| Parasiten | 15.06.2015 17:09 |
Beim surfen ständig Werbung, trotz Popupblocker - Interstat?
Hallo,
ich habe folgendes Problem: Trotz Adblock+ öffnen sich beim surfen ständig dubiose Popups. Ich habe neulich in der Systemsteuerung ein Programm entdeckt "Inetstat", welches ich auch gleich deinstalliert habe. Nun habe ich aber gelesen, dass das genau davon kommen kann.
Ich nutze Firefox auf einem Windows Surface mit Windows 8.1 64-Bit.
Ich habe nach Checkliste eures Forums folgende Logs erstellt, der FRST Log befindet sich im Anhang.
Addition.txt: Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version:13-06-2015
Ran by Ulrike at 2015-06-15 17:15:48
Running from C:\Users\Ulrike\Desktop
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-231024316-2932229012-4235142965-500 - Administrator - Disabled)
Gast (S-1-5-21-231024316-2932229012-4235142965-501 - Limited - Disabled)
Ulrike (S-1-5-21-231024316-2932229012-4235142965-1001 - Administrator - Enabled) => C:\Users\Ulrike
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Avira (HKLM-x32\...\{0696cc37-db90-4000-be99-4a173ca7c8af}) (Version: 1.1.39.17987 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.39.17987 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.10.434 - Avira Operations GmbH & Co. KG)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4631.1003 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Mozilla Firefox 37.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 37.0.1 (x86 de)) (Version: 37.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 36.0.1 - Mozilla)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Roaming Rate (HKLM-x32\...\Roaming Rate) (Version: 2.0.5567.42497 - Roaming Rate)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== Restore Points =========================
03-06-2015 18:19:35 Geplanter Prüfpunkt
11-06-2015 03:15:35 Windows Update
14-06-2015 21:22:26 Windows Update
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {05E9FE63-C925-4006-BAA5-85F2A1B942B3} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {50C205B5-6199-4985-A095-C8E876C9CF46} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {529188C0-59C9-4169-982F-F27D5A210252} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {6D39CC13-6191-476C-A11D-54524161F272} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\windows\system32\MRT.exe [2015-06-11] (Microsoft Corporation)
Task: {E5E57AEC-C9B5-4DFE-B888-B839EFFA92E7} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-24] (Microsoft Corporation)
==================== Loaded Modules (Whitelisted) ==============
2015-02-09 18:28 - 2015-02-09 18:28 - 01851392 _____ () C:\Program Files\WindowsApps\Microsoft.BingMaps_2.1.3230.2048_x64__8wekyb3d8bbwe\Map.exe
2015-03-04 20:05 - 2015-03-04 20:05 - 07770112 _____ () C:\Users\Ulrike\AppData\Local\Packages\Microsoft.BingMaps_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0\NativeImages\Map\6cd17eb59d72bdcbc0b998aeca37ad7f\Map.ni.exe
2015-02-18 18:04 - 2015-02-18 18:04 - 05185024 _____ () C:\windows\assembly\NativeImages_v4.0.30319_64\Windows.UI.Xaml\873b701d9b42e91132f08a6f05c4361a\Windows.UI.Xaml.ni.dll
2015-02-13 11:13 - 2015-02-13 11:13 - 01782784 _____ () C:\windows\assembly\NativeImages_v4.0.30319_64\Windows.App640a3541#\3f4dc590466037f015f65bc07d1ea923\Windows.ApplicationModel.ni.dll
2015-03-04 20:05 - 2015-03-04 20:05 - 01124352 _____ () C:\Users\Ulrike\AppData\Local\Packages\Microsoft.BingMaps_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0\NativeImages\DataTypes\91c8408d7a6527c381172049784a96ee\DataTypes.ni.dll
2015-03-04 20:05 - 2015-03-04 20:05 - 01495040 _____ () C:\Users\Ulrike\AppData\Local\Packages\Microsoft.BingMaps_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0\NativeImages\Bing.Maps\d475fa39290ac96c1227dbdde835040e\Bing.Maps.ni.dll
2015-03-04 20:05 - 2015-03-04 20:05 - 00445440 _____ () C:\Users\Ulrike\AppData\Local\Packages\Microsoft.BingMaps_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0\NativeImages\Utilities\a151842d6064dd7e06f33dc35ec45963\Utilities.ni.dll
2015-02-13 11:13 - 2015-02-13 11:13 - 02019840 _____ () C:\windows\assembly\NativeImages_v4.0.30319_64\Windows.Devices\0b4b3f23bdebd1d056b32b31e2f746bb\Windows.Devices.ni.dll
2015-02-13 11:12 - 2015-02-13 11:12 - 00363520 _____ () C:\windows\assembly\NativeImages_v4.0.30319_64\Windows.Foundation\6382e6f5ad8b7a9db4f5cd4817e70319\Windows.Foundation.ni.dll
2015-02-13 11:12 - 2015-02-13 11:12 - 00207872 _____ () C:\windows\assembly\NativeImages_v4.0.30319_64\Windows.System\a4efa88b742703220e527956d8ab4e84\Windows.System.ni.dll
2015-03-04 20:05 - 2015-03-04 20:05 - 01091584 _____ () C:\Users\Ulrike\AppData\Local\Packages\Microsoft.BingMaps_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0\NativeImages\Microsoft.Bc95a2f00#\4189e9fc4a0815046ed19942cbbd0c90\Microsoft.Bing.Platform.Logging.ClientWinRT.ni.dll
2015-02-13 11:13 - 2015-02-13 11:13 - 01278464 _____ () C:\windows\assembly\NativeImages_v4.0.30319_64\Windows.Storage\f9ac074d298db459c5eff6d3256861c8\Windows.Storage.ni.dll
2015-03-04 20:05 - 2015-03-04 20:05 - 00616960 _____ () C:\Users\Ulrike\AppData\Local\Packages\Microsoft.BingMaps_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0\NativeImages\Requests\2abe2a4f4f557d686ba73381b5ff253b\Requests.ni.dll
2015-02-13 11:13 - 2015-02-13 11:13 - 01459712 _____ () C:\windows\assembly\NativeImages_v4.0.30319_64\Windows.UI\4bd80968bf666252841ca7792faaff11\Windows.UI.ni.dll
2015-03-04 20:05 - 2015-03-04 20:05 - 00086016 _____ () C:\Users\Ulrike\AppData\Local\Packages\Microsoft.BingMaps_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0\NativeImages\ConfigModels\2fdabbc4794c67ad9c13881300195b57\ConfigModels.ni.dll
2015-03-04 20:05 - 2015-03-04 20:05 - 00212992 _____ () C:\Users\Ulrike\AppData\Local\Packages\Microsoft.BingMaps_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0\NativeImages\ConfigManager\d1990b5fb962cf0b0c3f6e239394c1e4\ConfigManager.ni.dll
2015-03-04 20:05 - 2015-03-04 20:05 - 00066048 _____ () C:\Users\Ulrike\AppData\Local\Packages\Microsoft.BingMaps_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0\NativeImages\Search\77c2e80e58ecbcc91ce13b73e0e4a49f\Search.ni.dll
2015-02-13 11:13 - 2015-02-13 11:13 - 01259520 _____ () C:\windows\assembly\NativeImages_v4.0.30319_64\Windows.Networking\8f0dd293f95c402613c49fb2fac85bdd\Windows.Networking.ni.dll
2015-02-13 11:12 - 2015-02-13 11:12 - 00347136 _____ () C:\windows\assembly\NativeImages_v4.0.30319_64\Windows.Gloaae92e31#\94e2bc13589233f9d2cc54292717b8cf\Windows.Globalization.ni.dll
2015-02-13 11:13 - 2015-02-13 11:13 - 00632320 _____ () C:\windows\assembly\NativeImages_v4.0.30319_64\Windows.Security\c7f6d022c5d5aec4891cb6b3b9934336\Windows.Security.ni.dll
2015-02-13 11:13 - 2015-02-13 11:13 - 00521216 _____ () C:\windows\assembly\NativeImages_v4.0.30319_64\Windows.Data\fae2b750f87849ca11806d20b2504bf2\Windows.Data.ni.dll
2015-03-04 20:05 - 2015-03-04 20:05 - 00247808 _____ () C:\Users\Ulrike\AppData\Local\Packages\Microsoft.BingMaps_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0\NativeImages\Authentication\6c7aea49b7d5e5149ad278364208c5c0\Authentication.ni.dll
2015-03-04 20:05 - 2015-03-04 20:05 - 00193024 _____ () C:\Users\Ulrike\AppData\Local\Packages\Microsoft.BingMaps_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0\NativeImages\Autosuggest\66817e929314edfdfa1bf7da589bb581\Autosuggest.ni.dll
2015-03-04 20:05 - 2015-03-04 20:05 - 00269312 _____ () C:\Users\Ulrike\AppData\Local\Packages\Microsoft.BingMaps_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0\NativeImages\MapClientGraph\8e5def4266f0a6d2eeb0d0204c63adea\MapClientGraph.ni.dll
2015-03-04 20:05 - 2015-03-04 20:05 - 00496640 _____ () C:\Users\Ulrike\AppData\Local\Packages\Microsoft.BingMaps_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0\NativeImages\Microsoft.B2384b708#\db55843d9e2ec1f1bd517bec4fcfdb54\Microsoft.Bing.Client.Graph.ni.dll
2015-02-13 11:13 - 2015-02-13 11:13 - 00467456 _____ () C:\windows\assembly\NativeImages_v4.0.30319_64\Windows.Graphics\ea818a24554fc2db9a73de1e79afb286\Windows.Graphics.ni.dll
2014-08-14 07:22 - 2014-08-14 07:22 - 02364928 _____ () C:\Program Files\WindowsApps\Microsoft.BingMaps_2.1.3230.2048_x64__8wekyb3d8bbwe\Microsoft.Bing.Client.Graph.dll
2015-06-08 02:12 - 2015-06-08 02:12 - 00163840 _____ () C:\Users\Ulrike\AppData\Local\Packages\Microsoft.BingMaps_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0\NativeImages\ActivationUrl\04e04c7743c0c97d9fae99010fd1e875\ActivationUrl.ni.dll
2015-06-15 17:09 - 2015-06-15 17:09 - 00050477 _____ () C:\Users\Ulrike\Desktop\Defogger.exe
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\Users\Ulrike\OneDrive:ms-properties
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-231024316-2932229012-4235142965-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Surface\Surface.jpg
DNS Servers: 192.168.2.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [{90C67790-4341-4B4D-BEF2-9C98EDD5FCAD}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{4D890DBA-4BEC-418F-B83E-9F73F982C4FE}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{847FC974-42BA-467D-8DDF-558BB0DACFB7}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{BA7FEC28-CA80-4FB4-9ED1-0F11E87EC408}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (06/14/2015 08:41:30 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT-AUTORITÄT)
Description: There was an error with the Windows Location Provider database
Error: (06/11/2015 10:08:45 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005
Error: (06/07/2015 05:45:02 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Das Volume "Windows RE tools" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057)
Error: (06/06/2015 02:24:36 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Das Volume "Windows RE tools" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057)
Error: (06/04/2015 03:50:56 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: wuauclt.exe, Version: 7.9.9600.17729, Zeitstempel: 0x55037cf8
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f4336
Ausnahmecode: 0xc0000374
Fehleroffset: 0x00000000000f0f20
ID des fehlerhaften Prozesses: 0x1384
Startzeit der fehlerhaften Anwendung: 0xwuauclt.exe0
Pfad der fehlerhaften Anwendung: wuauclt.exe1
Pfad des fehlerhaften Moduls: wuauclt.exe2
Berichtskennung: wuauclt.exe3
Vollständiger Name des fehlerhaften Pakets: wuauclt.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: wuauclt.exe5
Error: (06/03/2015 06:19:33 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Das Volume "Windows RE tools" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057)
Error: (05/19/2015 00:59:46 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005
Error: (05/01/2015 01:00:18 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005
Error: (04/29/2015 11:22:55 AM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT-AUTORITÄT)
Description: There was an error with the Windows Location Provider database
Error: (04/29/2015 11:21:18 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005
System errors:
=============
Error: (06/15/2015 00:16:38 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Windows Modules Installer" wurde mit folgendem Fehler beendet:
%%19
Error: (06/15/2015 00:16:08 AM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Der Dienst Windows Modules Installer konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.
Error: (06/14/2015 10:34:57 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (06/14/2015 10:34:57 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "WSearch" konnte sich nicht als "NT AUTHORITY\SYSTEM" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%50
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (06/14/2015 10:34:31 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (06/14/2015 10:34:27 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (06/14/2015 10:34:27 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (06/14/2015 10:34:26 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) Content Protection HECI Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (06/14/2015 10:34:26 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Druckwarteschlange" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (06/14/2015 09:22:59 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80240055 fehlgeschlagen: Kumulatives Sicherheitsupdate für Internet Explorer 11 für Windows 8.1 für x64-Systeme (KB3058515)
Microsoft Office:
=========================
Error: (06/14/2015 08:41:30 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT-AUTORITÄT)
Description: -2147024883
Error: (06/11/2015 10:08:45 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005
Error: (06/07/2015 05:45:02 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Windows RE toolsFalscher Parameter. (0x80070057)
Error: (06/06/2015 02:24:36 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Windows RE toolsFalscher Parameter. (0x80070057)
Error: (06/04/2015 03:50:56 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: wuauclt.exe7.9.9600.1772955037cf8ntdll.dll6.3.9600.17736550f4336c000037400000000000f0f20138401d09e61d866b4ecC:\windows\system32\wuauclt.exeC:\windows\SYSTEM32\ntdll.dll2371c3bb-0a5c-11e5-8265-60029292bed4
Error: (06/03/2015 06:19:33 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Windows RE toolsFalscher Parameter. (0x80070057)
Error: (05/19/2015 00:59:46 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005
Error: (05/01/2015 01:00:18 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005
Error: (04/29/2015 11:22:55 AM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT-AUTORITÄT)
Description: -2147024883
Error: (04/29/2015 11:21:18 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005
CodeIntegrity Errors:
===================================
Date: 2015-04-02 17:58:43.738
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-04-02 17:58:43.644
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-04-02 17:58:43.566
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-04-02 17:58:43.410
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-04-02 17:58:43.019
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-04-02 03:40:43.595
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-04-02 03:40:43.144
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-04-02 03:40:42.695
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-04-02 03:40:42.218
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-04-02 03:40:41.783
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-4300U CPU @ 1.90GHz
Percentage of memory in use: 44%
Total physical RAM: 4001.07 MB
Available physical RAM: 2216.67 MB
Total Pagefile: 4705.07 MB
Available Pagefile: 2451.64 MB
Total Virtual: 131072 MB
Available Virtual: 131071.77 MB
==================== Drives ================================
Drive c: (Windows) (Fixed) (Total:113.3 GB) (Free:22.93 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 119.2 GB) (Disk ID: A81DC799)
Partition: GPT Partition Type.
==================== End of log ============================
Als ich den GMER Scan machen wollte, stürzte das Programm ab, weil irgendwelche Dateien wohl schon verwendet werden würden, aus dem Systemordner.
Außerdem hat sich nun ein Problem ergeben: Für GMER habe ich Antivir ausgeschaltet, doch es lässt sich nicht mehr aktivieren, da ich angeblich nicht über die Berechtigungen verfüge. Ein Systemscan ist auch nicht möglich. Nach einem Neustart, ist der Echtzeitscanner zu Glück wieder aktiv.
Was kann ich tun? Danke für eure Hilfe! :)
Liebe Grüße | 
So funktioniert es:
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
