Kerstin 0 Report post Posted July 23, 2014 Hallo, mein Virenprogramm (G-Data) hat Trojan.GenericKD festgestellt und kann diesen leider nicht beseitigen. Könnte mir bitte jemand helfen? Vielen Dank derweilen, Kerstin Share this post Link to post Share on other sites
schrauber 30 Report post Posted July 23, 2014 Hi und Herzlich Willkommen beim Emsisoft Support Forum! Systemscan mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Start > Computer (Rechtsklick) > Eigenschaften) Starte jetzt FRST. Ändere ungefragt keine der Checkboxen und klicke auf Scan. Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop. Bitte beide Logfiles in der nächsten Antwort anhängen Share this post Link to post Share on other sites
Kerstin 0 Report post Posted July 23, 2014 Hallo Thomas, vielen Dank für das herzliche Willkommen. Share this post Link to post Share on other sites
Kerstin 0 Report post Posted July 23, 2014 ... habe mich leider verdrückt. Ich kann die Dateien leider nicht hochladen. Es kommt eine Fehlermeldung "The server returned an error during upload" Share this post Link to post Share on other sites
Kerstin 0 Report post Posted July 23, 2014 Hier mal die FRST kopiert: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-07-2014Ran by User (administrator) on PC on 23-07-2014 12:43:01Running from C:\Users\User\DesktopPlatform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)Internet Explorer Version 11Boot Mode: NormalThe only official download link for FRST:Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/Download link from any site other than Bleeping Computer is unpermitted or outdated.See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/==================== Processes (Whitelisted) =================(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe() C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GdBgInx64.exe(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GDKBFltExe32.exe(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe(Microsoft) C:\Program Files\Softland\novaPDF 8\Server\novapdfs.exe(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKBap64.exe(Intel Corporation) C:\Windows\System32\igfxtray.exe(Intel Corporation) C:\Windows\System32\igfxsrvc.exe(Intel Corporation) C:\Windows\System32\hkcmd.exe(Intel Corporation) C:\Windows\System32\igfxpers.exe(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.1.355.0\SeaPort.EXE(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe==================== Registry (Whitelisted) ==================HKLM\...\Run: [iAStorIcon] => C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIconLaunch.exe [36352 2013-08-07] (Intel Corporation)HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetchHKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1756792 2014-05-20] (G Data Software AG)HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)HKLM-x32\...\Run: [] => [X]HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-07-08] (Apple Inc.)HKLM\...\Winlogon: [userinit] C:\Windows\system32\userinit.exe,c:\program files (x86)\g data\internetsecurity\avkkid\avkcks.exe,C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exeWinlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)HKU\S-1-5-21-1288194900-4253203852-1844218772-1001\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-08-27] (TomTom)HKU\S-1-5-21-1288194900-4253203852-1844218772-1001\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [122200 2014-06-09] (Garmin Ltd or its subsidiaries)Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnkShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnkShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)==================== Internet (Whitelisted) ====================HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://t.de.msn.com/HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x8B7F85B9336ACF01HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DEBHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.1.355.0\BingExt.dll (Microsoft Corporation.)BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.355.0\BingExt.dll (Microsoft Corporation.)Tcpip\Parameters: [DhcpNameServer] 172.16.0.1FireFox:========FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zom9p3wc.defaultFF Homepage: hxxp://www.parandian.atFF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()FF Plugin: @garmin.com/GpsControl - C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()FF Plugin-x32: @garmin.com/GpsControl - C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zom9p3wc.default\searchplugins\11-suche.xmlFF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zom9p3wc.default\searchplugins\englische-ergebnisse.xmlFF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zom9p3wc.default\searchplugins\gmx-suche.xmlFF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zom9p3wc.default\searchplugins\lastminute.xmlFF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zom9p3wc.default\searchplugins\webde-suche.xmlFF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xmlFF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xmlFF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xmlFF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xmlFF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zom9p3wc.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2014-05-07]FF Extension: Tab Mix Plus - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zom9p3wc.default\Extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi [2014-05-07]==================== Services (Whitelisted) =================R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe [936728 2013-05-07] ()R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2250360 2014-05-27] (G Data Software AG)R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG)R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe [2683760 2014-05-20] (G Data Software AG)R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [435032 2014-06-09] (Garmin Ltd or its subsidiaries)R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [3203392 2014-05-20] (G Data Software AG)R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700536 2014-05-20] (G Data Software AG)R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2011-08-18] (Hewlett-Packard Co.) [File not signed]R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation)R2 Intel® Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel® Corporation) [File not signed]S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel® Corporation)R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [169432 2013-08-19] (Intel Corporation)R2 Net Driver HPZ12; C:\Windows\System32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]R2 NovaPdfServer; C:\Program Files\Softland\novaPDF 8\Server\novapdfs.exe [204576 2014-04-30] (Microsoft)R2 Pml Driver HPZ12; C:\Windows\System32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)==================== Drivers (Whitelisted) ====================R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2012-08-22] ()R3 cleanhlp; C:\Users\User\Desktop\EEK\Run\cleanhlp64.sys [57024 2014-07-22] (Emsisoft GmbH)S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-09-25] (Windows ® Win 7 DDK provider)S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-09-25] (Windows ® Win 7 DDK provider)R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [55808 2014-07-02] (G Data Software AG)R1 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt64.sys [20992 2014-07-02] (G Data Software AG)R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [142336 2014-07-02] (G Data Software AG)R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [64000 2014-07-02] (G Data Software AG)R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [67584 2014-07-02] (G Data Software AG)R1 GRD; C:\Windows\system32\drivers\GRD.sys [106272 2014-05-12] (G Data Software)R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [61440 2014-07-02] (G Data Software AG)R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-08-19] (Intel Corporation)S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)==================== NetSvcs (Whitelisted) ======================================= One Month Created Files and Folders ========2014-07-23 12:43 - 2014-07-23 12:43 - 00013563 _____ () C:\Users\User\Desktop\FRST.txt2014-07-23 12:42 - 2014-07-23 12:43 - 00000000 ____D () C:\FRST2014-07-23 11:25 - 2014-07-23 11:25 - 02090496 _____ (Farbar) C:\Users\User\Desktop\FRST64.exe2014-07-23 10:54 - 2014-07-23 10:54 - 00104418 _____ () C:\Users\User\Desktop\OTL.Txt2014-07-23 10:48 - 2014-07-23 10:48 - 00054910 _____ () C:\Users\User\Desktop\Extras.Txt2014-07-23 10:43 - 2014-07-23 10:43 - 00000076 _____ () C:\Users\User\Desktop\230714_a2scan_140723-103216.txt2014-07-22 16:49 - 2014-07-22 16:50 - 00000000 ____D () C:\Users\User\Desktop\EEK2014-07-22 16:32 - 2014-07-22 16:48 - 218241662 _____ () C:\Users\User\Desktop\EmsisoftEmergencyKit.zip2014-07-22 16:32 - 2014-07-22 16:32 - 00602112 _____ (OldTimer Tools) C:\Users\User\Desktop\OTL.exe2014-07-22 15:38 - 2014-07-22 15:39 - 12787224 _____ (Elex do Brasil Participações Ltda) C:\Users\User\Desktop\yet_another_cleaner_sk.exe2014-07-21 16:59 - 2014-07-21 16:59 - 00002270 _____ () C:\Users\Public\Desktop\Ulead VideoStudio 7.lnk2014-07-21 16:59 - 2014-07-21 16:59 - 00000872 _____ () C:\Windows\DirectX.log2014-07-21 16:59 - 2014-07-21 16:59 - 00000216 _____ () C:\Windows\Ulead32.ini2014-07-21 16:59 - 2014-07-21 16:59 - 00000000 ____D () C:\Users\User\Documents\Ulead VideoStudio2014-07-21 16:59 - 2014-07-21 16:59 - 00000000 ____D () C:\Users\User\AppData\Roaming\Ulead Systems2014-07-21 16:59 - 2014-07-21 16:59 - 00000000 ____D () C:\ProgramData\Ulead Systems2014-07-21 16:59 - 2014-07-21 16:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ulead VideoStudio 72014-07-21 16:59 - 2014-07-21 16:59 - 00000000 ____D () C:\Program Files (x86)\Ulead Systems2014-07-21 16:32 - 2014-07-21 16:32 - 00000000 ____D () C:\Users\User\Documents\Pinnacle Studio2014-07-21 16:31 - 2014-07-21 16:32 - 00006656 _____ () C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini2014-07-21 16:01 - 2014-07-21 16:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Studio Plugins2014-07-21 16:01 - 2014-07-21 16:01 - 00000000 ____D () C:\Program Files (x86)\LooksBuilderSE2014-07-21 16:01 - 2004-03-29 17:23 - 00090112 _____ (MindVision Software) C:\Windows\unvise32.exe2014-07-21 15:57 - 2014-07-21 15:57 - 00001214 _____ () C:\Users\Public\Desktop\Pinnacle Studio 14.lnk2014-07-21 15:57 - 2014-07-21 15:57 - 00000000 ____D () C:\Users\User\AppData\Local\Pinnacle2014-07-21 15:57 - 2014-07-21 15:57 - 00000000 ____D () C:\Users\Public\Documents\My Projects2014-07-21 15:57 - 2014-07-21 15:57 - 00000000 ____D () C:\ProgramData\Pinnacle Studio Ultimate Collection2014-07-21 15:57 - 2014-07-21 15:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pinnacle Studio 142014-07-21 15:57 - 2014-07-21 15:57 - 00000000 _____ () C:\Windows\SysWOW64\OGLdpf.log2014-07-21 15:56 - 2014-07-21 15:57 - 00000000 ____D () C:\Users\Public\Documents\Pinnacle2014-07-21 15:56 - 2014-07-21 15:56 - 00000000 ____D () C:\ProgramData\Studio 142014-07-21 15:56 - 2014-07-21 15:56 - 00000000 ____D () C:\ProgramData\Pinnacle Studio Plus2014-07-21 15:55 - 2014-07-21 16:22 - 00000349 _____ () C:\Users\Public\Documents\PCLECHAL.INI2014-07-21 15:53 - 2014-07-21 16:01 - 00000000 ____D () C:\Program Files (x86)\Pinnacle2014-07-21 15:53 - 2014-07-21 15:57 - 00000000 ____D () C:\ProgramData\Pinnacle2014-07-21 15:51 - 2014-07-21 15:51 - 00001638 _____ () C:\Users\User\Desktop\Photoshop 7.0.lnk2014-07-21 15:48 - 2014-07-21 15:48 - 00001192 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ImageReady 7.0.lnk2014-07-21 15:48 - 2014-07-21 15:48 - 00001187 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop 7.0.lnk2014-07-21 15:47 - 1998-11-05 11:08 - 00087392 ____N (Twain Working Group) C:\Windows\twain.dll2014-07-21 15:44 - 1998-10-21 18:43 - 00328704 _____ (InstallShield Software Corporation ) C:\Windows\IsUn0407.exe2014-07-21 15:34 - 2014-07-21 15:28 - 00002497 _____ () C:\Users\User\Desktop\Adobe Illustrator CS.lnk2014-07-21 15:28 - 2014-07-21 15:28 - 00002605 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Illustrator CS.lnk2014-07-21 15:28 - 2014-07-21 15:28 - 00000000 ____D () C:\Windows\SysWOW64\Adobe2014-07-21 15:28 - 2001-11-14 20:19 - 00016384 _____ () C:\Windows\SysWOW64\FileOps.exe2014-07-21 15:22 - 2014-07-21 15:22 - 00000000 ____D () C:\Windows\Adobe Illustrator CS2014-07-16 20:00 - 2014-07-16 20:00 - 00001795 _____ () C:\Users\Public\Desktop\iTunes.lnk2014-07-16 20:00 - 2014-07-16 20:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes2014-07-16 20:00 - 2014-07-16 20:00 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF692014-07-16 20:00 - 2014-07-16 20:00 - 00000000 ____D () C:\Program Files\iTunes2014-07-16 20:00 - 2014-07-16 20:00 - 00000000 ____D () C:\Program Files\iPod2014-07-16 20:00 - 2014-07-16 20:00 - 00000000 ____D () C:\Program Files (x86)\iTunes2014-07-11 15:26 - 2014-07-11 15:26 - 00000000 ____D () C:\Users\User\AppData\Roaming\WinRAR2014-07-11 15:26 - 2014-07-11 15:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip2014-07-11 15:26 - 2014-07-11 15:26 - 00000000 ____D () C:\Program Files\7-Zip2014-07-11 14:00 - 2014-07-11 14:00 - 00000000 ____D () C:\Program Files\WinRAR2014-07-11 11:22 - 2014-07-11 11:22 - 00000000 ____D () C:\ProgramData\regid.1986-12.com.adobe2014-07-10 20:43 - 2014-07-21 15:46 - 00000000 ____D () C:\Program Files (x86)\Adobe2014-07-10 20:43 - 2014-07-10 20:43 - 00001013 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help.lnk2014-07-10 20:43 - 2014-07-10 20:43 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia2014-07-10 20:43 - 2014-07-10 20:43 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia2014-07-10 20:42 - 2014-07-21 15:35 - 00000000 ____D () C:\ProgramData\Adobe2014-07-10 20:39 - 2014-07-21 15:24 - 00000000 ____D () C:\Users\User\AppData\Local\Adobe2014-07-10 19:31 - 2014-07-10 19:31 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf2014-07-10 19:30 - 2014-07-10 19:30 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_netaapl64_01009.Wdf2014-07-10 14:56 - 2014-07-10 14:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight2014-07-10 14:56 - 2014-07-10 14:56 - 00000000 ____D () C:\Program Files\Microsoft Silverlight2014-07-10 14:56 - 2014-07-10 14:56 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight2014-07-10 11:07 - 2014-04-14 05:29 - 01018880 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll2014-07-10 11:06 - 2014-07-10 11:06 - 00000000 ___SD () C:\Windows\system32\CompatTel2014-07-10 10:59 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll2014-07-10 10:59 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll2014-07-10 10:59 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll2014-07-10 10:59 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll2014-07-10 10:59 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll2014-07-10 10:59 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll2014-07-10 10:59 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll2014-07-10 10:59 - 2014-06-19 01:46 - 00250880 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll2014-07-10 10:59 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe2014-07-10 10:59 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll2014-07-10 10:59 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll2014-07-10 10:59 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl2014-07-10 10:59 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll2014-07-10 10:59 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll2014-07-10 10:59 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll2014-07-10 10:59 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll2014-07-10 10:59 - 2014-06-19 00:57 - 00225280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll2014-07-10 10:59 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll2014-07-10 10:59 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll2014-07-10 10:59 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll2014-07-10 10:59 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl2014-07-10 10:59 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll2014-07-10 10:59 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll2014-07-10 10:59 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll2014-07-10 10:59 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll2014-07-10 10:59 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll2014-07-10 10:59 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll2014-07-10 10:59 - 2014-06-17 00:26 - 00779264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe2014-07-10 10:59 - 2014-06-17 00:24 - 00834048 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe2014-07-10 10:59 - 2014-06-06 16:20 - 04190720 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys2014-07-10 10:59 - 2014-05-30 05:03 - 00563200 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys2014-07-10 10:59 - 2014-05-29 14:02 - 00565576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys2014-07-10 10:59 - 2014-05-29 09:55 - 00735232 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll2014-07-10 10:59 - 2014-05-29 08:40 - 00735232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll2014-07-10 10:59 - 2014-05-29 08:37 - 00436224 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll2014-07-10 10:59 - 2014-05-29 07:34 - 00318976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll2014-07-10 10:59 - 2014-05-29 07:27 - 01417216 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll2014-07-10 10:58 - 2014-07-01 00:45 - 00688128 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll2014-07-10 10:58 - 2014-06-28 09:48 - 00527360 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll2014-07-10 10:58 - 2014-06-28 09:07 - 00385536 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll2014-07-10 10:58 - 2014-06-06 15:04 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll2014-07-10 10:58 - 2014-06-06 14:18 - 00488960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll2014-07-10 10:58 - 2014-05-31 12:07 - 00054776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe2014-07-10 10:58 - 2014-05-31 12:06 - 00555736 _____ (Microsoft Corporation) C:\Windows\system32\twinapi.appcore.dll2014-07-10 10:58 - 2014-05-31 05:40 - 13287936 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll2014-07-10 10:58 - 2014-05-31 05:30 - 11792384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll2014-07-10 10:58 - 2014-05-31 05:12 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll2014-07-10 10:58 - 2014-05-31 05:06 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll2014-07-10 10:58 - 2014-05-31 05:03 - 00827392 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll2014-07-10 10:58 - 2014-05-31 05:01 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll2014-07-10 10:58 - 2014-05-31 04:56 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll2014-07-10 10:58 - 2014-05-31 04:54 - 00666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll2014-07-10 10:58 - 2014-05-31 04:48 - 03463680 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll2014-07-10 10:58 - 2014-05-31 04:37 - 01054208 _____ (Microsoft Corporation) C:\Windows\system32\twinui.appcore.dll2014-07-10 10:58 - 2014-05-31 04:36 - 00923136 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll2014-07-10 10:58 - 2014-05-31 04:35 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.appcore.dll2014-07-10 10:58 - 2014-05-31 04:32 - 00756224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll2014-07-10 10:57 - 2014-07-10 10:57 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\WSReset.exe2014-07-02 12:52 - 2014-07-02 12:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity2014-06-28 16:39 - 2014-07-21 18:11 - 00012265 _____ () C:\Users\User\Desktop\to do_kerstin.odt2014-06-24 13:33 - 2014-07-23 12:08 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox==================== One Month Modified Files and Folders =======2014-07-23 12:43 - 2014-07-23 12:43 - 00013563 _____ () C:\Users\User\Desktop\FRST.txt2014-07-23 12:43 - 2014-07-23 12:42 - 00000000 ____D () C:\FRST2014-07-23 12:40 - 2014-05-07 17:18 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job2014-07-23 12:36 - 2014-05-07 22:34 - 00003902 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{73C4427F-4D97-43F8-9302-E7C9E66FCA95}2014-07-23 12:16 - 2014-04-02 22:32 - 01570646 _____ () C:\Windows\WindowsUpdate.log2014-07-23 12:08 - 2014-06-24 13:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox2014-07-23 11:25 - 2014-07-23 11:25 - 02090496 _____ (Farbar) C:\Users\User\Desktop\FRST64.exe2014-07-23 11:02 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\sru2014-07-23 10:54 - 2014-07-23 10:54 - 00104418 _____ () C:\Users\User\Desktop\OTL.Txt2014-07-23 10:48 - 2014-07-23 10:48 - 00054910 _____ () C:\Users\User\Desktop\Extras.Txt2014-07-23 10:43 - 2014-07-23 10:43 - 00000076 _____ () C:\Users\User\Desktop\230714_a2scan_140723-103216.txt2014-07-23 10:35 - 2014-04-02 22:36 - 01780340 _____ () C:\Windows\system32\PerfStringBackup.INI2014-07-23 10:35 - 2013-08-23 01:24 - 00765378 _____ () C:\Windows\system32\perfh007.dat2014-07-23 10:35 - 2013-08-23 01:24 - 00159696 _____ () C:\Windows\system32\perfc007.dat2014-07-23 10:29 - 2013-08-22 16:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT2014-07-23 10:29 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\BBI2014-07-23 10:16 - 2014-04-02 22:37 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1288194900-4253203852-1844218772-10012014-07-23 09:51 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\AppReadiness2014-07-23 09:40 - 2013-08-22 16:44 - 05008616 _____ () C:\Windows\system32\FNTCACHE.DAT2014-07-22 16:50 - 2014-07-22 16:49 - 00000000 ____D () C:\Users\User\Desktop\EEK2014-07-22 16:48 - 2014-07-22 16:32 - 218241662 _____ () C:\Users\User\Desktop\EmsisoftEmergencyKit.zip2014-07-22 16:32 - 2014-07-22 16:32 - 00602112 _____ (OldTimer Tools) C:\Users\User\Desktop\OTL.exe2014-07-22 15:39 - 2014-07-22 15:38 - 12787224 _____ (Elex do Brasil Participações Ltda) C:\Users\User\Desktop\yet_another_cleaner_sk.exe2014-07-21 18:11 - 2014-06-28 16:39 - 00012265 _____ () C:\Users\User\Desktop\to do_kerstin.odt2014-07-21 16:59 - 2014-07-21 16:59 - 00002270 _____ () C:\Users\Public\Desktop\Ulead VideoStudio 7.lnk2014-07-21 16:59 - 2014-07-21 16:59 - 00000872 _____ () C:\Windows\DirectX.log2014-07-21 16:59 - 2014-07-21 16:59 - 00000216 _____ () C:\Windows\Ulead32.ini2014-07-21 16:59 - 2014-07-21 16:59 - 00000000 ____D () C:\Users\User\Documents\Ulead VideoStudio2014-07-21 16:59 - 2014-07-21 16:59 - 00000000 ____D () C:\Users\User\AppData\Roaming\Ulead Systems2014-07-21 16:59 - 2014-07-21 16:59 - 00000000 ____D () C:\ProgramData\Ulead Systems2014-07-21 16:59 - 2014-07-21 16:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ulead VideoStudio 72014-07-21 16:59 - 2014-07-21 16:59 - 00000000 ____D () C:\Program Files (x86)\Ulead Systems2014-07-21 16:59 - 2014-04-02 23:26 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information2014-07-21 16:32 - 2014-07-21 16:32 - 00000000 ____D () C:\Users\User\Documents\Pinnacle Studio2014-07-21 16:32 - 2014-07-21 16:31 - 00006656 _____ () C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini2014-07-21 16:22 - 2014-07-21 15:55 - 00000349 _____ () C:\Users\Public\Documents\PCLECHAL.INI2014-07-21 16:02 - 2014-07-21 16:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Studio Plugins2014-07-21 16:01 - 2014-07-21 16:01 - 00000000 ____D () C:\Program Files (x86)\LooksBuilderSE2014-07-21 16:01 - 2014-07-21 15:53 - 00000000 ____D () C:\Program Files (x86)\Pinnacle2014-07-21 15:58 - 2014-06-03 16:06 - 00000000 ____D () C:\Users\User\AppData\Local\Downloaded Installations2014-07-21 15:57 - 2014-07-21 15:57 - 00001214 _____ () C:\Users\Public\Desktop\Pinnacle Studio 14.lnk2014-07-21 15:57 - 2014-07-21 15:57 - 00000000 ____D () C:\Users\User\AppData\Local\Pinnacle2014-07-21 15:57 - 2014-07-21 15:57 - 00000000 ____D () C:\Users\Public\Documents\My Projects2014-07-21 15:57 - 2014-07-21 15:57 - 00000000 ____D () C:\ProgramData\Pinnacle Studio Ultimate Collection2014-07-21 15:57 - 2014-07-21 15:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pinnacle Studio 142014-07-21 15:57 - 2014-07-21 15:57 - 00000000 _____ () C:\Windows\SysWOW64\OGLdpf.log2014-07-21 15:57 - 2014-07-21 15:56 - 00000000 ____D () C:\Users\Public\Documents\Pinnacle2014-07-21 15:57 - 2014-07-21 15:53 - 00000000 ____D () C:\ProgramData\Pinnacle2014-07-21 15:56 - 2014-07-21 15:56 - 00000000 ____D () C:\ProgramData\Studio 142014-07-21 15:56 - 2014-07-21 15:56 - 00000000 ____D () C:\ProgramData\Pinnacle Studio Plus2014-07-21 15:51 - 2014-07-21 15:51 - 00001638 _____ () C:\Users\User\Desktop\Photoshop 7.0.lnk2014-07-21 15:48 - 2014-07-21 15:48 - 00001192 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ImageReady 7.0.lnk2014-07-21 15:48 - 2014-07-21 15:48 - 00001187 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop 7.0.lnk2014-07-21 15:48 - 2014-04-02 22:32 - 00000000 ____D () C:\Users\User\AppData\Roaming\Adobe2014-07-21 15:46 - 2014-07-10 20:43 - 00000000 ____D () C:\Program Files (x86)\Adobe2014-07-21 15:35 - 2014-07-10 20:42 - 00000000 ____D () C:\ProgramData\Adobe2014-07-21 15:34 - 2014-04-02 22:32 - 00000000 ____D () C:\Users\User\AppData\Local\VirtualStore2014-07-21 15:28 - 2014-07-21 15:34 - 00002497 _____ () C:\Users\User\Desktop\Adobe Illustrator CS.lnk2014-07-21 15:28 - 2014-07-21 15:28 - 00002605 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Illustrator CS.lnk2014-07-21 15:28 - 2014-07-21 15:28 - 00000000 ____D () C:\Windows\SysWOW64\Adobe2014-07-21 15:24 - 2014-07-10 20:39 - 00000000 ____D () C:\Users\User\AppData\Local\Adobe2014-07-21 15:22 - 2014-07-21 15:22 - 00000000 ____D () C:\Windows\Adobe Illustrator CS2014-07-17 12:58 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\rescache2014-07-16 20:00 - 2014-07-16 20:00 - 00001795 _____ () C:\Users\Public\Desktop\iTunes.lnk2014-07-16 20:00 - 2014-07-16 20:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes2014-07-16 20:00 - 2014-07-16 20:00 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF692014-07-16 20:00 - 2014-07-16 20:00 - 00000000 ____D () C:\Program Files\iTunes2014-07-16 20:00 - 2014-07-16 20:00 - 00000000 ____D () C:\Program Files\iPod2014-07-16 20:00 - 2014-07-16 20:00 - 00000000 ____D () C:\Program Files (x86)\iTunes2014-07-15 15:26 - 2013-08-22 16:46 - 00025645 _____ () C:\Windows\setupact.log2014-07-11 15:26 - 2014-07-11 15:26 - 00000000 ____D () C:\Users\User\AppData\Roaming\WinRAR2014-07-11 15:26 - 2014-07-11 15:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip2014-07-11 15:26 - 2014-07-11 15:26 - 00000000 ____D () C:\Program Files\7-Zip2014-07-11 14:00 - 2014-07-11 14:00 - 00000000 ____D () C:\Program Files\WinRAR2014-07-11 13:36 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\LiveKernelReports2014-07-11 11:38 - 2014-05-09 14:52 - 00000000 ____D () C:\Users\User\Documents\Eigene Scans2014-07-11 11:22 - 2014-07-11 11:22 - 00000000 ____D () C:\ProgramData\regid.1986-12.com.adobe2014-07-10 20:43 - 2014-07-10 20:43 - 00001013 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help.lnk2014-07-10 20:43 - 2014-07-10 20:43 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia2014-07-10 20:43 - 2014-07-10 20:43 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia2014-07-10 20:25 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ToastData2014-07-10 20:25 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility2014-07-10 20:25 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility2014-07-10 20:25 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\WinStore2014-07-10 19:43 - 2014-05-29 12:37 - 00000000 ____D () C:\Users\User\AppData\Roaming\Apple Computer2014-07-10 19:31 - 2014-07-10 19:31 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf2014-07-10 19:30 - 2014-07-10 19:30 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_netaapl64_01009.Wdf2014-07-10 19:20 - 2014-06-03 15:55 - 00012250 _____ () C:\Users\User\Desktop\to do_laurenz.odt2014-07-10 14:56 - 2014-07-10 14:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight2014-07-10 14:56 - 2014-07-10 14:56 - 00000000 ____D () C:\Program Files\Microsoft Silverlight2014-07-10 14:56 - 2014-07-10 14:56 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight2014-07-10 11:08 - 2013-08-22 17:20 - 00000000 ____D () C:\Windows\CbsTemp2014-07-10 11:07 - 2014-05-07 18:35 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe2014-07-10 11:07 - 2014-05-07 18:35 - 00000000 ____D () C:\Windows\system32\MRT2014-07-10 11:07 - 2013-08-23 01:26 - 00000000 ____D () C:\Program Files\Windows Journal2014-07-10 11:07 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM2014-07-10 11:06 - 2014-07-10 11:06 - 00000000 ___SD () C:\Windows\system32\CompatTel2014-07-10 10:57 - 2014-07-10 10:57 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\WSReset.exe2014-07-08 19:40 - 2014-05-07 17:18 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater2014-07-02 12:52 - 2014-07-02 12:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity2014-07-02 12:52 - 2014-05-08 10:41 - 00020992 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBFlt64.sys2014-07-02 12:52 - 2014-05-08 10:41 - 00001998 _____ () C:\Users\Public\Desktop\G Data InternetSecurity.lnk2014-07-02 12:52 - 2014-05-07 17:06 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys2014-07-02 12:52 - 2014-05-07 17:05 - 00142336 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys2014-07-02 12:52 - 2014-05-07 17:05 - 00067584 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys2014-07-02 12:52 - 2014-05-07 17:05 - 00061440 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys2014-07-02 12:52 - 2014-05-07 17:05 - 00055808 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys2014-07-02 12:52 - 2014-05-07 16:56 - 00000000 ____D () C:\ProgramData\G Data2014-07-02 12:51 - 2014-05-07 17:05 - 00051984 _____ () C:\Windows\DPINST.LOG2014-07-01 00:45 - 2014-07-10 10:58 - 00688128 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll2014-06-28 15:12 - 2014-05-07 22:38 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service2014-06-28 09:48 - 2014-07-10 10:58 - 00527360 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll2014-06-28 09:07 - 2014-07-10 10:58 - 00385536 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll2014-06-26 22:55 - 2013-08-22 17:38 - 00703968 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe2014-06-26 22:55 - 2013-08-22 17:38 - 00105440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl2014-06-24 12:37 - 2014-05-07 22:38 - 00000000 ____D () C:\Program Files (x86)\Mozilla ThunderbirdSome content of TEMP:====================C:\Users\User\AppData\Local\Temp\Bootstrapper.exeC:\Users\User\AppData\Local\Temp\BootstrapperARA.dllC:\Users\User\AppData\Local\Temp\BootstrapperARU.dllC:\Users\User\AppData\Local\Temp\BootstrapperCHS.dllC:\Users\User\AppData\Local\Temp\BootstrapperCHT.dllC:\Users\User\AppData\Local\Temp\BootstrapperCSY.dllC:\Users\User\AppData\Local\Temp\BootstrapperDAN.dllC:\Users\User\AppData\Local\Temp\BootstrapperDEU.dllC:\Users\User\AppData\Local\Temp\BootstrapperELL.dllC:\Users\User\AppData\Local\Temp\BootstrapperENU.dllC:\Users\User\AppData\Local\Temp\BootstrapperESN.dllC:\Users\User\AppData\Local\Temp\BootstrapperESP.dllC:\Users\User\AppData\Local\Temp\BootstrapperFIN.dllC:\Users\User\AppData\Local\Temp\BootstrapperFRA.dllC:\Users\User\AppData\Local\Temp\BootstrapperHEB.dllC:\Users\User\AppData\Local\Temp\BootstrapperHRV.dllC:\Users\User\AppData\Local\Temp\BootstrapperHUN.dllC:\Users\User\AppData\Local\Temp\BootstrapperITA.dllC:\Users\User\AppData\Local\Temp\BootstrapperJPN.dllC:\Users\User\AppData\Local\Temp\BootstrapperKOR.dllC:\Users\User\AppData\Local\Temp\BootstrapperLOC.dllC:\Users\User\AppData\Local\Temp\BootstrapperNLD.dllC:\Users\User\AppData\Local\Temp\BootstrapperNOR.dllC:\Users\User\AppData\Local\Temp\BootstrapperPLK.dllC:\Users\User\AppData\Local\Temp\BootstrapperPTB.dllC:\Users\User\AppData\Local\Temp\BootstrapperPTG.dllC:\Users\User\AppData\Local\Temp\BootstrapperRUS.dllC:\Users\User\AppData\Local\Temp\BootstrapperSKY.dllC:\Users\User\AppData\Local\Temp\BootstrapperSLV.dllC:\Users\User\AppData\Local\Temp\BootstrapperSVE.dllC:\Users\User\AppData\Local\Temp\BootstrapperTHA.dllC:\Users\User\AppData\Local\Temp\BootstrapperTRK.dllC:\Users\User\AppData\Local\Temp\BootstrapperUKR.dllC:\Users\User\AppData\Local\Temp\dotnetfx35setup.exeC:\Users\User\AppData\Local\Temp\GarminInstall.exeC:\Users\User\AppData\Local\Temp\_is24FE.exe==================== Bamital & volsnap Check =================C:\Windows\System32\winlogon.exe => File is digitally signedC:\Windows\System32\wininit.exe => File is digitally signedC:\Windows\explorer.exe => File is digitally signedC:\Windows\SysWOW64\explorer.exe => File is digitally signedC:\Windows\System32\svchost.exe => File is digitally signedC:\Windows\SysWOW64\svchost.exe => File is digitally signedC:\Windows\System32\services.exe => File is digitally signedC:\Windows\System32\User32.dll => File is digitally signedC:\Windows\SysWOW64\User32.dll => File is digitally signedC:\Windows\System32\userinit.exe => File is digitally signedC:\Windows\SysWOW64\userinit.exe => File is digitally signedC:\Windows\System32\rpcss.dll => File is digitally signedC:\Windows\System32\Drivers\volsnap.sys => File is digitally signedLastRegBack: 2014-07-15 11:47==================== End Of Log ============================ Share this post Link to post Share on other sites
Kerstin 0 Report post Posted July 23, 2014 ... und hier die Addition kopiert: Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-07-2014Ran by User at 2014-07-23 12:43:17Running from C:\Users\User\DesktopBoot Mode: Normal============================================================================== Security Center ========================AV: G Data InternetSecurity (Enabled - Up to date) {545C8713-0744-B079-87F8-349A6D5C8CF0}AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}AS: G Data InternetSecurity (Enabled - Up to date) {EF3D66F7-217E-BFF7-BD48-0FE816DBC64D}AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}FW: G Data Personal Firewall (Enabled) {6C670636-4D2B-B121-ACA7-9DAF938FCB8B}==================== Installed Programs ======================64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.5.1.17730 - Adobe Systems Inc.)Adobe AIR (x32 Version: 2.5.1.17730 - Adobe Systems Inc.) HiddenAdobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.4.980 - Adobe Systems Incorporated.)Adobe Community Help (x32 Version: 3.4.980 - Adobe Systems Incorporated.) HiddenAdobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)Adobe Illustrator CS (HKLM-x32\...\{91A4AD99-69CE-4745-97B7-0E0DFBECFDE5}) (Version: 11 - Adobe Systems, Inc.)Adobe Photoshop 7.0 (HKLM-x32\...\Adobe Photoshop 7.0) (Version: 7.0 - Adobe Systems, Inc.)Adobe SVG Viewer 3.0 (HKLM-x32\...\Adobe SVG Viewer) (Version: 3.0 - Adobe Systems, Inc.)ANT Drivers Installer x64 (Version: 2.3.4 - Garmin Ltd or its subsidiaries) HiddenApple Application Support (HKLM-x32\...\{21ECABC3-40B2-42DF-8E21-ACF3A4D0D95A}) (Version: 3.0.5 - Apple Inc.)Apple Mobile Device Support (HKLM\...\{6AF2AC2A-3532-43FD-9F4D-BDC9C0D724C7}) (Version: 7.1.2.6 - Apple Inc.)Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)Bing Bar (HKLM-x32\...\{3611CA6C-5FCA-4900-A329-6A118123CCFC}) (Version: 7.1.355.0 - Microsoft Corporation)Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)BufferChm (x32 Version: 140.0.298.000 - Hewlett-Packard) HiddenC309a (x32 Version: 140.0.846.000 - Hewlett-Packard) HiddenDestinations (x32 Version: 140.0.253.000 - Hewlett-Packard) HiddenDeviceDiscovery (x32 Version: 140.0.298.000 - Hewlett-Packard) HiddenDocProc (x32 Version: 140.0.185.000 - Hewlett-Packard) HiddendoPDF (Version: 8.0.906 - Softland) HiddendoPDF 8 (HKLM-x32\...\{a137ef5e-56f5-4cca-89f8-80df47fc4521}) (Version: 8.0.906.0 - Softland)Elevated Installer (x32 Version: 3.2.7.0 - Garmin Ltd or its subsidiaries) HiddenFax (x32 Version: 140.0.307.000 - Hewlett-Packard) HiddenG Data InternetSecurity (HKLM-x32\...\{85203592-3610-4FB9-AA11-15B2255B5A12}) (Version: 25.0.1.4 - G Data Software AG)Garmin Communicator Plugin (HKLM-x32\...\{71DBFBF2-F7EB-4268-8485-9471D83C4E66}) (Version: 4.2.0 - Garmin Ltd or its subsidiaries)Garmin Communicator Plugin x64 (HKLM\...\{70A381F1-C161-4D61-A20C-BE12FC6777DF}) (Version: 4.2.0 - Garmin Ltd or its subsidiaries)Garmin Express (HKLM-x32\...\{55ae01f2-f0a8-4342-a9cc-a0327cdaa811}) (Version: 3.2.7.0 - Garmin Ltd or its subsidiaries)Garmin Express (x32 Version: 3.2.7.0 - Garmin Ltd or its subsidiaries) HiddenGarmin Express Tray (x32 Version: 3.2.7.0 - Garmin Ltd or its subsidiaries) HiddenGarmin USB Drivers (HKLM-x32\...\{3D5D6CFC-3097-425A-8D8F-7EAF5D57641D}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)Garmin WebUpdater (HKLM-x32\...\{AE1EC58E-B2AC-4959-A4C2-C38202A25239}) (Version: 2.5.6 - Garmin Ltd or its subsidiaries)GPBaseService2 (x32 Version: 140.0.297.000 - Hewlett-Packard) HiddenHP Customer Participation Program 14.0 (HKLM\...\HPExtendedCapabilities) (Version: 14.0 - HP)HP Imaging Device Functions 14.0 (HKLM\...\HP Imaging Device Functions) (Version: 14.0 - HP)HP Photosmart C309a All-In-One Driver Software 14.0 Rel. 6 (HKLM\...\{F089B734-1356-484F-A7B8-1B78F1616A15}) (Version: 14.0 - HP)HP Solution Center 14.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 14.0 - HP)HP Update (HKLM-x32\...\{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}) (Version: 5.002.006.003 - Hewlett-Packard)HPPhotoGadget (x32 Version: 140.0.524.000 - Hewlett-Packard) HiddenHPProductAssistant (x32 Version: 140.0.298.000 - Hewlett-Packard) HiddenHPSSupply (x32 Version: 140.0.297.000 - Hewlett-Packard) HiddenIntel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.13.1706 - Intel Corporation)Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3262 - Intel Corporation)Intel® Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.0.1016 - Intel Corporation)Intel® Rapid Storage Technology (Version: 12.8.0.1016 - Intel Corporation) HiddenIntel® Trusted Connect Service Client (Version: 1.28.487.1 - Intel Corporation) HiddeniTunes (HKLM\...\{33E28B58-7BA0-47B7-AA01-9225ABA2B8A9}) (Version: 11.3.0.54 - Apple Inc.)Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217055FF}) (Version: 7.0.550 - Oracle)Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) HiddenKnoll Light Factory EZ Studio (HKLM-x32\...\Knoll Light Factory EZ Studio) (Version: - )Magic Bullet Looks Studio (HKLM-x32\...\Magic Bullet Looks Studio) (Version: - )MarketResearch (x32 Version: 140.0.212.000 - Hewlett-Packard) HiddenMicrosoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053 - Adobe) HiddenMicrosoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053 - Adobe) HiddenMicrosoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053 - Adobe) HiddenMicrosoft_VC90_ATL_x86 (x32 Version: 1.00.0000 - Adobe) HiddenMicrosoft_VC90_CRT_x86 (x32 Version: 1.00.0000 - Adobe) HiddenMicrosoft_VC90_MFC_x86 (x32 Version: 1.00.0000 - Adobe) HiddenMicrosoft_VC90_MFCLOC_x86 (x32 Version: 1.00.0000 - Adobe) HiddenMozBackup 1.5.1 (HKLM-x32\...\MozBackup) (Version: - Pavel Cvrcek)Mozilla Firefox 30.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)Mozilla Thunderbird 24.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.6.0 (x86 de)) (Version: 24.6.0 - Mozilla)Network64 (Version: 140.0.306.000 - Hewlett-Packard) HiddennovaPDF 8 Printer Driver (HKLM\...\{1FE809AB-642F-451E-9F9C-7A2238B5A9FB}) (Version: 8.0.906 - Softland)OCR Software by I.R.I.S. 14.0 (HKLM\...\HPOCR) (Version: 14.0 - HP)OpenOffice 4.1.0 (HKLM-x32\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)Pinnacle Studio 14 (HKLM-x32\...\{AADD1C8F-D59F-4D55-A726-768C71A205A8}) (Version: 14.0.0.7255 - Pinnacle Systems)Pinnacle Studio Ultimate Collection Plugins (HKLM-x32\...\{F5C372A1-40F3-49DA-A049-F75CDE9177DC}) (Version: 14.0.0.7255 - Pinnacle Systems)Pinnacle Video Treiber (HKLM\...\{6DE721A5-5E89-4D74-994C-652BB3C0672E}) (Version: 12.1.0.030 - Pinnacle Systems)PS_AIO_05_C309_Software_Min (x32 Version: 140.0.855.000 - Hewlett-Packard) HiddenRealtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.19.726.2013 - Realtek)Red Giant ToonIt Studio (HKLM-x32\...\Red Giant ToonIt Studio) (Version: - )Scan (x32 Version: 140.0.253.000 - Hewlett-Packard) HiddenShop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 14.0 - HP)SolutionCenter (x32 Version: 140.0.299.000 - Hewlett-Packard) HiddenStatus (x32 Version: 140.0.342.000 - Hewlett-Packard) HiddenTomTom HOME (HKLM-x32\...\{99072AB4-D795-44D5-9D65-E3C9F8322C97}) (Version: 2.9.7 - Ihr Firmenname)TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)Toolbox (x32 Version: 140.0.596.000 - Hewlett-Packard) HiddenTrapcode 3DStroke Studio (HKLM-x32\...\Trapcode 3DStroke Studio) (Version: - )Trapcode Particular Studio (HKLM-x32\...\Trapcode Particular Studio) (Version: - )Trapcode Shine Studio (HKLM-x32\...\Trapcode Shine Studio) (Version: - )TrayApp (x32 Version: 140.0.297.000 - Hewlett-Packard) HiddenUlead VideoStudio 7 SE Basic (HKLM-x32\...\{757AD3D4-036B-42FA-B0A4-96BD6F4605A0}) (Version: 7.0 - Ulead Systems, Inc.)WebReg (x32 Version: 140.0.297.017 - Hewlett-Packard) HiddenWindows Driver Package - Garmin (grmnusb) GARMIN Devices (04/19/2012 2.3.1.0) (HKLM\...\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)Windows-Treiberpaket - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\...\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.)Windows-Treiberpaket - Silicon Labs Software (DSI_SiUSBXp_3_1) USB (02/06/2007 3.1) (HKLM\...\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software)WinRAR 5.10 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.10.0 - win.rar GmbH)==================== Restore Points =========================11-07-2014 13:26:06 Installed 7-Zip 9.20 (x64 edition)21-07-2014 13:27:21 Installiert Adobe Illustrator CS==================== Hosts content: ==========================2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts==================== Scheduled Tasks (whitelisted) =============Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTaskTask: {05437506-B845-4749-B97A-063B9B069D2A} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-ValidationTask: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsListTask: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTaskTask: {27D962FC-144B-4647-8F50-FB23034BA261} - System32\Tasks\doPDF Update => C:\Program Files\Softland\novaPDF 8\Driver\UpdateApplication.exe [2014-04-30] ()Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulateTask: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalanceTask: {5496D42F-8743-4350-A576-3B2CFF9E73AE} - System32\Tasks\Microsoft\Windows\DiskFootprint\DiagnosticsTask: {628CD93E-FFBB-4EA8-9501-2C97C85A4A6E} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-ManagementTask: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play CleanupTask: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance TaskTask: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTaskTask: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryStateTask: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance TaskTask: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTaskTask: {98785033-CC17-4244-A7EF-233C31E2ABDC} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network => Sc.exe start wuauservTask: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance WorkTask: {B7E0BF36-99D8-4C24-97B7-A924194FB103} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\Windows\system32\cleanmgr.exe [2014-02-22] (Microsoft Corporation)Task: {B9EC6D45-E19D-4E29-B35E-78AAB3B3BA90} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-07-10] (Microsoft Corporation)Task: {BE0FE4D3-AA15-43C5-9A3B-FF642F784E7C} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-08] (Adobe Systems Incorporated)Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTaskTask: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensingTask: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon SynchronizationTask: {E340CEF3-4118-4922-9801-D4DEF50500AF} - System32\Tasks\GarminUpdaterTask => C:\Program Files (x86)\Garmin\Express Self Updater\ExpressSelfUpdater.exe [2014-06-09] ()Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRETask: {EC8B436E-964D-4857-B65D-3BE93DE4CDA7} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyUploadTask: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe==================== Loaded Modules (whitelisted) =============2014-04-30 15:41 - 2014-04-30 15:41 - 00017920 _____ () C:\Windows\System32\novamn8.dll2014-04-02 23:21 - 2013-05-07 09:45 - 00936728 _____ () C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe2014-05-15 19:46 - 2014-05-15 19:46 - 00130933 _____ () C:\Windows\TEMP\bfecfd06-a508-454d-a95b-17cabd8e5c04\AgileDotNetRT64.dll2014-05-15 19:46 - 2014-05-15 19:46 - 00130933 _____ () C:\Windows\TEMP\ce98dbf9-9a5d-4dd4-aa9f-e7ee1148a36d\AgileDotNetRT64.dll2014-05-20 03:38 - 2014-05-20 03:38 - 00340088 ____N () C:\Program Files (x86)\Common Files\G Data\AVKProxy\PktIcpt2x64.dll2014-04-23 16:05 - 2014-04-23 16:05 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll2014-04-23 16:04 - 2014-04-23 16:04 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll2014-04-02 23:21 - 2014-07-23 10:29 - 00027136 _____ () C:\Program Files (x86)\ASUS\AXSP\1.01.02\PEbiosinterface32.dll2014-04-02 23:21 - 2013-05-07 09:45 - 00104448 _____ () C:\Program Files (x86)\ASUS\AXSP\1.01.02\ATKEX.dll2014-04-02 23:27 - 2013-08-19 11:10 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\ACE.dll2014-06-24 13:33 - 2014-06-24 13:33 - 03852912 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll==================== Alternate Data Streams (whitelisted) ============================= Safe Mode (whitelisted) ===================HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => ""="Driver"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys => ""="Driver"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => ""="Driver"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys => ""="Driver"==================== EXE Association (whitelisted) ================================= MSCONFIG/TASK MANAGER disabled items ============================= Faulty Device Manager Devices =============Name: Photosmart C309a seriesDescription: Photosmart C309a seriesClass Guid: {4d36e971-e325-11ce-bfc1-08002be10318}Manufacturer: HPService:Problem: : This device is disabled. (Code 22)Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.==================== Event log errors: =========================Application errors:==================Error: (07/21/2014 04:59:47 PM) (Source: MsiInstaller) (EventID: 10005) (User: PC)Description: Produkt: Windows Media Encoder 9-Reihe -- Diese Version von Windows Media Encoder 9-Reihe kann nur unter Windows 2000, Windows XP und Windows .NET Server installiert werden.Error: (07/21/2014 03:48:21 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT-AUTORITÄT)Description: There was an error with the Windows Location Provider databaseError: (07/21/2014 08:54:10 AM) (Source: SideBySide) (EventID: 33) (User: )Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.30729.1"1".Die abhängige Assemblierung "Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.30729.1"" konnte nicht gefunden werden.Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".Error: (07/21/2014 08:54:10 AM) (Source: SideBySide) (EventID: 33) (User: )Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.30729.1"1".Die abhängige Assemblierung "Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.30729.1"" konnte nicht gefunden werden.Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".Error: (07/21/2014 08:54:10 AM) (Source: SideBySide) (EventID: 33) (User: )Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.30729.1"1".Die abhängige Assemblierung "Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.30729.1"" konnte nicht gefunden werden.Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".Error: (07/21/2014 08:54:09 AM) (Source: SideBySide) (EventID: 33) (User: )Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.30729.1"1".Die abhängige Assemblierung "Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.30729.1"" konnte nicht gefunden werden.Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".Error: (07/18/2014 08:26:29 AM) (Source: SideBySide) (EventID: 33) (User: )Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.30729.1"1".Die abhängige Assemblierung "Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.30729.1"" konnte nicht gefunden werden.Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".Error: (07/18/2014 08:26:29 AM) (Source: SideBySide) (EventID: 33) (User: )Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.30729.1"1".Die abhängige Assemblierung "Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.30729.1"" konnte nicht gefunden werden.Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".Error: (07/18/2014 08:26:28 AM) (Source: SideBySide) (EventID: 33) (User: )Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.30729.1"1".Die abhängige Assemblierung "Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.30729.1"" konnte nicht gefunden werden.Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".Error: (07/18/2014 08:26:28 AM) (Source: SideBySide) (EventID: 33) (User: )Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.30729.1"1".Die abhängige Assemblierung "Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.30729.1"" konnte nicht gefunden werden.Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".System errors:=============Error: (07/23/2014 00:22:49 PM) (Source: DCOM) (EventID: 10010) (User: PC)Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}Error: (07/23/2014 09:51:28 AM) (Source: DCOM) (EventID: 10010) (User: PC)Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}Error: (07/23/2014 09:40:55 AM) (Source: EventLog) (EventID: 6008) (User: )Description: Das System wurde zuvor am 22.07.2014 um 17:34:26 unerwartet heruntergefahren.Error: (07/23/2014 09:40:43 AM) (Source: Microsoft-Windows-Kernel-Boot) (EventID: 29) (User: NT-AUTORITÄT)Description: 32212256844794523533248472Error: (07/22/2014 00:17:58 PM) (Source: DCOM) (EventID: 10010) (User: PC)Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}Error: (07/21/2014 08:54:53 AM) (Source: DCOM) (EventID: 10010) (User: PC)Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}Error: (07/21/2014 08:54:23 AM) (Source: DCOM) (EventID: 10010) (User: PC)Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}Error: (07/18/2014 02:49:01 PM) (Source: DCOM) (EventID: 10010) (User: PC)Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}Error: (07/17/2014 02:31:26 PM) (Source: DCOM) (EventID: 10010) (User: PC)Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}Error: (07/17/2014 00:59:36 PM) (Source: DCOM) (EventID: 10010) (User: PC)Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}Microsoft Office Sessions:=========================Error: (07/21/2014 04:59:47 PM) (Source: MsiInstaller) (EventID: 10005) (User: PC)Description: Produkt: Windows Media Encoder 9-Reihe -- Diese Version von Windows Media Encoder 9-Reihe kann nur unter Windows 2000, Windows XP und Windows .NET Server installiert werden.(NULL)(NULL)(NULL)(NULL)(NULL)Error: (07/21/2014 03:48:21 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT-AUTORITÄT)Description: -2147024883Error: (07/21/2014 08:54:10 AM) (Source: SideBySide) (EventID: 33) (User: )Description: Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.30729.1"C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\DWA\resources\libraries\ARKCmdDefrag.dllError: (07/21/2014 08:54:10 AM) (Source: SideBySide) (EventID: 33) (User: )Description: Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.30729.1"C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\DWA\resources\libraries\ARKCmdCaps.dllError: (07/21/2014 08:54:10 AM) (Source: SideBySide) (EventID: 33) (User: )Description: Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.30729.1"C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\DWA\resources\libraries\ARKEngine.dllError: (07/21/2014 08:54:09 AM) (Source: SideBySide) (EventID: 33) (User: )Description: Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.30729.1"C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\DWA\resources\libraries\ARKCmdFS.dllError: (07/18/2014 08:26:29 AM) (Source: SideBySide) (EventID: 33) (User: )Description: Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.30729.1"C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\DWA\resources\libraries\ARKCmdDefrag.dllError: (07/18/2014 08:26:29 AM) (Source: SideBySide) (EventID: 33) (User: )Description: Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.30729.1"C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\DWA\resources\libraries\ARKCmdCaps.dllError: (07/18/2014 08:26:28 AM) (Source: SideBySide) (EventID: 33) (User: )Description: Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.30729.1"C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\DWA\resources\libraries\ARKEngine.dllError: (07/18/2014 08:26:28 AM) (Source: SideBySide) (EventID: 33) (User: )Description: Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.30729.1"C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\DWA\resources\libraries\ARKCmdFS.dll==================== Memory info ===========================Percentage of memory in use: 26%Total physical RAM: 8064.19 MBAvailable physical RAM: 5952.02 MBTotal Pagefile: 9344.19 MBAvailable Pagefile: 6793.97 MBTotal Virtual: 131072 MBAvailable Virtual: 131071.79 MB==================== Drives ================================Drive c: () (Fixed) (Total:111.45 GB) (Free:52.48 GB) NTFSDrive i: (Volume) (Fixed) (Total:1863.01 GB) (Free:1252.71 GB) NTFS==================== MBR & Partition Table ==========================================================================Disk: 0 (MBR Code: Windows 7 or (Size: 112 GB) (Disk ID: AA5A1BA2)Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)Partition 2: (Not Active) - (Size=111 GB) - (Type=07 NTFS)========================================================Disk: 1 (MBR Code: Windows 7 or (Size: 1863 GB) (Disk ID: 6487F287)Partition 1: (Not Active) - (Size=-198626508800) - (Type=07 NTFS)==================== End Of Log ============================ Share this post Link to post Share on other sites
schrauber 30 Report post Posted July 23, 2014 Hi, wo findet GDATA das denn? Bitte das Log davon posten wenn vorhanden, oder einen Screenshot. Ebenso bitte das Logfile von Emsisoft Antimalware direkt in den Thread posten, ich kann das Attachment aus deinem ersten Post nicht öffnen. Share this post Link to post Share on other sites
Kerstin 0 Report post Posted July 24, 2014 Hi Thomas, G-Data findet auf einmal diesen Trojaner nicht mehr. Ich habe auch eine externe Festplatte gescannt, nichts. Ich habe heute mehrere Scan´s mit G-Data gemacht, da ich es nicht glauben kann, dass der Trojan weg wäre. Leider kommen bei der Textdatei "a2scan_140724-200748.txt" von Emergency Kit immer nur Hieroglyphen raus ÿþE#m#s#i#s#o#f#t# #E#m#e#r#g#e#n#c#y# #K#i#t# #-# #V#e#r#s#i#o#n# #4#.#0# Mach ich evtl. etwas beim Abspeichern falsch? Meine Mails werden auf einmal über Thunderbird auch wieder abgerufen. Dies hat die letzten Tage nicht funktioniert. Kann es sein, dass der Trojan.GenericKD auf wundersame Weise verschwunden ist? Bin sehr verunsichert, da ich mich auch nicht gut auskenne. Grüße, Kerstin Share this post Link to post Share on other sites
schrauber 30 Report post Posted July 25, 2014 Komisch. Ist es möglich dass ich mir den Rechner mal kurz per Fernwartung anschaue? Share this post Link to post Share on other sites
Kerstin 0 Report post Posted July 26, 2014 Hallo Thomas, sicher, du müsstest mir nur bitte erklären, was ich dann machen muss. Leider (eigentlich gottseidank) fahren wir heute auf Urlaub. Dürfte ich mich bei dir in der KW 34, nach unserer Rückkehr nochmals melden? Vielen herzlichen Dank derweilen für deine Bemühungen. Schöne Wochen bis dahin, Kerstin Share this post Link to post Share on other sites
schrauber 30 Report post Posted July 27, 2014 Hi Kerstin, ja kein Problem, meld dich einfach wenn Du wieder da bist Share this post Link to post Share on other sites
Kerstin 0 Report post Posted August 19, 2014 Hallo Thomas, nun bin ich wieder aus dem Urlaub zurück. Gestern war der Computerfachmann bei mir, bei dem ich den Rechner vor ein paar Wochen gekauft habe. Dieser hat alles durchgeschaut und geprüft und nichts gefunden. Es funktioniert komischerweise auch wieder alles - hoffe, es bleibt so. Vielen herzlichen Dank an dich und eurem tollen Forum. Schöne Grüße, Kerstin Share this post Link to post Share on other sites
schrauber 30 Report post Posted August 19, 2014 Hallo Kerstin, alles klar. Wenn nochmal was sein sollte, einfach melden Share this post Link to post Share on other sites