:58 - 00002033 _____ () C:\Users\Besitzer\Desktop\Avira EU-Cleaner.lnk 2014-10-30 11:35 - 2014-10-30 11:35 - 02113536 _____ (Farbar) C:\Users\Besitzer\Downloads\FRST64.exe 2014-10-28 13:59 - 2014-10-28 13:59 - 00090502 _____ () C:\Users\Besitzer\Downloads\ganon.php 2014-10-28 13:05 - 2014-10-30 18:17 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2014-10-28 13:05 - 2014-10-28 13:05 - 00001120 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-10-28 13:05 - 2014-10-28 13:05 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-10-28 13:05 - 2014-10-28 13:05 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-10-28 13:05 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2014-10-28 13:05 - 2014-10-01 11:11 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys 2014-10-28 13:05 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys 2014-10-28 13:03 - 2014-10-28 13:05 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\Besitzer\Downloads\mbam-setup-2.0.3.1025.exe 2014-10-28 11:50 - 2014-10-28 11:51 - 04714656 _____ (Avira Operations GmbH & Co. KG) C:\Users\Besitzer\Downloads\avira_de_av___ws2015 (1).exe 2014-10-28 11:50 - 2014-10-28 11:50 - 04714656 _____ (Avira Operations GmbH & Co. KG) C:\Users\Besitzer\Downloads\avira_de_av___ws2015.exe 2014-10-28 11:43 - 2014-10-28 11:43 - 00002273 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-10-28 11:43 - 2014-10-28 11:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-10-28 11:39 - 2014-10-28 11:39 - 00880272 _____ (Google Inc.) C:\Users\Besitzer\Downloads\ChromeSetup.exe 2014-10-26 08:36 - 2014-07-09 15:56 - 00435504 _____ (DisplayLink Corp.) C:\WINDOWS\system32\Drivers\dlkmd.sys 2014-10-26 08:36 - 2014-07-09 15:56 - 00018736 _____ (DisplayLink Corp.) C:\WINDOWS\system32\Drivers\dlkmdldr.sys 2014-10-23 08:15 - 2014-10-23 08:15 - 00139416 _____ () C:\Users\Besitzer\Downloads\Bigspirits-Spirituosen-2014-10-23 09-15.xlsx 2014-10-21 14:54 - 2014-10-21 14:55 - 07902238 _____ () C:\Users\Besitzer\Downloads\jquery.mobile-1.4.4.zip 2014-10-21 13:42 - 2014-10-21 13:42 - 00021730 _____ () C:\Users\Besitzer\AppData\Local\recently-used.xbel 2014-10-21 10:56 - 2014-10-21 10:56 - 06126536 _____ (Tim Kosse) C:\Users\Besitzer\Downloads\FileZilla_3.9.0.6_win32-setup.exe 2014-10-19 11:17 - 2014-10-19 11:17 - 00027049 _____ () C:\Users\Besitzer\Downloads\quick_csv_import-2006-08-23.zip 2014-10-16 13:23 - 2014-10-16 13:23 - 00139701 _____ () C:\Users\Besitzer\Downloads\Bigspirits-Spirituosen-2014-10-16 14-23.xlsx 2014-10-15 14:10 - 2014-10-15 14:10 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-10-15 07:26 - 2014-10-16 06:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird 2014-10-15 06:19 - 2014-09-27 23:25 - 04183040 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys 2014-10-15 06:18 - 2014-09-25 23:50 - 13619200 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2014-10-15 06:18 - 2014-09-25 23:46 - 00243200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll 2014-10-15 06:18 - 2014-09-25 23:46 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll 2014-10-15 06:18 - 2014-09-25 23:43 - 11807232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2014-10-15 06:18 - 2014-09-25 23:32 - 02017280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl 2014-10-15 06:18 - 2014-09-25 23:31 - 02108416 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl 2014-10-15 06:18 - 2014-09-19 03:25 - 23631360 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2014-10-15 06:18 - 2014-09-19 02:44 - 17484800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2014-10-15 06:18 - 2014-09-19 02:41 - 02796032 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2014-10-15 06:18 - 2014-09-19 02:40 - 00547328 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll 2014-10-15 06:18 - 2014-09-19 02:38 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll 2014-10-15 06:18 - 2014-09-19 02:36 - 05829632 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2014-10-15 06:18 - 2014-09-19 02:25 - 04201472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2014-10-15 06:18 - 2014-09-19 02:25 - 00758272 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll 2014-10-15 06:18 - 2014-09-19 02:02 - 00454656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll 2014-10-15 06:18 - 2014-09-19 02:00 - 00085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll 2014-10-15 06:18 - 2014-09-19 01:59 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll 2014-10-15 06:18 - 2014-09-19 01:58 - 00289280 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll 2014-10-15 06:18 - 2014-09-19 01:55 - 02187264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2014-10-15 06:18 - 2014-09-19 01:42 - 00731136 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll 2014-10-15 06:18 - 2014-09-19 01:42 - 00710656 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe 2014-10-15 06:18 - 2014-09-19 01:42 - 00363008 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll 2014-10-15 06:18 - 2014-09-19 01:33 - 02309632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2014-10-15 06:18 - 2014-09-19 01:20 - 00607744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll 2014-10-15 06:18 - 2014-09-19 01:20 - 00315904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll 2014-10-15 06:18 - 2014-09-19 01:14 - 01447936 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2014-10-15 06:18 - 2014-09-19 00:59 - 01810944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2014-10-15 06:18 - 2014-09-19 00:59 - 00775168 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll 2014-10-15 06:18 - 2014-09-19 00:53 - 01190400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2014-10-15 06:18 - 2014-09-19 00:52 - 00678400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll 2014-10-15 06:18 - 2014-09-08 04:15 - 00054752 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe 2014-10-15 06:18 - 2014-09-08 02:46 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll 2014-10-15 06:18 - 2014-09-08 02:46 - 00050688 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll 2014-10-15 06:18 - 2014-09-08 01:08 - 00035328 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe 2014-10-15 06:18 - 2014-09-08 01:07 - 00137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll 2014-10-15 06:18 - 2014-09-08 01:05 - 03448320 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll 2014-10-15 06:18 - 2014-09-08 01:04 - 00388608 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll 2014-10-15 06:18 - 2014-09-08 01:04 - 00093696 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll 2014-10-15 06:18 - 2014-09-08 01:03 - 01702400 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll 2014-10-15 06:18 - 2014-09-08 01:03 - 00839680 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll 2014-10-15 06:18 - 2014-09-08 00:59 - 00123904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll 2014-10-15 06:18 - 2014-09-08 00:59 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe 2014-10-15 06:18 - 2014-09-08 00:56 - 00672256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll 2014-10-15 06:18 - 2014-09-08 00:56 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll 2014-10-15 06:18 - 2014-09-04 01:10 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\winbici.dll 2014-10-15 06:18 - 2014-09-04 00:57 - 00921600 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll 2014-10-15 06:18 - 2014-09-04 00:49 - 00626688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll 2014-10-15 06:17 - 2014-09-13 07:29 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\system32\packager.dll 2014-10-15 06:17 - 2014-09-13 06:49 - 00068608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\packager.dll 2014-10-15 06:17 - 2014-09-04 01:12 - 00590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\rastls.dll 2014-10-15 06:17 - 2014-09-04 01:01 - 00514048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rastls.dll 2014-10-15 06:16 - 2014-08-16 05:08 - 21195616 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll 2014-10-15 06:16 - 2014-08-16 05:08 - 01507648 _____ (Microsoft Corporation) C:\WINDOWS\system32\propsys.dll 2014-10-15 06:16 - 2014-08-16 05:01 - 01710184 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll 2014-10-15 06:16 - 2014-08-16 04:58 - 01112512 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll 2014-10-15 06:16 - 2014-08-16 04:57 - 02498880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys 2014-10-15 06:16 - 2014-08-16 04:57 - 00428864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS 2014-10-15 06:16 - 2014-08-16 04:16 - 18722600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll 2014-10-15 06:16 - 2014-08-16 04:16 - 01205976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\propsys.dll 2014-10-15 06:16 - 2014-08-16 04:03 - 01467384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll 2014-10-15 06:16 - 2014-08-16 02:31 - 00838144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll 2014-10-15 06:16 - 2014-08-16 02:04 - 00359424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wldap32.dll 2014-10-15 06:16 - 2014-08-16 01:58 - 00287744 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemEventsBrokerServer.dll 2014-10-15 06:16 - 2014-08-16 01:53 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\httpprxm.dll 2014-10-15 06:16 - 2014-08-16 01:46 - 00290816 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProximityService.dll 2014-10-15 06:16 - 2014-08-16 01:45 - 00267776 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll 2014-10-15 06:16 - 2014-08-16 01:43 - 00321024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Wldap32.dll 2014-10-15 06:16 - 2014-08-16 01:43 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\adhsvc.dll 2014-10-15 06:16 - 2014-08-16 01:31 - 00914432 _____ (Microsoft Corporation) C:\WINDOWS\system32\iphlpsvc.dll 2014-10-15 06:16 - 2014-08-16 01:31 - 00286208 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcsvDevice.dll 2014-10-15 06:16 - 2014-08-16 01:29 - 00249344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll 2014-10-15 06:16 - 2014-08-16 01:23 - 01106432 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchFolder.dll 2014-10-15 06:16 - 2014-08-16 01:22 - 00717824 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDriveTelemetry.dll 2014-10-15 06:16 - 2014-08-16 01:22 - 00286208 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDriveShell.dll 2014-10-15 06:16 - 2014-08-16 01:19 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll 2014-10-15 06:16 - 2014-08-16 01:18 - 04758528 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncEngine.dll 2014-10-15 06:16 - 2014-08-16 01:17 - 08757760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll 2014-10-15 06:16 - 2014-08-16 01:14 - 00265216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SkyDriveShell.dll 2014-10-15 06:16 - 2014-08-16 01:13 - 06649344 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll 2014-10-15 06:16 - 2014-08-16 01:13 - 05902848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll 2014-10-15 06:16 - 2014-08-16 01:13 - 00840192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchFolder.dll 2014-10-15 06:16 - 2014-08-16 01:11 - 00920064 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll 2014-10-15 06:16 - 2014-08-16 01:10 - 01120768 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDrive.exe 2014-10-15 06:16 - 2014-08-16 01:08 - 05777408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll 2014-10-15 06:16 - 2014-08-16 01:07 - 00756224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll 2014-10-15 06:16 - 2014-08-01 00:22 - 00388729 _____ () C:\WINDOWS\system32\ApnDatabase.xml 2014-10-15 06:14 - 2014-10-09 23:16 - 00678400 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll 2014-10-15 06:14 - 2014-10-08 23:09 - 00275968 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll 2014-10-15 06:14 - 2014-09-19 02:24 - 00527360 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll 2014-10-15 06:14 - 2014-09-13 07:02 - 02779648 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll 2014-10-15 06:14 - 2014-09-13 06:30 - 03117568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll 2014-10-15 06:14 - 2014-08-29 02:58 - 00109568 _____ (Microsoft Corporation) C:\WINDOWS\system32\appinfo.dll 2014-10-15 06:14 - 2014-08-29 00:56 - 02646016 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll 2014-10-15 06:14 - 2014-08-29 00:47 - 02321920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll 2014-10-10 08:12 - 2014-10-10 08:12 - 01615046 _____ () C:\Users\Besitzer\Downloads\jquery-ui-1.10.4.custom (7).zip 2014-10-09 17:38 - 2014-10-09 17:39 - 01616009 _____ () C:\Users\Besitzer\Downloads\jquery-ui-1.10.4.custom (6).zip 2014-10-09 17:21 - 2014-10-09 17:21 - 01596633 _____ () C:\Users\Besitzer\Downloads\jquery-ui-1.10.4.custom (5).zip 2014-10-09 16:28 - 2014-10-09 16:28 - 01596653 _____ () C:\Users\Besitzer\Downloads\jquery-ui-1.10.4.custom (4).zip 2014-10-07 09:41 - 2014-10-07 09:41 - 01504370 _____ () C:\Users\Besitzer\Downloads\jquery-ui-1.10.4.custom (3).zip 2014-10-01 07:30 - 2014-10-01 07:30 - 00609792 _____ () C:\Users\Besitzer\Downloads\taxonomy.de-DE (1).xls ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-10-30 18:33 - 2013-10-30 10:27 - 00000000 ____D () C:\Users\Besitzer 2014-10-30 18:27 - 2013-02-12 18:31 - 00000000 ____D () C:\Users\Besitzer\AppData\Roaming\FileZilla 2014-10-30 18:15 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru 2014-10-30 15:10 - 2013-02-01 16:53 - 00001130 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2014-10-30 15:07 - 2014-08-06 07:21 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2014-10-30 13:44 - 2013-10-30 15:05 - 00003930 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{242FF0FC-02FA-4565-8B40-99CBBE4802A8} 2014-10-30 10:55 - 2013-10-30 10:30 - 01418407 _____ () C:\WINDOWS\WindowsUpdate.log 2014-10-30 09:01 - 2013-03-17 12:39 - 00000000 ____D () C:\Users\Besitzer\.gimp-2.8 2014-10-29 07:10 - 2013-02-01 16:53 - 00001126 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2014-10-29 07:09 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness 2014-10-28 13:48 - 2013-03-17 12:46 - 00000000 ____D () C:\Users\Besitzer\AppData\Local\Eclipse 2014-10-28 13:31 - 2013-09-30 05:14 - 01780340 _____ () C:\WINDOWS\system32\PerfStringBackup.INI 2014-10-28 13:31 - 2013-09-30 04:56 - 00766620 _____ () C:\WINDOWS\system32\perfh007.dat 2014-10-28 13:31 - 2013-09-30 04:56 - 00159902 _____ () C:\WINDOWS\system32\perfc007.dat 2014-10-28 13:29 - 2012-10-09 11:12 - 00000000 ____D () C:\Program Files (x86)\Dell Backup and Recovery 2014-10-28 13:24 - 2013-10-30 13:36 - 00000000 ___DO () C:\Users\Besitzer\SkyDrive 2014-10-28 13:24 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2014-10-28 13:23 - 2013-09-29 20:04 - 00444578 _____ () C:\WINDOWS\PFRO.log 2014-10-28 13:23 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI 2014-10-28 13:23 - 2013-02-01 17:56 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-10-28 13:23 - 2012-10-09 11:14 - 00000000 ____D () C:\WINDOWS\de 2014-10-28 12:12 - 2013-02-01 13:24 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2663191920-3456297157-3779700049-1001 2014-10-28 11:43 - 2013-02-01 16:53 - 00000000 ____D () C:\Program Files (x86)\Google 2014-10-26 08:40 - 2014-08-06 07:21 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater 2014-10-26 08:36 - 2013-11-11 11:46 - 00000000 ____D () C:\Program Files\DisplayLink Core Software 2014-10-26 08:36 - 2013-08-22 15:46 - 00345631 _____ () C:\WINDOWS\setupact.log 2014-10-26 08:29 - 2013-03-09 09:31 - 00000000 ____D () C:\Users\Besitzer\Documents\PersBackup 2014-10-26 07:02 - 2013-02-12 18:31 - 00002018 _____ () C:\Users\Public\Desktop\FileZilla Client.lnk 2014-10-26 07:02 - 2013-02-12 18:31 - 00000000 ____D () C:\Program Files (x86)\FileZilla FTP Client 2014-10-21 07:19 - 2013-02-27 10:49 - 00015743 _____ () C:\Users\Public\BS-4040.odt 2014-10-21 06:05 - 2013-02-01 16:53 - 00004102 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA 2014-10-21 06:05 - 2013-02-01 16:53 - 00003866 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore 2014-10-16 07:06 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\rescache 2014-10-15 18:18 - 2013-08-22 16:36 - 00000000 ___RD () C:\WINDOWS\ToastData 2014-10-15 18:18 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\WinStore 2014-10-15 18:18 - 2013-08-22 15:44 - 00371584 _____ () C:\WINDOWS\system32\FNTCACHE.DAT 2014-10-15 18:17 - 2014-07-12 09:21 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel 2014-10-15 18:17 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\MediaViewer 2014-10-15 18:17 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\FileManager 2014-10-15 18:17 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\Camera 2014-10-15 07:03 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp 2014-10-15 07:02 - 2013-08-02 07:01 - 00000000 ____D () C:\WINDOWS\system32\MRT 2014-10-15 07:00 - 2013-02-02 14:57 - 103265616 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe Some content of TEMP: ==================== C:\Users\Besitzer\AppData\Local\Temp\DisplayLinkUpdater.exe C:\Users\Besitzer\AppData\Local\Temp\_is1067.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-10-28 13:38 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 30-10-2014
Ran by Besitzer at 2014-10-30 18:35:33
Running from C:\Users\Besitzer\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Digital Editions 2.0 (HKLM-x32\...\Adobe Digital Editions 2.0) (Version: 2.0.1 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.189 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
ALL-INKL WebDisk Version 0.1.6.3 (HKLM\...\{420BEC99-F9B3-446B-85A9-974192AFBEAD}_is1) (Version: 0.1.6.3 - ALL-INKL.COM)
Amazon Browser App (HKLM-x32\...\{0A7D6F3C-F2AB-48ED-BE23-99791BFF87D6}) (Version: 1.0.0.0 - Amazon)
Amazon Kindle (HKCU\...\Amazon Kindle) (Version: - Amazon)
AMD Catalyst Install Manager (HKLM\...\{306823F5-9E3B-6FEA-77B0-C9F9B725D7C4}) (Version: 8.0.881.0 - Advanced Micro Devices, Inc.)
AutoUpdate (HKLM-x32\...\{18D10072035C4515918F7E37EAFAACFC}) (Version: 1.1 - )
avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2021 - AVAST Software)
Brother MFC-465CN (HKLM-x32\...\{88C26226-DC99-4629-B353-3264EE204E6B}) (Version: 1.00 - Brother)
Brother MFL-Pro Suite (HKLM-x32\...\{A3FEC306-FBFF-4B0D-95B9-F9C67C65079E}) (Version: 1.00 - Brother Industries, Ltd.)
calibre 64bit (HKLM\...\{2B73426A-9499-4875-BAE9-8DD729009399}) (Version: 1.47.0 - Kovid Goyal)
Conexant HD Audio (HKLM-x32\...\{F0A37341-D692-11D4-A984-009027EC0A9C}) (Version: 1.0.46.0 - Conexant)
Conexant SmartAudio HD (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.54.40.0 - Conexant)
CSDiff (HKLM-x32\...\{F9C3B51C-DCCC-4916-B08D-A6820D914AC0}) (Version: 5.0 - ComponentSoftware)
CyberLink Media Suite 10 (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dell Backup and Recovery - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 1.0.0.5 - Dell Inc.)
Dell Backup and Recovery (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 1.0.0.5 - Dell Inc.)
Dell Touchpad (HKLM\...\Elantech) (Version: 11.3.5.4 - ELAN Microelectronic Corp.)
DisplayLink Core Software (HKLM\...\{C2FE0D6B-1304-4E02-ACEE-C96E9F4AEECA}) (Version: 7.6.56275.0 - DisplayLink Corp.)
DisplayLink Graphics (HKLM\...\{F8D0059A-CC6D-414F-A36F-FEDAE2588000}) (Version: 7.4.51587.0 - DisplayLink Corp.)
DivX Codec (HKLM-x32\...\{7B63B2922B174135AFC0E1377DD81EC2}) (Version: 6.8.2 - DivX, Inc.)
FileZilla Client 3.9.0.6 (HKLM-x32\...\FileZilla Client) (Version: 3.9.0.6 - Tim Kosse)
Fotogalerie (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
FreeCommander XE (HKLM-x32\...\FreeCommander XE_is1) (Version: Preview - Marek Jasinski)
GIMP 2.8.2 (HKLM\...\GIMP-2_is1) (Version: 2.8.2 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 38.0.2125.111 - Google Inc.)
Google Drive (HKLM-x32\...\{C6640705-7479-4EE5-BC86-879F05F65E74}) (Version: 1.17.7290.4094 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.25.5 - Google Inc.) Hidden
HeidiSQL (HKLM\...\HeidiSQL_is1) (Version: - Ansgar Becker)
HeidiSQL 8.1.0.4558 (HKLM-x32\...\HeidiSQL_is1) (Version: 8.1 - Ansgar Becker)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1008 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3412 - Intel Corporation)
Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (HKLM\...\{89478C31-5CE8-461A-9084-9A0AF059F84F}) (Version: 15.5.0.0344 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{302600C1-6BDF-4FD1-1309-148929CC1385}) (Version: 3.1.1309.0390 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.7.0.1013 - Intel Corporation)
Intel® PROSet/Wireless WiFi-Software (HKLM\...\{99FDAE3B-6905-45A6-8F73-595363AAD3D1}) (Version: 15.05.1000.1411 - Intel Corporation)
Java 7 Update 67 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417067FF}) (Version: 7.0.670 - Oracle)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Microsoft Office (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.6120.5004 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Mozilla Firefox 32.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 24.5.0 - Mozilla)
Mozilla Thunderbird 31.2.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.2.0 (x86 de)) (Version: 31.2.0 - Mozilla)
MSVCRT110_amd64 (Version: 16.4.1108.0727 - Microsoft) Hidden
My Dell (HKLM\...\PC-Doctor for Windows) (Version: 3.4.6422.14 - PC-Doctor, Inc.)
OpenOffice 4.1.0 (HKLM-x32\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)
Personal Backup 5.4 (HKLM\...\Personal Backup 5_is1) (Version: 5.3 - J. Rathlev)
Personal Backup 5.5 (HKLM-x32\...\Personal Backup 5_is1) (Version: 5.3 - J. Rathlev)
Photo Common (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
PowerXpressHybrid (x32 Version: 1.00.0000 - Ihr Firmenname) Hidden
PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden
Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 10.15.017 - Dell Inc.)
Realtek Ethernet Controller All-In-One Windows Driver (HKLM-x32\...\{F7E7F0CB-AA41-4D5A-B6F2-8E6738EB063F}) (Version: 8.2.612.2012 - Realtek)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.39030 - Realtek Semiconductor Corp.)
Screaming Frog SEO Spider (HKLM-x32\...\Screaming Frog SEO Spider) (Version: 2.40 - Screaming Frog Ltd)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Überwachungstool für die Intel® Turbo-Boost-Technik 2.6 (HKLM\...\{6C9365EB-1F9E-4893-9196-3EC77C88D0C5}) (Version: 2.6.2.0 - Intel)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3503.0728 - Microsoft Corporation)
WinMerge 2.14.0 (HKLM-x32\...\WinMerge_is1) (Version: 2.14.0 - Thingamahoochie Software)
XAMPP 1.7.1 (HKLM-x32\...\xampp) (Version: - )
XnView 1.99.6 (HKLM-x32\...\XnView_is1) (Version: 1.99.6 - Gougelet Pierre-e)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
09-10-2014 07:11:15 Geplanter Prüfpunkt
15-10-2014 05:59:59 Windows Update
22-10-2014 09:40:47 Geplanter Prüfpunkt
26-10-2014 07:35:50 Windows Update
30-10-2014 13:53:30 Prüfpunkt von HitmanPro
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {0AC84DB4-6D5A-45E8-AF06-5187BF56B009} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network => Sc.exe start wuauserv
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {113B305E-3CA6-4AAB-8247-B5F1E5389905} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\My Dell\sessionchecker.exe [2013-12-19] (PC-Doctor, Inc.)
Task: {137C9ECE-FDCB-4EEE-B496-2458FE452595} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-10-15] (Microsoft Corporation)
Task: {154AFC45-C036-416F-A0EA-0595DA40EABC} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {1D064B84-2C99-4AFB-80A1-BF65EB8CDC23} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-10-26] (Adobe Systems Incorporated)
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {477D9680-2A65-4746-A166-F8B9542CBCAF} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Management
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {7EE06950-8D6E-4A41-81FF-A51CC35BC2E2} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-07-04] (AVAST Software)
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {8BFD0437-B85C-4AC2-A0C3-14373EDC1F2D} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyUpload
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {A3899944-D402-4F7C-9BB4-971C1EA41410} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-02-01] (Google Inc.)
Task: {B0F1749E-D60A-4FA9-9AC7-52E4321B610F} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics
Task: {C9C5FB2C-A60E-466D-B8AB-1592215BD068} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-02-01] (Google Inc.)
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {E55794D2-A77E-4C1E-933E-B5CC9E512441} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\Windows\system32\cleanmgr.exe [2014-02-22] (Microsoft Corporation)
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: {EF7CE896-FAE8-47DD-83C0-393BE275BD92} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Validation
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2013-11-01 09:43 - 2005-04-22 13:36 - 00143360 _____ () C:\WINDOWS\system32\BrSNMP64.dll
2014-05-01 20:29 - 2014-05-01 20:29 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2012-10-09 10:56 - 2012-07-18 17:03 - 00165024 _____ () C:\Program Files\Conexant\SA3\MaxxAudioWrapper.dll
2013-10-03 23:42 - 2013-10-03 23:42 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 05497856 _____ () C:\xampp\mysql\bin\mysqld.exe
2014-05-21 14:52 - 2014-04-09 12:24 - 00199336 _____ () C:\Program Files\ALL-INKL WebDisk\liblzo2-2.dll
2014-05-21 14:52 - 2014-04-09 12:24 - 00122504 _____ () C:\Program Files\ALL-INKL WebDisk\libpkcs11-helper-1.dll
2014-10-28 11:43 - 2014-10-22 04:32 - 01366856 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\libglesv2.dll
2014-10-28 11:43 - 2014-10-22 04:32 - 00204616 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\libegl.dll
2014-10-28 11:43 - 2014-10-22 04:32 - 10578248 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\pdf.dll
2014-10-28 11:43 - 2014-10-22 04:32 - 01859400 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\ffmpegsumo.dll
2014-10-28 11:43 - 2014-10-22 04:32 - 26714952 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\PepperFlash\pepflashplayer.dll
2014-07-04 15:10 - 2014-07-04 15:10 - 00301152 _____ () C:\Program Files\AVAST Software\Avast\aswProperty.dll
2014-10-28 08:29 - 2014-10-28 08:29 - 02898432 _____ () C:\Program Files\AVAST Software\Avast\defs\14102702\algo.dll
2014-10-28 13:24 - 2014-10-28 13:24 - 02898432 _____ () C:\Program Files\AVAST Software\Avast\defs\14102800\algo.dll
2014-10-30 11:16 - 2014-10-30 11:16 - 02897920 _____ () C:\Program Files\AVAST Software\Avast\defs\14103000\algo.dll
2014-07-04 15:10 - 2014-07-04 15:10 - 19329904 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2014-10-16 06:53 - 2014-10-16 06:53 - 00016384 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PSIClient\2133a50009fa3b357bfbd29a218be0f6\PSIClient.ni.dll
2012-10-09 10:57 - 2012-06-25 06:11 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2014-10-16 10:15 - 2014-10-16 10:15 - 00035328 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll
2014-05-24 17:41 - 2014-05-24 17:41 - 00091648 _____ () C:\Program Files (x86)\FileZilla FTP Client\libgcc_s_sjlj-1.dll
2014-05-24 17:41 - 2014-05-24 17:41 - 00892416 _____ () C:\Program Files (x86)\FileZilla FTP Client\libstdc++-6.dll
2014-10-15 07:26 - 2014-10-15 07:26 - 03339376 _____ () C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll
2014-10-15 07:26 - 2014-10-15 07:26 - 00158832 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll
2014-10-15 07:26 - 2014-10-15 07:26 - 00023152 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll
2013-03-02 13:38 - 2009-08-06 00:00 - 00032768 _____ () C:\xampp\apache\modules\mod_autoindex_color.so
2013-03-02 13:37 - 2009-08-06 00:00 - 00852025 _____ () C:\xampp\perl\bin\perl510.dll
2013-03-02 13:38 - 2009-08-06 00:00 - 00127072 _____ () C:\xampp\apache\modules\mod_perl.so
2013-03-02 13:37 - 2009-08-06 00:00 - 01689600 _____ () C:\xampp\apache\bin\LIBMYSQL.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00020583 _____ () C:\xampp\perl\site\lib\auto\ModPerl\Util\Util.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00041075 _____ () C:\xampp\perl\site\lib\auto\Apache2\RequestRec\RequestRec.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00032881 _____ () C:\xampp\perl\site\lib\auto\Apache2\RequestIO\RequestIO.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00032885 _____ () C:\xampp\perl\site\lib\auto\Apache2\RequestUtil\RequestUtil.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00024677 _____ () C:\xampp\perl\site\lib\auto\Apache2\Log\Log.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00028785 _____ () C:\xampp\perl\site\lib\auto\Apache2\ServerRec\ServerRec.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00024691 _____ () C:\xampp\perl\site\lib\auto\Apache2\ServerUtil\ServerUtil.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00028787 _____ () C:\xampp\perl\site\lib\auto\Apache2\Connection\Connection.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00020585 _____ () C:\xampp\perl\site\lib\auto\Apache2\Const\Const.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00020581 _____ () C:\xampp\perl\site\lib\auto\APR\Const\Const.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00028773 _____ () C:\xampp\perl\site\lib\auto\APR\Table\Table.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00024683 _____ () C:\xampp\perl\site\lib\auto\Apache2\Access\Access.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00024683 _____ () C:\xampp\perl\site\lib\auto\Apache2\Module\Module.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00024687 _____ () C:\xampp\perl\site\lib\auto\Apache2\Response\Response.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00024691 _____ () C:\xampp\perl\site\lib\auto\Apache2\SubRequest\SubRequest.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00028779 _____ () C:\xampp\perl\site\lib\auto\Apache2\Filter\Filter.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00020583 _____ () C:\xampp\perl\site\lib\auto\Apache2\Util\Util.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00020581 _____ () C:\xampp\perl\site\lib\auto\Apache2\URI\URI.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00020579 _____ () C:\xampp\perl\site\lib\auto\APR\Date\Date.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00024675 _____ () C:\xampp\perl\site\lib\auto\APR\Pool\Pool.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00024673 _____ () C:\xampp\perl\site\lib\auto\APR\URI\URI.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00020579 _____ () C:\xampp\perl\site\lib\auto\APR\Util\Util.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00028777 _____ () C:\xampp\perl\site\lib\auto\APR\Brigade\Brigade.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00028775 _____ () C:\xampp\perl\site\lib\auto\APR\Bucket\Bucket.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00024646 _____ () C:\xampp\perl\lib\auto\Fcntl\Fcntl.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00020583 _____ () C:\xampp\perl\site\lib\auto\APR\Status\Status.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00020587 _____ () C:\xampp\perl\site\lib\auto\ModPerl\Global\Global.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00024683 _____ () C:\xampp\perl\lib\auto\Digest\MD5\MD5.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00020579 _____ () C:\xampp\perl\lib\auto\Cwd\Cwd.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00032881 _____ () C:\xampp\perl\lib\auto\Data\Dumper\Dumper.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00024681 _____ () C:\xampp\perl\lib\auto\Time\HiRes\HiRes.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00032846 _____ () C:\xampp\perl\lib\auto\SDBM_File\SDBM_File.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00024666 _____ () C:\xampp\perl\lib\auto\IO\IO.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00028786 _____ () C:\xampp\perl\lib\auto\List\Util\Util.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00024649 _____ () C:\xampp\perl\lib\auto\File\Glob\Glob.dll
2013-03-02 13:37 - 2009-08-06 00:00 - 00106619 _____ () C:\xampp\perl\lib\auto\Compress\Raw\Zlib\Zlib.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\Besitzer\SkyDrive:ms-properties
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\Run32: => "CLMLServer_For_P2G8"
HKLM\...\StartupApproved\Run32: => "CLVirtualDrive"
HKLM\...\StartupApproved\Run32: => "RemoteControl10"
HKLM\...\StartupApproved\Run32: => "InstantBurn"
HKLM\...\StartupApproved\Run32: => "PowerDVD12Agent"
========================= Accounts: ==========================
Administrator (S-1-5-21-2663191920-3456297157-3779700049-500 - Administrator - Enabled) => C:\Users\Administrator
Besitzer (S-1-5-21-2663191920-3456297157-3779700049-1001 - Administrator - Enabled) => C:\Users\Besitzer
Gast (S-1-5-21-2663191920-3456297157-3779700049-501 - Limited - Enabled)
HomeGroupUser$ (S-1-5-21-2663191920-3456297157-3779700049-1003 - Limited - Enabled)
==================== Faulty Device Manager Devices =============
Name: AMD Radeon Hybrid (Blocked)
Description: AMD Radeon Hybrid (Blocked)
Class Guid: {4d36e968-e325-11ce-bfc1-08002be10318}
Manufacturer: Advanced Micro Devices, Inc.
Service: BasicDisplay
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver
==================== Event log errors: =========================
Application errors:
==================
Error: (10/30/2014 06:17:20 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm LiveComm.exe, Version 17.5.9600.20605 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: a58
Startzeit: 01cff44fadfb6f46
Endzeit: 4294967295
Anwendungspfad: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\LiveComm.exe
Berichts-ID: 997a19b6-6058-11e4-bf16-84a6c897f8ff
Vollständiger Name des fehlerhaften Pakets: microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ppleae38af2e007f4358a809ac99a64a67c1
Error: (10/30/2014 03:17:13 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm LiveComm.exe, Version 17.5.9600.20605 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: c74
Startzeit: 01cff44b7d3232a5
Endzeit: 4294967295
Anwendungspfad: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\LiveComm.exe
Berichts-ID: 7066b650-603f-11e4-bf16-84a6c897f8ff
Vollständiger Name des fehlerhaften Pakets: microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ppleae38af2e007f4358a809ac99a64a67c1
Error: (10/30/2014 02:53:30 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {2288e74b-45d4-405e-9d8f-12a351e22b56}
Error: (10/30/2014 02:53:29 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 38.0.2125.111, Zeitstempel: 0x544718dc
Name des fehlerhaften Moduls: chrome.dll, Version: 38.0.2125.111, Zeitstempel: 0x544714b0
Ausnahmecode: 0x80000003
Fehleroffset: 0x000000000005c768
ID des fehlerhaften Prozesses: 0x1b0
Startzeit der fehlerhaften Anwendung: 0xchrome.exe0
Pfad der fehlerhaften Anwendung: chrome.exe1
Pfad des fehlerhaften Moduls: chrome.exe2
Berichtskennung: chrome.exe3
Vollständiger Name des fehlerhaften Pakets: chrome.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: chrome.exe5
Error: (10/30/2014 02:47:13 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm LiveComm.exe, Version 17.5.9600.20605 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 2b30
Startzeit: 01cff4474c4f3f1a
Endzeit: 4294967295
Anwendungspfad: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\LiveComm.exe
Berichts-ID: 3f849b27-603b-11e4-bf16-84a6c897f8ff
Vollständiger Name des fehlerhaften Pakets: microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ppleae38af2e007f4358a809ac99a64a67c1
Error: (10/30/2014 02:17:18 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm LiveComm.exe, Version 17.5.9600.20605 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: f50
Startzeit: 01cff4431b6c5084
Endzeit: 4294967295
Anwendungspfad: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\LiveComm.exe
Berichts-ID: 112c69b0-6037-11e4-bf16-84a6c897f8ff
Vollständiger Name des fehlerhaften Pakets: microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ppleae38af2e007f4358a809ac99a64a67c1
Error: (10/30/2014 01:47:20 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm LiveComm.exe, Version 17.5.9600.20605 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 3ec
Startzeit: 01cff43eea69af0f
Endzeit: 4294967295
Anwendungspfad: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\LiveComm.exe
Berichts-ID: e1bb192d-6032-11e4-bf16-84a6c897f8ff
Vollständiger Name des fehlerhaften Pakets: microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ppleae38af2e007f4358a809ac99a64a67c1
Error: (10/30/2014 01:06:50 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm LiveComm.exe, Version 17.5.9600.20605 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: a28
Startzeit: 01cff43945f4cf4f
Endzeit: 4294967295
Anwendungspfad: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\LiveComm.exe
Berichts-ID: 397b1087-602d-11e4-bf16-84a6c897f8ff
Vollständiger Name des fehlerhaften Pakets: microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ppleae38af2e007f4358a809ac99a64a67c1
Error: (10/30/2014 00:40:27 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm LiveComm.exe, Version 17.5.9600.20605 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 2b7c
Startzeit: 01cff43596a305d9
Endzeit: 4294967295
Anwendungspfad: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\LiveComm.exe
Berichts-ID: 89f20244-6029-11e4-bf16-84a6c897f8ff
Vollständiger Name des fehlerhaften Pakets: microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ppleae38af2e007f4358a809ac99a64a67c1
Error: (10/30/2014 00:17:22 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm LiveComm.exe, Version 17.5.9600.20605 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 2b40
Startzeit: 01cff43257e8ea58
Endzeit: 4294967295
Anwendungspfad: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\LiveComm.exe
Berichts-ID: 4b0fb448-6026-11e4-bf16-84a6c897f8ff
Vollständiger Name des fehlerhaften Pakets: microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ppleae38af2e007f4358a809ac99a64a67c1
System errors:
=============
Error: (10/28/2014 01:29:36 PM) (Source: Service Control Manager) (EventID: 7046) (User: )
Description: Vom folgenden Dienst wurde wiederholt nicht auf Dienststeuerungsanforderungen reagiert: SoftThinks Agent Service
Erkundigen Sie sich beim Diensthersteller oder beim Systemadministrator danach, ob der Dienst deaktiviert werden sollte, bis das Problem gefunden wurde.
Der Computer muss unter Umständen im abgesicherten Modus gestartet werden, um den Dienst deaktivieren zu können.
Error: (10/28/2014 01:29:06 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst SftService erreicht.
Error: (10/28/2014 01:28:36 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst SftService erreicht.
Error: (10/28/2014 01:28:06 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst SftService erreicht.
Error: (10/28/2014 01:27:36 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst SftService erreicht.
Error: (10/28/2014 01:27:06 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst SftService erreicht.
Error: (10/28/2014 01:26:36 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst SftService erreicht.
Error: (10/28/2014 01:26:06 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst SftService erreicht.
Error: (10/28/2014 01:25:36 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst SftService erreicht.
Error: (10/28/2014 01:25:06 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst SftService erreicht.
Microsoft Office Sessions:
=========================
Error: (10/30/2014 06:17:20 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: LiveComm.exe17.5.9600.20605a5801cff44fadfb6f464294967295C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\LiveComm.exe997a19b6-6058-11e4-bf16-84a6c897f8ffmicrosoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbweppleae38af2e007f4358a809ac99a64a67c1
Error: (10/30/2014 03:17:13 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: LiveComm.exe17.5.9600.20605c7401cff44b7d3232a54294967295C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\LiveComm.exe7066b650-603f-11e4-bf16-84a6c897f8ffmicrosoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbweppleae38af2e007f4358a809ac99a64a67c1
Error: (10/30/2014 02:53:30 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Zugriff verweigert
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {2288e74b-45d4-405e-9d8f-12a351e22b56}
Error: (10/30/2014 02:53:29 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: chrome.exe38.0.2125.111544718dcchrome.dll38.0.2125.111544714b080000003000000000005c7681b001cff2ad3379d6b5C:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\chrome.dll206e2bb6-603c-11e4-bf16-84a6c897f8ff
Error: (10/30/2014 02:47:13 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: LiveComm.exe17.5.9600.206052b3001cff4474c4f3f1a4294967295C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\LiveComm.exe3f849b27-603b-11e4-bf16-84a6c897f8ffmicrosoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbweppleae38af2e007f4358a809ac99a64a67c1
Error: (10/30/2014 02:17:18 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: LiveComm.exe17.5.9600.20605f5001cff4431b6c50844294967295C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\LiveComm.exe112c69b0-6037-11e4-bf16-84a6c897f8ffmicrosoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbweppleae38af2e007f4358a809ac99a64a67c1
Error: (10/30/2014 01:47:20 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: LiveComm.exe17.5.9600.206053ec01cff43eea69af0f4294967295C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\LiveComm.exee1bb192d-6032-11e4-bf16-84a6c897f8ffmicrosoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbweppleae38af2e007f4358a809ac99a64a67c1
Error: (10/30/2014 01:06:50 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: LiveComm.exe17.5.9600.20605a2801cff43945f4cf4f4294967295C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\LiveComm.exe397b1087-602d-11e4-bf16-84a6c897f8ffmicrosoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbweppleae38af2e007f4358a809ac99a64a67c1
Error: (10/30/2014 00:40:27 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: LiveComm.exe17.5.9600.206052b7c01cff43596a305d94294967295C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\LiveComm.exe89f20244-6029-11e4-bf16-84a6c897f8ffmicrosoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbweppleae38af2e007f4358a809ac99a64a67c1
Error: (10/30/2014 00:17:22 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: LiveComm.exe17.5.9600.206052b4001cff43257e8ea584294967295C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\LiveComm.exe4b0fb448-6026-11e4-bf16-84a6c897f8ffmicrosoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbweppleae38af2e007f4358a809ac99a64a67c1
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-3632QM CPU @ 2.20GHz
Percentage of memory in use: 28%
Total physical RAM: 16253.27 MB
Available physical RAM: 11641.64 MB
Total Pagefile: 25775.32 MB
Available Pagefile: 19898.19 MB
Total Virtual: 131072 MB
Available Virtual: 131071.84 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:463.94 GB) (Free:212.53 GB) NTFS
Drive i: () (Removable) (Total:0.03 GB) (Free:0.03 GB) FAT
Drive y: (WINRETOOLS) (Fixed) (Total:0.27 GB) (Free:0 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 476.9 GB) (Disk ID: DEE27EE8)
Partition: GPT Partition Type.
========================================================
Disk: 1 (Size: 31 MB) (Disk ID: 6E652072)
No partition Table on disk 1.
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-10-30 18:45:41
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000033 M4-CT512M4SSD2 rev.040H 476,94GB
Running: Gmer-19357.exe; Driver: C:\Users\Besitzer\AppData\Local\Temp\uxldypog.sys
---- Kernel code sections - GMER 2.1 ----
.text C:\WINDOWS\System32\win32k.sys!W32pServiceTable fffff9600019ce00 15 bytes [00, F1, F6, 01, 40, 8F, 6C, ...]
.text C:\WINDOWS\System32\win32k.sys!W32pServiceTable + 16 fffff9600019ce10 11 bytes [00, 6D, FC, FF, 00, A3, C3, ...]
---- User code sections - GMER 2.1 ----
.text C:\WINDOWS\system32\winlogon.exe[792] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165 00007ff95f68553d 1 byte [62]
.text C:\WINDOWS\system32\lsass.exe[800] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165 00007ff95f68553d 1 byte [62]
.text C:\WINDOWS\system32\svchost.exe[916] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165 00007ff95f68553d 1 byte [62]
.text C:\WINDOWS\system32\svchost.exe[992] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165 00007ff95f68553d 1 byte [62]
.text C:\WINDOWS\system32\svchost.exe[656] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165 00007ff95f68553d 1 byte [62]
.text C:\WINDOWS\system32\svchost.exe[572] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165 00007ff95f68553d 1 byte [62]
.text C:\WINDOWS\System32\svchost.exe[344] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165 00007ff95f68553d 1 byte [62]
.text C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe[1092] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165 00007ff95f68553d 1 byte [62]
.text C:\WINDOWS\system32\svchost.exe[1264] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165 00007ff95f68553d 1 byte [62]
.text C:\WINDOWS\system32\WLANExt.exe[1368] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165 00007ff95f68553d 1 byte [62]
.text C:\WINDOWS\System32\spoolsv.exe[1648] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165 00007ff95f68553d 1 byte [62]
.text C:\WINDOWS\system32\svchost.exe[1708] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165 00007ff95f68553d 1 byte [62]
.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1660] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165 00007ff95f68553d 1 byte [62]
.text C:\WINDOWS\system32\dashost.exe[1756] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165 00007ff95f68553d 1 byte [62]
.text C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe[2664] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165 00007ff95f68553d 1 byte [62]
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3056] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165 00007ff95f68553d 1 byte [62]
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3240] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165 00007ff95f68553d 1 byte [62]
.text C:\WINDOWS\Explorer.EXE[4604] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165 00007ff95f68553d 1 byte [62]
.text C:\WINDOWS\Explorer.EXE[4604] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff95fc3169a 4 bytes [C3, 5F, F9, 7F]
.text C:\WINDOWS\Explorer.EXE[4604] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff95fc316a2 4 bytes [C3, 5F, F9, 7F]
.text C:\WINDOWS\Explorer.EXE[4604] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff95fc3181a 4 bytes [C3, 5F, F9, 7F]
.text C:\WINDOWS\Explorer.EXE[4604] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff95fc31832 4 bytes [C3, 5F, F9, 7F]
.text C:\WINDOWS\system32\SearchIndexer.exe[4408] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165 00007ff95f68553d 1 byte [62]
.text C:\Windows\System32\SettingSyncHost.exe[5412] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165 00007ff95f68553d 1 byte [62]
.text C:\Program Files\Conexant\SA3\SmartAudio3.exe[4792] C:\WINDOWS\system32\KERNEL32.dll!GetBinaryTypeW + 165 00007ff95f68553d 1 byte [62]
.text C:\WINDOWS\system32\igfxsrvc.exe[1124] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165 00007ff95f68553d 1 byte [62]
.text C:\Windows\System32\igfxpers.exe[5764] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165 00007ff95f68553d 1 byte [62]
.text C:\Windows\System32\rundll32.exe[5204] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165 00007ff95f68553d 1 byte [62]
.text C:\WINDOWS\system32\taskhost.exe[7948] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165 00007ff95f68553d 1 byte [62]
.text C:\Program Files\ALL-INKL WebDisk\ALL-INKL WebDisk.exe[11240] C:\WINDOWS\system32\KERNEL32.dll!GetBinaryTypeW + 165 00007ff95f68553d 1 byte [62]
.text C:\Program Files\ALL-INKL WebDisk\openvpn.exe[8236] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165 00007ff95f68553d 1 byte [62]
.text C:\WINDOWS\system32\conhost.exe[3632] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165 00007ff95f68553d 1 byte [62]
.text C:\WINDOWS\system32\taskhost.exe[9688] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165 00007ff95f68553d 1 byte [62]
.text C:\WINDOWS\system32\AUDIODG.EXE[6348] C:\WINDOWS\SYSTEM32\KERNEL32.DLL!GetBinaryTypeW + 165 00007ff95f68553d 1 byte [62]
---- Threads - GMER 2.1 ----
Thread C:\WINDOWS\system32\csrss.exe [720:1964] fffff960009cbb90
Thread C:\WINDOWS\system32\csrss.exe [720:1968] fffff960009cbb90
Thread C:\WINDOWS\system32\csrss.exe [720:1972] fffff960009cbb90
Thread C:\WINDOWS\Explorer.EXE [4604:8136] 00007ff952dcd73c
Thread C:\WINDOWS\Explorer.EXE [4604:8728] 00007ff9539cd73c
Thread C:\WINDOWS\SysWOW64\explorer.exe [6204:6608] 0000000001126b7c
Thread C:\WINDOWS\SysWOW64\explorer.exe [6204:6228] 00000000011172d8
Thread C:\WINDOWS\SysWOW64\explorer.exe [6204:7136] 00000000011269a8
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 28.10.2014 Scan Time: 13:11:38 Logfile: malwarebytes.log Administrator: Yes Version: 2.00.3.1025 Malware Database: v2014.10.28.02 Rootkit Database: v2014.10.22.01 License: Trial Malware Protection: Enabled Malicious Website Protection: Enabled Self-protection: Disabled OS: Windows 8.1 CPU: x64 File System: NTFS User: Besitzer Scan Type: Threat Scan Result: Completed Objects Scanned: 456691 Time Elapsed: 7 min, 54 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 1 PUP.Optional.Softonic.A, HKU\S-1-5-21-2663191920-3456297157-3779700049-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Universal Downloader, Quarantined, [a56d01191d5ff73f729c4506e61dd42c], Registry Values: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Folders: 0 (No malicious items detected) Files: 4 Trojan.FakeMS, C:\Users\Besitzer\AppData\Local\Temp\verfügungen_sg_28.10.2014__docx.zip, Quarantined, [ce44e832215b53e36f38cc038a77768a], PUP.Optional.Softonic, C:\Users\Besitzer\Downloads\SoftonicDownloader_fuer_vlc-media-player-nightly.exe, Quarantined, [868c31e95527f2440a2c6dae71900df3], PUP.Optional.Softonic, C:\Users\Besitzer\Downloads\SoftonicDownloader_fuer_vso-media-player.exe, Quarantined, [52c0100a6913eb4b191d3eddc23f6997], Trojan.FakeMS, C:\Users\Besitzer\Downloads\verfügungen_sg_28.10.2014__docx.zip, Quarantined, [50c260ba077544f2a40325aa5aa7d030], Physical Sectors: 0 (No malicious items detected) (end) Viele liebe Grüße Christian |
| Themen zu urlzone2 Infektion Meldung von abuse telekom |
| besitzer, fehlercode 0x80000003, fehlercode 0x80070057, fehlercode 0xc0000005, fehlercode 31, livecomm.exe, pup.optional.softonic, pup.optional.softonic.a, required, trojan.fakems, win32/cnetinstaller.b, win32/hiddenstart.a, win32/softonicdownloader.e, windowsapps, wscript.exe |
Baum-Darstellung