Boooh ej, mein 1&1 Stick - Volumen erreicht - bis ich hier war - fast nen Urlaub :blabla:
Also:
Hallo, hat etwas gedauert,
aber jetzt hoffe ich das es geklappt hat.
Die Logs weiter unten.
Ich habe es versucht meiner Mum zu helfen, bin mir aber nicht sicher, ob es was gebracht hat (AV wirklich aus? mit Rechtklick und Admin gestartet?)
Wenn die Logs "umsonst" waren wird die definitiv die Prozedur nicht nochmals machen, No Chance, sorry.
Hoffe, es hat was gebracht und ihr könnt einen Tipp geben um was es hier geht, bitte!
Muss man was beachten um FRST und Gmer wieder runterzuhauen???
Wenn der PC zum Plattmachen gebracht wird! (?)
LG Mimi
FRST:
FRST Logfile:
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-02-2014 01
Ran by ******* (administrator) on HEIDI on 11-02-2014 16:44:13
Running from C:\Users\*******\Desktop
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Cherished Technololgy LIMITED) C:\ProgramData\IePluginService\PluginService.exe
() C:\Program Files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2Service.exe
() C:\Program Files (x86)\Ashampoo\Ashampoo HDD Control 2\AHDDC2_Service.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\system32\dashost.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
(Nico Mak Computing) C:\Program Files (x86)\WinZip Malware Protector\WinZipMalwareProtector.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [IAStorIcon] - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-07-02] (Intel Corporation)
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13219984 2012-11-07] (Realtek Semiconductor)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] - C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [110144 2013-03-05] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] - C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [492248 2012-12-26] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-03-11] (CyberLink Corp.)
HKLM\...\Policies\Explorer: [ConfirmFileDelete] 1
HKU\.DEFAULT\...\Run: [AppLauncher] - C:\Program Files (x86)\Ashampoo\Ashampoo AppLauncher\AppLauncher.exe [969632 2012-08-10] (Ashampoo)
HKU\S-1-5-21-1943009515-3327771416-3860954323-1002\...\Run: [AppLauncher] - C:\Program Files (x86)\Ashampoo\Ashampoo AppLauncher\AppLauncher.exe [969632 2012-08-10] (Ashampoo)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.sweet-page.com/?type=hp&ts=1391692486&from=cor&uid=ST1000DM003-1CH162_Z1D555PGXXXXZ1D555PG
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.sweet-page.com/?type=hp&ts=1391692486&from=cor&uid=ST1000DM003-1CH162_Z1D555PGXXXXZ1D555PG
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1391692486&from=cor&uid=ST1000DM003-1CH162_Z1D555PGXXXXZ1D555PG&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.sweet-page.com/?type=hp&ts=1391692486&from=cor&uid=ST1000DM003-1CH162_Z1D555PGXXXXZ1D555PG
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.sweet-page.com/?type=hp&ts=1391692486&from=cor&uid=ST1000DM003-1CH162_Z1D555PGXXXXZ1D555PG
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.sweet-page.com/web/?type=ds&ts=1391692486&from=cor&uid=ST1000DM003-1CH162_Z1D555PGXXXXZ1D555PG&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1391692486&from=cor&uid=ST1000DM003-1CH162_Z1D555PGXXXXZ1D555PG&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.sweet-page.com/?type=hp&ts=1391692486&from=cor&uid=ST1000DM003-1CH162_Z1D555PGXXXXZ1D555PG
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.sweet-page.com/?type=hp&ts=1391692486&from=cor&uid=ST1000DM003-1CH162_Z1D555PGXXXXZ1D555PG
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.sweet-page.com/web/?type=ds&ts=1391692486&from=cor&uid=ST1000DM003-1CH162_Z1D555PGXXXXZ1D555PG&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.sweet-page.com/?type=sc&ts=1391692486&from=cor&uid=ST1000DM003-1CH162_Z1D555PGXXXXZ1D555PG
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1391692486&from=cor&uid=ST1000DM003-1CH162_Z1D555PGXXXXZ1D555PG&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1391692486&from=cor&uid=ST1000DM003-1CH162_Z1D555PGXXXXZ1D555PG&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1391692486&from=cor&uid=ST1000DM003-1CH162_Z1D555PGXXXXZ1D555PG&q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1391692486&from=cor&uid=ST1000DM003-1CH162_Z1D555PGXXXXZ1D555PG&q={searchTerms}
SearchScopes: HKCU - DefaultScope {1C64E312-CDF5-4FDF-84F9-291057E3AEAD} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=LCJB
SearchScopes: HKCU - {1C64E312-CDF5-4FDF-84F9-291057E3AEAD} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=LCJB
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1391692486&from=cor&uid=ST1000DM003-1CH162_Z1D555PGXXXXZ1D555PG&q={searchTerms}
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\*******\AppData\Roaming\Mozilla\Firefox\Profiles\ce073pkf.default
FF DefaultSearchEngine: sweet-page
FF SelectedSearchEngine: sweet-page
FF Homepage: hxxp://www.sweet-page.com/?type=hp&ts=1391692486&from=cor&uid=ST1000DM003-1CH162_Z1D555PGXXXXZ1D555PG
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\sweet-page.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Extension_Protected - C:\Users\*******\AppData\Roaming\Mozilla\Firefox\Profiles\ce073pkf.default\Extensions\jid0-O6MIff3eO5dIGf5Tcv8RsJDKxrs@jetpack.xpi [2014-02-06]
FF Extension: Lightning Speed Dial - C:\Users\*******\AppData\Roaming\Mozilla\Firefox\Profiles\ce073pkf.default\Extensions\lightningnewtab@gmail.com.xpi [2014-02-06]
FF Extension: RightSurf - C:\Users\*******\AppData\Roaming\Mozilla\Firefox\Profiles\ce073pkf.default\Extensions\{b9a19c25-a741-47e5-91a2-0b62bef307ff}.xpi [2014-02-05]
FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-01-26]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-01-26]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-01-26]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-01-26]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-01-26]
FF HKLM-x32\...\Firefox\Extensions: [lightningnewtab@gmail.com] - C:\Users\*******\AppData\Roaming\Mozilla\Firefox\Profiles\ce073pkf.default\extensions\lightningnewtab@gmail.com.xpi
FF Extension: Lightning Speed Dial - C:\Users\*******\AppData\Roaming\Mozilla\Firefox\Profiles\ce073pkf.default\extensions\lightningnewtab@gmail.com.xpi [2014-02-06]
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.sweet-page.com/?type=sc&ts=1391692486&from=cor&uid=ST1000DM003-1CH162_Z1D555PGXXXXZ1D555PG
==================== Services (Whitelisted) =================
R2 ACT2_Service; C:\Program Files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2Service.exe [1421216 2011-08-22] ()
R2 AHDDC2; C:\Program Files (x86)\Ashampoo\Ashampoo HDD Control 2\AHDDC2_Service.exe [1518504 2012-07-30] ()
R2 avp; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2013-10-17] (Kaspersky Lab ZAO)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [74712 2013-03-11] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [316376 2013-03-11] (CyberLink)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-07-02] (Intel Corporation)
R2 IePluginService; C:\ProgramData\IePluginService\PluginService.exe [508016 2014-01-14] (Cherished Technololgy LIMITED)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-04-11] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-04-11] (Intel Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)
S2 Wpm; C:\ProgramData\WPM\wprotectmanager.exe [493568 2014-02-06] (Cherished Technololgy LIMITED)
==================== Drivers (Whitelisted) ====================
R2 ACT2PM; C:\Program Files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2ProcessMonitor64.sys [15160 2011-06-10] ()
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-01-26] (Kaspersky Lab ZAO)
S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [29792 2014-01-26] (Kaspersky Lab)
S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [112224 2013-06-08] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [623712 2014-01-26] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\system32\DRIVERS\klim6.sys [30304 2013-10-17] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\system32\DRIVERS\klkbdflt.sys [29280 2013-10-17] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\system32\DRIVERS\klmouflt.sys [29280 2013-10-17] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\system32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 klwfp; C:\Windows\system32\DRIVERS\klwfp.sys [64608 2013-05-07] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\system32\DRIVERS\kneps.sys [178272 2014-01-26] (Kaspersky Lab ZAO)
S3 RTL8192cu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1576080 2012-08-07] (Realtek Semiconductor Corporation )
S3 RtlWlanu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1576080 2012-08-07] (Realtek Semiconductor Corporation )
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-02-11 16:44 - 2014-02-11 16:44 - 00017594 _____ () C:\Users\*******\Desktop\FRST.txt
2014-02-11 16:43 - 2014-02-11 16:44 - 00000000 ____D () C:\FRST
2014-02-11 16:40 - 2014-02-11 16:40 - 02151424 _____ (Farbar) C:\Users\*******\Desktop\FRST64.exe
2014-02-10 20:55 - 2014-02-11 16:05 - 00129957 _____ () C:\Windows\WindowsUpdate.log
2014-02-10 16:59 - 2014-02-10 17:50 - 00000000 ____D () C:\Program Files (x86)\WinZip Malware Protector
2014-02-10 16:59 - 2014-02-10 16:59 - 00003116 _____ () C:\Windows\System32\Tasks\WinZip Malware Protector_startup
2014-02-10 16:59 - 2014-02-10 16:59 - 00000000 ____D () C:\Users\*******\AppData\Roaming\Nico Mak Computing
2014-02-10 16:59 - 2014-02-10 16:59 - 00000000 ____D () C:\ProgramData\Nico Mak Computing
2014-02-10 16:59 - 2013-03-15 17:10 - 00020480 _____ () C:\Windows\system32\wsusnative64.exe
2014-02-10 16:58 - 2014-02-10 15:46 - 04892480 _____ (WinZip International LLC ) C:\Program Files (x86)\wzmp_8.exe
2014-02-08 14:32 - 2014-02-08 14:32 - 00000000 ____D () C:\ProgramData\AMMYY
2014-02-08 14:26 - 2014-02-08 14:26 - 04386896 _____ (TeamViewer) C:\Users\*******\Downloads\TeamViewerQS_en-ckq.exe
2014-02-07 21:18 - 2014-02-07 21:18 - 00000000 _SHDL () C:\Programme
2014-02-07 21:18 - 2014-02-07 21:18 - 00000000 _SHDL () C:\Dokumente und Einstellungen
2014-02-07 21:01 - 2014-02-07 21:01 - 00000000 __SHD () C:\Recovery
2014-02-07 20:58 - 2014-02-07 20:58 - 00262144 _____ () C:\Windows\system32\config\userdiff
2014-02-07 20:16 - 2014-02-08 14:37 - 00083805 _____ () C:\Windows\diagwrn.xml
2014-02-07 20:16 - 2014-02-08 14:37 - 00083805 _____ () C:\Windows\diagerr.xml
2014-02-07 17:21 - 2014-02-07 17:21 - 00004030 _____ () C:\Windows\System32\Tasks\LaunchApp
2014-02-06 14:17 - 2014-02-06 14:18 - 00001146 _____ () C:\Users\*******\Desktop\Die Installation von Internet Explorer 10 fortsetzen.lnk
2014-02-06 14:15 - 2014-02-11 15:43 - 00000000 ____D () C:\Program Files (x86)\SupTab
2014-02-06 14:15 - 2014-02-06 14:15 - 30091776 _____ (Microsoft Corporation) C:\Users\*******\Downloads\InternetExplorer [1].exe
2014-02-06 14:15 - 2014-02-06 14:15 - 00000000 ____D () C:\ProgramData\WPM
2014-02-06 14:15 - 2014-02-06 14:15 - 00000000 ____D () C:\ProgramData\IePluginService
2014-02-06 14:14 - 2014-02-06 14:16 - 00000000 ____D () C:\Program Files (x86)\RightSurf
2014-02-06 14:13 - 2014-02-11 15:05 - 00000000 ____D () C:\Users\*******\AppData\Roaming\systweak
2014-02-06 14:13 - 2014-02-11 15:01 - 00000298 _____ () C:\Windows\Tasks\RegClean Pro_DEFAULT.job
2014-02-06 14:13 - 2014-02-08 14:18 - 00003108 _____ () C:\Windows\System32\Tasks\RegClean Pro
2014-02-06 14:13 - 2014-02-07 19:01 - 00000306 _____ () C:\Windows\Tasks\RegClean Pro_UPDATES.job
2014-02-06 14:13 - 2014-02-06 14:13 - 00003032 _____ () C:\Windows\System32\Tasks\RegClean Pro_UPDATES
2014-02-06 14:13 - 2014-02-06 14:13 - 00002876 _____ () C:\Windows\System32\Tasks\RegClean Pro_DEFAULT
2014-02-06 14:13 - 2013-12-27 18:10 - 00020312 _____ (Systweak Inc., (www.systweak.com)) C:\Windows\system32\roboot64.exe
2014-02-06 14:11 - 2014-02-06 14:11 - 00654616 _____ ( ) C:\Users\*******\Downloads\InternetExplorer.exe
2014-02-06 14:02 - 2014-02-06 14:02 - 04721144 _____ (Piriform Ltd) C:\Users\*******\Downloads\ccsetup410pro.exe
2014-01-28 19:18 - 2014-01-28 19:18 - 00000000 ____D () C:\Users\*******\AppData\Roaming\CyberLink
2014-01-26 16:32 - 2014-01-26 16:32 - 00002338 _____ () C:\Users\*******\Desktop\Sicherer Zahlungsverkehr.lnk
2014-01-26 16:32 - 2014-01-26 16:32 - 00001333 _____ () C:\Users\*******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security.lnk
2014-01-26 16:29 - 2014-01-26 16:28 - 00001128 _____ () C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-01-26 14:53 - 2014-01-26 15:35 - 257813336 _____ () C:\Users\*******\Downloads\kis14.0.0.4651de-de.exe
2014-01-26 14:50 - 2014-01-26 16:11 - 256314176 _____ () C:\Users\*******\Downloads\kis14.0.0.4651abDE_5169.exe
2014-01-16 14:48 - 2013-12-07 07:37 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-01-16 14:48 - 2013-12-07 07:37 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-01-16 14:48 - 2013-12-07 06:15 - 00562688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-01-16 14:48 - 2013-12-07 06:15 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-01-16 14:48 - 2013-10-31 06:56 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\MPSSVC.dll
2014-01-16 14:48 - 2013-10-31 06:56 - 00758784 _____ (Microsoft Corporation) C:\Windows\system32\FirewallAPI.dll
2014-01-16 14:48 - 2013-10-31 05:01 - 00550400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FirewallAPI.dll
2014-01-16 14:48 - 2013-10-31 04:42 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mpsdrv.sys
2014-01-16 14:48 - 2013-10-28 06:50 - 00588288 _____ (Microsoft Corporation) C:\Windows\system32\SHCore.dll
2014-01-16 14:48 - 2013-10-28 05:05 - 00452608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SHCore.dll
2014-01-16 14:48 - 2013-10-13 21:49 - 00100696 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\disk.sys
2014-01-16 14:48 - 2013-08-27 06:21 - 00227840 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2014-01-16 14:48 - 2013-08-27 06:19 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2014-01-16 14:48 - 2013-08-26 23:29 - 00199168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2014-01-16 14:48 - 2013-08-26 23:28 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2014-01-14 11:55 - 2014-01-14 11:55 - 00000000 ____D () C:\Program Files (x86)\Belkin
==================== One Month Modified Files and Folders =======
2014-02-11 16:44 - 2014-02-11 16:44 - 00017594 _____ () C:\Users\*******\Desktop\FRST.txt
2014-02-11 16:44 - 2014-02-11 16:43 - 00000000 ____D () C:\FRST
2014-02-11 16:41 - 2013-12-18 19:45 - 00000000 ____D () C:\Users\*******\Documents\Outlook-Dateien
2014-02-11 16:40 - 2014-02-11 16:40 - 02151424 _____ (Farbar) C:\Users\*******\Desktop\FRST64.exe
2014-02-11 16:36 - 2013-03-25 09:34 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-02-11 16:33 - 2013-11-10 12:39 - 00000000 ____D () C:\Users\*******\AppData\Local\Packages
2014-02-11 16:05 - 2014-02-10 20:55 - 00129957 _____ () C:\Windows\WindowsUpdate.log
2014-02-11 16:05 - 2013-11-26 19:18 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-11 16:00 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\sru
2014-02-11 15:59 - 2013-11-28 19:15 - 00000000 ____D () C:\Users\*******\Documents\Eigene Dokumente
2014-02-11 15:55 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\AUInstallAgent
2014-02-11 15:43 - 2014-02-06 14:15 - 00000000 ____D () C:\Program Files (x86)\SupTab
2014-02-11 15:15 - 2013-11-10 13:54 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1943009515-3327771416-3860954323-1002
2014-02-11 15:05 - 2014-02-06 14:13 - 00000000 ____D () C:\Users\*******\AppData\Roaming\systweak
2014-02-11 15:01 - 2014-02-06 14:13 - 00000298 _____ () C:\Windows\Tasks\RegClean Pro_DEFAULT.job
2014-02-10 17:50 - 2014-02-10 16:59 - 00000000 ____D () C:\Program Files (x86)\WinZip Malware Protector
2014-02-10 16:59 - 2014-02-10 16:59 - 00003116 _____ () C:\Windows\System32\Tasks\WinZip Malware Protector_startup
2014-02-10 16:59 - 2014-02-10 16:59 - 00000000 ____D () C:\Users\*******\AppData\Roaming\Nico Mak Computing
2014-02-10 16:59 - 2014-02-10 16:59 - 00000000 ____D () C:\ProgramData\Nico Mak Computing
2014-02-10 16:59 - 2013-03-22 14:08 - 00756568 _____ () C:\Windows\system32\perfh007.dat
2014-02-10 16:59 - 2013-03-22 14:08 - 00157238 _____ () C:\Windows\system32\perfc007.dat
2014-02-10 16:59 - 2012-07-26 08:28 - 01757638 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-10 15:46 - 2014-02-10 16:58 - 04892480 _____ (WinZip International LLC ) C:\Program Files (x86)\wzmp_8.exe
2014-02-09 12:56 - 2013-03-22 13:23 - 00000000 ____D () C:\Windows\Panther
2014-02-08 16:07 - 2012-07-26 08:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-08 14:37 - 2014-02-07 20:16 - 00083805 _____ () C:\Windows\diagwrn.xml
2014-02-08 14:37 - 2014-02-07 20:16 - 00083805 _____ () C:\Windows\diagerr.xml
2014-02-08 14:34 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\Registration
2014-02-08 14:32 - 2014-02-08 14:32 - 00000000 ____D () C:\ProgramData\AMMYY
2014-02-08 14:26 - 2014-02-08 14:26 - 04386896 _____ (TeamViewer) C:\Users\*******\Downloads\TeamViewerQS_en-ckq.exe
2014-02-08 14:18 - 2014-02-06 14:13 - 00003108 _____ () C:\Windows\System32\Tasks\RegClean Pro
2014-02-08 12:21 - 2013-11-23 18:30 - 00000000 ___HD () C:\Windows\system32\CanonIJ Uninstaller Information
2014-02-08 12:21 - 2013-11-10 12:40 - 00000000 ___RD () C:\Users\*******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-08 12:21 - 2013-11-10 12:40 - 00000000 ___RD () C:\Users\*******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-02-08 12:21 - 2013-11-10 12:39 - 00000000 ___RD () C:\Users\*******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-02-08 12:21 - 2013-11-10 12:39 - 00000000 ___RD () C:\Users\*******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-02-08 12:21 - 2013-11-10 12:39 - 00000000 ____D () C:\Users\*******
2014-02-08 12:21 - 2013-08-29 14:14 - 00000000 ___RD () C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-02-08 12:21 - 2013-08-29 14:14 - 00000000 ___RD () C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-02-08 12:21 - 2013-08-29 14:14 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-02-08 12:21 - 2013-08-29 14:14 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-02-08 12:21 - 2013-06-25 15:08 - 00000000 ____D () C:\Windows\tr
2014-02-08 12:21 - 2013-06-25 15:08 - 00000000 ____D () C:\Windows\sv
2014-02-08 12:21 - 2013-06-25 15:08 - 00000000 ____D () C:\Windows\sl
2014-02-08 12:21 - 2013-06-25 15:08 - 00000000 ____D () C:\Windows\pl
2014-02-08 12:21 - 2013-06-25 15:08 - 00000000 ____D () C:\Windows\nl
2014-02-08 12:21 - 2013-06-25 15:08 - 00000000 ____D () C:\Windows\it
2014-02-08 12:21 - 2013-06-25 15:08 - 00000000 ____D () C:\Windows\hu
2014-02-08 12:21 - 2013-06-25 15:08 - 00000000 ____D () C:\Windows\fr
2014-02-08 12:21 - 2013-06-25 15:08 - 00000000 ____D () C:\Windows\fi
2014-02-08 12:21 - 2013-06-25 15:08 - 00000000 ____D () C:\Windows\es
2014-02-08 12:21 - 2013-06-25 15:08 - 00000000 ____D () C:\Windows\el
2014-02-08 12:21 - 2013-06-25 15:08 - 00000000 ____D () C:\Windows\de
2014-02-08 12:21 - 2013-06-25 15:08 - 00000000 ____D () C:\Windows\da
2014-02-08 12:21 - 2013-03-22 13:27 - 00000000 ____D () C:\ProgramData\PRICache
2014-02-08 12:21 - 2012-07-26 10:45 - 00000000 ____D () C:\Windows\ShellNew
2014-02-08 12:21 - 2012-07-26 10:43 - 00000000 ____D () C:\Windows\SysWOW64\WCN
2014-02-08 12:21 - 2012-07-26 10:43 - 00000000 ____D () C:\Windows\SysWOW64\sysprep
2014-02-08 12:21 - 2012-07-26 10:43 - 00000000 ____D () C:\Windows\system32\WCN
2014-02-08 12:21 - 2012-07-26 10:43 - 00000000 ____D () C:\Windows\en-GB
2014-02-08 12:21 - 2012-07-26 09:18 - 00000000 ____D () C:\Windows\DigitalLocker
2014-02-08 12:21 - 2012-07-26 09:12 - 00000000 __SHD () C:\Program Files\Windows Sidebar
2014-02-08 12:21 - 2012-07-26 09:12 - 00000000 __SHD () C:\Program Files (x86)\Windows Sidebar
2014-02-08 12:21 - 2012-07-26 09:12 - 00000000 __RSD () C:\Windows\Media
2014-02-08 12:21 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\spool
2014-02-08 12:21 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\Recovery
2014-02-08 12:21 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\NDF
2014-02-08 12:21 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\IME
2014-02-08 12:21 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\Help
2014-02-08 12:21 - 2012-07-26 09:12 - 00000000 ____D () C:\Program Files\Common Files\System
2014-02-08 12:21 - 2012-07-26 09:12 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-02-08 12:21 - 2012-07-26 06:38 - 00000000 ____D () C:\Windows\SysWOW64\SMI
2014-02-08 12:21 - 2012-07-26 06:38 - 00000000 ____D () C:\Windows\SysWOW64\oobe
2014-02-08 12:21 - 2012-07-26 06:38 - 00000000 ____D () C:\Windows\system32\Sysprep
2014-02-07 21:18 - 2014-02-07 21:18 - 00000000 _SHDL () C:\Programme
2014-02-07 21:18 - 2014-02-07 21:18 - 00000000 _SHDL () C:\Dokumente und Einstellungen
2014-02-07 21:15 - 2013-08-29 14:02 - 01804472 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-02-07 21:12 - 2012-07-26 06:26 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-02-07 21:11 - 2012-07-26 06:26 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2014-02-07 21:01 - 2014-02-07 21:01 - 00000000 __SHD () C:\Recovery
2014-02-07 20:58 - 2014-02-07 20:58 - 00262144 _____ () C:\Windows\system32\config\userdiff
2014-02-07 19:01 - 2014-02-06 14:13 - 00000306 _____ () C:\Windows\Tasks\RegClean Pro_UPDATES.job
2014-02-07 17:21 - 2014-02-07 17:21 - 00004030 _____ () C:\Windows\System32\Tasks\LaunchApp
2014-02-06 14:18 - 2014-02-06 14:17 - 00001146 _____ () C:\Users\*******\Desktop\Die Installation von Internet Explorer 10 fortsetzen.lnk
2014-02-06 14:16 - 2014-02-06 14:14 - 00000000 ____D () C:\Program Files (x86)\RightSurf
2014-02-06 14:15 - 2014-02-06 14:15 - 30091776 _____ (Microsoft Corporation) C:\Users\*******\Downloads\InternetExplorer [1].exe
2014-02-06 14:15 - 2014-02-06 14:15 - 00000000 ____D () C:\ProgramData\WPM
2014-02-06 14:15 - 2014-02-06 14:15 - 00000000 ____D () C:\ProgramData\IePluginService
2014-02-06 14:14 - 2013-11-26 19:11 - 00001359 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-02-06 14:14 - 2013-11-10 12:40 - 00002071 _____ () C:\Users\Public\Desktop\eBay.lnk
2014-02-06 14:14 - 2013-11-10 12:40 - 00002061 _____ () C:\Users\*******\Desktop\MEDION Serviceportal.lnk
2014-02-06 14:14 - 2013-11-10 12:40 - 00001662 _____ () C:\Users\*******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-02-06 14:14 - 2013-11-10 12:40 - 00001301 _____ () C:\Users\Public\Desktop\Medion Telefondienste.lnk
2014-02-06 14:14 - 2013-11-10 12:39 - 00001233 _____ () C:\Users\*******\Desktop\Windows 8 Info.lnk
2014-02-06 14:13 - 2014-02-06 14:13 - 00003032 _____ () C:\Windows\System32\Tasks\RegClean Pro_UPDATES
2014-02-06 14:13 - 2014-02-06 14:13 - 00002876 _____ () C:\Windows\System32\Tasks\RegClean Pro_DEFAULT
2014-02-06 14:11 - 2014-02-06 14:11 - 00654616 _____ ( ) C:\Users\*******\Downloads\InternetExplorer.exe
2014-02-06 14:05 - 2013-11-26 19:18 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-06 14:02 - 2014-02-06 14:02 - 04721144 _____ (Piriform Ltd) C:\Users\*******\Downloads\ccsetup410pro.exe
2014-01-28 19:34 - 2013-08-29 14:43 - 00000000 ____D () C:\ProgramData\CyberLink
2014-01-28 19:18 - 2014-01-28 19:18 - 00000000 ____D () C:\Users\*******\AppData\Roaming\CyberLink
2014-01-28 19:18 - 2013-11-10 13:49 - 00000000 ____D () C:\Users\Public\Documents\CyberLink
2014-01-26 16:57 - 2013-10-17 15:47 - 00623712 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-01-26 16:57 - 2013-10-17 15:47 - 00458336 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kl1.sys
2014-01-26 16:57 - 2013-06-06 17:38 - 00178272 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kneps.sys
2014-01-26 16:57 - 2012-07-27 18:38 - 00029792 _____ (Kaspersky Lab) C:\Windows\system32\Drivers\klelam.sys
2014-01-26 16:32 - 2014-01-26 16:32 - 00002338 _____ () C:\Users\*******\Desktop\Sicherer Zahlungsverkehr.lnk
2014-01-26 16:32 - 2014-01-26 16:32 - 00001333 _____ () C:\Users\*******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security.lnk
2014-01-26 16:29 - 2013-03-25 09:34 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab
2014-01-26 16:28 - 2014-01-26 16:29 - 00001128 _____ () C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-01-26 16:11 - 2014-01-26 14:50 - 256314176 _____ () C:\Users\*******\Downloads\kis14.0.0.4651abDE_5169.exe
2014-01-26 15:36 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\rescache
2014-01-26 15:35 - 2014-01-26 14:53 - 257813336 _____ () C:\Users\*******\Downloads\kis14.0.0.4651de-de.exe
2014-01-22 14:54 - 2013-11-26 19:16 - 00000000 ____D () C:\Users\*******\AppData\Local\Adobe
2014-01-17 20:17 - 2012-07-26 10:45 - 00000000 ____D () C:\Program Files\Windows Journal
2014-01-17 20:17 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\WinStore
2014-01-17 20:17 - 2012-07-26 09:12 - 00000000 ____D () C:\Program Files\Windows Photo Viewer
2014-01-17 20:17 - 2012-07-26 09:12 - 00000000 ____D () C:\Program Files\Windows Defender
2014-01-17 20:17 - 2012-07-26 09:12 - 00000000 ____D () C:\Program Files (x86)\Windows Photo Viewer
2014-01-17 20:17 - 2012-07-26 09:12 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2014-01-17 20:16 - 2013-03-22 14:06 - 00000000 ____D () C:\Windows\SysWOW64\XPSViewer
2014-01-17 20:16 - 2012-07-26 10:43 - 00000000 ____D () C:\Windows\SysWOW64\winrm
2014-01-17 20:16 - 2012-07-26 10:43 - 00000000 ____D () C:\Windows\SysWOW64\slmgr
2014-01-17 20:16 - 2012-07-26 10:43 - 00000000 ____D () C:\Windows\SysWOW64\Printing_Admin_Scripts
2014-01-17 20:16 - 2012-07-26 10:43 - 00000000 ____D () C:\Windows\system32\winrm
2014-01-17 20:16 - 2012-07-26 10:43 - 00000000 ____D () C:\Windows\system32\slmgr
2014-01-17 20:16 - 2012-07-26 09:12 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel
2014-01-17 20:16 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\SysWOW64\migwiz
2014-01-17 20:16 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\SysWOW64\Com
2014-01-17 20:16 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\migwiz
2014-01-17 20:16 - 2012-07-26 06:38 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-01-17 20:16 - 2012-07-26 06:38 - 00000000 ____D () C:\Windows\system32\oobe
2014-01-17 20:14 - 2012-07-26 06:38 - 00000000 ____D () C:\Windows\system32\Dism
2014-01-17 20:13 - 2012-07-26 10:43 - 00000000 ____D () C:\Windows\system32\Printing_Admin_Scripts
2014-01-17 20:13 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\SystemResetPlatform
2014-01-17 20:13 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\Com
2014-01-17 20:11 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\SysWOW64\MUI
2014-01-17 20:06 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-01-17 20:05 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\MUI
2014-01-16 18:05 - 2013-12-08 12:52 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-01-16 18:05 - 2013-11-23 18:48 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-16 18:05 - 2012-07-26 06:26 - 00000167 _____ () C:\Windows\win.ini
2014-01-16 18:04 - 2013-03-22 18:03 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-16 16:28 - 2012-07-26 06:37 - 00000000 ____D () C:\Windows\servicing
2014-01-14 15:26 - 2013-11-26 19:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-01-14 15:14 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\SysWOW64\sl-SI
2014-01-14 15:13 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\sl-SI
2014-01-14 11:55 - 2014-01-14 11:55 - 00000000 ____D () C:\Program Files (x86)\Belkin
2014-01-14 11:55 - 2013-03-25 11:31 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-02-08 12:41
==================== End Of Log ============================
--- --- ---
--- --- ---
Addition: Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-02-2014 01
Ran by ****** at 2014-02-11 16:44:28
Running from C:\Users\******\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
==================== Installed Programs ======================
Adobe Flash Player 12 Plugin (x32 Version: 12.0.0.44 - Adobe Systems Incorporated)
Ashampoo AppLauncher v.1.0.0 (x32 Version: 1.0.0 - Ashampoo GmbH & Co. KG)
Ashampoo Burning Studio 11 v.11.0.4 (x32 Version: 11.0.4 - Ashampoo GmbH & Co. KG)
Ashampoo Core Tuner 2 v.2.0.1 (x32 Version: 2.01 - Ashampoo GmbH & Co. KG)
Ashampoo GetBack Photo v.1.0.1 (x32 Version: 1.0.1 - Ashampoo GmbH & Co. KG)
Ashampoo HDD Control 2 v.2.1.0 (x32 Version: 2.1.0 - Ashampoo GmbH & Co. KG)
Ashampoo Music Studio 4 v.4.0.1 (x32 Version: 4.0.1 - Ashampoo GmbH & Co. KG)
Ashampoo Photo Commander 10 v.10.1.3 (x32 Version: 10.1.3 - Ashampoo GmbH & Co. KG)
Ashampoo Photo Optimizer 5 v.5.1.2 (x32 Version: 5.1.2 - Ashampoo GmbH & Co. KG)
Ashampoo Slideshow Studio HD 2 v.2.0.5 (x32 Version: 2.0.5 - Ashampoo GmbH & Co. KG)
Ashampoo Snap 5 v.5.1.5 (x32 Version: 5.1.5 - Ashampoo GmbH & Co. KG)
Ashampoo UnInstaller 4 v.4.30 (x32 Version: 4.3.0 - Ashampoo GmbH & Co. KG)
Ashampoo Video Styler v.1.0.1 (x32 Version: 1.0.1 - Ashampoo GmbH & Co. KG)
Ashampoo WinOptimizer 9 v.9.04.31 (x32 Version: 9.04.31 - Ashampoo GmbH & Co. KG)
Belkin USB Wireless Adapter (x32 Version: 1.0.0.12 - Belkin)
Belkin USB Wireless Adapter (x32 Version: 1.0.0.12 - Belkin) Hidden
Canon iP4900 series Printer Driver (Version: - )
CCleaner (Version: 4.08 - Piriform)
CyberLink LabelPrint 2.5 (x32 Version: 2.5.5415 - CyberLink Corp.) Hidden
CyberLink MediaEspresso 6.5 (x32 Version: 6.5.3807_46074 - CyberLink Corp.) Hidden
CyberLink Power2Go 8 (x32 Version: 8.0.0.2426b - CyberLink Corp.) Hidden
CyberLink PowerDVD 10 (x32 Version: 10.0.5211.02 - CyberLink Corp.) Hidden
CyberLink PowerDVD Copy 1.5 (x32 Version: 1.5.0.3725 - CyberLink Corp.) Hidden
CyberLink PowerRecover (Version: 5.7.0.0913 - CyberLink Corp.) Hidden
CyberLink PowerRecover (x32 Version: 5.7.0.0913 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Definition Update for Microsoft Office 2013 (KB2760587) 64-Bit Edition (Version: - Microsoft)
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotogalerija (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotogalleri (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotogalleriet (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotoğraf Galerisi (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotótár (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galeria de Fotografias (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galería de fotos (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galeria fotografii (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
IePluginService12.27.0.3326 (x32 Version: 12.27.0.3326 - Cherished Technololgy LIMITED) <==== ATTENTION
Intel(R) Manageability Engine Firmware Recovery Agent (x32 Version: 1.0.0.36702 - Intel Corporation)
Intel(R) Management Engine Components (x32 Version: 9.0.0.1323 - Intel Corporation)
Intel(R) Rapid Storage Technology (Version: 12.7.0.1036 - Intel Corporation)
Intel(R) Rapid Storage Technology (Version: 12.7.0.1036 - Intel Corporation) Hidden
Intel® Trusted Connect Service Client (Version: 1.27.798.1 - Intel Corporation) Hidden
Kaspersky Internet Security (x32 Version: 14.0.0.4651 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 14.0.0.4651 - Kaspersky Lab) Hidden
Medion Home Cinema 10 (x32 Version: 10.0 - CyberLink Corp.)
Medion Home Cinema 10 (x32 Version: 10.2419 - CyberLink Corp.) Hidden
Microsoft Access MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft DCF MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Excel MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Groove MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft InfoPath MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Lync MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office 32-bit Components 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Korrekturhilfen 2013 - Deutsch (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office OSM MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office OSM UX MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2013 (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2013 - English (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2013 - Italiano (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Shared 32-bit MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft OneNote MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Outlook MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft PowerPoint MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Publisher MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft Word MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0 - Microsoft Corporation)
NVIDIA Control Panel 320.49 (Version: 320.49 - NVIDIA Corporation) Hidden
NVIDIA Graphics Driver 320.49 (Version: 320.49 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.26.4 (Version: 1.3.26.4 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.124.810 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.0604 - NVIDIA Corporation) Hidden
NVIDIA PhysX System Software 9.13.0604 (Version: 9.13.0604 - NVIDIA Corporation)
NVIDIA Update 1.14.17 (Version: 1.14.17 - NVIDIA Corporation)
NVIDIA Update Components (Version: 1.14.17 - NVIDIA Corporation) Hidden
Outils de vérification linguistique 2013 de Microsoft Office - Français (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Raccolta foto (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Realtek Ethernet Controller Driver (x32 Version: 8.10.1226.2012 - Realtek)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6777 - Realtek Semiconductor Corp.)
Secure Download Manager (x32 Version: 3.1.40 - Kivuto Solutions Inc.)
Update for Microsoft Access 2013 (KB2768008) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Access 2013 (KB2827233) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft InfoPath 2013 (KB2837648) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Lync 2013 (KB2817678) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2726954) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2726996) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2738038) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2760224) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2760242) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2760267) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2760539) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2760553) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2760610) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2767845) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2768016) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2817314) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2817316) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2817490) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2817626) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2826004) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2827225) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2827227) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2827230) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2827239) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2837626) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2837637) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2837638) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2837655) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2850066) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft OneNote 2013 (KB2850063) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Outlook 2013 (KB2850061) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft PowerPoint 2013 (KB2767850) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Project 2013 (KB2727085) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Publisher 2013 (KB2837635) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft SkyDrive Pro (KB2817495) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft SkyDrive Pro (KB2837652) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Visio 2013 (KB2817306) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Visio Viewer 2013 (KB2768338) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Word 2013 (KB2837647) 64-Bit Edition (Version: - Microsoft)
Valokuvavalikoima (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 16.4.3508.0205 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Temel Parçalar (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Liven peruspaketti (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Συλλογή φωτογραφιών (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
==================== Restore Points =========================
10-02-2014 14:51:49 Windows Update
Und zu guter letzt GMER: Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-02-11 18:42:37
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\0000003b ST1000DM003-1CH162 rev.CC47 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\HEIDIH~1\AppData\Local\Temp\pgtoipob.sys
---- User code sections - GMER 2.1 ----
.text C:\Windows\System32\spoolsv.exe[1680] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007fad390177a 4 bytes [90, D3, FA, 07]
.text C:\Windows\System32\spoolsv.exe[1680] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007fad3901782 4 bytes [90, D3, FA, 07]
.text C:\Windows\System32\dwm.exe[1248] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007fad390177a 4 bytes [90, D3, FA, 07]
.text C:\Windows\System32\dwm.exe[1248] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007fad3901782 4 bytes [90, D3, FA, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1168] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fad0031532 4 bytes [03, D0, FA, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1168] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fad003153a 4 bytes [03, D0, FA, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1168] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fad003165a 4 bytes [03, D0, FA, 07]
.text C:\Windows\system32\nvvsvc.exe[1096] C:\Windows\system32\MSIMG32.dll!GradientFill + 690 000007fad0031532 4 bytes [03, D0, FA, 07]
.text C:\Windows\system32\nvvsvc.exe[1096] C:\Windows\system32\MSIMG32.dll!GradientFill + 698 000007fad003153a 4 bytes [03, D0, FA, 07]
.text C:\Windows\system32\nvvsvc.exe[1096] C:\Windows\system32\MSIMG32.dll!TransparentBlt + 246 000007fad003165a 4 bytes [03, D0, FA, 07]
.text C:\Windows\system32\nvvsvc.exe[1096] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007fad390177a 4 bytes [90, D3, FA, 07]
.text C:\Windows\system32\nvvsvc.exe[1096] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007fad3901782 4 bytes [90, D3, FA, 07]
.text C:\Windows\Explorer.EXE[2804] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007fad390177a 4 bytes [90, D3, FA, 07]
.text C:\Windows\Explorer.EXE[2804] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007fad3901782 4 bytes [90, D3, FA, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2644] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fad0031532 4 bytes [03, D0, FA, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2644] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fad003153a 4 bytes [03, D0, FA, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2644] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fad003165a 4 bytes [03, D0, FA, 07]
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\SYSTEM32\ntdll.dll!RtlLeaveCriticalSection + 61 000007fad437104d 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\SYSTEM32\ntdll.dll!RtlEnterCriticalSection + 39 000007fad4371087 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\SYSTEM32\ntdll.dll!RtlGetCurrentUmsThread + 77 000007fad43710dd 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\SYSTEM32\ntdll.dll!RtlGetCurrentUmsThread + 128 000007fad4371110 48 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\SYSTEM32\ntdll.dll!_local_unwind + 36 000007fad4371174 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\SYSTEM32\ntdll.dll!memcmp + 199 000007fad4371257 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\SYSTEM32\ntdll.dll!strcat + 144 000007fad4371300 16 bytes {JMP 0xffffffffffffff8c}
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\SYSTEM32\ntdll.dll!strcpy + 183 000007fad43713d7 40 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\SYSTEM32\ntdll.dll!strlen + 168 000007fad4371578 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\SYSTEM32\ntdll.dll!strncat + 405 000007fad4371725 32 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\SYSTEM32\ntdll.dll!strncmp + 181 000007fad4371805 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\SYSTEM32\ntdll.dll!strncpy + 354 000007fad4371982 64 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\SYSTEM32\ntdll.dll!RtlGetCurrentProcessorNumberEx + 52 000007fad4371a24 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\SYSTEM32\ntdll.dll!NtdllDialogWndProc_W + 601 000007fad4371dee 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\SYSTEM32\ntdll.dll!DbgUserBreakPoint + 99 000007fad4371e73 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\SYSTEM32\ntdll.dll!RtlInterlockedPushListSList + 118 000007fad4372096 48 bytes {JMP 0xffffffffffffffc0}
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\SYSTEM32\ntdll.dll!RtlpUmsExecuteYieldThreadEnd + 403 000007fad43725b4 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\SYSTEM32\ntdll.dll!__chkstk + 77 000007fad437261d 40 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\SYSTEM32\ntdll.dll!_setjmp + 160 000007fad43726f0 16 bytes {JMP RAX}
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\SYSTEM32\ntdll.dll!longjmp + 236 000007fad437289c 32 bytes {JMP 0xffffffffffffffb9}
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000007fad4372cb0 8 bytes {JMP QWORD [RIP-0x402]}
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000007fad4372e30 8 bytes {JMP QWORD [RIP-0x51b]}
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000007fad4372e60 8 bytes {JMP QWORD [RIP-0x5ca]}
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000007fad4372f80 8 bytes {JMP QWORD [RIP-0x6da]}
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000007fad4373030 8 bytes {JMP QWORD [RIP-0x792]}
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000007fad43736f1 8 bytes {JMP QWORD [RIP-0xca0]}
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000007fad43739d1 8 bytes {JMP QWORD [RIP-0x1018]}
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000007fad4374251 8 bytes {JMP QWORD [RIP-0x18a0]}
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 616 00000000777c15f0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\system32\wow64cpu.dll!CpuProcessTerm + 3 00000000777c15fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 272 00000000777c17d4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 140 00000000777c18c4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 00000000777c18e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\system32\wow64cpu.dll!CpuSetStackPointer + 23 00000000777c1903 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000777c1923 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000777c195f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\system32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000777c196b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*******\Desktop\Gmer-19357.exe[4368] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000777c1977 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
---- Threads - GMER 2.1 ----
Thread C:\Windows\system32\csrss.exe [1892:3700] fffff960008645e8
---- Processes - GMER 2.1 ----
Process C:\ProgramData\WPM\wprotectmanager.exe (*** suspicious ***) @ C:\ProgramData\WPM\wprotectmanager.exe [1604] (WPM Service/Cherished Technololgy LIMITED)(2 0000000000950000
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Hoffe ich hab jetzt alles richtig gemacht, ging um drei Ecken, über Mail, Doc, in Editor, Namen ****, jetzt reinkopieren.
Nun sind wir total gespannt auf eure Antwort.
Wie, die Hoffung stirbt zuletzt,
Lieben Gruß an Schrauber :dankeschoen:
LG
Mimi:singsing:
Probleme die aufgetreten sind:
nun auch die Datei von dem Gmer zu. Musste es insgesamt mehrmals machen, da sich der PC runter- und wieder raufgefahren hat
Insgesamt ist das Fenster:
„C\windows\system32\config\system „ 3 Mal aufgegangen. Zu Beginn des Scans und am Ende des Scnas mit den Worten:
„auf die Datei kann nicht zugegriffen werden, da die Datei von einem anderen Prozess verwendet wird. |
FRST 32-Bit | FRST 64-Bit