| Driver 198 | 24.01.2014 19:22 |
Windows 7 Pro: BKA Pop up (oder ähnlicher) lässt sich nicht mehr schließen, nach Neustart PC frei nutzbar
Hallo,
beim Surfen ist mir irgendwann der besagte Pop up aufgefallen, habe denn PC leider zuschnell neu gestartet ohne darauf zu achten wer da genau Geld von mir wollte,
allerdings war dort ein wünderschönes Foto der Kanzlerin. Das Pop up lies sich nicht mehr schliessen konnte denn PC aber weiterhin voll nutzen.
Nach einem Neustart ist der PC weiterhin voll nutzbar auch das Pop up kam nach dem Start von Firefox ebenfalls nicht mehr.
Würde dennoch gerne wissen ob sich der PC mit irgendwas infiziert hat und bin daher auf eure Seite gestoßen und hoffe auf eure Hilfe.
Ich bin bereits eure ersten Schritte durchgegangen in der Hoffnung das es richtig war... Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 18:06 on 24/01/2014 (unser)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST Logfile:
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-01-2014
Ran by unser (administrator) on UNSER-PC on 24-01-2014 18:07:49
Running from C:\Users\unser\Desktop\Neuer Ordner (6)
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
(Acresso Corporation) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
() C:\Program Files (x86)\MP4 Player\Mp4Player.exe
() C:\Users\unser\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesApp64.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11545192 2010-11-02] (Realtek Semiconductor)
HKLM\...\Run: [AtherosBtStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [613536 2010-10-27] (Atheros Communications)
HKLM\...\Run: [AthBtTray] - C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [379040 2010-10-27] (Atheros Commnucations)
HKLM-x32\...\Run: [JMB36X IDE Setup] - C:\Windows\RaidTool\xInsIDE.exe [43632 2010-01-19] ()
HKLM-x32\...\Run: [Krait] - C:\Program Files (x86)\Razer\Krait\razerhid.exe [126976 2007-02-16] ()
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\pdf24\pdf24.exe [162408 2012-10-25] (Geek Software GmbH)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [IndexSearch] - C:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe [46368 2010-03-08] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PaperPort PTD] - C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe [29984 2010-03-08] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDFHook] - C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe [636192 2010-03-05] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDF5 Registry Controller] - C:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe [62752 2010-03-05] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [ControlCenter4] - C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [143360 2012-08-28] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] - C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.)
HKCU\...\Run: [HydraVisionDesktopManager] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [393216 2010-11-18] (AMD)
HKCU\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)
HKCU\...\Run: [MP4 Player] - C:\Program Files (x86)\MP4 Player\mp4Player.exe [772096 2008-11-06] ()
HKCU\...\Run: [Amazon Cloud Player] - C:\Users\unser\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3139072 2013-11-24] ()
MountPoints2: {e7919562-429c-11e0-9dfe-bcaec5b87ea1} - G:\Startme.exe
IFEO\audibledownloadhelper.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe"
IFEO\ccleaner64.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe"
IFEO\gothic.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe"
IFEO\meinsparbuchheute.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe"
IFEO\nusb3utl.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe"
IFEO\pccompanion.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe"
IFEO\pdf24-creator.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe"
IFEO\pdf24-editor.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe"
IFEO\pdf24-fax.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe"
IFEO\pdfplus.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe"
IFEO\razercfg.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe"
IFEO\razertra.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe"
IFEO\uninst.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe"
IFEO\win7ui.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe"
IFEO\wiso2010.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe"
IFEO\wisohilfe.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe"
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x9540BC1207E8CB01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
URLSearchHook: HKCU - (No Name) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - No File
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
SearchScopes: HKCU - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus
SearchScopes: HKCU - {71BF2931-DBDE-4FD7-BB1C-3779AC2713BB} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000YYDE&apn_uid=9B93ABBB-6525-411C-8DE9-F0297AE09DC3&apn_sauid=E5A6B190-AD78-4B89-A430-6E344C58E24A
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus
SearchScopes: HKCU - {DCAF3EE1-7096-4A34-A0F5-F457295C800B} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=244506&p={searchTerms}
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: PlusIEEventHelper Class - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Toolbar: HKLM - Free PDF Perfect - {EFC2B9BE-AB2B-47F1-A47D-9EB28E58C917} - C:\Program Files (x86)\Freemium\Free PDF Perfect\ieagent64.dll (soft Xpansion)
Toolbar: HKLM-x32 - No Name - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No File
Toolbar: HKLM-x32 - Free PDF Perfect - {EFC2B9BE-AB2B-47F1-A47D-9EB28E58C917} - C:\Program Files (x86)\Freemium\Free PDF Perfect\ieagent32.dll (soft Xpansion)
Toolbar: HKCU - No Name - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No File
Toolbar: HKCU - No Name - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\unser\AppData\Roaming\Mozilla\Firefox\Profiles\to00fe0h.default
FF user.js: detected! => C:\Users\unser\AppData\Roaming\Mozilla\Firefox\Profiles\to00fe0h.default\user.js
FF DefaultSearchEngine: foxsearch
FF SearchEngineOrder.1: foxsearch
FF SelectedSearchEngine: foxsearch
FF Homepage: hxxp://www.google.de/
FF Keyword.URL: hxxp://www.finduny.com?client=mozilla-firefox&cd=UTF-8&search=1&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @java.com/DTPlugin,version=10.13.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.13.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @soft-xpansion/npsxpdf - C:\Program Files (x86)\Common Files\Freemium\np-sxpdf.dll (soft-Xpansion)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101799.dll (Amazon.com, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\unser\AppData\Roaming\Mozilla\Firefox\Profiles\to00fe0h.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\unser\AppData\Roaming\Mozilla\Firefox\Profiles\to00fe0h.default\searchplugins\Search_Results.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\foxsearch.src
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\Search_Results.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: pricealarm - C:\Users\unser\AppData\Roaming\Mozilla\Firefox\Profiles\to00fe0h.default\Extensions\EFGLQA@78ETGYN-0W7FN789T87.COM [2013-09-24]
FF Extension: DownloadHelper - C:\Users\unser\AppData\Roaming\Mozilla\Firefox\Profiles\to00fe0h.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013-08-30]
FF Extension: Youtube to MP3 Plugin - C:\Users\unser\AppData\Roaming\Mozilla\Firefox\Profiles\to00fe0h.default\Extensions\flv2mp3@hotger.com.xpi [2012-09-10]
FF Extension: Adblock Plus - C:\Users\unser\AppData\Roaming\Mozilla\Firefox\Profiles\to00fe0h.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-09-10]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2013-12-13]
FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [{B45418F9-6406-4828-9D1A-35313FB1E2D6}] - C:\ProgramData\Freemium\Free PDF Perfect\Data\fftb
FF Extension: Free PDF Perfect - C:\ProgramData\Freemium\Free PDF Perfect\Data\fftb [2013-09-24]
FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-01-07]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-01-07]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-01-07]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-01-07]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-01-07]
FF HKLM-x32\...\Thunderbird\Extensions: [{B45418F9-6406-4828-9D1A-35313FB1E2D6}] - C:\ProgramData\Freemium\Free PDF Perfect\Data\fftb
FF Extension: Free PDF Perfect - C:\ProgramData\Freemium\Free PDF Perfect\Data\fftb [2013-09-24]
Chrome:
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "hxxp://www.google.com"
CHR DefaultSearchURL: {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\20.0.1132.57\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\20.0.1132.57\pdf.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\20.0.1132.57\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_268.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\unser\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.477_0\plugin/npUrlAdvisor.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\unser\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.477_0\plugin/npVKPlugin.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\unser\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0\plugin/npABPlugin.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.310.5) - C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (Gutscheinmieze-Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\npmieze.dll No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Shockwave for Director) - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll No File
CHR Extension: (Modul zur Link-Untersuchung) - C:\Users\unser\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj [2012-07-22]
CHR Extension: (Safe Money) - C:\Users\unser\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh [2013-06-14]
CHR Extension: (Dangerous Websites Blocker) - C:\Users\unser\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail [2013-06-14]
CHR Extension: (Virtuelle Tastatur) - C:\Users\unser\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh [2012-07-22]
CHR Extension: (Google Wallet) - C:\Users\unser\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-08]
CHR Extension: (Anti-Banner) - C:\Users\unser\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman [2012-07-22]
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2013-10-17]
==================== Services (Whitelisted) =================
R2 avp; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2013-10-17] (Kaspersky Lab ZAO)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-03-08] (Nuance Communications, Inc.)
S4 Sony Ericsson PCCompanion; C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [150528 2011-02-10] (Avanquest Software)
S3 SXDS10; C:\Program Files (x86)\Common Files\soft Xpansion\sxds10.exe [234096 2013-09-24] (soft Xpansion)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [2409272 2013-12-10] (TuneUp Software)
==================== Drivers (Whitelisted) ====================
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2011-03-17] ()
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-01-07] (Kaspersky Lab ZAO)
S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [112224 2013-06-08] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620640 2014-01-07] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2013-10-17] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2013-10-17] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-10-17] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178272 2014-01-07] (Kaspersky Lab ZAO)
S3 krait03; C:\Windows\System32\Drivers\krait.sys [10368 2006-01-24] (Razer (Asia-Pacific) Pte Ltd)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2011-03-17] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 s1039bus; C:\Windows\System32\DRIVERS\s1039bus.sys [127600 2010-03-01] (MCCI Corporation)
S3 s1039mdfl; C:\Windows\System32\DRIVERS\s1039mdfl.sys [19568 2010-03-01] (MCCI Corporation)
S3 s1039mdm; C:\Windows\System32\DRIVERS\s1039mdm.sys [161904 2010-03-01] (MCCI Corporation)
S3 s1039mgmt; C:\Windows\System32\DRIVERS\s1039mgmt.sys [141424 2010-03-01] (MCCI Corporation)
S3 s1039nd5; C:\Windows\System32\DRIVERS\s1039nd5.sys [34416 2010-03-01] (MCCI Corporation)
S3 s1039obex; C:\Windows\System32\DRIVERS\s1039obex.sys [137328 2010-03-01] (MCCI Corporation)
S3 s1039unic; C:\Windows\System32\DRIVERS\s1039unic.sys [158320 2010-03-01] (MCCI Corporation)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [11880 2012-09-19] (TuneUp Software)
S3 ALSysIO; \??\C:\Users\unser\AppData\Local\Temp\ALSysIO64.sys [x]
S0 mv91xx; system32\DRIVERS\mv91xx.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-24 18:07 - 2014-01-24 18:07 - 00000000 ____D C:\FRST
2014-01-24 18:06 - 2014-01-24 18:06 - 00000000 _____ C:\Users\unser\defogger_reenable
2014-01-24 18:04 - 2014-01-24 18:07 - 00000000 ____D C:\Users\unser\Desktop\Neuer Ordner (6)
2014-01-24 15:02 - 2014-01-24 15:02 - 00001109 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-01-24 15:02 - 2014-01-24 15:02 - 00000000 ____D C:\Users\unser\AppData\Roaming\Malwarebytes
2014-01-24 15:02 - 2014-01-24 15:02 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-24 15:02 - 2014-01-24 15:02 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-24 15:02 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-24 15:00 - 2014-01-24 15:00 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\unser\Desktop\mbam-setup-1.75.0.1300.exe
2014-01-24 14:53 - 2014-01-24 14:56 - 00000000 ____D C:\Windows\system32\MRT
2014-01-24 14:32 - 2014-01-24 14:34 - 130658432 _____ C:\Users\unser\Desktop\avira_free_antivirus_de.exe
2014-01-18 20:56 - 2014-01-19 20:57 - 00000000 ____D C:\Users\unser\Desktop\Neuer Ordner (5)
2014-01-18 20:40 - 2014-01-18 20:41 - 00000000 ____D C:\Users\unser\Desktop\Neuer Ordner (2)
2014-01-15 14:30 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 14:30 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 14:30 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 14:30 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 14:30 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 14:30 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 14:30 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 14:30 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 14:30 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-14 13:00 - 2014-01-24 16:25 - 00007718 _____ C:\Windows\PFRO.log
2014-01-08 19:54 - 2014-01-08 19:54 - 00093048 _____ C:\Users\unser\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-08 19:53 - 2014-01-24 16:38 - 00002744 _____ C:\Windows\setupact.log
2014-01-08 19:53 - 2014-01-15 15:52 - 00370104 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-08 19:53 - 2014-01-08 19:53 - 00000000 _____ C:\Windows\setuperr.log
2014-01-07 17:19 - 2014-01-07 17:21 - 00000000 ____D C:\Users\unser\Desktop\Jana Micha Geb
==================== One Month Modified Files and Folders =======
2014-01-24 18:07 - 2014-01-24 18:07 - 00000000 ____D C:\FRST
2014-01-24 18:07 - 2014-01-24 18:04 - 00000000 ____D C:\Users\unser\Desktop\Neuer Ordner (6)
2014-01-24 18:06 - 2014-01-24 18:06 - 00000000 _____ C:\Users\unser\defogger_reenable
2014-01-24 18:06 - 2011-02-12 20:51 - 00000000 ____D C:\Users\unser
2014-01-24 17:42 - 2011-06-25 17:29 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-24 17:34 - 2013-06-14 08:02 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-24 17:05 - 2011-02-12 22:33 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2014-01-24 16:46 - 2009-07-14 05:45 - 00014640 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-24 16:46 - 2009-07-14 05:45 - 00014640 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-24 16:44 - 2009-07-14 18:58 - 00654150 _____ C:\Windows\system32\perfh007.dat
2014-01-24 16:44 - 2009-07-14 18:58 - 00130022 _____ C:\Windows\system32\perfc007.dat
2014-01-24 16:44 - 2009-07-14 06:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-24 16:43 - 2012-07-17 14:37 - 01531805 _____ C:\Windows\WindowsUpdate.log
2014-01-24 16:38 - 2014-01-08 19:53 - 00002744 _____ C:\Windows\setupact.log
2014-01-24 16:38 - 2011-06-25 17:29 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-24 16:38 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-24 16:25 - 2014-01-14 13:00 - 00007718 _____ C:\Windows\PFRO.log
2014-01-24 15:02 - 2014-01-24 15:02 - 00001109 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-01-24 15:02 - 2014-01-24 15:02 - 00000000 ____D C:\Users\unser\AppData\Roaming\Malwarebytes
2014-01-24 15:02 - 2014-01-24 15:02 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-24 15:02 - 2014-01-24 15:02 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-24 15:00 - 2014-01-24 15:00 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\unser\Desktop\mbam-setup-1.75.0.1300.exe
2014-01-24 14:56 - 2014-01-24 14:53 - 00000000 ____D C:\Windows\system32\MRT
2014-01-24 14:34 - 2014-01-24 14:32 - 130658432 _____ C:\Users\unser\Desktop\avira_free_antivirus_de.exe
2014-01-23 12:22 - 2012-11-25 15:29 - 00000000 ____D C:\Users\unser\Desktop\gif
2014-01-21 09:45 - 2012-04-24 16:44 - 00003694 _____ C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm
2014-01-20 11:38 - 2012-05-15 13:02 - 00000000 ____D C:\Users\unser\Desktop\Jule
2014-01-19 20:57 - 2014-01-18 20:56 - 00000000 ____D C:\Users\unser\Desktop\Neuer Ordner (5)
2014-01-18 20:41 - 2014-01-18 20:40 - 00000000 ____D C:\Users\unser\Desktop\Neuer Ordner (2)
2014-01-18 06:00 - 2013-06-13 11:11 - 00000000 ____D C:\Users\unser\AppData\Roaming\vlc
2014-01-18 06:00 - 2011-02-15 18:53 - 00000000 ____D C:\Users\unser\AppData\Local\CrashDumps
2014-01-18 05:59 - 2012-03-07 13:10 - 00000000 ____D C:\Users\unser\Desktop\nokia
2014-01-18 05:50 - 2011-02-22 15:45 - 00000000 ____D C:\Users\unser\Desktop\bilder
2014-01-15 15:52 - 2014-01-08 19:53 - 00370104 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-14 07:34 - 2012-05-15 12:58 - 00000000 ____D C:\ProgramData\Microsoft Help
2014-01-14 07:34 - 2009-07-14 03:34 - 00000478 _____ C:\Windows\win.ini
2014-01-08 19:54 - 2014-01-08 19:54 - 00093048 _____ C:\Users\unser\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-08 19:53 - 2014-01-08 19:53 - 00000000 _____ C:\Windows\setuperr.log
2014-01-08 14:51 - 2012-07-17 14:17 - 00002774 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-01-08 14:41 - 2011-02-12 20:42 - 00000000 ____D C:\Windows\Panther
2014-01-07 17:21 - 2014-01-07 17:19 - 00000000 ____D C:\Users\unser\Desktop\Jana Micha Geb
2014-01-07 14:50 - 2013-10-17 15:47 - 00620640 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-01-07 14:50 - 2013-10-17 15:47 - 00458336 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kl1.sys
2014-01-07 14:50 - 2013-06-06 17:38 - 00178272 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kneps.sys
2014-01-07 14:43 - 2011-02-12 22:33 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2014-01-06 16:20 - 2011-02-12 21:28 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
Files to move or delete:
====================
C:\Users\unser\AppData\Roaming\swk.ini
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-19 11:53
==================== End Of Log ============================
--- --- ---
--- --- --- Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-01-2014
Ran by unser at 2014-01-24 18:08:17
Running from C:\Users\unser\Desktop\Neuer Ordner (6)
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
==================== Installed Programs ======================
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (x32 Version: 11.0.06 - Adobe Systems Incorporated)
Amazon Cloud Player (HKCU Version: 2.1.0.381 - Amazon Services LLC)
Amazon MP3-Downloader 1.0.17 (x32 Version: 1.0.17 - Amazon Services LLC)
AMD Accelerated Video Transcoding (Version: 12.5.100.21219 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.1084.4 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (Version: 8.0.903.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - ATI Technologies Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.71219.1540 - Advanced Micro Devices, Inc.) Hidden
ArcaniA - Gothic 4 (x32 Version: - JoWooD Entertainment AG)
ArcaniA - Gothic 4 Hotfix (x32 Version: - JoWooD Entertainment AG)
ArcaniA - Gothic 4 Patch (x32 Version: - JoWooD Entertainment AG)
ATI AVIVO64 Codecs (Version: 11.6.0.51118 - ATI Technologies Inc.) Hidden
Audible Download Manager (x32 Version: 6.6.0.15 - Audible, Inc.)
Bluetooth Win7 Suite (64) (Version: 7.2.0.40 - Atheros Communications)
Brother MFL-Pro Suite MFC-J430W (x32 Version: 1.1.6.0 - Brother Industries, Ltd.)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center (x32 Version: 2012.1219.1521.27485 - Ihr Firmenname) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2012.0611.1251.21046 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
CCleaner (Version: 3.20 - Piriform)
Core Temp version 0.99.8 (Version: 0.99.8 - Arthur Liberman)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32 Version: - Microsoft)
Die Sims™ 3 (x32 Version: 1.42.130 - Electronic Arts)
Die Sims™ 3 Einfach tierisch (x32 Version: 10.0.96 - Electronic Arts)
Die Sims™ 3 Luxus-Accessoires (x32 Version: 3.0.38 - Electronic Arts)
Die Sims™ 3 Reiseabenteuer (x32 Version: 2.0.86 - Electronic Arts)
Die Sims™ 3 Traumkarrieren (x32 Version: 4.10.1 - Electronic Arts)
Die Sims™ 3 Traumsuite-Accessoires (x32 Version: 11.0.84 - Electronic Arts)
Free FLV Converter V 7.4.0 (x32 Version: 7.4.0.0 - Koyote Soft)
Free Pdf Perfect Prereq (x32 Version: 1.1.0 - Covus Freemium GmbH)
Free Pdf Perfect Prereq (x32 Version: 1.1.0 - Covus Freemium GmbH) Hidden
Freemium Free PDF Perfect (x32 Version: 1.0 - Freemium)
GoldWave v5.57 (x32 Version: - )
Google Chrome (x32 Version: 32.0.1700.76 - Google Inc.)
Google Earth Plug-in (x32 Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Gothic (x32 Version: 1.0.0 - JoWooD)
HydraVision (x32 Version: 4.2.184.0 - ATI Technologies Inc.) Hidden
Intel(R) Control Center (x32 Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1118 - Intel Corporation)
Intel(R) Network Connections 15.6.25.0 (Version: 15.6.25.0 - Intel)
Intel(R) Network Connections 15.6.25.0 (Version: 15.6.25.0 - Intel) Hidden
Intel(R) Rapid Storage Technology (x32 Version: 10.0.0.1046 - Intel Corporation)
Java 7 Update 13 (64-bit) (Version: 7.0.130 - Oracle)
Java 7 Update 9 (x32 Version: 7.0.90 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.0 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 31 (64-bit) (Version: 6.0.310 - Oracle)
Java(TM) 6 Update 37 (x32 Version: 6.0.370 - Oracle)
JMicron JMB36X Driver (x32 Version: 1.17.58.2 - JMicron Technology Corp.)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Kaspersky Internet Security (x32 Version: 14.0.0.4651 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 14.0.0.4651 - Kaspersky Lab) Hidden
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Business 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft PowerPoint Viewer (x32 Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (x32 Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (x32 Version: 9.0.30411 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (x32 Version: 3.0.5305.0 - Microsoft Corp.)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
MP4 Player (x32 Version: - )
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0 - Microsoft Corporation)
Nuance PaperPort 12 (x32 Version: 12.1.0000 - Nuance Communications, Inc.)
Nuance PDF Viewer Plus (x32 Version: 5.30.3290 - Nuance Communications, Inc)
OpenOffice.org 3.4 (x32 Version: 3.4.9590 - OpenOffice.org)
Origin (x32 Version: 8.6.0.357 - Electronic Arts, Inc.)
PaperPort Image Printer 64-bit (Version: 1.00.0001 - Nuance Communications, Inc.)
PDF24 Creator 4.9.0 (x32 Version: - PDF24.org)
Power RM AVI MPG VCD WMV Converter 6.3 (x32 Version: - AML SOFT, Inc.)
Razer Krait (x32 Version: 5.01 - Razer USA Ltd.)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6235 - Realtek Semiconductor Corp.)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.28.1 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.28.1 - Renesas Electronics Corporation) Hidden
Risen (x32 Version: 1.00.0000 - Deep Silver)
Risen 2 - Dark Waters (x32 Version: - )
Risen Hotfix 1.01 (x32 Version: 1.01 - Deep Silver)
Scansoft PDF Professional (x32 Version: - ) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden
Smart PDF Converter 5.1.0.399 (Version: 5.1.0.399 - Smart Soft)
Sony Ericsson PC Companion 2.01.149 (x32 Version: 2.01.149 - Sony Ericsson)
Steam (x32 Version: 1.0.0.0 - Valve Corporation)
SUPER © v2012.build.51 (April 7, 2012) Version v2012.build.51 (x32 Version: v2012.build.51 - eRightSoft)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TechPowerUp GPU-Z (x32 Version: - TechPowerUp)
The Elder Scrolls V: Skyrim (x32 Version: - Bethesda Game Studios)
TuneUp Utilities 2013 (x32 Version: 13.0.4000.179 - TuneUp Software)
TuneUp Utilities 2013 (x32 Version: 13.0.4000.179 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (x32 Version: 12.0.3600.73 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (x32 Version: 13.0.4000.179 - TuneUp Software) Hidden
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition (x32 Version: - Microsoft)
VLC media player 2.0.7 (x32 Version: 2.0.7 - VideoLAN)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Family Safety (Version: 15.4.3555.0308 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3555.0308 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger Companion Core (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8 - Microsoft Corp)
Windows Utils (x32 Version: - )
WinRAR (x32 Version: - )
WISO Sparbuch 2010 (x32 Version: 17.00.6531 - Buhl Data Service GmbH)
==================== Restore Points =========================
24-12-2013 08:31:15 Windows Update
27-12-2013 11:24:01 Windows Update
01-01-2014 11:06:02 Windows Update
05-01-2014 10:49:27 Windows Update
10-01-2014 08:39:17 Windows Update
14-01-2014 06:04:40 Windows Update
14-01-2014 06:31:45 Windows Update
15-01-2014 13:45:58 Windows Update
21-01-2014 07:43:30 Windows Update
24-01-2014 09:27:07 Windows Update
24-01-2014 13:53:18 Windows Update
==================== Hosts content: ==========================
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {22FAEE6C-3FED-45C2-9B26-82D46802034D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-12] (Adobe Systems Incorporated)
Task: {3C4E56D8-1106-4105-9B91-56C6B76F639C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-06-25] (Google Inc.)
Task: {4B8FB69D-D76D-4C76-AF5F-B1B6346EF10B} - System32\Tasks\{F41372AA-C446-45A5-8A75-C5EA7065D4DD} => D:\Spiele\gothic 2 gold\System\Gothic2.exe
Task: {602CBF44-A887-4F57-9034-C98C4F21E0D5} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2012-06-22] (Piriform Ltd)
Task: {6DADAB95-C553-4AEF-9E10-25D299A92E1F} - System32\Tasks\{998ABE73-6DFC-4F43-9F47-966F84C1B0B8} => D:\Spiele\Gothic\system\GOTHIC.EXE
Task: {8A58A992-EC82-4F84-881D-B8685D1128DE} - System32\Tasks\WISO Mein Sparbuch heute => C:\Program Files (x86)\WISO\Sparbuch 2010\meinsparbuchheute.exe [2009-11-06] ()
Task: {8F0EC9D2-3915-4150-AF20-6DD9A0A21F1C} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\TuneUp Utilities 2013\OneClick.exe [2013-12-10] (TuneUp Software)
Task: {BDA749D9-6F92-4882-862F-25C7CE9F5993} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2012-07-03] (Sun Microsystems, Inc.)
Task: {DCDAD241-17C0-45B6-9969-A4BCCACC65F0} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-06-25] (Google Inc.)
Task: {F1F72175-E89E-4B94-A3CB-439F84DEA408} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2011-02-14 16:32 - 2010-03-15 11:28 - 00052224 _____ () C:\Program Files (x86)\WinRAR\rarext64.dll
2011-02-16 14:59 - 2010-10-15 20:18 - 00349064 _____ () C:\Program Files\Smart PDF Converter\ExplorerExt_x64.dll
2013-06-17 12:35 - 2013-06-17 12:35 - 00478400 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\dblite.dll
2013-05-08 14:52 - 2013-05-08 14:52 - 01270464 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\kpcengine.2.3.dll
2013-05-31 15:12 - 2009-02-27 15:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2013-12-13 14:34 - 2013-12-13 14:34 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-08-15 16:23 - 2013-08-15 16:23 - 00169472 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\cd9a4b4dbc1a4b564ebed696e18cadb6\IsdiInterop.ni.dll
2011-02-12 21:51 - 2010-09-13 18:28 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2013-12-12 11:34 - 2013-12-12 11:34 - 16242056 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\Users\unser\Desktop\Julia:zylomtest
AlternateDataStreams: C:\Users\unser\Desktop\Julia:zylomtr{000HQ7FF-AD7A-3FG3-VK8A-25GG67KOIVUV}
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (01/21/2014 10:11:26 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 26.0.0.5087, Zeitstempel: 0x52a0d273
Name des fehlerhaften Moduls: xul.dll, Version: 26.0.0.5087, Zeitstempel: 0x52a0d20a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0014e1a8
ID des fehlerhaften Prozesses: 0xd4c
Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0
Pfad der fehlerhaften Anwendung: firefox.exe1
Pfad des fehlerhaften Moduls: firefox.exe2
Berichtskennung: firefox.exe3
Error: (01/20/2014 10:32:27 AM) (Source: MsiInstaller) (User: unser-PC)
Description: Produkt: Adobe Reader XI - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011006}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127
Error: (01/18/2014 06:00:05 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: wmplayer.exe, Version: 12.0.7601.18150, Zeitstempel: 0x518c6df8
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0xe50
Startzeit der fehlerhaften Anwendung: 0xwmplayer.exe0
Pfad der fehlerhaften Anwendung: wmplayer.exe1
Pfad des fehlerhaften Moduls: wmplayer.exe2
Berichtskennung: wmplayer.exe3
Error: (01/18/2014 05:59:31 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: wmplayer.exe, Version: 12.0.7601.18150, Zeitstempel: 0x518c6df8
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0x151c
Startzeit der fehlerhaften Anwendung: 0xwmplayer.exe0
Pfad der fehlerhaften Anwendung: wmplayer.exe1
Pfad des fehlerhaften Moduls: wmplayer.exe2
Berichtskennung: wmplayer.exe3
Error: (01/18/2014 05:59:01 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: wmplayer.exe, Version: 12.0.7601.18150, Zeitstempel: 0x518c6df8
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0x484
Startzeit der fehlerhaften Anwendung: 0xwmplayer.exe0
Pfad der fehlerhaften Anwendung: wmplayer.exe1
Pfad des fehlerhaften Moduls: wmplayer.exe2
Berichtskennung: wmplayer.exe3
Error: (01/08/2014 02:40:46 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Integrator.exe, Version: 13.0.4000.179, Zeitstempel: 0x52a75271
Name des fehlerhaften Moduls: rtl120.bpl, Version: 12.0.3420.21218, Zeitstempel: 0x4a0b8b7f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00006c32
ID des fehlerhaften Prozesses: 0x16c8
Startzeit der fehlerhaften Anwendung: 0xIntegrator.exe0
Pfad der fehlerhaften Anwendung: Integrator.exe1
Pfad des fehlerhaften Moduls: Integrator.exe2
Berichtskennung: Integrator.exe3
Error: (01/05/2014 05:59:34 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: wmplayer.exe, Version: 12.0.7601.18150, Zeitstempel: 0x518c6df8
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0x10bc
Startzeit der fehlerhaften Anwendung: 0xwmplayer.exe0
Pfad der fehlerhaften Anwendung: wmplayer.exe1
Pfad des fehlerhaften Moduls: wmplayer.exe2
Berichtskennung: wmplayer.exe3
Error: (01/05/2014 00:47:46 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: wmplayer.exe, Version: 12.0.7601.18150, Zeitstempel: 0x518c6df8
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0x1534
Startzeit der fehlerhaften Anwendung: 0xwmplayer.exe0
Pfad der fehlerhaften Anwendung: wmplayer.exe1
Pfad des fehlerhaften Moduls: wmplayer.exe2
Berichtskennung: wmplayer.exe3
Error: (12/12/2013 11:40:22 AM) (Source: Application Hang) (User: )
Description: Programm firefox.exe, Version 25.0.1.5064 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 108c
Startzeit: 01cef7254561358a
Endzeit: 20
Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Berichts-ID: ca416275-6319-11e3-8855-002683113b9b
Error: (09/24/2013 06:49:19 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: wmplayer.exe, Version: 12.0.7601.17514, Zeitstempel: 0x4ce7a485
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0x1254
Startzeit der fehlerhaften Anwendung: 0xwmplayer.exe0
Pfad der fehlerhaften Anwendung: wmplayer.exe1
Pfad des fehlerhaften Moduls: wmplayer.exe2
Berichtskennung: wmplayer.exe3
System errors:
=============
Error: (01/24/2014 04:39:30 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTLOKALER DIENSTS-1-5-19LocalHost (unter Verwendung von LRPC)
Error: (01/24/2014 04:39:24 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (01/24/2014 04:38:39 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
mv91xx
Error: (01/24/2014 04:26:37 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTLOKALER DIENSTS-1-5-19LocalHost (unter Verwendung von LRPC)
Error: (01/24/2014 04:26:35 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (01/24/2014 04:25:40 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
mv91xx
Error: (01/24/2014 02:49:52 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTLOKALER DIENSTS-1-5-19LocalHost (unter Verwendung von LRPC)
Error: (01/24/2014 02:49:49 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (01/24/2014 02:48:56 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
mv91xx
Error: (01/24/2014 02:45:11 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Microsoft Office Sessions:
=========================
Error: (01/21/2014 10:11:26 AM) (Source: Application Error)(User: )
Description: firefox.exe26.0.0.508752a0d273xul.dll26.0.0.508752a0d20ac00000050014e1a8d4c01cf167dedfe74bbC:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Program Files (x86)\Mozilla Firefox\xul.dll00d984c9-827c-11e3-b7c0-002683113b9b
Error: (01/20/2014 10:32:27 AM) (Source: MsiInstaller)(User: unser-PC)
Description: Adobe Reader XI - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011006}1625(NULL)(NULL)(NULL)
Error: (01/18/2014 06:00:05 AM) (Source: Application Error)(User: )
Description: wmplayer.exe12.0.7601.18150518c6df8unknown0.0.0.000000000c000000500000000e5001cf140a26d201feC:\Program Files (x86)\Windows Media Player\wmplayer.exeunknown64e50750-7ffd-11e3-b394-bcaec5b87ea1
Error: (01/18/2014 05:59:31 AM) (Source: Application Error)(User: )
Description: wmplayer.exe12.0.7601.18150518c6df8unknown0.0.0.000000000c000000500000000151c01cf140a126828e2C:\Program Files (x86)\Windows Media Player\wmplayer.exeunknown50572b74-7ffd-11e3-b394-bcaec5b87ea1
Error: (01/18/2014 05:59:01 AM) (Source: Application Error)(User: )
Description: wmplayer.exe12.0.7601.18150518c6df8unknown0.0.0.000000000c00000050000000048401cf1409ff034e1cC:\Program Files (x86)\Windows Media Player\wmplayer.exeunknown3e68d3d3-7ffd-11e3-b394-bcaec5b87ea1
Error: (01/08/2014 02:40:46 PM) (Source: Application Error)(User: )
Description: Integrator.exe13.0.4000.17952a75271rtl120.bpl12.0.3420.212184a0b8b7fc000000500006c3216c801cf0c770ce0fba1C:\Program Files (x86)\TuneUp Utilities 2013\Integrator.exeC:\Program Files (x86)\TuneUp Utilities 2013\rtl120.bpl799e43e9-786a-11e3-af2e-002683113b9b
Error: (01/05/2014 05:59:34 PM) (Source: Application Error)(User: )
Description: wmplayer.exe12.0.7601.18150518c6df8unknown0.0.0.000000000c00000050000000010bc01cf0a37819acf88C:\Program Files (x86)\Windows Media Player\wmplayer.exeunknownc05aaee8-762a-11e3-bb0c-002683113b9b
Error: (01/05/2014 00:47:46 PM) (Source: Application Error)(User: )
Description: wmplayer.exe12.0.7601.18150518c6df8unknown0.0.0.000000000c000000500000000153401cf0a0bf2f601cbC:\Program Files (x86)\Windows Media Player\wmplayer.exeunknown31824e0c-75ff-11e3-bb0c-002683113b9b
Error: (12/12/2013 11:40:22 AM) (Source: Application Hang)(User: )
Description: firefox.exe25.0.1.5064108c01cef7254561358a20C:\Program Files (x86)\Mozilla Firefox\firefox.execa416275-6319-11e3-8855-002683113b9b
Error: (09/24/2013 06:49:19 PM) (Source: Application Error)(User: )
Description: wmplayer.exe12.0.7601.175144ce7a485unknown0.0.0.000000000c000000500000000125401ceb9466a0f3e6eC:\Program Files (x86)\Windows Media Player\wmplayer.exeunknowna305bd31-2541-11e3-b453-002683113b9b
CodeIntegrity Errors:
===================================
Date: 2014-01-24 17:07:40.350
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-24 17:07:40.350
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-24 17:07:40.350
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-24 16:44:14.246
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-24 16:44:14.246
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-24 16:44:14.246
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-24 15:40:56.249
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-24 15:40:56.249
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-24 15:40:56.249
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-24 15:17:10.448
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 53%
Total physical RAM: 8174.31 MB
Available physical RAM: 3823.41 MB
Total Pagefile: 16346.8 MB
Available Pagefile: 11641.8 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:931.41 GB) (Free:785.73 GB) NTFS
Drive e: () (Fixed) (Total:73.34 GB) (Free:57.34 GB) NTFS
Drive f: (Daten) (Fixed) (Total:159.54 GB) (Free:155.14 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 38BB0ECC)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (Size: 233 GB) (Disk ID: EAFEEAFE)
Partition 1: (Active) - (Size=73 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=160 GB) - (Type=OF Extended)
==================== End Of Log ============================
Code:
GMER 2.1.19355 - hxxp://www.gmer.net
Rootkit scan 2014-01-24 19:03:14
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 SAMSUNG_ rev.1AJ1 931,51GB
Running: gmer.exe; Driver: C:\Users\unser\AppData\Local\Temp\kgloapow.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe[1148] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey 00000000777bfaa8 5 bytes JMP 00000001738018a8
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe[1148] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 00000000777c0038 5 bytes JMP 0000000173801ea1
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe[2200] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075331465 2 bytes [33, 75]
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe[2200] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000753314bb 2 bytes [33, 75]
.text ... * 2
.text C:\Program Files (x86)\MP4 Player\Mp4Player.exe[2576] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075331465 2 bytes [33, 75]
.text C:\Program Files (x86)\MP4 Player\Mp4Player.exe[2576] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000753314bb 2 bytes [33, 75]
.text ... * 2
.text C:\Users\unser\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe[2588] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075331465 2 bytes [33, 75]
.text C:\Users\unser\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe[2588] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000753314bb 2 bytes [33, 75]
.text ... * 2
.text C:\Program Files (x86)\Browny02\BrYNSvc.exe[3484] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075331465 2 bytes [33, 75]
.text C:\Program Files (x86)\Browny02\BrYNSvc.exe[3484] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000753314bb 2 bytes [33, 75]
.text ... * 2
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[1092] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075331465 2 bytes [33, 75]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[1092] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000753314bb 2 bytes [33, 75]
.text ... * 2
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000775c11f5 8 bytes {JMP 0xd}
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000775c1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000775c143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000775c158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000775c191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000775c1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000775c1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000775c1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000775c1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000775c1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000775c1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000775c1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000775c1fd7 8 bytes {JMP 0xb}
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000775c2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000775c2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000775c2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000775c27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000775c27d2 8 bytes {JMP 0x10}
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000775c282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000775c2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000775c2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000775c2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000775c3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000775c323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000775c33c0 16 bytes {JMP 0x4e}
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000775c3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000775c3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000775c3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000775c3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000775c4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077611380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077611500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077611530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077611650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077611700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077611d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077611f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000776127e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000073d913cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000073d9146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000073d916d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 0000000073d916e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000073d919db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000073d919fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000073d91a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000073d91a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000073d91a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe[1136] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000073d91a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
---- Processes - GMER 2.1 ----
Process C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (*** suspicious ***) @ C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [2568] 0000000000400000
Process C:\Users\unser\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe (*** suspicious ***) @ C:\Users\unser\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [2588] 0000000000df0000
Library C:\Users\unser\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\uno_packages\sv5jbln.tmp_\ootb.oxt\Windows\ootb32.dll (*** suspicious ***) @ C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin [1092] 0000000064960000
Library C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{DA2E910D-EF9E-4D4B-A600-EFE17157D9EE}\mpengine.dll (*** suspicious ***) @ C:\Windows\System32\svchost.exe [4956] (Microsoft Malware Protection Engine/Microsoft Corporation SIGNED)(2014-01-24 09:27:33) 000007fee7ac0000
Process C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe (*** suspicious ***) @ C:\Users\unser\AppData\Local\Temp\Rar$EX00.747\gmer.exe [1136](2014-01-24 17:54:53) 0000000000400000
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001583b63dfd
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002683113b9b
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002683113b9b@d875335ba969 0xD6 0xFB 0xC3 0x17 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002683113b9b@fcc734398358 0x13 0x80 0x74 0x64 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\KLIF\Parameters@LastProcessedRevision 52057627
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001583b63dfd (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002683113b9b (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002683113b9b@d875335ba969 0xD6 0xFB 0xC3 0x17 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002683113b9b@fcc734398358 0x13 0x80 0x74 0x64 ...
---- EOF - GMER 2.1 ----
P.S. das Program Malwarebytes hatte ich leider schon einmal vor euren empfohlenen Schritten durchlaufen lassen und alle Elemte gelöscht, leider fehlt das Logfile :headbang:
mfg Driver
und vor Lauter Aufregung schein ich auch noch im falschen bereich gelandet zu sein :eek: |
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
SecurityCheck und:
