Win 7 x64: Entfernen des Win32/Small.CA-Virus
Hallo.
Seit einiger Zeit taucht die Meldung "Entfernen des Win32/Small.CA-Virus" in den Meldungen meines Wartungscenters auf. Ich habe dann einige Zeit lang nichts unternommen, da Sophos nichts Verdächtiges gefunden hat, ebenso wenig wie die Microsoft Produkte. Nach damaliger Recherche habe ich auch gelesen, dass Sophos einen "false positive" verursacht.
Da das Problem doch häufiger auftritt (auch bei Systemen ohne Sophos), würde ich das Problem gerne lösen. Über Hilfe wäre ich sehr Dankbar.
Hier schonmal die ersten Logs:
FRST.txt Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-10-2013
Ran by Lars (administrator) on NOTEBOOK on 28-10-2013 09:35:05
Running from C:\Users\Lars\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Lenovo.) C:\Windows\system32\ibmpmsvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
(Conexant Systems Inc.) C:\Windows\system32\CxAudMsg64.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SAsrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE
(Lenovo Group Limited) C:\Program Files (x86)\Lenovo\Screen Reading Optimizer\SROSVC.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe
(Ericsson AB) C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Lenovo Group Limited) C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe
(Lenovo Group Limited) C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE
(Lenovo Group Limited) C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Silicon Motion) C:\Windows\SMIKsSTI.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Lenovo Group Limited) C:\Program Files (x86)\Lenovo\Screen Reading Optimizer\SRORest.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Lenovo Group Limited) C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BtStackServer.exe
() C:\Program Files (x86)\LENOVO\Message Center Plus\MCPLaunch.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2731304 2011-03-24] (Synaptics Incorporated)
HKLM\...\Run: [SMI_SSE_V5] - C:\Windows\SMIKsSTI.exe [212992 2011-04-11] (Silicon Motion)
HKLM\...\Run: [TpShocks] - C:\Windows\System32\TpShocks.exe [380776 2011-01-14] (Lenovo.)
HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe [310912 2011-03-24] (Conexant Systems, Inc.)
HKLM\...\Run: [ForteConfig] - C:\Program Files\CONEXANT\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [LENOVO.TPKNRRES] - C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe [41320 2011-04-04] (Lenovo Group Limited)
HKLM\...\Run: [ALCKRESI.EXE] - C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe [281960 2011-04-04] (Lenovo Group Limited)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [Google Update] - C:\Users\Lars\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-04-19] (Google Inc.)
MountPoints2: D - D:\LaunchU3.exe -a
MountPoints2: {48023753-f944-11e0-9f81-806e6f6e6963} - Q:\LenovoQDrive.exe
HKLM-x32\...\Run: [PWMTRV] - C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.dll [1556032 2012-10-03] (Lenovo Group Limited)
HKLM-x32\...\Run: [Lenovo Registration] - C:\Program Files (x86)\Lenovo Registration\LenovoReg.exe [4351712 2011-07-13] (Lenovo, Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrobat_sl.exe [41336 2013-09-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe [840568 2013-09-03] (Adobe Systems Inc.)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [Sophos AutoUpdate Monitor] - C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe [929272 2013-01-11] (Sophos Limited)
HKU\Default\...\RunOnce: [] - [x]
HKU\Default\...\RunOnce: [Lenovoautoqdrive] - C:\Program Files (x86)\Common Files\Lenovo\LenovoDrive\LenovoAutoRunReg.exe [159744 2009-03-24] ()
HKU\Default User\...\RunOnce: [] - [x]
HKU\Default User\...\RunOnce: [Lenovoautoqdrive] - C:\Program Files (x86)\Common Files\Lenovo\LenovoDrive\LenovoAutoRunReg.exe [159744 2009-03-24] ()
AppInit_DLLs: C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~2.DLL [217672 2013-10-27] (Sophos Limited)
AppInit_DLLs-x32: C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~1.DLL [275352 2013-10-27] (Sophos Limited)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/welcome/thinkpad
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=LENP&bmod=LENP
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=2a16bbf6-eed7-404f-820c-f1f15d058a2f&searchtype=hp&fr=linkury-tb&installDate=14/05/2013&type=hp1000
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=2a16bbf6-eed7-404f-820c-f1f15d058a2f&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=14/05/2013&type=hp1000
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com/welcome/thinkpad
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=2a16bbf6-eed7-404f-820c-f1f15d058a2f&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=14/05/2013&type=hp1000
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=2a16bbf6-eed7-404f-820c-f1f15d058a2f&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=14/05/2013&type=hp1000
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=2a16bbf6-eed7-404f-820c-f1f15d058a2f&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=14/05/2013&type=hp1000
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=2a16bbf6-eed7-404f-820c-f1f15d058a2f&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=14/05/2013&type=hp1000
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=2a16bbf6-eed7-404f-820c-f1f15d058a2f&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=14/05/2013&type=hp1000
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Symantec VIP Access Add-On - {C63CD127-A1CB-4D49-A4F7-D6F88A917BE6} - C:\Program Files (x86)\Symantec\VIP Access Client\64bit\VIPAddOnForIE64.dll (Symantec Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Symantec VIP Access Add-On - {C63CD127-A1CB-4D49-A4F7-D6F88A917BE6} - C:\Program Files (x86)\Symantec\VIP Access Client\VIPAddOnForIE.dll (Symantec Corporation)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog9 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [88128] (Sophos Limited)
Winsock: Catalog9 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [88128] (Sophos Limited)
Winsock: Catalog9 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [88128] (Sophos Limited)
Winsock: Catalog9 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [88128] (Sophos Limited)
Winsock: Catalog9 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [88128] (Sophos Limited)
Winsock: Catalog9 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [88128] (Sophos Limited)
Winsock: Catalog9 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [88128] (Sophos Limited)
Winsock: Catalog9 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [88128] (Sophos Limited)
Winsock: Catalog9 20 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [88128] (Sophos Limited)
Winsock: Catalog9-x64 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [131648] (Sophos Limited)
Winsock: Catalog9-x64 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [131648] (Sophos Limited)
Winsock: Catalog9-x64 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [131648] (Sophos Limited)
Winsock: Catalog9-x64 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [131648] (Sophos Limited)
Winsock: Catalog9-x64 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [131648] (Sophos Limited)
Winsock: Catalog9-x64 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [131648] (Sophos Limited)
Winsock: Catalog9-x64 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [131648] (Sophos Limited)
Winsock: Catalog9-x64 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [131648] (Sophos Limited)
Winsock: Catalog9-x64 20 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [131648] (Sophos Limited)
Hosts: 127.0.0.1 activate.adobe.com
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Lars\AppData\Roaming\Mozilla\Firefox\Profiles\0xizg4ty.default
FF NewTab: about:blank
FF Homepage: https://www.google.de/
FF Keyword.URL: hxxp://www.google.com/search?ie=UTF-8&oe=utf-8&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Lars\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Lars\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Users\Lars\AppData\Roaming\Mozilla\Firefox\Profiles\0xizg4ty.default\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\Lars\AppData\Roaming\Mozilla\Firefox\Profiles\0xizg4ty.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM-x32\...\Firefox\Extensions: [VIP@verisign.com] - C:\Program Files (x86)\Symantec\VIP Access Client\
FF Extension: Symantec VIP Access Add-On - C:\Program Files (x86)\Symantec\VIP Access Client\
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
==================== Services (Whitelisted) =================
R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [133992 2011-07-12] (Lenovo Group Limited)
S3 OpenVPNService; C:\Program Files\OpenVPN\bin\openvpnserv.exe [34528 2013-01-08] (The OpenVPN Project)
R2 SAVAdminService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe [290296 2013-10-27] (Sophos Limited)
R2 SAVService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe [206328 2013-10-27] (Sophos Limited)
R2 Sophos AutoUpdate Service; C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe [237048 2013-01-11] (Sophos Limited)
R2 SROSVC; C:\Program Files (x86)\Lenovo\Screen Reading Optimizer\SROSVC.exe [443240 2011-03-02] (Lenovo Group Limited)
S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [22376 2013-04-11] ()
R2 swi_service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe [3109880 2013-10-27] (Sophos Limited)
S2 swi_update_64; C:\ProgramData\Sophos\Web Intelligence\swi_update_64.exe [2012152 2013-10-27] (Sophos Limited)
R2 VIPAppService; C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe [84088 2011-04-13] (Symantec Corporation)
R2 WMCoreService; C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe [648744 2011-08-12] (Ericsson AB)
==================== Drivers (Whitelisted) ====================
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-05-14] (DT Soft Ltd)
R3 ecnssndis; C:\Windows\System32\Drivers\wwuss64.sys [26664 2011-06-13] (Ericsson AB)
R3 ecnssndisfltr; C:\Windows\System32\Drivers\wwussf64.sys [30248 2011-06-13] (Ericsson AB)
R3 l36wgps; C:\Windows\System32\DRIVERS\l36wgps64.sys [101416 2011-07-01] (Ericsson AB)
R3 Mbm3CBus; C:\Windows\System32\DRIVERS\Mbm3CBus.sys [419400 2011-04-29] (MCCI Corporation)
R3 Mbm3DevMt; C:\Windows\System32\DRIVERS\Mbm3DevMt.sys [430664 2011-04-29] (MCCI Corporation)
R3 Mbm3mdfl; C:\Windows\System32\DRIVERS\Mbm3mdfl.sys [19528 2011-04-29] (MCCI Corporation)
R3 Mbm3Mdm; C:\Windows\System32\DRIVERS\Mbm3Mdm.sys [483400 2011-04-29] (MCCI Corporation)
R1 PHCORE; C:\Program Files\Lenovo\RapidBoot\PHCORE64.SYS [32104 2011-07-08] (Lenovo Group Limited)
R1 SAVOnAccess; C:\Windows\System32\DRIVERS\savonaccess.sys [154952 2013-10-27] (Sophos Limited)
S3 sdcfilter; C:\Windows\System32\DRIVERS\sdcfilter.sys [36640 2013-01-22] (Sophos Limited)
S4 SophosBootDriver; C:\Windows\System32\DRIVERS\SophosBootDriver.sys [25608 2013-10-27] (Sophos Plc)
R3 TVTI2C; C:\Windows\System32\DRIVERS\Tvti2c.sys [41536 2009-09-24] (Lenovo (United States) Inc.)
R3 usbsmi; C:\Windows\System32\DRIVERS\SMIksdrv.sys [210048 2011-04-11] (SMI)
R3 WwanUsbServ; C:\Windows\System32\DRIVERS\WwanUsbMp64.sys [268840 2011-08-12] (Ericsson AB)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-28 09:34 - 2013-10-28 09:34 - 00000000 ____D C:\FRST
2013-10-28 09:33 - 2013-10-28 09:33 - 01956538 _____ (Farbar) C:\Users\Lars\Desktop\FRST64.exe
2013-10-28 09:31 - 2013-10-28 09:31 - 00000540 _____ C:\Users\Lars\Desktop\defogger_disable.log
2013-10-28 09:31 - 2013-10-28 09:31 - 00000168 _____ C:\Users\Lars\defogger_reenable
2013-10-28 09:29 - 2013-10-28 09:29 - 00050477 _____ C:\Users\Lars\Desktop\Defogger.exe
2013-10-27 16:34 - 2013-10-27 16:30 - 00037880 _____ (Sophos Limited) C:\Windows\system32\SophosBootTasks.exe
2013-10-27 16:30 - 2013-10-27 16:30 - 00154952 _____ (Sophos Limited) C:\Windows\system32\Drivers\savonaccess.sys
2013-10-27 16:14 - 2013-10-27 16:14 - 00025608 _____ (Sophos Plc) C:\Windows\system32\Drivers\SophosBootDriver.sys
2013-10-27 16:09 - 2013-10-27 16:11 - 08582056 _____ (Igor Pavlov) C:\Users\Lars\Downloads\ses103cau_ext.exe
2013-10-27 15:42 - 2013-10-27 15:42 - 00247530 _____ C:\ProgramData\1382884859.bdinstall.bin
2013-10-27 14:35 - 2013-10-27 14:35 - 00000385 _____ C:\Users\Lars\AppData\Roaminguser_gensett.xml
2013-10-27 13:03 - 2013-10-27 13:03 - 00534306 _____ C:\ProgramData\1382874960.bdinstall.bin
2013-10-27 13:01 - 2013-10-27 13:01 - 00000000 ____D C:\ProgramData\BDLogging
2013-10-27 12:56 - 2013-10-27 15:42 - 00000000 ____D C:\Program Files\Bitdefender
2013-10-27 12:56 - 2013-10-27 15:41 - 00000000 ____D C:\ProgramData\Bitdefender
2013-10-27 12:56 - 2013-10-27 12:56 - 00000000 ____D C:\Users\Lars\AppData\Roaming\QuickScan
2013-10-27 12:55 - 2013-10-27 15:41 - 00000000 ____D C:\Program Files\Common Files\Bitdefender
2013-10-27 12:53 - 2013-10-27 12:54 - 00000008 _____ C:\Users\Lars\Desktop\Bitdefender Key.txt
2013-10-20 10:22 - 2013-10-20 10:22 - 00000000 ___HD C:\ProgramData\CanonBJ
2013-10-12 02:19 - 2013-09-23 00:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-10-12 02:19 - 2013-09-23 00:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-10-12 02:19 - 2013-09-23 00:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-10-12 02:19 - 2013-09-23 00:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-10-12 02:19 - 2013-09-23 00:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-10-12 02:19 - 2013-09-23 00:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-10-12 02:19 - 2013-09-23 00:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-10-12 02:19 - 2013-09-23 00:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-10-12 02:19 - 2013-09-23 00:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-10-12 02:19 - 2013-09-23 00:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-10-12 02:19 - 2013-09-23 00:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-10-12 02:19 - 2013-09-23 00:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-10-12 02:19 - 2013-09-23 00:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-10-12 02:19 - 2013-09-22 23:55 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-12 02:19 - 2013-09-22 23:55 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-12 02:19 - 2013-09-22 23:55 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-12 02:19 - 2013-09-22 23:54 - 19252224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-12 02:19 - 2013-09-22 23:54 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-12 02:19 - 2013-09-22 23:54 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-12 02:19 - 2013-09-22 23:54 - 02647552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-12 02:19 - 2013-09-22 23:54 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-12 02:19 - 2013-09-22 23:54 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-12 02:19 - 2013-09-22 23:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-12 02:19 - 2013-09-22 23:54 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-12 02:19 - 2013-09-22 23:54 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-12 02:19 - 2013-09-22 23:54 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-12 02:19 - 2013-09-22 23:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-12 02:19 - 2013-09-21 04:38 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-12 02:19 - 2013-09-21 04:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-10-12 02:19 - 2013-09-21 03:48 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-12 02:19 - 2013-09-21 03:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-10-11 08:11 - 2013-07-12 11:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-11 08:11 - 2013-07-12 11:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-11 08:11 - 2013-07-04 13:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-11 08:11 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2013-10-11 08:11 - 2013-07-03 05:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-11 08:11 - 2013-07-03 05:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-11 08:11 - 2013-06-25 23:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-11 08:11 - 2013-06-06 06:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-11 08:11 - 2013-06-06 06:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-11 08:11 - 2013-06-06 06:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-11 08:11 - 2013-06-06 06:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-11 08:11 - 2013-06-06 05:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2013-10-11 08:11 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2013-10-11 08:11 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2013-10-11 08:11 - 2013-06-06 04:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-11 08:11 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2013-10-11 08:11 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2013-10-11 08:10 - 2013-09-14 02:10 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-11 08:10 - 2013-09-08 03:30 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-11 08:10 - 2013-09-08 03:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-11 08:10 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2013-10-11 08:10 - 2013-08-29 03:17 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-11 08:10 - 2013-08-29 03:16 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-11 08:10 - 2013-08-29 03:16 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-11 08:10 - 2013-08-29 03:16 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-10-11 08:10 - 2013-08-29 03:13 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-11 08:10 - 2013-08-29 02:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-10-11 08:10 - 2013-08-29 02:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-10-11 08:10 - 2013-08-29 02:50 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-10-11 08:10 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2013-10-11 08:10 - 2013-08-29 02:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-10-11 08:10 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2013-10-11 08:10 - 2013-08-29 01:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-10-11 08:10 - 2013-08-29 01:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-10-11 08:10 - 2013-08-29 01:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-10-11 08:10 - 2013-08-29 01:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-10-11 08:10 - 2013-08-28 02:21 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-11 08:10 - 2013-08-28 02:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-11 08:10 - 2013-08-01 13:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-11 08:10 - 2013-07-20 11:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-11 08:10 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2013-10-11 08:10 - 2013-07-04 13:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-11 08:10 - 2013-07-04 13:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-11 08:10 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2013-10-11 08:10 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2013-10-11 08:10 - 2013-07-04 11:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-02 15:20 - 2013-10-02 15:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
==================== One Month Modified Files and Folders =======
2013-10-28 09:35 - 2013-01-11 09:00 - 00000466 _____ C:\Windows\Tasks\SystemToolsDailyTest.job
2013-10-28 09:34 - 2013-10-28 09:34 - 00000000 ____D C:\FRST
2013-10-28 09:33 - 2013-10-28 09:33 - 01956538 _____ (Farbar) C:\Users\Lars\Desktop\FRST64.exe
2013-10-28 09:31 - 2013-10-28 09:31 - 00000540 _____ C:\Users\Lars\Desktop\defogger_disable.log
2013-10-28 09:31 - 2013-10-28 09:31 - 00000168 _____ C:\Users\Lars\defogger_reenable
2013-10-28 09:31 - 2013-01-22 17:11 - 00000000 ____D C:\Users\Lars
2013-10-28 09:29 - 2013-10-28 09:29 - 00050477 _____ C:\Users\Lars\Desktop\Defogger.exe
2013-10-28 09:29 - 2013-01-11 09:00 - 00000528 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
2013-10-28 09:25 - 2013-07-19 17:55 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-28 09:12 - 2011-10-18 05:50 - 01832467 _____ C:\Windows\WindowsUpdate.log
2013-10-28 09:11 - 2013-04-19 11:20 - 00001116 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2023589072-630133933-1296572217-1000UA.job
2013-10-27 20:10 - 2011-10-18 15:34 - 00696870 _____ C:\Windows\system32\perfh007.dat
2013-10-27 20:10 - 2011-10-18 15:34 - 00148134 _____ C:\Windows\system32\perfc007.dat
2013-10-27 20:10 - 2009-07-14 06:13 - 01612484 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-27 20:07 - 2013-01-22 18:43 - 00000000 ____D C:\Users\Lars\Documents\Outlook-Dateien
2013-10-27 16:53 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-10-27 16:33 - 2013-01-22 17:39 - 00000000 ____D C:\ProgramData\Sophos
2013-10-27 16:30 - 2013-10-27 16:34 - 00037880 _____ (Sophos Limited) C:\Windows\system32\SophosBootTasks.exe
2013-10-27 16:30 - 2013-10-27 16:30 - 00154952 _____ (Sophos Limited) C:\Windows\system32\Drivers\savonaccess.sys
2013-10-27 16:14 - 2013-10-27 16:14 - 00025608 _____ (Sophos Plc) C:\Windows\system32\Drivers\SophosBootDriver.sys
2013-10-27 16:12 - 2013-01-22 17:39 - 00000000 ____D C:\Program Files (x86)\Sophos
2013-10-27 16:11 - 2013-10-27 16:09 - 08582056 _____ (Igor Pavlov) C:\Users\Lars\Downloads\ses103cau_ext.exe
2013-10-27 15:59 - 2009-07-14 05:45 - 00031072 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-27 15:59 - 2009-07-14 05:45 - 00031072 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-27 15:51 - 2013-08-28 08:59 - 00000000 ____D C:\Users\Lars\Desktop\LateX-Vorlage
2013-10-27 15:51 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2013-10-27 15:50 - 2013-02-21 17:38 - 00000000 ____D C:\Program Files (x86)\Miranda IM
2013-10-27 15:50 - 2011-10-18 06:02 - 00000000 ____D C:\Program Files\Broadcom
2013-10-27 15:50 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2013-10-27 15:42 - 2013-10-27 15:42 - 00247530 _____ C:\ProgramData\1382884859.bdinstall.bin
2013-10-27 15:42 - 2013-10-27 12:56 - 00000000 ____D C:\Program Files\Bitdefender
2013-10-27 15:41 - 2013-10-27 12:56 - 00000000 ____D C:\ProgramData\Bitdefender
2013-10-27 15:41 - 2013-10-27 12:55 - 00000000 ____D C:\Program Files\Common Files\Bitdefender
2013-10-27 15:39 - 2013-05-24 12:14 - 00000000 ____D C:\Windows\system32\appmgmt
2013-10-27 14:52 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-27 14:51 - 2009-07-14 05:51 - 00057918 _____ C:\Windows\setupact.log
2013-10-27 14:35 - 2013-10-27 14:35 - 00000385 _____ C:\Users\Lars\AppData\Roaminguser_gensett.xml
2013-10-27 13:03 - 2013-10-27 13:03 - 00534306 _____ C:\ProgramData\1382874960.bdinstall.bin
2013-10-27 13:01 - 2013-10-27 13:01 - 00000000 ____D C:\ProgramData\BDLogging
2013-10-27 12:56 - 2013-10-27 12:56 - 00000000 ____D C:\Users\Lars\AppData\Roaming\QuickScan
2013-10-27 12:54 - 2013-10-27 12:53 - 00000008 _____ C:\Users\Lars\Desktop\Bitdefender Key.txt
2013-10-20 10:22 - 2013-10-20 10:22 - 00000000 ___HD C:\ProgramData\CanonBJ
2013-10-18 08:43 - 2013-04-19 11:20 - 00001064 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2023589072-630133933-1296572217-1000Core.job
2013-10-18 08:32 - 2013-04-19 11:20 - 00004084 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2023589072-630133933-1296572217-1000UA
2013-10-18 08:32 - 2013-04-19 11:20 - 00003688 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2023589072-630133933-1296572217-1000Core
2013-10-12 02:39 - 2009-07-14 05:45 - 00469192 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-12 02:18 - 2011-10-18 06:02 - 01590378 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-10-12 02:13 - 2013-07-29 12:03 - 00000000 _____ C:\Windows\system32\vireng.log
2013-10-12 02:11 - 2013-08-01 16:46 - 00000000 ____D C:\Windows\system32\MRT
2013-10-12 02:08 - 2013-01-23 10:33 - 80541720 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-10-11 07:55 - 2013-07-19 17:55 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-10-11 07:54 - 2013-02-01 15:49 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-10-11 07:54 - 2013-02-01 15:49 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-10-07 22:31 - 2013-01-22 17:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-10-04 10:03 - 2013-01-22 17:19 - 00000000 ____D C:\Users\Lars\AppData\Local\Mozilla
2013-10-02 15:20 - 2013-10-02 15:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-10-02 14:46 - 2009-07-14 06:08 - 00019270 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-10-02 12:21 - 2013-03-20 19:13 - 00000000 ____D C:\Users\Lars\AppData\Roaming\Skype
Some content of TEMP:
====================
C:\Users\Lars\AppData\Local\Temp\firefoxjre_exe.exe
C:\Users\Lars\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Lars\AppData\Local\Temp\ose00000.exe
C:\Users\Lars\AppData\Local\Temp\SkypeSetup.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-10-27 16:44
==================== End Of Log ============================
Addition.txt Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 28-10-2013
Ran by Lars at 2013-10-28 09:37:03
Running from C:\Users\Lars\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Sophos Anti-Virus (Enabled - Up to date) {65FBD860-96D8-75EF-C7ED-7BE27E6C498A}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Sophos Anti-Virus (Enabled - Up to date) {DE9A3984-B0E2-7A61-FD5D-409005EB0337}
==================== Installed Programs ======================
2007 Microsoft Office Suite Service Pack 3 (SP3) (x32)
Adobe Acrobat X Pro - English, Français, Deutsch (x32 Version: 10.1.8)
Adobe Digital Editions 2.0 (x32 Version: 2.0)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117)
Adobe Reader XI (11.0.01) - Deutsch (x32 Version: 11.0.01)
Anzeige am Bildschirm (Version: 6.62.01)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 1.0.2.43)
Broadcom InConcert Maestro (Version: 1.0.1.2100)
Citavi (x32 Version: 3.4.0.1)
Conexant HD Audio (Version: 8.32.27.0)
Create Recovery Media (x32 Version: 1.20.0.00)
D3DX10 (x32 Version: 15.4.2368.0902)
DAEMON Tools Lite (x32 Version: 4.47.1.0333)
Disable AMT Profile Synchronization Pop-up for Windows XP/Vista/7 (Version: 1.00)
foobar2000 v1.2.2 (x32 Version: 1.2.2)
GPL Ghostscript (Version: 9.02)
IBM SPSS Statistics 20 (x32 Version: 20.0.0.0)
Inkscape 0.48.4 (x32 Version: 0.48.4)
Integrated Camera (Version: 5.50.3.8)
Integrated Camera (x32 Version: 5.50.3.8)
Intel PROSet Wireless
Intel(R) Control Center (x32 Version: 1.2.1.1007)
Intel(R) Identity Protection Technology 1.1.2.0 (x32 Version: 1.1.2.0)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1144)
Intel(R) Processor Graphics (x32 Version: 8.15.10.2418)
Intel(R) PROSet/Wireless WiFi-Software (Version: 14.00.1000)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
Lenovo Auto Scroll Utility (Version: 1.11)
Lenovo Patch Utility (x32 Version: 1.0.1.1)
Lenovo Patch Utility 64 bit (Version: 1.2.0.1)
Lenovo Power Management Driver (Version: 1.66.00.22)
Lenovo Registration (x32 Version: 1.0.4)
Lenovo Screen Reading Optimizer (x32 Version: 1.07)
Lenovo System Interface Driver (Version: 1.05)
Lenovo System Update (x32 Version: 5.02.0011)
Lenovo ThinkVantage Toolbox (Version: 6.0.5802.24)
Lenovo User Guide (x32 Version: 1.0.0008.00)
Lenovo Warranty Information (x32 Version: 1.0.0005.00)
Lenovo Welcome (x32 Version: 2.02.003.0)
Maple 16
Maple 16 (x32 Version: 16.0.0.0)
Mesh Runtime (x32 Version: 15.4.5722.2)
Message Center Plus (x32 Version: 2.0.0012.00)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Silverlight (x32 Version: 4.0.50401.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.50727.42)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (Version: 10.0.30319)
MiKTeX 2.9 (Version: 2.9)
Miranda IM 0.10.10 (x32 Version: 0.10.10)
Mobile Broadband Drivers (x32 Version: 6.5.1.5)
Mozilla Firefox 24.0 (x86 de) (x32 Version: 24.0)
Mozilla Maintenance Service (x32 Version: 24.0)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
Music Manager (HKCU)
OpenVPN 2.3.0-I001 (Version: 2.3.0-I001)
pstoedit and importps 3.61 (Version: 3.61)
R for Windows 2.15.2 (Version: 2.15.2)
RapidBoot (Version: 1.10)
Realtek PCIE Card Reader (x32 Version: 6.1.7600.69)
Registry Patch to Enable Maximum Power Saving on WiFi Adapters for Windows 7 (Version: 1.00)
RStudio (x32 Version: 0.97.318)
Skype™ 6.6 (x32 Version: 6.6.106)
Sophos Anti-Virus (x32 Version: 10.3.1)
Sophos AutoUpdate (x32 Version: 2.9.0.344)
TAP-Windows 9.9.2 (Version: 9.9.2)
TeXnicCenter Version 2.0 Beta 1 (Version: 2.0 Beta 1)
ThinkPad Bluetooth with Enhanced Data Rate Software (Version: 6.4.0.2100)
ThinkPad Energie-Manager (x32 Version: 3.61)
ThinkPad UltraNav Driver (Version: 15.2.19.0)
ThinkVantage AutoLock (Version: 1.02)
ThinkVantage Communications Utility (Version: 2.06)
ThinkVantage System für aktiven Festplattenschutz (Version: 1.74)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3)
VIPAccess (x32 Version: 2.0.1.91)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3508.1109)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3508.1109)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2)
Windows Live Messenger (x32 Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
Windows-Treiberpaket - Intel (iaStor) hdc (11/06/2010 10.1.0.1008) (Version: 11/06/2010 10.1.0.1008)
Windows-Treiberpaket - Lenovo 1.62.00.00 (01/19/2011 1.62.00.00) (Version: 01/19/2011 1.62.00.00)
Windows-Treiberpaket - Synaptics (SynTP) Mouse (03/24/2011 15.2.19.0) (Version: 03/24/2011 15.2.19.0)
WinRAR 4.20 (64-Bit) (Version: 4.20.0)
==================== Restore Points =========================
21-09-2013 01:00:32 Windows Update
24-09-2013 09:24:04 Windows Update
01-10-2013 14:49:03 Windows Update
04-10-2013 15:18:12 Windows Update
11-10-2013 07:10:07 Windows Update
12-10-2013 01:00:21 Windows Update
17-10-2013 10:47:47 Windows Update
26-10-2013 18:23:39 Windows Update
27-10-2013 13:07:13 Removed Sophos AutoUpdate
27-10-2013 13:57:53 Windows Update
27-10-2013 14:39:06 Removed Broadcom InConcert Maestro
27-10-2013 14:47:29 Wiederherstellungsvorgang
27-10-2013 15:11:25 Removed Sophos AutoUpdate
27-10-2013 15:11:52 Installed Sophos AutoUpdate
27-10-2013 15:13:29 Removed Sophos AutoUpdate
==================== Hosts content: ==========================
2009-07-14 03:34 - 2013-01-27 12:58 - 00000854 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 activate.adobe.com
==================== Scheduled Tasks (whitelisted) =============
Task: {084205F0-C16F-48C0-8568-B2F32FBB4F85} - System32\Tasks\PCDEventLauncher => C:\Program Files\PC-Doctor\sessionchecker.exe [2011-03-31] (PC-Doctor, Inc.)
Task: {167A29EE-B4ED-4991-8BAE-59D2C4C93A1D} - System32\Tasks\PMTask => C:\Program Files (x86)\ThinkPad\Utilities\PWMIDTSV.EXE [2011-06-01] (Lenovo Group Limited)
Task: {40843BAA-98A9-443A-B2B3-B855E6A2EF5D} - System32\Tasks\MCP => C:\Program Files (x86)\Lenovo\Message Center Plus\MCPLaunch.exe [2009-05-27] ()
Task: {4447A86F-76A7-4DEA-9EA4-E70C1DA5525F} - System32\Tasks\Lenovo\SROptimizer => %TRPATH%\SRORest.exe
Task: {49F3E7CB-0E26-4576-9F6D-455E5A538F62} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2023589072-630133933-1296572217-1000Core => C:\Users\Lars\AppData\Local\Google\Update\GoogleUpdate.exe [2013-04-19] (Google Inc.)
Task: {A4B76FA3-633B-45D7-B959-702043724BBD} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-21] (Microsoft Corporation)
Task: {AC80CAD9-380C-4A37-9302-BFE7EEE98CBC} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2023589072-630133933-1296572217-1000UA => C:\Users\Lars\AppData\Local\Google\Update\GoogleUpdate.exe [2013-04-19] (Google Inc.)
Task: {BFCDE02A-3AAE-4D09-A047-8C39A5514648} - System32\Tasks\SystemToolsDailyTest => C:\Program Files\PC-Doctor\uaclauncher.exe [2011-03-31] (PC-Doctor, Inc.)
Task: {BFF31B0C-10C6-4AA1-A60B-96C69645F67B} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {CEA316DA-ADC6-4F92-A932-5CFC379489D2} - System32\Tasks\TVT\TVSUUpdateTask => C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [2013-04-11] ()
Task: {E512563A-C52A-4442-BF9B-9B880AB78772} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\PC-Doctor\uaclauncher.exe [2011-03-31] (PC-Doctor, Inc.)
Task: {F9088644-656E-4EF4-9492-2FC983D9731E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-11] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2023589072-630133933-1296572217-1000Core.job => C:\Users\Lars\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2023589072-630133933-1296572217-1000UA.job => C:\Users\Lars\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job => C:\Program Files\PC-Doctor\uaclauncher.exe
Task: C:\Windows\Tasks\SystemToolsDailyTest.job => C:\Program Files\PC-Doctor\uaclauncher.exe
==================== Loaded Modules (whitelisted) =============
2011-10-18 06:12 - 2011-06-01 19:01 - 00054272 ____N () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.DLL
2011-10-18 15:28 - 2011-03-24 11:48 - 00057640 _____ () C:\Program Files\Synaptics\SynTP\SynTPEnhPS.dll
2011-10-18 06:09 - 2011-06-10 17:36 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-01-11 09:34 - 2011-05-26 17:17 - 00065576 ____R () C:\Program Files (x86)\Mobile Broadband drivers\WMCore\MBMDebug.dll
2011-10-18 05:57 - 2010-11-04 09:17 - 00393216 _____ () C:\Windows\SMIKsLIB.dll
2011-10-18 05:57 - 2009-10-23 17:50 - 00326144 _____ () C:\Windows\system32\370prop.ax
2011-10-18 06:13 - 2010-04-06 08:05 - 02085888 _____ () C:\Program Files\Lenovo\AutoLock\cv210.dll
2011-10-18 06:13 - 2010-04-06 08:04 - 02201088 _____ () C:\Program Files\Lenovo\AutoLock\cxcore210.dll
2013-09-03 14:54 - 2013-09-03 14:54 - 00019968 _____ () C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\locale\de_de\acrotray.deu
2013-10-02 15:20 - 2013-10-02 15:20 - 03279768 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-01-26 19:27 - 2013-01-26 19:27 - 00122880 _____ () C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox\components\CitaviPickerCommunication.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SAVService => ""="service"
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (10/27/2013 04:50:26 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "x64" des "processorArchitecture"-Attributs im assemblyIdentity-Element ist ungültig.
Error: (10/27/2013 04:32:45 PM) (Source: Sophos Anti-Virus) (User: )
Description: Ausnahme entdeckt in CInfrastructureModule::PreMessageLoop.
Error: (10/27/2013 04:32:45 PM) (Source: Sophos Anti-Virus) (User: )
Description: Fehler beim Anfordern der Komponente ConfigurationManager vom ComponentManager.
Error: (10/27/2013 04:32:45 PM) (Source: Sophos Anti-Virus) (User: )
Description: Fehler bei der Konfiguration von ConfigurationManager.
Error: (10/27/2013 04:32:45 PM) (Source: Sophos Anti-Virus) (User: )
Description: Die Bootstrap-Konfigurationsdatei 'C:\ProgramData\Sophos\Sophos Anti-Virus\Config\bootstrap.xml' fehlt.
Error: (10/27/2013 04:13:43 PM) (Source: MsiInstaller) (User: Notebook)
Description: Produkt: Sophos AutoUpdate -- Fehler 25012. Sophos AutoUpdate konnte nicht installiert werden, da zur Zeit ein Update läuft. Bitte warten Sie, bis dieser beendet ist, bevor Sie es erneut versuchen.
Error: (10/27/2013 02:56:52 PM) (Source: ESENT) (User: )
Description: taskhost (1000) WebCacheLocal: Bei Datenbankwiederherstellung trat ein unerwarteter Fehler -1032 auf.
Error: (10/27/2013 02:56:52 PM) (Source: ESENT) (User: )
Description: taskhost (1000) WebCacheLocal: Versuch, Datei "C:\Users\Lars\AppData\Local\Microsoft\Windows\WebCache\V01.log" für den Lesezugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
Error: (10/27/2013 02:56:42 PM) (Source: ESENT) (User: )
Description: taskhost (1000) WebCacheLocal: Versuch, Datei "C:\Users\Lars\AppData\Local\Microsoft\Windows\WebCache\V01.log" für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
Error: (10/27/2013 02:52:39 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (10/27/2013 04:33:15 PM) (Source: DCOM) (User: )
Description: {D2B7A809-15DC-40B4-A1E1-C61EA97191DB}
Error: (10/27/2013 04:32:45 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Sophos Anti-Virus" wurde mit folgendem dienstspezifischem Fehler beendet: %%-2147467259.
Error: (10/27/2013 04:32:45 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: ComputerstandardLokalAktivierung{000C101C-0000-0000-C000-000000000046}{000C101C-0000-0000-C000-000000000046}NT-AUTORITÄTLOKALER DIENSTS-1-5-19LocalHost (unter Verwendung von LRPC)
Error: (10/27/2013 02:57:00 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x800f0816 fehlgeschlagen: Sicherheitsupdate für Windows 7 für x64-basierte Systeme (KB2862330)
Error: (10/27/2013 02:52:00 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Sophos Anti-Virus" wurde mit folgendem dienstspezifischem Fehler beendet: %%-2147467259.
Error: (10/27/2013 02:52:00 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: ComputerstandardLokalAktivierung{000C101C-0000-0000-C000-000000000046}{000C101C-0000-0000-C000-000000000046}NT-AUTORITÄTLOKALER DIENSTS-1-5-19LocalHost (unter Verwendung von LRPC)
Error: (10/27/2013 03:48:00 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%10106
Error: (10/27/2013 03:48:00 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet:
%%10106
Error: (10/27/2013 03:46:26 PM) (Source: DCOM) (User: )
Description: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
Error: (10/27/2013 03:45:56 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Update" wurde mit folgendem Fehler beendet:
%%-2147014790
Microsoft Office Sessions:
=========================
==================== Memory info ===========================
Percentage of memory in use: 53%
Total physical RAM: 4009.9 MB
Available physical RAM: 1846.83 MB
Total Pagefile: 8017.98 MB
Available Pagefile: 5676.15 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: (Windows7_OS) (Fixed) (Total:284.61 GB) (Free:216.53 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive q: (Lenovo_Recovery) (Fixed) (Total:12.3 GB) (Free:3.61 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 298 GB) (Disk ID: 5D8739B2)
Partition 1: (Active) - (Size=1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=285 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=12 GB) - (Type=07 NTFS)
==================== End Of Log ============================
defogger_disable.txt: Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 09:31 on 28/10/2013 (Lars)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
HKCU:DAEMON Tools Lite -> Removed
Checking for services/drivers...
-=E.O.F=-
gmer.txt Code:
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-10-28 10:09:36
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 HITACHI_ rev.EC2Z 298,09GB
Running: 86tt77j8.exe; Driver: C:\Users\Lars\AppData\Local\Temp\uxrdqpow.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff80003001000 45 bytes [00, 00, 00, 00, 00, 00, 00, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575 fffff8000300102f 16 bytes [00, 00, 10, 00, 00, 00, 00, ...]
---- User code sections - GMER 2.1 ----
.text C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe[1848] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b01465 2 bytes [B0, 75]
.text C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe[1848] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b014bb 2 bytes [B0, 75]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1872] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b01465 2 bytes [B0, 75]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1872] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b014bb 2 bytes [B0, 75]
.text ... * 2
.text C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe[1220] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b01465 2 bytes [B0, 75]
.text C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe[1220] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b014bb 2 bytes [B0, 75]
.text ... * 2
.text C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe[1404] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b01465 2 bytes [B0, 75]
.text C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe[1404] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b014bb 2 bytes [B0, 75]
.text ... * 2
.text C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe[1284] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b01465 2 bytes [B0, 75]
.text C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe[1284] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b014bb 2 bytes [B0, 75]
.text ... * 2
.text C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe[1628] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b01465 2 bytes [B0, 75]
.text C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe[1628] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b014bb 2 bytes [B0, 75]
.text ... * 2
.text C:\Windows\SysWOW64\SAsrv.exe[2076] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b01465 2 bytes [B0, 75]
.text C:\Windows\SysWOW64\SAsrv.exe[2076] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b014bb 2 bytes [B0, 75]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3076] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b01465 2 bytes [B0, 75]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3076] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b014bb 2 bytes [B0, 75]
.text ... * 2
.text C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE[1784] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b01465 2 bytes [B0, 75]
.text C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE[1784] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b014bb 2 bytes [B0, 75]
.text ... * 2
.text C:\Program Files (x86)\Lenovo\Screen Reading Optimizer\SROSVC.exe[508] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b01465 2 bytes [B0, 75]
.text C:\Program Files (x86)\Lenovo\Screen Reading Optimizer\SROSVC.exe[508] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b014bb 2 bytes [B0, 75]
.text ... * 2
.text C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe[3628] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b01465 2 bytes [B0, 75]
.text C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe[3628] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b014bb 2 bytes [B0, 75]
.text ... * 2
.text C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe[3600] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b01465 2 bytes [B0, 75]
.text C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe[3600] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b014bb 2 bytes [B0, 75]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2756] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b01465 2 bytes [B0, 75]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2756] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b014bb 2 bytes [B0, 75]
.text ... * 2
.text C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[3836] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b01465 2 bytes [B0, 75]
.text C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[3836] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b014bb 2 bytes [B0, 75]
.text ... * 2
.text C:\Windows\Explorer.EXE[1596] C:\Windows\system32\kernel32.dll!CopyFileExW 0000000077a323d0 5 bytes JMP 000000016fff00d8
.text C:\Windows\Explorer.EXE[1596] C:\Windows\system32\kernel32.dll!MoveFileWithProgressW 0000000077aaf6c0 8 bytes JMP 000000016fff0110
.text C:\Windows\Explorer.EXE[1596] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe537490 11 bytes JMP 000007fffe5000d8
.text C:\Windows\SMIKsSTI.exe[4404] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b01465 2 bytes [B0, 75]
.text C:\Windows\SMIKsSTI.exe[4404] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b014bb 2 bytes [B0, 75]
.text ... * 2
.text C:\Windows\SMIKsSTI.exe[4404] C:\Windows\SysWOW64\ksuser.dll!KsCreatePin + 35 00000000756b11a8 2 bytes [6B, 75]
.text C:\Windows\SMIKsSTI.exe[4404] C:\Windows\SysWOW64\ksuser.dll!KsCreateAllocator + 21 00000000756b13a8 2 bytes [6B, 75]
.text C:\Windows\SMIKsSTI.exe[4404] C:\Windows\SysWOW64\ksuser.dll!KsCreateClock + 21 00000000756b1422 2 bytes [6B, 75]
.text C:\Windows\SMIKsSTI.exe[4404] C:\Windows\SysWOW64\ksuser.dll!KsCreateTopologyNode + 19 00000000756b1498 2 bytes [6B, 75]
.text C:\Windows\SMIKsSTI.exe[4404] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 195 00000000756a1b41 2 bytes [6A, 75]
.text C:\Windows\SMIKsSTI.exe[4404] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 362 00000000756a1be8 2 bytes [6A, 75]
.text C:\Windows\SMIKsSTI.exe[4404] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 418 00000000756a1c20 2 bytes [6A, 75]
.text C:\Windows\SMIKsSTI.exe[4404] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 596 00000000756a1cd2 2 bytes [6A, 75]
.text C:\Windows\SMIKsSTI.exe[4404] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 628 00000000756a1cf2 2 bytes [6A, 75]
.text C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[4464] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b01465 2 bytes [B0, 75]
.text C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[4464] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b014bb 2 bytes [B0, 75]
.text ... * 2
.text C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[4480] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b01465 2 bytes [B0, 75]
.text C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[4480] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b014bb 2 bytes [B0, 75]
.text ... * 2
.text C:\Windows\SysWOW64\rundll32.exe[5032] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b01465 2 bytes [B0, 75]
.text C:\Windows\SysWOW64\rundll32.exe[5032] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b014bb 2 bytes [B0, 75]
.text ... * 2
.text C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[3252] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b01465 2 bytes [B0, 75]
.text C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[3252] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b014bb 2 bytes [B0, 75]
.text ... * 2
.text C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4280] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b01465 2 bytes [B0, 75]
.text C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4280] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b014bb 2 bytes [B0, 75]
.text ... * 2
.text C:\Windows\SysWOW64\RunDll32.exe[6124] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b01465 2 bytes [B0, 75]
.text C:\Windows\SysWOW64\RunDll32.exe[6124] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b014bb 2 bytes [B0, 75]
.text ... * 2
.text C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe[3300] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b01465 2 bytes [B0, 75]
.text C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe[3300] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b014bb 2 bytes [B0, 75]
.text ... * 2
.text C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe[9480] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b01465 2 bytes [B0, 75]
.text C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe[9480] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b014bb 2 bytes [B0, 75]
.text ... * 2
.text C:\Users\Lars\Desktop\86tt77j8.exe[2224] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b01465 2 bytes [B0, 75]
.text C:\Users\Lars\Desktop\86tt77j8.exe[2224] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b014bb 2 bytes [B0, 75]
.text ... * 2
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\402cf46ab911
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\9439e5917421
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\402cf46ab911 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\9439e5917421 (not active ControlSet)
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
P.S.: Alle Scans haben problemlos geklappt, als ich aber mein Notebook danach rebooten wollte, wurde das System beim Herunterfahren durch einen Bluescreen beendet.
VG |
AdwCleaner auf deinen Desktop.
Malwarebytes Anti-Malware 
SecurityCheck und:
WARNUNG an die MITLESER: 
