| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Windows 7 - Desktop ist Schwarz und nur der "Arbeitsplatz" ist geöffnetWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
15.12.2014, 20:50
| #1 |
| |  Windows 7 - Desktop ist Schwarz und nur der "Arbeitsplatz" ist geöffnet Hallo zusammen, ich habe das Problem, dass von jetzt auf dann der Desktop "verschwunden" ist und nur ein schwarzer Hintergrund sichtbar ist und der "Arbeitsplatz" geöffnet ist. Von hier aus kann ich zwar so gut wie alles machen, wie z.B. ins Internet gehen, diverse Programme öffnen, neue Programme installieren,... Aber es wird z.B. meine externe Festplatte nicht angezeigt, obwohl sie angesteckt ist und ich kann beim hochfahren zwar versuchen den PC über einen Recovery CD zu booten, aber die Tastatur wird nicht angenommen und dann komme ich nicht weiter. Hab schon Microsoft Security Essentials heruntergeladen und den Fund "HackTool:Win32/Keygen", aber auch nach dem Entfernen hat sich nichts geändert. Kann mir bitte jemand helfen? Bin mit meinem Latein am Ende... DANKE! lg, Sarah Hab FRST ausgeführt. Hier die Datei "Addition" Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 14-12-2014 01
Ran by Sarah at 2014-12-15 20:18:33
Running from C:\Users\Sarah\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Reader XI (11.0.09) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Alt WAV MP3 WMA OGG Converter 7.3 (HKLM\...\Alt WAV MP3 WMA OGG Converter 7.3_is1) (Version: 7.3 - Nesoft Inc.)
Apple Application Support (HKLM\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{235EBB33-3DA1-46DF-AADE-9955123409CB}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
AudibleManager (HKLM\...\AudibleManager) (Version: 1244580.2001686661.2004467941.32 - Audible, Inc.)
AudioCon (HKLM\...\AudioCon) (Version: 1.0 - Basement Softworks)
Audiograbber 1.83 SE (HKLM\...\Audiograbber) (Version: 1.83 SE - Audiograbber Deutschland)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
Boot Camp-Dienste (HKLM\...\{B56ACF7B-D7B5-442B-8E1D-6B41347D88B2}) (Version: 3.3.2921 - Apple Inc.)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.4954 - CDBurnerXP)
CloneCD (HKLM\...\CloneCD) (Version: - Elaborate Bytes)
Cool Edit Pro 2.1 (HKLM\...\Cool Edit Pro 2.1) (Version: - )
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
DealPly (HKU\.DEFAULT\...\DealPly) (Version: - ) <==== ATTENTION
Digital Rowing RowPro (HKLM\...\{2A290549-4638-4E74-BF42-22F9DBB93B4E}) (Version: 2.011.0000 - Digital Rowing)
Dream Aquarium (HKLM\...\DreamAqua) (Version: - )
Dropbox (HKU\S-1-5-21-228080255-764624864-3776522250-1000\...\Dropbox) (Version: 1.6.16 - Dropbox, Inc.)
Free CD Ripper V2.0 (HKLM\...\Free CD Ripper_is1) (Version: 2.0.0.0 - Koyote Soft)
Free HTML5 Video Player and Converter version 5.0.20.1031 (HKLM\...\Free HTML5 Video Player and Converter_is1) (Version: 5.0.20.1031 - DVDVideoSoft Ltd.)
Free Video Converter V 3.2 (HKLM\...\Free Video Converter_is1) (Version: 3.2.0.0 - Koyote Soft)
Free YouTube Download version 3.1.40.1031 (HKLM\...\Free YouTube Download_is1) (Version: 3.1.40.1031 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.12.41.623 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.41.623 - DVDVideoSoft Ltd.)
FreePDF (Remove only) (HKLM\...\FreePDF_XP) (Version: - )
FreeRIP 3.92 (HKLM\...\{501451DE-5808-4599-B544-8BD0915B6B24}_is1) (Version: 3.92 - GreenTree Applications SRL)
Google Earth Plug-in (HKLM\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.04) (Version: 9.04 - Artifex Software Inc.)
HappyFoto-Designer 4.5 (HKLM\...\HappyFoto-Designer_is1) (Version: - )
HOFER Bestellsoftware 4.12.1 (HKLM\...\HOFER Bestellsoftware) (Version: 4.12.1 - ORWO Net)
iCloud (HKLM\...\{AC6EE263-E4DD-4150-9014-689B1D4A3315}) (Version: 4.0.5.20 - Apple Inc.)
iTunes (HKLM\...\{5D928931-D1D2-4A93-A82D-BF60D0E7CFA5}) (Version: 12.0.1.26 - Apple Inc.)
Java 7 Update 71 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle)
Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LG Bluetooth Drivers (HKLM\...\{AC7EE5F1-0DE4-4256-8E43-92B73C8E6019}) (Version: 1.1 - LG Electronics)
LG United Mobile Driver (HKLM\...\{2A3A4BD6-6CE0-4E2A-80D2-1D0FF6ACBFBA}) (Version: 3.8.1 - LG Electronics)
Macromedia Fireworks MX (HKLM\...\{930B2432-43D4-11D5-9871-00C04F8EEB39}) (Version: 6 - Macromedia)
Magic DVD Copier V7.1.0 (HKLM\...\Magic DVD Copier_is1) (Version: - Magic DVD Software, Inc.)
Media Go (HKLM\...\{7A6C3344-5CF9-4B83-959C-6576C5B27D09}) (Version: 2.3.255 - Sony)
Media Go Video Playback Engine 1.96.113.08260 (HKLM\...\{065DBB54-6E55-A609-2E1E-F0617E827D53}) (Version: 1.96.113.08260 - Sony)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM\...\{95140000-0080-0407-0000-0000000FF1CE}) (Version: 14.0.6106.5001 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 34.0.5 (x86 de) (HKLM\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MP3 Cut 5.2.1 (HKLM\...\1A455290-CCE1-400A-B40C-BA562A3804F5_is1) (Version: - Accmeware Corporation)
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser and SDK (HKLM\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
MyFreeCodec (HKU\S-1-5-21-228080255-764624864-3776522250-1000\...\MyFreeCodec) (Version: - )
office Convert Pdf to Jpg Jpeg Tiff Free 6.5 (HKLM\...\office Convert Pdf to Jpg Jpeg Tiff Free_is1) (Version: - Officeconvert Software, Inc.)
OnlineFotoservice (HKLM\...\OnlineFotoservice) (Version: 5.1.6 - CEWE Stiftung u Co. KGaA)
PlayStation(R)Network Downloader (HKLM\...\{B6659DD8-00A7-4A24-BBFB-C1F6982E5D66}) (Version: 2.07.00849 - Sony Computer Entertainment Inc.)
PlayStation(R)Store (HKLM\...\{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}) (Version: 4.12.6.14870 - Sony Computer Entertainment Inc.)
QuickTime 7 (HKLM\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5936 - Realtek Semiconductor Corp.)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version: - )
Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.1.13105_6 - Samsung Electronics Co., Ltd.)
Samsung Kies (Version: 2.6.1.13105_6 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.43.0 - SAMSUNG Electronics Co., Ltd.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Shape Collage (HKLM\...\ShapeCollage) (Version: - Shape Collage Inc.)
Transcribe! 8.31 (HKLM\...\Transcribe!_is1) (Version: 8.31 - Seventh String Software)
VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)
Windows Driver Package - OMNIKEY (cxbu0wdm) SmartCardReader (10/09/2006 1.1.1.4) (HKLM\...\179D2AC2BC1558CA27C66E9A0888081AB9F73F67) (Version: 10/09/2006 1.1.1.4 - OMNIKEY)
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows-Treiberpaket - Apple Inc. (AppleUSBEthernet) Net (01/11/2008 3.4.3.18) (HKLM\...\AD3493E108434977125BBF78F47699626F8AF64B) (Version: 01/11/2008 3.4.3.18 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. (AppleUSBEthernet) Net (02/01/2008 3.8.3.10) (HKLM\...\07170A155D5587C8782EABA10E94E4127A86F6E4) (Version: 02/01/2008 3.8.3.10 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Bluetooth Enabler (06/27/2007 2.0.0.1) (HKLM\...\5F8BE32FAE3D6BC77B512F7B0624D7B6C8A26EFB) (Version: 06/27/2007 2.0.0.1 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Broadcom Bluetooth (03/01/2010 3.1.0.3) (HKLM\...\5D1F13EEF9A42CC17001EAFFC701D57AF8D13E9D) (Version: 03/01/2010 3.1.0.3 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Broadcom Bluetooth (04/27/2011 4.0.0.1) (HKLM\...\0A8E69CB2299FB82BA54D1D4C0F3B1810146DBAB) (Version: 04/27/2011 4.0.0.1 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Built-in iSight (10/25/2007 2.0.1.0) (HKLM\...\9324ED54E32F5399037F87E076CA01C6CEB92830) (Version: 10/25/2007 2.0.1.0 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Display (01/23/2009 3.0.0.0) (HKLM\...\C5CE3BA75A23622D2140C5D5D0998C07DDC4CF1C) (Version: 01/23/2009 3.0.0.0 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple IR Receiver (02/21/2008 2.0.4.0) (HKLM\...\4D00971668041EDAD7097C5827D1739F03B9E5D7) (Version: 02/21/2008 2.0.4.0 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Keyboard (03/24/2010 3.1.0.3) (HKLM\...\10D2BC6E46256E5119E70339886763898529B437) (Version: 03/24/2010 3.1.0.3 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Keyboard (05/05/2011 4.0.0.1) (HKLM\...\4B114013DDC5858DB929CE55F363AB88CDE1F78C) (Version: 05/05/2011 4.0.0.1 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Multitouch (02/11/2010 3.1.0.0) (HKLM\...\60B5F87397EB801AB1BAB3E940CE0E077830B153) (Version: 02/11/2010 3.1.0.0 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Multitouch (05/05/2011 4.0.0.1) (HKLM\...\44E2556E81BCB991055DD976642491906DD3B8A0) (Version: 05/05/2011 4.0.0.1 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Multitouch (10/05/2010 3.2.0.1) (HKLM\...\AEB482706002E9220FBFB86D4A1D24257F71A3D4) (Version: 10/05/2010 3.2.0.1 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Multitouch Mouse (02/11/2010 3.1.0.0) (HKLM\...\5A9DF61C17938C73DCC75C9B4B3A4DE3C74D38ED) (Version: 02/11/2010 3.1.0.0 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Multitouch Mouse (05/05/2011 4.0.0.1) (HKLM\...\B9491C5C199D7236FCDCB76367922461FADC80C7) (Version: 05/05/2011 4.0.0.1 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Multitouch Mouse (10/05/2010 3.2.0.1) (HKLM\...\A7A7D84907D2DCB34930D77C6BA911E3834C1E34) (Version: 10/05/2010 3.2.0.1 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple ODD (01/17/2008 2.0.2.2) (HKLM\...\B4AC4F962DDC0DD6B71FCF20B8F2F694214FAE69) (Version: 01/17/2008 2.0.2.2 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple ODD (05/17/2010 3.1.0.0) (HKLM\...\2E2B6DCC02509BB8D2629A009DE8B5C3055B6779) (Version: 05/17/2010 3.1.0.0 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple System Device (04/05/2011 3.2.0.8) (HKLM\...\F46F6C2CF86ECDFF2CE25B508923B04E2F23F1CE) (Version: 04/05/2011 3.2.0.8 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Trackpad (07/13/2009 3.0.0.1) (HKLM\...\A0DAD483951AB3046050D68A2A1D8CEB4A7C61EE) (Version: 07/13/2009 3.0.0.1 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Trackpad Enabler (07/13/2009 3.0.0.1) (HKLM\...\111E266FDD1556398EFC13BE47678F96E8497682) (Version: 07/13/2009 3.0.0.1 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Wireless Mouse (06/01/2011 4.0.0.1) (HKLM\...\20CF1F4786CB13A83CD2EC358929609A9B7A205C) (Version: 06/01/2011 4.0.0.1 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Wireless Mouse (11/30/2009 3.0.0.6) (HKLM\...\DE32692B1421420518B0CA8EEDD6DF2A494F279F) (Version: 11/30/2009 3.0.0.6 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Wireless Trackpad (04/12/2010 3.1.0.5) (HKLM\...\E0C32821F1E2CE3EB89C177BEA1AEF6558D681D9) (Version: 04/12/2010 3.1.0.5 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Wireless Trackpad (08/24/2010 3.1.0.7) (HKLM\...\CFC3D985EA69596C8BE0A30313010FCC8CE2C70F) (Version: 08/24/2010 3.1.0.7 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Bluetooth (03/01/2010 3.0.0.5) (HKLM\...\31BC243044B2C02B454ECDA8F5B44427F3754DD0) (Version: 03/01/2010 3.0.0.5 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. System (08/22/2008 2.1.1.1) (HKLM\...\F24CB85E5983448F6319803791DEACED91E6565B) (Version: 08/22/2008 2.1.1.1 - Apple Inc.)
Windows-Treiberpaket - Atheros Communications Inc. (athr) Net (11/18/2009 8.0.0.258) (HKLM\...\950F5FEDF7BEABD19AAE5CEA69570873BE2A99DA) (Version: 11/18/2009 8.0.0.258 - Atheros Communications Inc.)
Windows-Treiberpaket - Broadcom (b57nd60x) Net (02/09/2010 14.0.0.7) (HKLM\...\7EAE7556A4DC36C23D853AB245A429FD075DB0D9) (Version: 02/09/2010 14.0.0.7 - Broadcom)
Windows-Treiberpaket - Broadcom (BCM43XX) Net (08/21/2009 5.60.18.8) (HKLM\...\E9575EA5D430B59D0CFF29323C74D0FBA1898F3B) (Version: 08/21/2009 5.60.18.8 - Broadcom)
Windows-Treiberpaket - Cirrus Logic, Inc. (CirrusFilter) MEDIA (04/28/2010 6.6001.1.25) (HKLM\...\16E9B4B4A3817C38179BF7D6E12774E0432FD558) (Version: 04/28/2010 6.6001.1.25 - Cirrus Logic, Inc.)
Windows-Treiberpaket - Cirrus Logic, Inc. (CirrusFilter) MEDIA (08/16/2010 6.6001.1.26) (HKLM\...\680D5EED614F3F01A9AD4547E9D81CFE9B0E4902) (Version: 08/16/2010 6.6001.1.26 - Cirrus Logic, Inc.)
Windows-Treiberpaket - Intel (e1express) Net (02/06/2008 9.12.17.0) (HKLM\...\B345101E6CC8B2FD9765620B9C7BCD3D7002BE6D) (Version: 02/06/2008 9.12.17.0 - Intel)
Windows-Treiberpaket - Intel (E1G60) Net (01/08/2008 8.3.9.0) (HKLM\...\2AC97D2605162B73D046D68013D1030CB7CFB87E) (Version: 01/08/2008 8.3.9.0 - Intel)
Windows-Treiberpaket - Intel (e1kexpress) Net (07/22/2008 10.3.45.0) (HKLM\...\9747248FCA6A074E791AABC17F527823A8225756) (Version: 07/22/2008 10.3.45.0 - Intel)
Windows-Treiberpaket - Intel (e1qexpress) Net (08/05/2008 10.3.49.0) (HKLM\...\1E934494E1FDB938ED1D9B958D5D5D465A07F06A) (Version: 08/05/2008 10.3.49.0 - Intel)
Windows-Treiberpaket - Intel (e1yexpress) Net (07/16/2008 9.52.10.0) (HKLM\...\065B919FD23D12E588F6E2BFB21F7836E2F0E704) (Version: 07/16/2008 9.52.10.0 - Intel)
Windows-Treiberpaket - Intel Net (02/06/2008 9.12.18.0) (HKLM\...\78C67451B87511098A9A0EC86E75B99B12298F5C) (Version: 02/06/2008 9.12.18.0 - Intel)
Windows-Treiberpaket - Intel Net (06/13/2008 9.52.9.0) (HKLM\...\A06888013552B918232820F81FDBA706F5CAAD39) (Version: 06/13/2008 9.52.9.0 - Intel)
Windows-Treiberpaket - Intel Net (07/22/2008 10.3.45.0) (HKLM\...\675AAC36E980D647C94EAFFB2F929F247E711708) (Version: 07/22/2008 10.3.45.0 - Intel)
Windows-Treiberpaket - Intel Net (08/05/2008 10.3.49.0) (HKLM\...\7BD968405DE73C7E0F8E489DB5A5853A6CCB8D1D) (Version: 08/05/2008 10.3.49.0 - Intel)
Windows-Treiberpaket - Intel Net (11/07/2007 8.10.1.0) (HKLM\...\627745F8E8BB901B043047C3E308B4A76C1194FE) (Version: 11/07/2007 8.10.1.0 - Intel)
Windows-Treiberpaket - Intel System (07/20/2007 1.2.76.0) (HKLM\...\82BE89CA9B7493FA05D2D4D32B415CF07EA08B47) (Version: 07/20/2007 1.2.76.0 - Intel)
Windows-Treiberpaket - Marvell (yukonwlh) Net (03/23/2007 10.12.7.3) (HKLM\...\1D68F7A8B8397256B162B831457A6775BD17F3F4) (Version: 03/23/2007 10.12.7.3 - Marvell)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-228080255-764624864-3776522250-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Sarah\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-228080255-764624864-3776522250-1000_Classes\CLSID\{6fc9af94-39ee-5a57-935c-17c37e34e33b}\InprocServer32 -> C:\Users\Sarah\AppData\Local\Ignite\npOCDM.1.1.4.0.dll No File
CustomCLSID: HKU\S-1-5-21-228080255-764624864-3776522250-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Sarah\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-228080255-764624864-3776522250-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Sarah\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-228080255-764624864-3776522250-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Sarah\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-228080255-764624864-3776522250-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Sarah\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll (Dropbox, Inc.)
==================== Restore Points =========================
02-12-2014 16:50:15 Windows Update
05-12-2014 21:20:27 Windows Update
09-12-2014 17:07:34 Windows Update
11-12-2014 20:48:25 Windows Update
14-12-2014 08:19:35 Dr. Web Security Space installation
14-12-2014 11:23:19 Windows-Sicherung
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {249E25D1-F529-4325-85CE-78B861AA32A8} - \DealPlyUpdate No Task File <==== ATTENTION
Task: {2C056A72-B6CA-4A6E-BD1A-B48660E95BC2} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {325BB7B7-89AD-467D-BF30-0D35231E1BDA} - \DealPly No Task File <==== ATTENTION
Task: {3727462C-0005-4AD2-9E5A-E3ECFC5FCEE1} - System32\Tasks\{07DF2C7E-7707-4159-8AB8-7FF9FF91A53F} => pcalua.exe -a "C:\Users\Sarah\Programme-Dateien\Macromedia MX Suite\keygen_Macromedia_Studio_MX.exe" -d "C:\Users\Sarah\Programme-Dateien\Macromedia MX Suite"
Task: {5C844CC0-83AB-470D-BFF5-C986EB0A5720} - System32\Tasks\{956EE214-1896-4B41-9303-9553CE457B39} => pcalua.exe -a D:\setup.exe -d D:\
Task: {80CB656C-DD25-4AEE-874D-4620CD8A04A1} - System32\Tasks\{C0494223-9D31-4758-A1AE-FC73A18E4EE3} => pcalua.exe -a C:\Users\Roman\Downloads\mp3gain-win-full-1_3_4(1).exe -d "C:\Program Files\Mozilla Firefox"
Task: {8F7B10DA-0725-4201-B350-7A3B3535DC18} - System32\Tasks\{9B312E90-9F39-43B6-AD9A-2D1945FA7C03} => pcalua.exe -a C:\Users\Roman\Desktop\RowProSetup.exe -d C:\Users\Roman\Desktop
Task: {B8F24106-A889-4230-AB54-7FC909676FF6} - System32\Tasks\{B46C5A17-889B-460E-BD15-9A0F8E1355AC} => pcalua.exe -a C:\Users\Sarah\Downloads\ActiveSetupN.exe -d C:\Users\Sarah\Downloads
Task: {BA2E13EA-89EE-468A-BF7B-46F550FFA852} - System32\Tasks\{602B643B-9952-49C9-B3CC-8A761879CD6C} => pcalua.exe -a "C:\Program Files\LG Electronics\LG Bluetooth Drivers\UninstallShld.exe" -d C:\Windows\system32 -c C:\Program Files\LG Electronics\LG Bluetooth Drivers
Task: {BD0BBC9C-4E5A-44B6-96CC-101575077018} - System32\Tasks\{D21F524F-65A9-43F7-9210-26A65A9EB0BB} => pcalua.exe -a G:\SETUP.EXE -d G:\
Task: {BD4DF003-B75D-4A63-8987-C5C30A0CBC45} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-05-23] (Google Inc.)
Task: {E0ADEA19-343C-4C59-8CE0-93CBE7A86B84} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {F70D55AE-0409-49B4-A59F-22F6F1B62EA3} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-05-23] (Google Inc.)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2012-05-22 15:20 - 2010-06-17 20:56 - 00116224 _____ () C:\Windows\System32\redmonnt.dll
2014-02-12 19:58 - 2014-02-12 19:58 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 13:05 - 2014-10-11 13:05 - 01044776 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2011-08-15 17:34 - 2011-08-15 17:34 - 00194432 _____ () C:\Windows\system32\AppleOSSMgr.exe
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2014-12-09 19:35 - 2014-12-09 19:35 - 03758192 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Windows:E97C8CFF37043261
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-228080255-764624864-3776522250-500 - Administrator - Disabled)
Gast (S-1-5-21-228080255-764624864-3776522250-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-228080255-764624864-3776522250-1005 - Limited - Enabled)
Roman (S-1-5-21-228080255-764624864-3776522250-1001 - Administrator - Enabled) => C:\Users\Roman
Sarah (S-1-5-21-228080255-764624864-3776522250-1000 - Administrator - Enabled) => C:\Users\Sarah
==================== Faulty Device Manager Devices =============
Name: Intel(R) 5 Series/3400 Series Chipset Family USB Universal Host Controller - 3B36
Description: Intel(R) 5 Series/3400 Series Chipset Family USB Universal Host Controller - 3B36
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: Intel
Service: usbuhci
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Name: Broadcom NetXtreme Gigabit Ethernet
Description: Broadcom NetXtreme Gigabit Ethernet
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Broadcom
Service: b57nd60x
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Name: Intel(R) 5 Series/3400 Series Chipset Family USB Universal Host Controller - 3B3B
Description: Intel(R) 5 Series/3400 Series Chipset Family USB Universal Host Controller - 3B3B
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: Intel
Service: usbuhci
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Name: ELBY DVD-ROM SCSI CdRom Device
Description: CD-ROM-Laufwerk
Class Guid: {4d36e965-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standard-CD-ROM-Laufwerke)
Service: cdrom
Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)
Resolution: A registry problem was detected.
This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.
Name: Bluetooth-Gerät (PAN)
Description: Bluetooth-Gerät (PAN)
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: BthPan
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (12/15/2014 06:45:56 PM) (Source: System Restore) (EventID: 8200) (User: )
Description: Fehler beim Initiieren der Systemwiederherstellung (Windows Update).
Error: (12/15/2014 04:28:45 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 25094898
Error: (12/15/2014 04:28:45 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 25094898
Error: (12/15/2014 04:28:45 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (12/15/2014 09:30:46 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 15632
Error: (12/15/2014 09:30:46 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 15632
Error: (12/15/2014 09:30:46 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (12/15/2014 06:15:30 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 15553
Error: (12/15/2014 06:15:30 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 15553
Error: (12/15/2014 06:15:30 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
System errors:
=============
Error: (12/15/2014 06:09:16 PM) (Source: Microsoft Antimalware) (EventID: 1119) (User: )
Description: Beim Anwenden von Aktionen auf Schadsoftware und potenziell unerwünschte Software wurde von %Trojan:Win32/Malat60 ein schwerwiegender Fehler festgestellt.
Weitere Informationen finden Sie hier:
%Trojan:Win32/Malat603
Name: Trojan:Win32/Malat
ID: 2147625421
Schweregrad: %Trojan:Win32/Malat600
Kategorie: %Trojan:Win32/Malat602
Pfad: 4.6.0305.02
Ursprung der Erkennung: 4.6.0305.04
Typ der Erkennung: 4.6.0305.08
Quelle der Erkennung: %Trojan:Win32/Malat608
Benutzer: {2949DC02-3CCE-43A6-A863-DA7AA8E64451}9
Prozessname: %Trojan:Win32/Malat609
Aktion: {2949DC02-3CCE-43A6-A863-DA7AA8E64451}1
Aktionsstatus: {2949DC02-3CCE-43A6-A863-DA7AA8E64451}8
Fehlercode: {2949DC02-3CCE-43A6-A863-DA7AA8E64451}3
Fehlerbeschreibung: {2949DC02-3CCE-43A6-A863-DA7AA8E64451}4
Signaturversion: 2014-12-15T15:38:28.245Z1
Modulversion: 2014-12-15T15:38:28.245Z2
Error: (12/15/2014 05:05:38 PM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: NT-AUTORITÄT)
Description: 0x8000002a171\??\Volume{4bbc0f6b-9771-11e1-ac77-806e6f6e6963}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{A8105CFF-00E3-48E2-AC63-B12D29CC1DFC}
Error: (12/15/2014 04:28:54 PM) (Source: Tcpip) (EventID: 4199) (User: )
Description: Das System hat einen Adressenkonflikt der IP-Adresse 10.0.0.1 mit dem Computer mit der
Netzwerkhardwareadresse 50-EA-D6-24-81-F4 ermittelt. Netzwerkvorgänge könnten daher auf diesem
System unterbrochen werden.
Error: (12/14/2014 08:27:47 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Definitionsupdate für Microsoft Security Essentials – KB2310138 (Definition 1.189.2144.0)
Error: (12/14/2014 08:26:51 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 0.0.0.0
Aktualisierungsquelle: %NT-AUTORITÄT59
Aktualisierungsphase: 4.6.0305.00
Quellpfad: 4.6.0305.01
Signaturtyp: %NT-AUTORITÄT602
Aktualisierungstyp: %NT-AUTORITÄT604
Benutzer: NT-AUTORITÄT\SYSTEM
Aktuelle Modulversion: %NT-AUTORITÄT605
Vorherige Modulversion: %NT-AUTORITÄT606
Fehlercode: %NT-AUTORITÄT607
Fehlerbeschreibung: %NT-AUTORITÄT608
Error: (12/14/2014 08:26:42 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion:
Aktualisierungsquelle: %NT-AUTORITÄT15
Aktualisierungsphase: 4.6.0305.00
Quellpfad: 4.6.0305.01
Signaturtyp: %NT-AUTORITÄT602
Aktualisierungstyp: %NT-AUTORITÄT604
Benutzer: NT-AUTORITÄT\SYSTEM
Aktuelle Modulversion: %NT-AUTORITÄT605
Vorherige Modulversion: %NT-AUTORITÄT606
Fehlercode: %NT-AUTORITÄT607
Fehlerbeschreibung: %NT-AUTORITÄT608
Error: (12/14/2014 08:26:42 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion:
Aktualisierungsquelle: %NT-AUTORITÄT15
Aktualisierungsphase: 4.6.0305.00
Quellpfad: 4.6.0305.01
Signaturtyp: %NT-AUTORITÄT602
Aktualisierungstyp: %NT-AUTORITÄT604
Benutzer: NT-AUTORITÄT\SYSTEM
Aktuelle Modulversion: %NT-AUTORITÄT605
Vorherige Modulversion: %NT-AUTORITÄT606
Fehlercode: %NT-AUTORITÄT607
Fehlerbeschreibung: %NT-AUTORITÄT608
Error: (12/14/2014 03:23:54 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (12/14/2014 03:23:54 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1068fdPHost{D3DCB472-7261-43CE-924B-0704BD730D5F}
Error: (12/14/2014 03:23:54 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1068fdPHost{145B4335-FE2A-4927-A040-7C35AD3180EF}
Microsoft Office Sessions:
=========================
Error: (12/15/2014 06:45:56 PM) (Source: System Restore) (EventID: 8200) (User: )
Description: Windows Update0x80070001
Error: (12/15/2014 04:28:45 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 25094898
Error: (12/15/2014 04:28:45 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 25094898
Error: (12/15/2014 04:28:45 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (12/15/2014 09:30:46 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 15632
Error: (12/15/2014 09:30:46 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 15632
Error: (12/15/2014 09:30:46 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (12/15/2014 06:15:30 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 15553
Error: (12/15/2014 06:15:30 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 15553
Error: (12/15/2014 06:15:30 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i3 CPU 540 @ 3.07GHz
Percentage of memory in use: 38%
Total physical RAM: 3061.98 MB
Available physical RAM: 1881.92 MB
Total Pagefile: 6122.25 MB
Available Pagefile: 4713.38 MB
Total Virtual: 2047.88 MB
Available Virtual: 1904.73 MB
==================== Drives ================================
Drive c: (BOOTCAMP) (Fixed) (Total:300.6 GB) (Free:129.8 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (KRD10) (CDROM) (Total:0.29 GB) (Free:0 GB) CDFS
Drive e: (Ohne Titel) (Fixed) (Total:164.84 GB) (Free:61.17 GB) HFS
Drive g: (Elements) (Fixed) (Total:931.51 GB) (Free:157.86 GB) NTFS
Drive i: (KINGSTON) (Removable) (Total:7.45 GB) (Free:7.16 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 81F681F6)
Partition: GPT Partition Type.
Partition 2: (Not Active) - (Size=164.8 GB) - (Type=AF)
Partition 3: (Active) - (Size=300.6 GB) - (Type=07 NTFS)
========================================================
Disk: 2 (MBR Code: Windows XP) (Size: 931.5 GB) (Disk ID: 00056EF3)
Partition 1: (Active) - (Size=931.5 GB) - (Type=07 NTFS)
========================================================
Disk: 3 (Size: 7.5 GB) (Disk ID: 082763E9)
Partition 1: (Active) - (Size=7.5 GB) - (Type=0B)
==================== End Of Log ============================
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 14-12-2014 01
Ran by Sarah (administrator) on SARAH-PC on 15-12-2014 20:18:00
Running from C:\Users\Sarah\Downloads
Loaded Profile: Sarah (Available profiles: Sarah & Roman)
Platform: Microsoft Windows 7 Ultimate Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Windows\System32\AppleOSSMgr.exe
(Apple Inc.) C:\Windows\System32\AppleTimeSrv.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Apple_KbdMgr] => C:\Program Files\Boot Camp\Bootcamp.exe [526208 2011-08-15] (Apple Inc.)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [KiesTrayAgent] => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311616 2014-04-23] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [FreePDF Assistant] => C:\Program Files\FreePDF_XP\fpassist.exe [371200 2011-02-23] (shbox.de)
HKLM\...\Run: [CloneCDTray] => C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe [73728 2002-12-02] (Elaborate Bytes AG)
HKLM\...\Run: [CloneCDElbyCDFL] => C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe [45056 2002-11-02] (Elaborate Bytes AG)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-09-12] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [974432 2014-08-22] (Microsoft Corporation)
HKU\S-1-5-21-228080255-764624864-3776522250-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [354304 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-228080255-764624864-3776522250-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1564992 2014-04-23] (Samsung)
HKU\S-1-5-21-228080255-764624864-3776522250-1000\...\Run: [KiesAirMessage] => C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup
HKU\S-1-5-21-228080255-764624864-3776522250-1000\...\RunOnce: [Dr.Web Setup] => C:\Users\Sarah\Desktop\drweb-1000-win-space.exe [305170808 2014-12-14] (Doctor Web, Ltd.)
HKU\S-1-5-21-228080255-764624864-3776522250-1000\...\MountPoints2: {0be74601-4f4e-11e3-849f-c42c0331ae6e} - G:\LGAutoRun.exe
HKU\S-1-5-21-228080255-764624864-3776522250-1000\...\MountPoints2: {d1bfc0f2-50e2-11e2-8b0f-8e3ab69467ee} - G:\DPFMate.exe
HKU\S-1-5-21-228080255-764624864-3776522250-1000\...\MountPoints2: {dbd853d1-9b03-11e3-8627-bf3f0d447aed} - H:\ting.exe
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Sarah\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Sarah\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Sarah\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKU\S-1-5-21-228080255-764624864-3776522250-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.search.ask.com/?o=APN10649A&gct=hp&d=414-135&v=a13350-397&t=4
HKU\S-1-5-21-228080255-764624864-3776522250-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://at.msn.com/?ocid=iehp
SearchScopes: HKLM -> DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2412} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=412&sr=0&q={searchTerms}
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2412} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=412&sr=0&q={searchTerms}
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2414} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=135&systemid=414&v=a13350-397&apn_uid=3702104207414041&apn_dtid=BND414&o=APN10649&apn_ptnrs=AGA&q={searchTerms}
SearchScopes: HKU\S-1-5-21-228080255-764624864-3776522250-1000 -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =
SearchScopes: HKU\S-1-5-21-228080255-764624864-3776522250-1000 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2414} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=135&systemid=414&v=a13350-397&apn_uid=3702104207414041&apn_dtid=BND414&o=APN10649&apn_ptnrs=AGA&q={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: DVDVideoSoft WebPageAdjuster Class -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll No File
Winsock: Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138
FireFox:
========
FF ProfilePath: C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\41lpefd9.default
FF NewTab: https://safesearch.avira.com
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Ask.com
FF Homepage: www.google.at
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll No File
FF Plugin: @playstation.com/PsndlCheck,version=1.00 -> C:\Program Files\Sony\PLAYSTATION Network Downloader\nppsndl.dll (Sony Computer Entertainment Inc.)
FF Plugin: @SonyCreativeSoftware.com/Media Go,version=1.0 -> C:\Program Files\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-228080255-764624864-3776522250-1000: opencandy.com/Ignite -> C:\Users\Sarah\AppData\Local\Ignite\npOCDM.1.1.4.0.dll No File
FF user.js: detected! => C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\41lpefd9.default\user.js
FF SearchPlugin: C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\41lpefd9.default\searchplugins\Ask.xml
FF SearchPlugin: C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\41lpefd9.default\searchplugins\avira-safesearch.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\Ask.xml
FF Extension: Avira Browser Safety - C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\41lpefd9.default\Extensions\abs@avira.com [2014-12-11]
FF Extension: Avira SafeSearch - C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\41lpefd9.default\Extensions\safesearch@avira.com [2014-12-04]
FF HKLM\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AppleOSSMgr; C:\Windows\system32\AppleOSSMgr.exe [194432 2011-08-15] ()
R2 AppleTimeSrv; C:\Windows\system32\AppleTimeSrv.exe [99640 2010-10-06] (Apple Inc.)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22192 2014-08-22] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [288120 2014-08-22] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag.sys [23040 2012-07-03] (LG Electronics Inc.)
S3 AndNetDiag2; C:\Windows\System32\DRIVERS\lgandnetdiag2.sys [23040 2012-07-03] (LG Electronics Inc.)
S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem.sys [27776 2012-07-03] (LG Electronics Inc.)
S3 andnetndis; C:\Windows\System32\DRIVERS\lgandnetndis.sys [73728 2012-07-04] (LG Electronics Inc.)
R3 applebmt; C:\Windows\System32\DRIVERS\applebmt.sys [34304 2011-06-02] (Apple Inc.)
R3 AppleBtBc; C:\Windows\System32\DRIVERS\AppleBtBc.sys [18944 2011-06-28] (Apple Inc.)
R0 AppleHFS; C:\Windows\system32\Drivers\AppleHFS.sys [58200 2011-08-15] (Apple Inc.)
R0 AppleMNT; C:\Windows\system32\Drivers\AppleMNT.sys [15320 2011-08-15] (Apple Inc.)
R3 applewtp; C:\Windows\System32\DRIVERS\applewtp.sys [37888 2010-10-14] (Apple Inc.)
S3 ASPI; C:\Windows\System32\DRIVERS\ASPI32.sys [84832 2002-07-17] (Adaptec) [File not signed]
R3 CirrusFilter; C:\Windows\System32\DRIVERS\CS420x86.sys [14336 2010-10-14] (Cirrus Logic)
R3 ElbyCDFL; C:\Windows\System32\Drivers\ElbyCDFL.sys [15360 2002-11-28] (Elaborate Bytes AG) [File not signed]
R2 ElbyCDIO; C:\Windows\System32\Drivers\ElbyCDIO.sys [16320 2002-11-29] (Elaborate Bytes AG) [File not signed]
R0 ElbyVCD; C:\Windows\System32\DRIVERS\ElbyVCD.sys [22016 2002-11-28] (Elaborate Bytes AG) [File not signed]
R3 IRRemoteFlt; C:\Windows\System32\DRIVERS\IRFilter.sys [16512 2010-08-10] (Apple Inc.)
R2 KeyAgent; C:\Windows\system32\drivers\KeyAgent.sys [15064 2011-08-15] (Apple Inc.)
R3 KeyMagic; C:\Windows\System32\DRIVERS\KeyMagic.sys [26624 2011-06-02] (Apple Inc.)
R2 MacHALDriver; C:\Windows\system32\drivers\MacHALDriver.sys [12928 2010-08-05] (Apple Inc.) [File not signed]
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [231800 2014-07-17] (Microsoft Corporation)
S3 lgbusenum; system32\DRIVERS\lgbtbus.sys [X]
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-15 20:18 - 2014-12-15 20:18 - 00013724 _____ () C:\Users\Sarah\Downloads\FRST.txt
2014-12-15 20:17 - 2014-12-15 20:18 - 00000000 ____D () C:\FRST
2014-12-15 20:15 - 2014-12-15 20:17 - 00002154 _____ () C:\Users\Sarah\Desktop\Rkill.txt
2014-12-15 20:15 - 2014-12-15 20:15 - 01940728 _____ (Bleeping Computer, LLC) C:\Users\Sarah\Downloads\rkill.exe
2014-12-15 20:14 - 2014-12-15 20:14 - 01111040 _____ (Farbar) C:\Users\Sarah\Downloads\FRST.exe
2014-12-14 20:42 - 2014-12-14 20:42 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Sarah\Downloads\revosetup95.exe
2014-12-14 20:42 - 2014-12-14 20:42 - 00001230 _____ () C:\Users\Sarah\Desktop\Revo Uninstaller.lnk
2014-12-14 20:42 - 2014-12-14 20:42 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-12-14 20:27 - 2014-12-14 20:28 - 00000000 ____D () C:\Kaspersky Rescue Disk 10.0
2014-12-14 20:17 - 2014-12-14 20:22 - 00002198 _____ () C:\Windows\epplauncher.mif
2014-12-14 20:17 - 2014-12-14 20:17 - 00002125 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2014-12-14 20:17 - 2014-12-14 20:17 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-12-14 20:09 - 2014-12-14 20:10 - 11473216 _____ (Microsoft Corporation) C:\Users\Sarah\Downloads\mseinstall.exe
2014-12-14 20:01 - 2014-12-14 20:01 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-12-14 20:00 - 2014-12-14 20:01 - 03044736 _____ (Enigma Software Group USA, LLC.) C:\Users\Sarah\Downloads\SpyHunter-Installer.exe
2014-12-14 12:05 - 2014-12-14 12:15 - 308701184 _____ () C:\Users\Sarah\Downloads\kav_rescue_10.iso
2014-12-14 09:20 - 2014-12-14 12:01 - 00000000 ____D () C:\Program Files\DrWeb
2014-12-14 09:20 - 2014-12-14 12:01 - 00000000 ____D () C:\Program Files\Common Files\Doctor Web
2014-12-14 09:12 - 2014-12-14 12:01 - 00000000 ____D () C:\ProgramData\Doctor Web
2014-12-14 07:55 - 2014-12-14 07:55 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Sarah\Desktop\mbam-setup-2.0.4.1028.exe
2014-12-14 07:44 - 2014-12-14 07:54 - 305170808 _____ (Doctor Web, Ltd.) C:\Users\Sarah\Desktop\drweb-1000-win-space.exe
2014-12-12 12:47 - 2014-12-14 19:05 - 00000000 ____D () C:\Windows\system32\appraiser
2014-12-11 21:54 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-12-11 16:38 - 2014-12-04 05:38 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2014-12-11 16:38 - 2014-12-04 05:38 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2014-12-11 16:38 - 2014-12-04 05:38 - 00337920 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-12-11 16:38 - 2014-12-04 05:38 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2014-12-11 16:38 - 2014-12-04 05:38 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-12-11 16:38 - 2014-12-04 05:38 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2014-12-11 16:38 - 2014-12-04 05:38 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\aepic(57).dll
2014-12-11 16:38 - 2014-12-04 05:34 - 00873984 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-12-11 16:38 - 2014-12-02 00:28 - 01160872 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2014-12-11 16:38 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-12-11 16:38 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-12-11 16:38 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-12-11 16:38 - 2014-11-22 03:20 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-12-11 16:38 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-12-11 16:38 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-12-11 16:38 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-12-11 16:38 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-12-11 16:38 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-12-11 16:38 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-12-11 16:38 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-12-11 16:38 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-12-11 16:38 - 2014-11-22 02:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-11 16:38 - 2014-11-22 02:55 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-12-11 16:38 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-12-11 16:38 - 2014-11-22 02:48 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-11 16:38 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-12-11 16:38 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-11 16:38 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-12-11 16:38 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-12-11 16:38 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-12-11 16:38 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-12-11 16:38 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-12-11 16:38 - 2014-11-22 02:23 - 00684544 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-12-11 16:38 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-12-11 16:38 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-12-11 16:38 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-12-11 16:38 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-12-11 16:38 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-12-11 16:38 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-12-11 16:38 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-12-11 16:38 - 2014-11-11 02:32 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2014-12-11 16:37 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-12-11 16:37 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2014-12-11 16:36 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-12-11 16:36 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2014-12-11 16:36 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2014-12-11 16:36 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2014-12-11 16:36 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2014-12-09 19:35 - 2014-12-14 19:05 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-11-21 10:05 - 2014-11-21 13:08 - 00008530 _____ () C:\Users\Sarah\Desktop\Glückwunschkarte 8,9 x 17,8 cm, hoch.pcf
2014-11-19 05:48 - 2014-11-11 03:44 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-11-19 05:48 - 2014-11-11 03:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2014-11-19 04:31 - 2014-11-19 04:31 - 01217192 _____ (Microsoft Corporation) C:\Windows\system32\FM20.DLL
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-15 20:15 - 2012-12-22 16:25 - 01895052 _____ () C:\Windows\WindowsUpdate.log
2014-12-15 20:14 - 2012-05-23 06:11 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-12-15 20:09 - 2009-07-14 05:34 - 00026768 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-15 20:09 - 2009-07-14 05:34 - 00026768 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-15 20:02 - 2012-05-23 06:11 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-12-15 20:02 - 2012-02-14 22:11 - 09061642 _____ () C:\Windows\setupact.log
2014-12-15 20:02 - 2010-11-20 22:48 - 00306928 _____ () C:\Windows\PFRO.log
2014-12-15 20:02 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-14 20:13 - 2012-12-22 18:27 - 00000000 ____D () C:\ProgramData\Avira
2014-12-14 20:03 - 2012-12-22 15:29 - 00000000 ____D () C:\Users\Sarah
2014-12-14 19:06 - 2012-12-22 15:29 - 00000000 ____D () C:\Users\Roman
2014-12-14 19:05 - 2014-09-21 12:35 - 00000000 ___RD () C:\Users\Roman\iCloudDrive
2014-12-14 19:05 - 2014-05-06 19:54 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-12-14 19:05 - 2012-05-06 13:52 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-12-14 19:05 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\wfp
2014-12-14 19:05 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-12-14 19:05 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-12-14 19:05 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\rescache
2014-12-14 19:05 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\registration
2014-12-14 19:05 - 2009-07-14 03:37 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-12-14 19:04 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\AppCompat
2014-12-14 19:03 - 2012-12-21 23:01 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-14 15:05 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\LogFiles
2014-12-14 12:22 - 2010-11-20 22:01 - 01629372 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-14 12:00 - 2011-04-12 02:38 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-12-14 09:16 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\security
2014-12-14 09:14 - 2012-05-06 10:36 - 00000000 ___RD () C:\Users\Sarah\Documents\Sonstiges
2014-12-12 16:12 - 2012-06-11 21:00 - 00000000 ____D () C:\Users\Sarah\AppData\Local\FreePDF_XP
2014-12-11 21:56 - 2012-05-06 14:12 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-11 21:52 - 2013-07-23 21:51 - 00000000 ____D () C:\Windows\system32\MRT
2014-12-11 21:49 - 2012-02-14 21:45 - 109818608 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-12-11 11:36 - 2012-05-06 10:30 - 00000000 ____D () C:\Users\Sarah\Documents\Rezepte
2014-11-22 06:54 - 2009-07-14 05:53 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-11-21 21:11 - 2013-05-25 19:33 - 00000000 ____D () C:\Users\Roman\Desktop\Rezepte
2014-11-21 09:44 - 2012-08-16 14:11 - 00000000 ____D () C:\Program Files\HappyFoto-Designer
2014-11-15 18:49 - 2013-12-22 18:40 - 00000143 _____ () C:\Users\Roman\AppData\Roaming\WB.CFG
Some content of TEMP:
====================
C:\Users\Roman\AppData\Local\Temp\avgnt.exe
C:\Users\Roman\AppData\Local\Temp\ICReinstall_DownloadAcceleratorSetup.exe
C:\Users\Roman\AppData\Local\Temp\installhelper.dll
C:\Users\Roman\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Roman\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Roman\AppData\Local\Temp\SRAssetsHelper.dll
C:\Users\Roman\AppData\Local\Temp\wmfdist.exe
C:\Users\Roman\AppData\Local\Temp\{31A0E2B4-C4D5-48DB-81FC-0F404245F6B6}-GoogleEarth-Win-Plugin-7.1.1.1888.exe
C:\Users\Roman\AppData\Local\Temp\{D297E8E2-A38F-49F1-B8A4-C8E786C0119F}-GoogleEarth-Win-Plugin-7.1.1.1888.exe
C:\Users\Roman\AppData\Local\Temp\{DB830A83-ACD5-46AA-B291-DCD514DFB993}-GoogleEarth-Win-Plugin-7.1.1.1888.exe
C:\Users\Roman\AppData\Local\Temp\~convert2180175332858082165.exe
C:\Users\Roman\AppData\Local\Temp\~convert3574605038286609900.exe
C:\Users\Roman\AppData\Local\Temp\~convert7326708653201566604.exe
C:\Users\Roman\AppData\Local\Temp\~convert7622007027701423545.exe
C:\Users\Sarah\AppData\Local\Temp\AskSLib.dll
C:\Users\Sarah\AppData\Local\Temp\avgnt.exe
C:\Users\Sarah\AppData\Local\Temp\BearShare_setup.exe
C:\Users\Sarah\AppData\Local\Temp\ICReinstall_DownloadAcceleratorSetup(1).exe
C:\Users\Sarah\AppData\Local\Temp\jre-7u11-windows-i586-iftw.exe
C:\Users\Sarah\AppData\Local\Temp\jre-7u13-windows-i586-iftw.exe
C:\Users\Sarah\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Sarah\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Sarah\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Sarah\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\Sarah\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe
C:\Users\Sarah\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe
C:\Users\Sarah\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
C:\Users\Sarah\AppData\Local\Temp\SetupDataMngr_BearShare.exe
C:\Users\Sarah\AppData\Local\Temp\tmd_34013198.exe
C:\Users\Sarah\AppData\Local\Temp\uninst1.exe
C:\Users\Sarah\AppData\Local\Temp\vlc-2.0.5-win32.exe
C:\Users\Sarah\AppData\Local\Temp\vlc-2.1.3-win32.exe
C:\Users\Sarah\AppData\Local\Temp\~convert1066666292567318678.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-12-15 16:57
==================== End Of Log ============================
Geändert von schrauber (15.12.2014 um 21:15 Uhr) |
|
15.12.2014, 21:16
| #2 | |
| /// the machine /// TB-Ausbilder    | Windows 7 - Desktop ist Schwarz und nur der "Arbeitsplatz" ist geöffnet hi,
__________________Zitat:
 So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Lade Dir bitte von hier  Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Scan mit Combofix
__________________ |
|
15.12.2014, 21:59
| #3 |
| | Windows 7 - Desktop ist Schwarz und nur der "Arbeitsplatz" ist geöffnet Hi Schrauber,
__________________Danke für deine Antwort! Das Hack Tool wurde unter folgendem Pfad gefunden: c:\users\puplic\downloads\... Den gesamten Pfad kann ich leider nicht kopieren aus Windows Security Essentials. Soll ich ihn abtippen? Es ist aber eine Installationsdatei, welche ich niemals ausgeführt habe! Mit dem Revo Uninstaller habe ich nichts gefunden, was "DealPly" heißt. Und konnte somit auch nichts entfernen! Soll ich jetzt trotzdem mit dem Combofix weitermachen? lg Nochmal wegen Combofix: wie kann ich meine Antivirensoftware sowie Malware/Spyware Scanner deaktivieren, wenn ich keine Taskleiste habe? Gibt es da eine andere Möglichkeit? |
|
16.12.2014, 21:06
| #4 |
| /// the machine /// TB-Ausbilder | Windows 7 - Desktop ist Schwarz und nur der "Arbeitsplatz" ist geöffnet Ja bitte abtippen wenn möglich, dann direkt Combofix. Im Taskmanager den Prozess des AV PRogrammes beenden.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
18.12.2014, 20:54
| #5 |
| | Windows 7 - Desktop ist Schwarz und nur der "Arbeitsplatz" ist geöffnet Das ist der Link (die Datei ist allerdings schon alt und ich habe diese Datei auch nie installiert!): containerfile:C:\Users\Public\Downloads\eMule\Incoming\Microsoft Office 2010 Proffesional Plus x86 + x64 Editions German.iso Combofix habe ich nun 3x probiert. Er warnt mich immer, dass noch Microsoft Security Essentials läuft (Antiviren und Antispyware), obwohl ich alle Prozesse, die auf Virensoftware hinweisen beendet habe. Hab es dann trotzdem gestartet und es ist nie durchgelaufen. Es hat einfach egwig geprüft (auch über Nacht) und aber nie eine txt-Datei erstlellt. Was soll ich denn nun machen??? HILFE!!!! |
|
19.12.2014, 19:32
| #6 | ||
| /// the machine /// TB-Ausbilder | Windows 7 - Desktop ist Schwarz und nur der "Arbeitsplatz" ist geöffnetZitat:
Zitat:
__________________ --> Windows 7 - Desktop ist Schwarz und nur der "Arbeitsplatz" ist geöffnet |
|
| Themen zu Windows 7 - Desktop ist Schwarz und nur der "Arbeitsplatz" ist geöffnet |
| computer, converter, dealply entfernen, downloader, dvdvideosoft ltd., entfernen, fehlercode %nt-autorität607, fehlercode 19, fehlercode 22, fehlercode windows, festplatte, homepage, kaspersky, newtab, security, software, spyhunter, spyhunter entfernen, svchost.exe, tastatur, teredo, this device cannot start. (code10), this device is disabled. (code 22), windows xp |
dann auf 
und dann auf 
. 
Linear-Darstellung
