Liebe Alle,
ich halte mich momentan in Madagaskar auf und scheine mir gestern in einem Hotel einen Virus auf den USB Stick geladen zu haben. Alle Dateien wurden als Shortcut angezeigt. Neue auf den USB-Stick geladene Dateien (später von einem anderen PC aus wurden nicht mehr umgewandelt)
Das Virusprogramm Microsoft Security Essentials hat infizierte Dateien gefunden und anschließend entfernt. Es schien als ob die Dateien (die nicht zwingend gesichert werden müssen) nicht mehr vorhanden waren, ich habe sie dann unter Eigenschaften sichtbar gemacht, sie erscheinen jetzt transparent.
Wie kann ich den Log, den ihr für eure Arbeit braucht, hier posten?

Ist der Virus jetzt gebannt? Sind die beiden PCs, an die ich den USB-Stick gesteckt habe jetzt auch infiziert (hier haben sich bis jetzt die Dateien nicht geändert)

Ich freue mich auf eure Antworten.
Herzlichst Mikki

Hallo und

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!



Zudem bitte auch ein Log mit Farbars Tool machen:

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

• Starte jetzt FRST.
• Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
• Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
• Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

• Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
• Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
• Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
• Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

das programm, dass den Virus auf dem USB-Stick entdeckt hat ist Microsoft Security Essentials. Ich hoffe, dass ich den richtigen Log gefunden habe, da es dazu keine Anleitung gibt. Ich habe den USB-Stick auch in einen anderen Laptop gesteckt, werde jetzt aber erst einmal nur mit einem arbeiten. Muss ich später den anderen Laptop auch bearbeiten?

Category: Worm

Description: This program is dangerous and self-propagates over a network connection.

Recommended action: Remove this software immediately.

Security Essentials detected programs that may compromise your privacy or damage your computer. You can still access the files that these programs use without removing them (not recommended). To access these files, select the Allow action and click Apply actions. If this option is not available, log on as administrator or ask the security administrator for help.

Items: 
file:E:\.lnk
file:E:\BA_Kauert.lnk
file:E:\Bericht-Regionalarzt-zu-Antananarivo.lnk
file:E:\book critic.lnk
file:E:\Dokumente.lnk
file:E:\drucken.lnk
file:E:\fishzbozl.lnk
file:E:\geburtstag.lnk
file:E:\Higher Ground - Stevie Wonder (1973).lnk
file:E:\Kauert_Review.lnk
file:E:\Lister der belegten Seminare und Module.lnk
file:E:\Madagaskar steckt seit 15 Jahren in einer tiefen Depression.lnk
file:E:\madagaskar.lnk
file:E:\masterarbeit 3. idee.lnk
file:E:\MichiHAkorrUli-1.lnk
file:E:\Praktikantenleitfaden-2015.lnk
file:E:\Quasi-Staaten_Kauert.lnk
file:E:\Reisepass_Kauert.lnk
file:E:\studium magdeburg ab ws13.lnk
file:E:\System Volume Information.lnk
file:E:\Transparency International Deutschland.lnk
file:E:\Transparency International Deutschland2.lnk
file:E:\Transparency International Deutschland23.lnk
file:E:\_Michaela.lnk
file:E:\Äthiopien 2015_2016.lnk

Get more information about this item online.
         

Farbar Recovery läuft gerade (ich denke auf dem gesamten (1.) PC, der USB-Stick ist nach wie vor angesteckt. Richtig so?

das ist der frst code


FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:05-03-2016 01
Ran by user (administrator) on USER-BOOK (18-03-2016 14:47:55)
Running from C:\Users\user\Downloads
Loaded Profiles: user (Available Profiles: user)
Platform: Microsoft Windows 7 Starter  Service Pack 1 (X86) Language: English (United States)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Dritek System Inc.) C:\Program Files\Hotkey OSD Driver\hkosdsvis.exe
() C:\Program Files\InternetEverywhere\InternetEverywhere_Service.exe
(Microsoft Corporation) C:\Program Files\Microsoft\BingBar\SeaPort.EXE
() C:\Program Files\MOOV UI\bin\MonServiceUDisk.exe
() C:\Program Files\Join Air\AssistantServices.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe
(Dritek System Inc.) C:\Program Files\Hotkey OSD Driver\HotKeyOSD.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Dritek System Inc.) C:\Program Files\Hotkey OSD Driver\NButilps.exe
(Sentelic Corporation) C:\Program Files\FSP\FspUip.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
() C:\Program Files\Join Air\UIExec.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(© 2015 Microsoft Corporation) C:\Users\user\AppData\Local\Microsoft\BingSvc\BingSvc.exe
() C:\Program Files\InternetEverywhere\InternetEverywhere_Launcher.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.11.292\SSScheduler.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\WINWORD.EXE


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray.exe [495708 2010-06-08] (IDT, Inc.)
HKLM\...\Run: [HotKeyOSD] => C:\Program Files\Hotkey OSD Driver\HotKeyOSD.exe [349776 2010-10-22] (Dritek System Inc.)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-06-08] (Intel Corporation)
HKLM\...\Run: [fspuip] => C:\Program Files\FSP\fspuip.exe [3759104 2010-10-07] (Sentelic Corporation)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [997920 2011-06-16] (Microsoft Corporation)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [UIExec] => C:\Program Files\Join Air\UIExec.exe [153424 2011-08-09] ()
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-12-03] (Adobe Systems Incorporated)
HKLM\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [707496 2014-08-15] (Cisco Systems, Inc.)
HKU\S-1-5-21-2775988421-3821143660-593909798-1000\...\Run: [Facebook Update] => C:\Users\user\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-10-28] (Facebook Inc.)
HKU\S-1-5-21-2775988421-3821143660-593909798-1000\...\Run: [BingSvc] => C:\Users\user\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-04-07] (© 2015 Microsoft Corporation)
HKU\S-1-5-21-2775988421-3821143660-593909798-1000\...\MountPoints2: {0af906da-84b8-11e3-b8fb-8a53805d23aa} - F:\unlock.exe autoplay=true
HKU\S-1-5-21-2775988421-3821143660-593909798-1000\...\MountPoints2: {71ae4ffe-e17f-11e3-91a0-8289a7524698} - E:\.\Setup.exe AUTORUN=1
HKU\S-1-5-21-2775988421-3821143660-593909798-1000\...\MountPoints2: {a3888c69-e1c6-11e3-96f1-979647295bf4} - E:\.\Setup.exe AUTORUN=1
HKU\S-1-5-21-2775988421-3821143660-593909798-1000\...\MountPoints2: {fc8102ad-330e-11e2-a282-047d7b9c086f} - E:\Setup.exe /Auto
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Launcher.lnk [2014-05-22]
ShortcutTarget: Launcher.lnk -> C:\Program Files\InternetEverywhere\InternetEverywhere_Launcher.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2016-03-18]
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.292\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk [2012-12-21]
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: 0.0.0.1	mssplus.mcafee.com
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{2D62EAAB-30CF-4376-BBAD-644BA9B92BDF}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{D02DB38A-12F5-4762-A214-4A45619AF295}: [DhcpNameServer] 80.12.72.7 41.190.236.206

Internet Explorer:
==================
HKU\S-1-5-21-2775988421-3821143660-593909798-1000\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.prolink2u.com
HKU\S-1-5-21-2775988421-3821143660-593909798-1000\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.prolink2u.com
SearchScopes: HKLM -> DefaultScope {A88CE635-28EA-43FF-86CF-D109B9C5D357} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MNMTDF&pc=MANM&src=IE-SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {A88CE635-28EA-43FF-86CF-D109B9C5D357} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MNMTDF&pc=MANM&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2775988421-3821143660-593909798-1000 -> DefaultScope {A88CE635-28EA-43FF-86CF-D109B9C5D357} URL = 
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2013-09-12] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-22] (Microsoft Corp.)
BHO: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files\Windows Live\Companion\companioncore.dll [2010-11-10] (Microsoft Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-10-12] (Microsoft Corporation)
BHO: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files\Microsoft\BingBar\BingExt.dll [2011-03-02] (Microsoft Corporation.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2013-09-12] (Oracle Corporation)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll [2011-03-02] (Microsoft Corporation.)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-10-12] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\upjfjuhi.default-1457417851393
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_19_0_0_185.dll [2015-10-01] ()
FF Plugin: @java.com/DTPlugin,version=10.40.2 -> C:\Windows\system32\npDeployJava1.dll [2013-09-12] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.40.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2013-09-12] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll [2012-03-29] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin: PDF Architect 2 -> C:\Program Files\PDF Architect 2\np-previewer.dll [2014-04-30] (pdfforge GmbH)
FF Plugin HKU\S-1-5-21-2775988421-3821143660-593909798-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\user\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited)
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-10-08]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1433216 2015-10-12] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1773696 2015-10-12] (Microsoft Corporation)
R2 hkosdservice; C:\Program Files\Hotkey OSD Driver\hkosdsvis.exe [231504 2010-10-22] (Dritek System Inc.)
R2 InternetEverywhere_Service; C:\Program Files\InternetEverywhere\InternetEverywhere_Service.exe [346680 2013-05-15] ()
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.292\McCHSvc.exe [239880 2016-02-05] (McAfee, Inc.)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe [11736 2011-04-28] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [208944 2011-04-28] (Microsoft Corporation)
S3 PDF Architect 2; C:\Program Files\PDF Architect 2\ws.exe [1716264 2014-04-30] (pdfforge GmbH)
S3 pdfforge CrashHandler; C:\Program Files\PDF Architect 2\crash-handler-ws.exe [861736 2014-04-30] (pdfforge GmbH)
R2 STacSV; C:\Program Files\IDT\WDM\STacSV.exe [237650 2010-06-08] (IDT, Inc.)
R2 UDisk Monitor; C:\Program Files\MOOV UI\bin\MonServiceUDisk.exe [262144 2009-08-05] () [File not signed]
R2 UI Assistant Service; C:\Program Files\Join Air\AssistantServices.exe [270672 2011-08-09] ()
R2 vpnagent; C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe [563112 2014-08-15] (Cisco Systems, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-14] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 acsock; C:\Windows\System32\DRIVERS\acsock.sys [92528 2014-08-15] (Cisco Systems, Inc.)
S3 huawei_cdcacm; C:\Windows\System32\DRIVERS\ew_jucdcacm.sys [89856 2014-05-22] (Huawei Technologies Co., Ltd.)
S3 huawei_cdcecm; C:\Windows\System32\DRIVERS\ew_jucdcecm.sys [66688 2014-05-22] (Huawei Technologies Co., Ltd.)
S3 huawei_ext_ctrl; C:\Windows\System32\DRIVERS\ew_juextctrl.sys [26624 2014-05-22] (Huawei Technologies Co., Ltd.)
S3 massfilter; C:\Windows\System32\drivers\massfilter.sys [9216 2011-03-26] (MBB Incorporated)
R1 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [165648 2011-04-18] (Microsoft Corporation)
R3 MpNWMon; C:\Windows\System32\DRIVERS\MpNWMon.sys [43392 2011-04-18] (Microsoft Corporation)
S3 orange_zte_cdc_acm; C:\Windows\System32\DRIVERS\orange_zte_cdc_acm.sys [66432 2014-05-22] (ZTE)
S3 orange_zte_cdc_ecm; C:\Windows\System32\DRIVERS\orange_zte_cdc_ecm.sys [32768 2014-05-22] (ZTE)
S3 orange_zte_ecm_enum; C:\Windows\System32\DRIVERS\orange_zte_ecm_enum.sys [44800 2014-05-22] (ZTE)
S3 orange_zte_ecm_enum_filter; C:\Windows\System32\DRIVERS\orange_zte_ecm_enum_filter.sys [44800 2014-05-22] (ZTE)
S3 orange_zte_wcpo; C:\Windows\System32\DRIVERS\orange_zte_wcpo.sys [9600 2014-05-22] (ZTE)
S3 RTL8192Ce; C:\Windows\System32\DRIVERS\rtl8192Ce.sys [984168 2010-07-23] (Realtek Semiconductor Corporation                           )
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva-6.sys [43888 2014-08-15] (Cisco Systems, Inc.)
S3 WYTmtusbser; C:\Windows\System32\DRIVERS\CT_WYTMT_U_USBSER.sys [104704 2009-07-28] (ZTEMT Incorporated)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-03-18 14:47 - 2016-03-18 14:49 - 00014249 _____ C:\Users\user\Downloads\FRST.txt
2016-03-18 14:47 - 2016-03-18 14:47 - 01725440 _____ (Farbar) C:\Users\user\Downloads\FRST.exe
2016-03-18 14:47 - 2016-03-18 14:47 - 00000000 ____D C:\FRST
2016-03-18 11:07 - 2016-03-18 11:08 - 02761608 _____ C:\Users\user\Downloads\UmmyVD-Web-Loader-[148-yt-OEGPgiESXOI].exe
2016-03-18 08:17 - 2016-03-18 08:17 - 00002052 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2016-03-18 08:17 - 2016-03-18 08:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2016-03-17 19:44 - 2016-03-18 08:10 - 00000000 ____D C:\Program Files\Mozilla Firefox
2016-03-17 18:06 - 2016-03-17 18:06 - 00050779 _____ C:\Users\user\Desktop\INDEMNITE_PARTICIPANT session 1YLTP 2016.xlsx
2016-03-08 09:17 - 2016-03-08 09:17 - 00000000 ____D C:\Users\user\Desktop\Anciennes données de Firefox
2016-03-04 16:42 - 2016-03-04 16:43 - 00318792 _____ C:\Windows\Minidump\030416-16723-01.dmp

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-03-18 14:35 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\tracing
2016-03-18 12:29 - 2010-11-21 00:01 - 00782206 _____ C:\Windows\system32\PerfStringBackup.INI
2016-03-18 12:29 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\inf
2016-03-18 11:54 - 2013-10-28 14:49 - 00000924 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2775988421-3821143660-593909798-1000UA.job
2016-03-18 08:18 - 2009-07-14 07:34 - 00020160 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-03-18 08:18 - 2009-07-14 07:34 - 00020160 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-03-18 08:16 - 2015-09-29 09:25 - 00000000 ____D C:\Program Files\McAfee Security Scan
2016-03-18 08:11 - 2009-07-14 07:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-03-18 08:10 - 2013-05-29 09:34 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2016-03-17 19:59 - 2015-09-17 09:42 - 00000000 ____D C:\Users\user\Desktop\11.xx_YLTP_Session7_Economie_17-19sept
2016-03-16 17:32 - 2013-10-28 14:49 - 00000902 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2775988421-3821143660-593909798-1000Core.job
2016-03-08 11:09 - 2012-12-21 08:50 - 00000000 ____D C:\Users\user\AppData\Local\ElevatedDiagnostics
2016-03-08 10:04 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\system32\NDF
2016-03-04 16:42 - 2012-12-06 15:16 - 00000000 ____D C:\Windows\Minidump

==================== Files in the root of some directories =======

2013-05-29 08:20 - 2013-05-29 08:20 - 0000017 _____ () C:\Users\user\AppData\Local\resmon.resmoncfg

Some files in TEMP:
====================
C:\Users\user\AppData\Local\Temp\BSvcProcessor.exe
C:\Users\user\AppData\Local\Temp\BSvcUpdater.exe
C:\Users\user\AppData\Local\Temp\fp_pl_pfs_installer-1.exe
C:\Users\user\AppData\Local\Temp\fp_pl_pfs_installer-2.exe
C:\Users\user\AppData\Local\Temp\fp_pl_pfs_installer-3.exe
C:\Users\user\AppData\Local\Temp\fp_pl_pfs_installer-4.exe
C:\Users\user\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\user\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe
C:\Users\user\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\user\AppData\Local\Temp\jre-7u40-windows-i586-iftw.exe
C:\Users\user\AppData\Local\Temp\SkypeSetup.exe


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-03-08 11:02

==================== End of FRST.txt ============================
         

--- --- ---

--- --- ---

--- --- ---

--- --- ---

und der addition.txt

[CODE]Additional
FRST Logfile:

FRST Logfile:

scan result of Farbar Recovery Scan Tool (x86) Version:05-03-2016 01
Ran by user (2016-03-18 14:50:15)
Running from C:\Users\user\Downloads
Microsoft Windows 7 Starter  Service Pack 1 (X86) (2012-11-20 11:20:51)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-2775988421-3821143660-593909798-500 - Administrator - Disabled)
Guest (S-1-5-21-2775988421-3821143660-593909798-501 - Limited - Disabled)
user (S-1-5-21-2775988421-3821143660-593909798-1000 - Administrator - Enabled) => C:\Users\user

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {108DAC43-C256-20B7-BB05-914135DA5160}
AS: Microsoft Security Essentials (Enabled - Up to date) {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 10 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 10.2.152.32 - Adobe Systems Incorporated)
Adobe Flash Player 19 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 19.0.0.185 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Bing Bar (HKLM\...\{1E03DB52-D5CB-4338-A338-E526DD4D4DB1}) (Version: 7.0.610.0 - Microsoft Corporation)
Cisco AnyConnect Secure Mobility Client  (HKLM\...\Cisco AnyConnect Secure Mobility Client) (Version: 3.1.05182 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (Version: 3.1.05182 - Cisco Systems, Inc.) Hidden
Cisco EAP-FAST Module (HKLM\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Complément Microsoft Enregistrer en tant que PDF ou XPS pour programmes Microsoft Office*2007 (HKLM\...\{90120000-00B2-040C-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
Facebook Video Calling 3.1.0.521 (HKLM\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
Finger Sensing Pad Driver (HKLM\...\{E86906FF-C63D-4EAF-ACE7-5F8D55FBEA9A}) (Version: 8.7.7.4 - Sentelic)
Hotkey OSD Driver (HKLM\...\HotKeyOSD) (Version: 1.0.12 - Dritek System Inc.)
IDT Audio (HKLM\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6288.0 - IDT)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.14.10.2230 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.4.1002 - Intel Corporation)
Internet Everywhere (HKLM\...\InternetEverywhere) (Version: 3.0.3.3 - Internet Everywhere)
Java 7 Update 40 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217040FF}) (Version: 7.0.400 - Oracle)
Join Air (HKLM\...\{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}) (Version: 1.0.0.1 - ZTE Corporation)
Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
K-Lite Mega Codec Pack 9.7.5 (HKLM\...\KLiteCodecPack_is1) (Version: 9.7.5 - )
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.11.292.3 - McAfee, Inc.)
Mesh Runtime (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office Professional Plus 2007 (HKLM\...\PROPLUS) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 2.1.1116.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.1.10329.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
MOOV  UI (HKLM\...\MOOV UI_is1) (Version:  - )
Mozilla Firefox 43.0.1 (x86 fr) (HKLM\...\Mozilla Firefox 43.0.1 (x86 fr)) (Version: 43.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 43.0.1.5828 - Mozilla)
OpenOffice.org 3.4.1 (HKLM\...\{7DA1C06F-C913-46C7-8A0F-DA2CBA17EA1D}) (Version: 3.41.9593 - Apache Software Foundation)
PC Chrono 1.1.0.6 (HKLM\...\{C1C910A7-0B89-4260-8845-FE221D9285E8}_is1) (Version:  - highspheres.com)
PDF Architect 2 (HKLM\...\PDF Architect 2) (Version: 2.0.24.16092 - pdfforge GmbH)
PDF Architect 2 View Module (HKLM\...\{46889070-D447-4936-A5D3-246DB972FA2E}) (Version: 2.0.6.16537 - pdfforge GmbH)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.3 - pdfforge)
Realtek Ethernet Controller Driver For Windows 7 (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.23.623.2010 - Realtek)
Realtek USB 2.0 Card Reader (HKLM\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30123 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM\...\{9D3D8C60-A55F-4123-B2B9-173F09590E16}) (Version: 1.00.0159 - REALTEK Semiconductor Corp.)
Skype Click to Call (HKLM\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.5.0.9082 - Microsoft Corporation)
Skype™ 7.7 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.7.103 - Skype Technologies S.A.)
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-2775988421-3821143660-593909798-1000_Classes\CLSID\{1FD1FE74-9E3C-4C1C-AEEB-AAB592AD770F}\localserver32 -> C:\Users\user\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-2775988421-3821143660-593909798-1000_Classes\CLSID\{5E71E4F3-E8C7-4906-9626-973E418762B6}\InprocServer32 -> C:\Users\user\AppData\Local\Facebook\Update\1.2.205.0\goopdate.dll (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-2775988421-3821143660-593909798-1000_Classes\CLSID\{8B9F5BF4-0407-4BB2-9FED-4C0372DABD00}\localserver32 -> C:\Users\user\AppData\Local\Facebook\Video\Skype\FacebookVideoCallingProxy.exe (Skype Limited)
CustomCLSID: HKU\S-1-5-21-2775988421-3821143660-593909798-1000_Classes\CLSID\{CBE9C57E-FFA9-4123-8354-AD360D6DD3CC}\InprocServer32 -> C:\Users\user\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {326F6758-1DB7-496A-9D70-475E84E3D7AD} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2775988421-3821143660-593909798-1000UA => C:\Users\user\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-10-28] (Facebook Inc.)
Task: {47423C79-8CE2-4BD7-AAC2-E9979DF84CB3} - System32\Tasks\Games\UpdateCheck_S-1-5-21-2775988421-3821143660-593909798-1000
Task: {98156983-5B12-4167-A352-5C1788C4821F} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2775988421-3821143660-593909798-1000Core => C:\Users\user\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-10-28] (Facebook Inc.)
Task: {BE625277-220B-40B6-824B-6B0DD6812A3D} - System32\Tasks\{A4A45D3E-C25F-4A17-B593-6DBE2B9A56BE} => Firefox.exe hxxp://ui.skype.com/ui/0/6.6.0.106/fr/abandoninstall?source=lightinstaller&page=tsInstall
Task: {F0C27548-01A6-410F-B399-710740926C8B} - System32\Tasks\{E6E3F73E-74F4-46B2-8FBC-16A07387C937} => Firefox.exe hxxp://ui.skype.com/ui/0/6.6.0.106/fr/abandoninstall?source=lightinstaller&page=tsInstall
Task: {F50E6B4D-76A6-4728-9768-B710946A48B2} - System32\Tasks\Microsoft\Microsoft Antimalware\MP Scheduled Scan => c:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-28] (Microsoft Corporation)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2775988421-3821143660-593909798-1000Core.job => C:\Users\user\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2775988421-3821143660-593909798-1000UA.job => C:\Users\user\AppData\Local\Facebook\Update\FacebookUpdate.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

Shortcut: C:\Users\user\Desktop\Connexion au NAS.lnk -> C:\mountscript\laptopProlink.bat ()

==================== Loaded Modules (Whitelisted) ==============

2014-08-15 21:25 - 2014-08-15 21:25 - 00063400 _____ () C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll
2014-07-04 11:58 - 2013-04-15 12:49 - 00176128 _____ () C:\Windows\System32\HP1006LM.DLL
2014-07-04 12:01 - 2013-04-15 12:49 - 00059904 _____ () C:\Windows\system32\spool\PRTPROCS\W32X86\HP1006PP.dll
2014-05-22 14:15 - 2013-05-15 13:46 - 00346680 ____N () C:\Program Files\InternetEverywhere\InternetEverywhere_Service.exe
2012-11-20 17:00 - 2009-08-05 10:18 - 00262144 _____ () C:\Program Files\MOOV UI\bin\MonServiceUDisk.exe
2014-05-15 12:39 - 2011-08-09 21:35 - 00270672 _____ () C:\Program Files\Join Air\AssistantServices.exe
2011-07-13 21:17 - 2010-10-07 10:46 - 00044544 _____ () C:\Program Files\FSP\KbdHook.dll
2011-07-13 21:16 - 2010-10-07 10:46 - 00066048 _____ () C:\Program Files\FSP\FspLib.dll
2014-05-15 12:39 - 2011-08-09 21:35 - 00153424 _____ () C:\Program Files\Join Air\UIExec.exe
2014-05-22 14:15 - 2013-05-15 13:46 - 00645688 ____N () C:\Program Files\InternetEverywhere\InternetEverywhere_Launcher.exe
2012-08-10 15:51 - 2012-08-10 15:51 - 00985088 _____ () C:\Program Files\OpenOffice.org 3\program\libxml2.dll
2013-01-11 16:17 - 2013-01-11 16:17 - 00170496 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\6e0e5d6d7d5fe4e011335c395f6a8031\IsdiInterop.ni.dll
2011-07-13 21:00 - 2010-06-08 20:44 - 00058880 _____ () C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2006-10-26 13:56 - 2006-10-26 13:56 - 00757008 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL
2014-07-04 11:59 - 2013-04-15 12:49 - 02869248 _____ () C:\Windows\system32\spool\DRIVERS\W32X86\3\HP1006SU.DLL
2014-07-04 11:58 - 2013-04-15 12:48 - 00949248 _____ () C:\Windows\system32\spool\DRIVERS\W32X86\3\HP1006GC.dll
2014-07-04 11:59 - 2013-04-15 12:49 - 00261632 _____ () C:\Windows\system32\spool\DRIVERS\W32X86\3\HP1006SD.DLL

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 05:04 - 2016-03-18 08:17 - 00000856 ____A C:\Windows\system32\Drivers\etc\hosts

0.0.0.1	mssplus.mcafee.com

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2775988421-3821143660-593909798-1000\Control Panel\Desktop\\Wallpaper -> 
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{C05A85CF-4927-49FA-AF4B-2254DF5C3A8D}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{E984A406-459B-4A77-BCAB-85F5B0A12C68}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{B3A96186-4AAE-4DE4-A3E0-CA8ECD880F40}C:\program files\skype\phone\skype.exe] => (Allow) C:\program files\skype\phone\skype.exe
FirewallRules: [UDP Query User{C4D85C10-17ED-4DA9-B57F-990ECF082B16}C:\program files\skype\phone\skype.exe] => (Allow) C:\program files\skype\phone\skype.exe
FirewallRules: [{147F51A0-E525-4511-AAE7-8BE29AD22221}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe
FirewallRules: [{4692DCA9-C977-43FB-960B-2615B3BA0636}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{EEE72CDA-D8CF-4D3D-B7A2-C7DAA9443324}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe

==================== Restore Points =========================

13-11-2015 09:24:53 Windows Update
08-03-2016 11:09:32 Scheduled Checkpoint
17-03-2016 08:40:30 Windows Update

==================== Faulty Device Manager Devices =============

Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: HUAWEI Mobile Connect - Bus Enumerate Device
Description: HUAWEI Mobile Connect - Bus Enumerate Device
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: HUAWEI Technologies CO.,LTD
Service: huawei_enumerator
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Bluetooth Peripheral Device
Description: Bluetooth Peripheral Device
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (03/18/2016 08:11:43 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/17/2016 11:24:36 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/16/2016 05:54:06 PM) (Source: Google Update) (EventID: 20) (User: user-Book)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80

Error: (03/16/2016 05:32:43 PM) (Source: Google Update) (EventID: 20) (User: user-Book)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80

Error: (03/08/2016 12:18:15 PM) (Source: Google Update) (EventID: 20) (User: user-Book)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x

Error: (03/08/2016 11:56:46 AM) (Source: Google Update) (EventID: 20) (User: user-Book)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x

Error: (03/08/2016 11:06:23 AM) (Source: SideBySide) (EventID: 72) (User: )
Description: Activation context generation failed for "imaging1".Error in manifest or policy file "imaging2" on line imaging3.
The element imaging appears as a child of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by this version of Windows.

Error: (03/08/2016 09:55:14 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program WINWORD.EXE version 12.0.4518.1014 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 1484

Start Time: 01d17906de1699d4

Termination Time: 31

Application Path: C:\Program Files\Microsoft Office\Office12\WINWORD.EXE

Report Id: a3cc089e-e4fa-11e5-86f6-00059a3c7a00

Error: (03/08/2016 09:18:00 AM) (Source: Google Update) (EventID: 20) (User: user-Book)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80

Error: (03/08/2016 09:10:17 AM) (Source: Google Update) (EventID: 20) (User: user-Book)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80


System errors:
=============
Error: (03/18/2016 12:12:44 PM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR10.

Error: (03/18/2016 08:23:55 AM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR2.

Error: (03/18/2016 08:23:55 AM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR2.

Error: (03/18/2016 08:23:54 AM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR2.

Error: (03/18/2016 08:23:45 AM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR1.

Error: (03/18/2016 08:23:44 AM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR1.

Error: (03/18/2016 08:23:44 AM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR1.

Error: (03/18/2016 08:11:22 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load: 
cdrom

Error: (03/17/2016 06:08:06 PM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR3.

Error: (03/17/2016 06:08:05 PM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR3.


==================== Memory info =========================== 

Processor: Intel(R) Atom(TM) CPU N570 @ 1.66GHz
Percentage of memory in use: 49%
Total physical RAM: 2036.2 MB
Available physical RAM: 1018.53 MB
Total Virtual: 4072.39 MB
Available Virtual: 2798.24 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:48.83 GB) (Free:9.82 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive d: (Data) (Fixed) (Total:243.3 GB) (Free:243.21 GB) NTFS
Drive e: (DRF KUPO) (Removable) (Total:1.88 GB) (Free:1.06 GB) FAT

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 6FE9E1FA)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=5.9 GB) - (Type=27)
Partition 3: (Not Active) - (Size=48.8 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=243.3 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 1.9 GB) (Disk ID: 00000000)

Partition: GPT.

==================== End of Addition.txt ============================
         

--- --- ---

--- --- ---


ich hoffe, das war jetzt richtig? Falls nicht, entschuldige bitte...

Malwarebytes Anti-Rootkit (MBAR)

Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

• Starte bitte die mbar.exe.
• Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
• Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
• Klicke auf den CleanUp Button und erlaube den Neustart.
• Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
• Nach dem Neustart starte die mbar.exe erneut.
• Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

hallo Cosinus,

vielen Dank. ich lade gerade das programm runter. Ist der Schädling auf dem PC oder nach wie vor auf dem USB-Stick? Kann ich diesen weiter benutzen? Und sollte ich den anderen Laptop, der mit dem USb-Stick in kontakt kam ebenfalls hier "untersuchen" lassen?

genau das wollen wir doch hier gerade untersuchen wo genau welche Schädlinge sitzen

Es sieht so aus, als ob das System nichts gefunden hat. Ich kann zumindest den cleanup button nicht betätigen (es startet also nicht neu). Es gibt in dem Ordner auch keine Log-Datei-
Das ist aufgetaucht: Congratulations, no cleanup is required! Scan Finished: No malware found!

Hört sich doch ganz gut an, oder? Wie soll ich weiter vorgehen? Kann ich den USB-Stick benutzen? Wie bekomme ich die transparenten Dateien wieder sichtbar? Soll ich den anderen Laptop ebenfalls wie von dir beschrieben untersuchen?

Herzliche Grüße
Mikki

bitte das Log posten

Lieber Cosinus,

es gab kein Log, da anscheinend nichts gefunden wurde...
Ich habe mittlerweile keinen Zugriff mehr auf den PC. Wie soll ich fortfahren? Soll ich den anderen Laptop ebenfalls untersuchen?

Herzliche Grüße
Mikki

Bitte lies doch Anleitung richtig. Ich versteh auch nicht warum ihr alle immer den Trichter kommt, dass kein Log erstellt wird wenn nichts gefunden wurde. So ein Log zeigt schon etwas mehr als nur Fund oder kein Fund.