Programme lassen sich nicht mehr starten

Enna-AF · 12.04.2015, 23:04

Hallo,

als ich heute meinen PC nach einiger Zeit wieder startete, kamen nach einiger Zeit Meldungen, dass diverse .dll´s nicht ausgeführt werden könnten, da sie nicht richtig installiert seien. Diese Meldungen kamen (laut Header) z.B von jusched.exe, dem Flash Player, aber beim Versuch etwas zu drucken, auf vom dafür benutzten Programm (Firefox, Adobe Reader, Editor). (Dabei wurde eine .dll aus dem /spool Ordner als defekt vermeldet. Selbst der Neustart scheiterte an solchen Meldungen. Zunächst war der Spuk dann vorbei (Programme öffnen, FRST-Scan, Emsisoft (das habe ich übrigens am letzten Tag installiert, bevor der PC länger unbenutzt blieb) und co funktionierten wieder, aber nur für ca. 3-5 Minuten. Dann ließen sich garkeine Programme mehr öffnen, es kam der Hinweis, das diese Programme keine gültigen Win32 Anwendungen seien. Auf einen Doppelklick auf Emsisoft in der Taskleiste wurde garnicht reagiert. Im abgesicherten Modus (mit Netzwerktreibern) klappt alles wunderbar. Hier habe ich nun auch Malwarebytes und GMER laufen lassen. FRST und Emsisoft liefen in der kurzen Zeit nach dem ersten Neustart.
(Ich habe, bevor die Probleme erstmalig auftauchten, Onlinebanking betrieben (mTan geschützt). Sollte ich dies sperren lassen?)

Hier die Logs:
defogger:

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 23:38 on 12/04/2015 (***)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

FRST

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-04-2015
Ran by *** (administrator) on ***-PC on 12-04-2015 23:05:52
Running from C:\Users\***\Desktop
Loaded Profiles: *** (Available profiles: ***)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
() C:\Program Files\ASUS\Six Engine\SixEngine.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler64.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe
(NVIDIA) C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA) C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneCmd.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_16_0_0_305_ActiveX.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Windows\System32\PrintIsolationHost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403104 2014-07-25] (NVIDIA Corporation)
HKLM-x32\...\Run: [P17RunE] => RunDll32 P17RunE.dll,RunDLLEntry
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [707496 2014-07-21] (Cisco Systems, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation)
HKLM-x32\...\Run: [emsisoft anti-malware] => c:\program files (x86)\emsisoft anti-malware\a2guard.exe [4885584 2015-03-02] (Emsisoft GmbH)
HKU\S-1-5-21-2348180457-2134729463-1863465213-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [163328 2010-11-20] (Microsoft Corporation)
HKU\S-1-5-21-2348180457-2134729463-1863465213-1000\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x20000000
HKU\S-1-5-21-2348180457-2134729463-1863465213-1000\...\MountPoints2: {28df5f0a-dbf2-11e2-b74d-806e6f6e6963} - E:\stub.exe
HKU\S-1-5-21-2348180457-2134729463-1863465213-1000\...\MountPoints2: {8a69b5b0-62da-11e2-baeb-0022155bfc5f} - J:\Startme.exe
HKU\S-1-5-21-2348180457-2134729463-1863465213-1000\...\MountPoints2: {9238ccf2-8b23-11e2-8f95-0022155bfc5f} - J:\iStudio.exe
HKU\S-1-5-21-2348180457-2134729463-1863465213-1000\...\MountPoints2: {a5c96a64-de84-11dd-9681-806e6f6e6963} - E:\stub.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2348180457-2134729463-1863465213-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.msn.com/
HKU\S-1-5-21-2348180457-2134729463-1863465213-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKU\S-1-5-21-2348180457-2134729463-1863465213-1000\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.bing.com/
SearchScopes: HKU\S-1-5-21-2348180457-2134729463-1863465213-1000 -> DefaultScope {094261C1-FB30-4687-B4DC-031BCDC13A47} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2348180457-2134729463-1863465213-1000 -> {094261C1-FB30-4687-B4DC-031BCDC13A47} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2348180457-2134729463-1863465213-1000 -> {AC350029-2AA6-40EC-93D2-7C9BFCFFC9B0} URL = hxxp://www.youtube.com/results?search_query={searchTerms}&page={startPage?}&utm_source=opensearch
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll [2015-02-08] (Oracle Corporation)
BHO: WOT Helper -> {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} -> C:\Program Files\WOT\WOT.dll [2013-09-02] ()
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-02-08] (Oracle Corporation)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-09-20] (Hewlett-Packard Co.)
BHO-x32: Ghostery Add-On -> {237EB6DA-3FEA-4DD2-8A61-A901B5C489D7} -> C:\Program Files (x86)\GhosteryIEplugin\GhosteryBrowserHelperObject.dll [2011-04-20] ()
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-02-08] (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22] (Microsoft Corporation)
BHO-x32: WOT Helper -> {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} -> C:\Program Files (x86)\WOT\WOT.dll [2013-09-02] ()
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-02-08] (Oracle Corporation)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-09-20] (Hewlett-Packard Co.)
Toolbar: HKLM - WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll [2013-09-02] ()
Toolbar: HKLM-x32 - WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files (x86)\WOT\WOT.dll [2013-09-02] ()
Toolbar: HKU\S-1-5-21-2348180457-2134729463-1863465213-1000 -> WOT - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll [2013-09-02] ()
DPF: HKLM {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM {3234EB1E-733E-4E6A-A8AB-EBB6287E5A7E} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel64_4.5.5.0.cab
DPF: HKLM {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: HKLM-x32 {10000000-1000-1000-1000-100000000000} hxxp://cdn.betteradvertising.com/ghostery/addons/ie/2.4.2.0/ghostery.cab
DPF: HKLM-x32 {1C11B948-582A-433F-A98D-A8C4D5CC64F2} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_Win32.cab
DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {6C269571-C6D7-4818-BCA4-32A035E8C884} hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15102/CTSUEng.cab
DPF: HKLM-x32 {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} hxxp://game.zylom.com/activex/zylomgamesplayer.cab
DPF: HKLM-x32 {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com/bin/srldetect_intel_4.5.22.0.cab
DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: HKLM-x32 {E4CF4E86-D0DC-4864-8F0E-4F6EA2526334} https://img.web.de/v/smartdrive/v23/activex/web_de_osupload_2002.cab
DPF: HKLM-x32 {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab
Handler: data - {038664DA-5BA5-47FC-88D9-15ADE940ED55} -  No File
Handler-x32: http - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [2000-11-21] (Microsoft Corporation)
Handler-x32: http - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [2000-11-21] (Microsoft Corporation)
Handler-x32: https - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [2000-11-21] (Microsoft Corporation)
Handler-x32: https - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [2000-11-21] (Microsoft Corporation)
Handler-x32: ipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [2000-11-21] (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [2000-11-21] (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [2000-11-21] (Microsoft Corporation)
Handler: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll [2013-09-02] ()
Handler-x32: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files (x86)\WOT\WOT.dll [2013-09-02] ()
Filter-x32: text/html - {4459DC76-1FDE-4B16-BAD0-E4F8E7647555} - C:\Program Files (x86)\GhosteryIEplugin\GhosteryMimeFilter.dll [2011-04-20] ()
Hosts: 134.76.22.1	vpn.gwdg.de ###Cisco AnyConnect VPN client modified this file. Please do not modify contents until this comment is removed.
Tcpip\Parameters: [DhcpNameServer] 10.10.8.1

FireFox:
========
FF ProfilePath: C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\95y20sg3.default
FF Homepage: hxxp://the-west.de
FF NetworkProxy: "no_proxies_on", ""
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-05] ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll [2011-06-20] (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-02-08] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-02-08] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-05] ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll [2011-06-20] (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-02-08] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-02-08] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-04-16] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-07-02] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-07-02] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-05] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-05] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Extension: WOT - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\95y20sg3.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-09-22]
FF Extension: Classic Theme Restorer - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\95y20sg3.default\Extensions\ClassicThemeRestorer@ArisT2Noia4dev.xpi [2014-04-30]
FF Extension: Grooveshark Unlocker - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\95y20sg3.default\Extensions\groovesharkUnlocker@overlord1337.xpi [2014-01-25]
FF Extension: Illuminations for Developers - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\95y20sg3.default\Extensions\sroussey@illumination-for-developers.com.xpi [2012-10-31]
FF Extension: Video DownloadHelper - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\95y20sg3.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2015-04-12]
FF Extension: Greasemonkey - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\95y20sg3.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2012-08-25]
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2 [2015-04-12]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2 [2015-04-12]
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-09-04]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011-02-10]
FF HKU\S-1-5-21-2348180457-2134729463-1863465213-1000\...\Firefox\Extensions: [{F239AB75-8097-4DF8-A721-CC8A5369BE37}] - C:\Users\***\AppData\Local\{F239AB75-8097-4DF8-A721-CC8A5369BE37}
FF Extension: XULRunner - C:\Users\***\AppData\Local\{F239AB75-8097-4DF8-A721-CC8A5369BE37} [2011-01-17]
FF HKU\S-1-5-21-2348180457-2134729463-1863465213-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S4 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [140672 2011-08-12] (SUPERAntiSpyware.com) [File not signed]
R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [5019496 2015-03-02] (Emsisoft GmbH)
S3 Creative ALchemy AL6 Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2014-08-23] (Creative Labs) [File not signed]
S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2009-09-03] (Creative Labs) [File not signed]
R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [307200 2008-11-18] (Creative Technology Ltd) [File not signed]
R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2010-10-22] (Hewlett-Packard Co.) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
S2 MSSQL$SQLEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [57617752 2009-03-30] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R2 nTuneService; C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe [276584 2009-11-06] (NVIDIA)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2014-07-25] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18956064 2014-07-25] (NVIDIA Corporation)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
S4 Prosieben; C:\Program Files (x86)\maxdome\DCBin\DCService.exe [77032 2009-05-01] (Entriq, Inc.)
S3 Sony PC Companion; C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe [155320 2012-01-18] (Avanquest Software) [File not signed]
S4 SQLAgent$SQLEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [427880 2009-03-30] (Microsoft Corporation)
S4 UpdateCenterService; C:\Program Files (x86)\NVIDIA Corporation\System Update\UpdateCenterService.exe [282728 2009-11-06] (NVIDIA)
S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 61883; C:\Windows\System32\DRIVERS\61883.sys [60288 2009-07-14] (Microsoft Corporation)
S1 acedrv05; C:\Windows\system32\drivers\acedrv05.sys [136192 2010-05-15] () [File not signed]
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13368 2009-12-11] ()
S3 athrusb; C:\Windows\System32\DRIVERS\athrxusb.sys [1037312 2007-04-20] (Atheros Communications, Inc.)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2009-09-05] ()
S3 CBPSp50a64; C:\Windows\System32\Drivers\CBPSp50a64.sys [41280 2006-11-28] (Printing Communications Assoc., Inc. (PCAUSA))
R2 cpuz133; C:\Windows\system32\drivers\cpuz133_x64.sys [20968 2010-03-30] (Windows (R) Win 7 DDK provider)
R1 epp64; C:\Windows\System32\DRIVERS\epp64.sys [135800 2015-03-02] (Emsisoft GmbH)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2009-09-05] ()
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-12-11] ()
R0 mv61xx; C:\Windows\System32\DRIVERS\mv61xx.sys [173096 2008-06-24] (Marvell Semiconductor, Inc.)
R3 nvoclk64; C:\Windows\System32\DRIVERS\nvoclk64.sys [42088 2009-09-15] (NVIDIA Corp.)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-07-25] (NVIDIA Corporation)
S3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [52736 2012-07-09] (Apple, Inc.) [File not signed]
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52592 2014-07-21] (Cisco Systems, Inc.)
S3 ALSysIO; \??\C:\Users\NIKLAS~1\AppData\Local\Temp\ALSysIO64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-12 23:05 - 2015-04-12 23:06 - 00022641 _____ () C:\Users\***\Desktop\FRST.txt
2015-04-12 23:05 - 2015-04-12 23:05 - 00000000 ____D () C:\Users\***\Desktop\FRST-OlderVersion
2015-04-12 22:58 - 2015-04-12 23:05 - 02096640 _____ (Farbar) C:\Users\***\Desktop\FRST64.exe
2015-04-12 22:46 - 2015-04-12 22:46 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-12 23:05 - 2015-03-04 01:47 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2015-04-12 23:05 - 2014-10-23 20:05 - 00000000 ____D () C:\FRST
2015-04-12 23:03 - 2009-09-26 10:40 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-12 23:03 - 2009-09-02 16:54 - 00000284 _____ () C:\Windows\Tasks\RtlVistaStart.job
2015-04-12 23:03 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-12 23:02 - 2014-08-20 15:52 - 00728932 _____ () C:\Windows\PFRO.log
2015-04-12 23:02 - 2014-06-22 12:37 - 00015396 _____ () C:\Windows\setupact.log
2015-04-12 23:02 - 2012-05-18 13:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-04-12 23:02 - 2009-09-02 16:29 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-04-12 22:57 - 2009-07-14 19:58 - 00765634 _____ () C:\Windows\system32\perfh007.dat
2015-04-12 22:57 - 2009-07-14 19:58 - 00174864 _____ () C:\Windows\system32\perfc007.dat
2015-04-12 22:57 - 2009-07-14 07:13 - 01807538 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-12 22:48 - 2015-03-03 15:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox.bak
2015-04-12 22:43 - 2009-11-05 19:53 - 00003998 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{D1008078-F272-4726-ADE4-1D3399E81D2B}
2015-04-12 22:28 - 2010-08-17 19:49 - 01806251 _____ () C:\Windows\WindowsUpdate.log
2015-04-12 22:13 - 2012-04-14 20:00 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-04-12 22:04 - 2009-11-05 19:23 - 00019440 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-12 22:04 - 2009-11-05 19:23 - 00019440 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

==================== Files in the root of some directories =======

2010-02-12 17:11 - 2014-01-04 14:59 - 0000000 _____ () C:\Users\***\AppData\Roaming\FileIn.cns
2010-02-12 17:11 - 2014-01-04 14:59 - 0000000 _____ () C:\Users\***\AppData\Roaming\FileOut.cns
2013-06-11 18:38 - 2013-06-11 18:38 - 0000026 _____ () C:\Users\***\AppData\Roaming\mbam.context.scan
2011-01-18 16:13 - 2011-01-18 16:13 - 0000000 _____ () C:\Users\***\AppData\Local\Csibazefijocifa.bin
2010-01-13 18:16 - 2013-07-07 21:46 - 0024064 _____ () C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2011-01-17 19:54 - 2011-01-18 16:13 - 0000120 _____ () C:\Users\***\AppData\Local\Eseti.dat
2010-07-12 19:44 - 2010-07-12 19:44 - 0000600 _____ () C:\Users\***\AppData\Local\PUTTY.RND
2014-12-06 13:27 - 2014-12-06 13:27 - 0001490 _____ () C:\Users\***\AppData\Local\recently-used.xbel
2009-12-07 20:45 - 2013-07-19 16:14 - 0007669 _____ () C:\Users\***\AppData\Local\Resmon.ResmonCfg
2012-07-25 11:43 - 2012-07-25 11:43 - 0017408 _____ () C:\Users\***\AppData\Local\WebpageIcons.db
2010-08-30 19:53 - 2011-02-11 17:25 - 0008203 _____ () C:\ProgramData\hpzinstall.log
2011-05-02 20:20 - 2012-10-08 11:28 - 0000155 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-03 19:55

==================== End Of Log ============================

--- --- ---

[/code]

Addition

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-04-2015
Ran by *** at 2015-04-12 23:06:56
Running from C:\Users\***\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Emsisoft Anti-Malware (Disabled - Up to date) {8504DEEF-CC04-1F76-2137-F1A5F4A659DA}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Emsisoft Anti-Malware (Disabled - Up to date) {3E653F0B-EA3E-10F8-1B87-CAD78F211367}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 RAFG Bruggen (HKLM-x32\...\ RAFG Bruggen) (Version:  - )
64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
A2A Accusim for the Wings of POWER 3 Razorback (HKLM-x32\...\A2A Accusim for the Wings of POWER 3 Razorback) (Version:  - )
A2A Accusim for the Wings of Silver B377 (HKLM-x32\...\A2A Accusim for the Wings of Silver B377) (Version:  - )
A2A Wings of POWER 3 P47 Razorback (HKLM-x32\...\A2A Wings of POWER 3 P47 Razorback) (Version:  - )
A2A Wings of Silver B377 Stratocruiser (HKLM-x32\...\A2A Wings of Silver B377 Stratocruiser) (Version:  - )
ACD/Labs Software in C:\ACDFREE12\ (HKLM-x32\...\ACDLabs in C__ACDFREE12_) (Version: v12.00, FREE - ACD/Labs)
Adobe Digital Editions (HKLM-x32\...\Digital Editions) (Version:  - )
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
AEGEAN SMALL AIRPORTS BY GAP (HKLM-x32\...\AEGEAN SMALL AIRPORTS BY GAP) (Version:  - )
aerosoft's - German Aiports 4 - Version 3.2 Update - FS2004 (HKLM-x32\...\{2B0000B7-89C7-49FD-B9CC-139CA2456822}) (Version:  - )
aerosoft's - German Airports 2 - Cologne-Bonn  - FS2004 (HKLM-x32\...\{46464A5D-7D14-41E3-9C26-E3C186F37D84}) (Version:  - )
aerosoft's - German Airports 3 - FS2004 (HKLM-x32\...\{ECE1939E-3491-409E-87B7-E7DF65E7B909}) (Version:  - )
aerosoft's - German Airports 4 - FS2004 (HKLM-x32\...\{674D3526-6B4F-468A-9802-1130A39B1562}) (Version:  - )
aerosoft's - German Football Stadiums - FS2004 (HKLM-x32\...\{3CDBA499-FB8B-4FFC-A374-F5AA59AB534D}) (Version:  - )
aerosoft's - Piper Cheyenne (HKLM-x32\...\{0489CB0C-89F7-4EFF-827F-C85339ABF232}) (Version:  - )
AIO_Scan (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
Amazon MP3-Downloader 1.0.9 (HKLM-x32\...\Amazon MP3-Downloader) (Version:  - )
ANNO 1404 (HKLM-x32\...\{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}) (Version: 1.03.0000 - Ubisoft)
Anno 1404 (x32 Version: 1.00.0000 - Ubisoft) Hidden
Anno 1701 (HKLM-x32\...\{A2433A63-5F5D-40E5-B529-9123C2B3E734}) (Version: 1.04 - Sunflowers)
Ashampoo Burning Studio 2012 CBE v.11.0.4 (HKLM-x32\...\Ashampoo Burning Studio 2012 CBE_is1) (Version: 11.0.4 - Ashampoo GmbH & Co. KG)
ASUS WiFi-AP @n (HKLM-x32\...\{6600970A-BAE7-412A-BFFC-91AD793B3A41}) (Version: 1.00.0000 - ASUS)
ASUS WiFi-AP @n (x32 Version: 1.00.0000 - ASUS) Hidden
Audacity 2.0 (HKLM-x32\...\Audacity_is1) (Version:  - Audacity Team)
BellHuey2lt1 Beta (HKLM-x32\...\BellHuey2lt1 Beta) (Version:  - )
Blender (HKLM\...\Blender) (Version: 2.67b - Blender Foundation)
BOINC (HKLM\...\{68D2AC29-B594-466A-8D6F-238FA2135BB5}) (Version: 7.0.64 - Space Sciences Laboratory, U.C. Berkeley)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
BufferChm (x32 Version: 130.0.331.000 - Hewlett-Packard) Hidden
C6200 (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
C6200_Help (x32 Version: 100.0.206.000 - Hewlett-Packard) Hidden
Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version:  - ‪Canon Inc.‬)
Canon MG4200 series Benutzerregistrierung (HKLM-x32\...\Canon MG4200 series Benutzerregistrierung) (Version:  - Canon Inc.‎)
Canon MG4200 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG4200_series) (Version: 1.01 - Canon Inc.)
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: 3.0.0 - Canon Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 4.07 - Piriform)
CH Comm V 3.0.0 (HKLM-x32\...\ST6UNST #1) (Version:  - )
Cisco AnyConnect Secure Mobility Client  (HKLM-x32\...\Cisco AnyConnect Secure Mobility Client) (Version: 3.1.05178 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (x32 Version: 3.1.05178 - Cisco Systems, Inc.) Hidden
Cloud9 Bergen FS9 1.0.1 (HKLM-x32\...\Cloud9 Bergen FS9_is1) (Version:  - )
CMake 2.8, a cross-platform, open-source build system (HKLM-x32\...\CMake 2.8.8) (Version: 2.8.8 - Kitware)
Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
COMPUTERBILD App-Center (HKLM-x32\...\{5D5509EA-B85A-411E-AB75-59069A411876}) (Version: 1.1.11 - J3S)
COMPUTERBILD-Abzockschutz (HKLM-x32\...\{B4E4ACA0-79C5-4FC0-818F-ECE4521EBF8D}) (Version: 1.0.29 - J3S)
ConvertHelper 2.2 (HKLM-x32\...\{27CC6AB1-E72B-4179-AF1A-EAE507EBAF51}_is1) (Version:  - DownloadHelper)
Copy (x32 Version: 130.0.428.000 - Hewlett-Packard) Hidden
Core Temp 1.0 RC3 (HKLM\...\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1) (Version: 1.0 - Alcpu)
CPUID CPU-Z 1.54 (HKLM\...\CPUID CPU-Z_is1) (Version:  - )
Creative ALchemy (HKLM-x32\...\ALchemy) (Version: 1.45 - Creative Technology Limited)
Creative Audio-Systemsteuerung (HKLM-x32\...\AudioCS) (Version: 2.56 - Creative Technology Limited)
Creative MediaSource 5 (HKLM-x32\...\{BEEFC4F8-2909-48B3-AFAA-55D3533FDEDD}) (Version: 5.00 - Creative Technology Limited)
Creative Software AutoUpdate (HKLM-x32\...\Creative Software AutoUpdate) (Version: 1.40 - Creative Technology Limited)
Creative Sound Blaster Properties x64 Edition (HKLM-x32\...\Creative Sound Blaster Properties x64 Edition) (Version:  - )
Creative WaveStudio 7 (HKLM-x32\...\WaveStudio 7) (Version: 7.14 - Creative Technology Limited)
Destinations (x32 Version: 130.0.0.0 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 130.0.465.000 - Hewlett-Packard) Hidden
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.3 - DivX, LLC)
DocProc (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
DVD Decrypter (Remove Only) (HKLM-x32\...\DVD Decrypter) (Version:  - )
Emsisoft Anti-Malware (HKLM-x32\...\{5502032C-88C1-4303-99FE-B5CBD7684CEA}_is1) (Version: 9.0 - Emsisoft Ltd.)
EPU-6 Engine (HKLM-x32\...\{56B83336-FBC1-4C46-8613-90A9E3B440D6}) (Version: 1.00.16 - )
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
Exact Audio Copy 1.0beta3 (HKLM-x32\...\Exact Audio Copy) (Version: 1.0beta3 - Andre Wiethoff)
F-4 Phantom II (HKLM-x32\...\{8B7435C6-2099-4BE9-874A-CADE173AFA91}) (Version: 1.0.0 - Virtavia)
Fax (x32 Version: 130.0.418.000 - Hewlett-Packard) Hidden
Finale NotePad 2008 (HKLM-x32\...\Finale NotePad 2008) (Version: 13.0.0.0 - MakeMusic)
FLAC 1.2.1b (remove only) (HKLM-x32\...\FLAC) (Version: 1.2.1b - Xiph.org)
Flight1 Downloader (HKU\S-1-5-21-2348180457-2134729463-1863465213-1000\...\Flight1 Downloader) (Version:  - )
FMS (HKLM-x32\...\FMS) (Version:  - )
foobar2000 v1.3.3 (HKLM-x32\...\foobar2000) (Version: 1.3.3 - Peter Pawlowski)
Free YouTube Download 2.3 (HKLM-x32\...\Free YouTube Download_is1) (Version:  - DVDVideoSoft Limited.)
FreeFalcon6 (HKLM-x32\...\FreeFalcon6) (Version: 6.0 - )
FreeZ (HKLM\...\FreeZ) (Version: 0.9 Ultra - Freez.aero)
FRP 2004 (HKLM-x32\...\FRP 2004) (Version:  - )
FS Recorder 2.01  for FS2004 (HKLM-x32\...\{AEA944B7-D9C2-4560-92AE-64BD1D755A37}) (Version: 2.0.1.0 - Matthias Neusinger)
FSacars (HKLM-x32\...\{FFC78FC9-2FE6-4648-BFEB-446C61C2D61E}) (Version: 4.0 - Jose Oliveira/FSacars team)
Futuremark SystemInfo (HKLM-x32\...\{BEE64C14-BEF1-4610-8A68-A16EAA47B882}) (Version: 3.17.0.1 - Futuremark Corporation)
GAP_LGHIv2 (HKLM-x32\...\GAP_LGHIv2) (Version:  - )
GAP_LGIO 2007 (HKLM-x32\...\GAP_LGIO 2007) (Version:  - )
GAP_LGRPv2 (HKLM-x32\...\GAP_LGRPv2) (Version:  - )
GAP_LGSM_2009 (HKLM-x32\...\GAP_LGSM_2009) (Version:  - )
GAP_LGZA 2006 (HKLM-x32\...\GAP_LGZA 2006) (Version:  - )
GAP_MAKairports (HKLM-x32\...\GAP_MAKairports) (Version:  - )
GAP_MEGA_KERKYRA_2009 (HKLM-x32\...\GAP_MEGA_KERKYRA_2009) (Version:  - )
GAP_MEGA_KERKYRA_2009 (PORT AREA) (HKLM-x32\...\GAP_MEGA_KERKYRA_2009 (PORT AREA)) (Version:  - )
GeoGebra 4.0 (HKU\S-1-5-21-2348180457-2134729463-1863465213-1000\...\GeoGebra 4.0) (Version:  - International GeoGebra Institute)
German Police BMW 318i (HKLM-x32\...\German Police BMW 318i) (Version:  - )
German Railroads - DB 232 (HKLM-x32\...\German Railroads - DB 232) (Version:  - )
German Railroads - Vol 1 - Biggetal (HKLM-x32\...\German Railroads - Vol 1 - Biggetal) (Version:  - )
German Railroads - Vol 2 - Rollbahn (HKLM-x32\...\German Railroads - Vol 2 - Rollbahn) (Version:  - )
German Railroads - Vol 3 - Werrabahn (HKLM-x32\...\German Railroads - Vol 3 - Werrabahn) (Version:  - )
GetDataBack for NTFS (HKLM-x32\...\{56582EEA-3AEF-4D84-8B9D-C87A3CD9250F}) (Version: 4.30.000 - Runtime Software)
Ghostery IE Plugin (HKLM-x32\...\Ghostery IE Plugin_is1) (Version: 2.5.2.0 - Ghostery)
GIMP 2.8.2 (HKLM\...\GIMP-2_is1) (Version: 2.8.2 - The GIMP Team)
Glacier Bay v2a (HKLM-x32\...\Glacier Bay v2a_is1) (Version:  - Holger Sandmann)
Glacier Bay v2b (HKLM-x32\...\Glacier Bay v2b_is1) (Version:  - Holger Sandmann)
Google Earth (HKLM-x32\...\{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}) (Version: 6.1.0.5001 - Google)
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
GRID (HKLM-x32\...\{5A0B7BA5-4682-4273-81C2-69B17E649103}) (Version: 1.00.0000 - Codemasters)
Hawaii Islands SRTM3 Terrain Mesh (HKLM-x32\...\Hawaii Islands SRTM3 Terrain Mesh) (Version:  - )
Hawker Hunter Trainers (HKLM-x32\...\Hawker Hunter Trainers) (Version:  - )
Hewlett-Packard ACLM.NET v1.1.0.0 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
HP Customer Participation Program 13.0 (HKLM\...\HPExtendedCapabilities) (Version: 13.0 - HP)
HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)
HP Photosmart All-In-One Driver Software 13.0 Rel. 2 (HKLM\...\{988329F4-A1A1-4D51-803C-EF2725A97627}) (Version: 13.0 - HP)
HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP)
HP Product Detection (HKLM-x32\...\{A436F67F-687E-4736-BD2B-537121A804CF}) (Version: 11.14.0001 - HP)
HP Smart Web Printing 4.51 (HKLM\...\HP Smart Web Printing) (Version: 4.51 - HP)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Update (HKLM-x32\...\{97486FBE-A3FC-4783-8D55-EA37E9D171CC}) (Version: 5.005.000.001 - Hewlett-Packard)
HP USB Disk Storage Format Tool (HKLM-x32\...\{0E0DF90C-D0BA-4C89-9262-AD78D1A3DE51}) (Version:  - )
HPPhotoGadget (x32 Version: 130.0.282.000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabel_PaperLabel (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabel_PrintOnDisc (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabelContent1 (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
hpphotosmartdisclabelplugin (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotosmartEssential (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
HSP LGSO 1.0 (HKLM-x32\...\HSP LGSO_is1) (Version:  - HSP)
Image Resizer Powertoy Clone for Windows (64 bit) (HKLM\...\{80A620C1-B22C-4781-A351-B14B8A37BFE3}) (Version: 2.1 - Brice Lambson)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
Island Wars 2 demo v2.50 (Deutsch) (HKLM-x32\...\Island Wars 2 demo (Deutsch)_is1) (Version:  - InterAction studios)
Java 8 Update 31 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418031F0}) (Version: 8.0.310 - Oracle Corporation)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
KCL Chemikalien Manager 3.4 (HKLM-x32\...\KCL Chemikalien Manager_is1) (Version:  - KCL)
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version:  - )
Landscape Germany Rivers (HKLM-x32\...\{C87E5016-201A-11D9-A9CC-0080AD30B67D}) (Version:  - )
Legacy 'The Luxury Aircraft Collection' (HKLM-x32\...\Legacy 'The Luxury Aircraft Collection') (Version:  - )
LFRB - Brest Guipavas (HKU\S-1-5-21-2348180457-2134729463-1863465213-1000\...\LFRB - Brest Guipavas) (Version:  - )
Logitech Gaming Software 5.04 (HKLM\...\{8753DF4D-64B0-474E-9A97-0AB5585D9A53}) (Version: 5.04.110 - Logitech)
LuPO 1.0.2.41 (HKLM-x32\...\LuPO_is1) (Version:  - Ministerium für Schule, Wissenschaft und Forschung NRW)
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
MarketResearch (x32 Version: 130.0.374.000 - Hewlett-Packard) Hidden
marvell 61xx (HKLM-x32\...\mv61xxDriver) (Version: 1.2.0.57 - Marvell)
Marvell Miniport Driver (HKLM-x32\...\Marvell Miniport Driver) (Version: 11.45.3.3 - Marvell)
maxdome Download Manager 4.1.300.78 (HKLM-x32\...\{E948B551-08DB-4163-8995-8C43B03D1B19}) (Version: 4.1.30078 - Prosieben)
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Flight Simulator 2004 - Das Jahrhundert der Luftfahrt (HKLM-x32\...\Flight Simulator 9.0) (Version: 9.0 - Microsoft)
Microsoft Office 2000 SR-1 Premium (HKLM-x32\...\{00000407-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.9327 - Microsoft Corporation)
Microsoft Office Access 2003 Runtime (HKLM-x32\...\{901C0407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM-x32\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 x64 ENU (HKLM\...\{D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft Train Simulator (HKLM-x32\...\Train Simulator 1.0) (Version:  - )
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
mIRC (HKLM-x32\...\mIRC) (Version: 7.25 - mIRC Co. Ltd.)
Mozilla Firefox 36.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 36.0 (x86 de)) (Version: 36.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
MSVC80_x64_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC80_x86_v2 (x32 Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser und SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
Napulevola Albenga Airport LIMG (HKLM-x32\...\Napulevola Albenga Airport LIMG) (Version:  - )
Napulevola Photoreal Packs A+B+C (HKLM-x32\...\Napulevola Photoreal Packs A+B+C) (Version:  - )
Network64 (Version: 130.0.572.000 - Hewlett-Packard) Hidden
Network64 (Version: 140.0.221.000 - Hewlett-Packard) Hidden
NFS Underground (HKLM-x32\...\{A99968BE-C155-474C-0089-33239DEE1CE2}) (Version:  - )
Nokia Connectivity Cable Driver (HKLM-x32\...\{0906982B-A432-4C06-8F01-C01BE1143779}) (Version: 7.1.92.0 - Nokia)
NVIDIA 3D Vision Controller-Treiber 340.50 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 340.50 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 340.52 - NVIDIA Corporation)
NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 1.10 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)
NVIDIA Performance (HKLM-x32\...\InstallShield_{7C7F30F4-94E7-4AA8-8941-90C4A80C68BF}) (Version: 6.5 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA System Monitor (HKLM-x32\...\InstallShield_{E9CFBE78-ED91-4FCF-9E6F-210E477E527D}) (Version: 6.5 - NVIDIA Corporation)
NVIDIA System Update (HKLM-x32\...\InstallShield_{65A92AAA-3D05-4C94-9F70-731C05E60C16}) (Version: 3.00 - NVIDIA Corporation)
OCR Software by I.R.I.S. 13.0 (HKLM\...\HPOCR) (Version: 13.0 - HP)
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
Origin85 (x32 Version: 8.50.000 - OriginLab) Hidden
OriginPro 8.5G (HKLM-x32\...\{E0E49070-F2C7-402A-9D36-C9B87CA2E09D}) (Version: 8.5 - OriginLabCorporation)
Our Lady of Lebanon for FS2004 (by Jad Abizeid) (HKLM-x32\...\Our Lady of Lebanon for FS2004 (by Jad Abizeid)) (Version:  - )
PC Connectivity Solution (HKLM-x32\...\{BA77F9D2-CD35-41EB-9BC9-769879DFF8A6}) (Version: 12.0.48.0 - Nokia)
PC Probe II (HKLM-x32\...\{F7338FA3-DAB5-49B2-900D-0AFB5760C166}) (Version: 1.04.75 - ASUSTek)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.2.3 - Frank Heindörfer, Philip Chinery)
Plan-G v3 (HKLM-x32\...\{56251E2E-176C-449E-9012-2BA827EC1D65}) (Version: 3.0.0 - TA Software)
Ports Of Call Classic Edition - astragon 1.2.2 (HKLM-x32\...\Ports Of Call Classic Edition - astragon 1.2.2) (Version:  - )
Project Canarias 2006 (x32 Version: 1.0.0 - CanarySim) Hidden
Project Canarias 2006 by CanarySim (HKLM-x32\...\Project Canarias 2006) (Version:  - )
ProTrain 12 - DELUXE - 1.0 (HKLM-x32\...\ProTrain 12 - DELUXE - 1.0) (Version: 1.0 - BlueSky Interactive)
ProTrain 3 3.0 (HKLM-x32\...\ProTrain 3 3.0) (Version: 3.0 - Blue Sky Interactive)
ProTrain 6 - DELUXE - 1.0 (HKLM-x32\...\ProTrain 6 - DELUXE - 1.0) (Version: 1.0 - BlueSky Interactive)
ProTrain 8 - DELUXE - 1.0 (HKLM-x32\...\ProTrain 8 - DELUXE - 1.0) (Version: 1.0 - BlueSky Interactive)
ProTrain Rheintal 1.0 (HKLM-x32\...\ProTrain Rheintal 1.0) (Version:  - )
PS_AIO_02_ProductContext (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
PS_AIO_02_Software (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
PS_AIO_02_Software_Min (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
PVSonyDll (Version: 1.00.0001 - NVIDIA Corporation) Hidden
Real Environment Xtreme for FS2004 - Overdrive (HKLM-x32\...\{7885C4FD-5453-444E-BDA3-43CDA41F9F60}) (Version: 1.5.2010.1210 - Real Environment Simulations, Inc.)
Real Environment Xtreme FS2004 (HKLM-x32\...\{46559469-7C15-49F4-BB76-21480BE1BEF4}) (Version: 1.0.8 - Real Environment Simulations)
Rigs of Rods 0.39.5 (HKLM-x32\...\Rigs of Rods 0.39.5) (Version: 0.39.5 - Rigs of Rods Team)
SAMSUNG Intelli-studio (HKLM-x32\...\Intelli-studio) (Version:  - )
Scan (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
Service Pack 1 für SQL Server 2008 (KB 968369) (64-bit) (HKLM\...\KB968369) (Version: 10.1.2531.0 - Microsoft Corporation)
SHIELD Streaming (Version: 3.1.100 - NVIDIA Corporation) Hidden
Ship Simulator 2008 (HKLM-x32\...\Shipsim2008) (Version:  - )
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 13.0 - HP)
SIW 2011 Home Edition (HKLM-x32\...\{AB67580-257C-45FF-B8F4-C8C30682091A}_is1) (Version: 2011.10.29 - Topala Software Solutions)
Ski Challenge 15 (HKU\S-1-5-21-2348180457-2134729463-1863465213-1000\...\sc15-GAMETWIST_MAIN) (Version:  - )
SmartWebPrinting (x32 Version: 130.0.457.000 - Hewlett-Packard) Hidden
SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
Sony PC Companion 2.10.136 (HKLM-x32\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.136 - Sony)
Sql Server Customer Experience Improvement Program (Version: 10.1.2531.0 - Microsoft Corporation) Hidden
Status (x32 Version: 130.0.469.000 - Hewlett-Packard) Hidden
STP DB ICE3 403 V1.0 (HKLM-x32\...\STP DB ICE3 403 V1.0) (Version:  - )
SUPER © v2012.build.54 (Nov 18, 2012) Version v2012.build.54 (HKLM-x32\...\{8F311E92-C29F-4DF9-8259-B739A1831669}_is1) (Version: v2012.build.54 - eRightSoft)
SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 5.0.1146 - SUPERAntiSpyware.com)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
System Requirements Lab for Intel (64-bit) (HKLM\...\{171C55A9-DE88-4A60-A26D-C13CA38AA771}) (Version: 4.5.5.0 - Husdawg, LLC)
System Requirements Lab for Intel (HKLM-x32\...\{1EBDF6D2-CEA0-484C-A23E-2DDAD7FD0DD0}) (Version: 4.5.22.0 - Husdawg, LLC)
TmNationsForever Update 2010-03-15 (HKLM-x32\...\TmNationsForever_is1) (Version:  - Nadeo)
Toolbox (x32 Version: 130.0.648.000 - Hewlett-Packard) Hidden
Train Store (German Language Pack) (HKLM-x32\...\Train Store (German Language Pack)) (Version:  - )
Train Store V3.2 (HKLM-x32\...\Train Store V3.2) (Version:  - )
TrayApp (x32 Version: 130.0.422.000 - Hewlett-Packard) Hidden
Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
UK Roads (HKLM-x32\...\UK Roads) (Version:  - )
Ultimate Terrain - Europe (HKLM-x32\...\Ultimate Terrain - Europe) (Version:  - )
Uninstall 1.0.0.1 (HKLM-x32\...\Uninstall_is1) (Version:  - )
UnloadSupport (x32 Version: 11.0.0 - Hewlett-Packard) Hidden
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
vroute.info - 1  (HKU\S-1-5-21-2348180457-2134729463-1863465213-1000\...\ea913c639d7ea423) (Version: 1.1.1.3 - vroute)
WebM Media Foundation Components (HKLM-x32\...\webmmf) (Version: 1.0.1.2 - WebM Project)
WebReg (x32 Version: 130.0.132.017 - Hewlett-Packard) Hidden
Windows Live Anmelde-Assistent (HKLM-x32\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8117.0416 - Microsoft Corporation)
Windows Live Sync (HKLM-x32\...\{586509F0-350D-48B5-B763-9CC2F8D96C4C}) (Version: 14.0.8117.416 - Microsoft Corporation)
Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
Windows Mobile-Gerätecenter (HKLM\...\{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}) (Version: 6.1.6965.0 - Microsoft Corporation)
Windows-Treiberpaket - Nokia pccsmcfd LegacyDriver  (05/31/2012 7.1.2.0) (HKLM\...\62BBD193ADFDBB228C7E1ADB56463F5732FF7F6F) (Version: 05/31/2012 7.1.2.0 - Nokia)
WinRAR (HKLM\...\WinRAR archiver) (Version:  - )
WOT für Internet Explorer (HKLM\...\{373B90E1-A28C-434C-92B6-7281AFA6115A}) (Version: 13.9.2.0 - WOT Services Oy)
Wupper Express 11 Actpack 1.0 (HKU\S-1-5-21-2348180457-2134729463-1863465213-1000\...\Wupper Express 11 Actpack 1.0) (Version:  - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2348180457-2134729463-1863465213-1000_Classes\CLSID\{D45F043D-F17F-4e8a-8435-70971D9FA46D}\InprocServer32 -> D:\Blender\BlendThumb64.dll ()

==================== Restore Points  =========================

12-02-2015 23:43:06 Windows Update
17-02-2015 00:41:20 Windows Update
18-02-2015 00:10:01 Windows Update
18-02-2015 18:31:02 Windows Update
19-02-2015 00:39:51 Windows Update
03-03-2015 15:37:10 Windows Update
04-03-2015 01:58:17 Windows Update
12-04-2015 22:15:01 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2014-11-10 21:08 - 2014-11-10 21:08 - 00000141 ____N C:\Windows\system32\Drivers\etc\hosts


134.76.22.1	vpn.gwdg.de ###Cisco AnyConnect VPN client modified this file. Please do not modify contents until this comment is removed.


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {08E86C97-F73C-473E-9ABC-BEF05DA58C04} - System32\Tasks\{FEEC60F1-E4B6-4DA6-AF29-AB808CD4FD55} => D:\UT_Europe-1\UT_Europe-1.exe [2011-07-24] ()
Task: {0C3529EB-02AD-4C56-B540-9EF8713D22C9} - System32\Tasks\Norton Internet Security CBE\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security CBE\Engine\21.6.0.32\SymErr.exe
Task: {11849137-DFEB-4803-8E3A-D85E5B32EDAC} - System32\Tasks\ASUS\ASUS SIX Engine => C:\Program Files\ASUS\Six Engine\SixEngine.exe [2008-06-03] ()
Task: {145DE017-6FD2-4B56-B42B-C7A1071231E8} - System32\Tasks\{11DA0059-918B-4D6A-8AA6-48BBCBA49C6A} => C:\Program Files (x86)\FMS\FMS.exe [2004-12-08] ()
Task: {2906C624-1408-4390-BA04-7161550F97BF} - System32\Tasks\{2119693C-45C7-41F1-9FBD-B43F60DA1AF5} => D:\UT_Europe-1\UT_Europe-1.exe [2011-07-24] ()
Task: {2BB894AE-FCAE-4121-929C-228E01D6262A} - System32\Tasks\The West starten => Firefox.exe 
Task: {3C38C9DC-F748-45B2-9F8C-1DFD69B72E20} - System32\Tasks\{EE5CB017-A914-49C4-BA71-C5EEDF500F28} => D:\Flusi\installer\UT_Europe-1\UT_Europe-1.exe [2011-07-25] ( Flight1, Inc.)
Task: {3CA97FB3-2DFC-4B72-B652-60BC1B5F49F7} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-10-22] (Piriform Ltd)
Task: {426B1D59-67D0-4534-9B1E-762CE840926E} - System32\Tasks\{27C39755-EC25-4FC5-A0F9-4A5B6B1E757E} => C:\Program Files (x86)\poc\poc_classicedition\bin\pocclasse.exe [2006-10-19] (Dipl. Ing. R.D.Klein)
Task: {43910C43-ACB6-4070-BEAF-9FC09F2032CF} - System32\Tasks\{72001849-51D5-4A01-9A48-BF2A73A20891} => pcalua.exe -a "C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D37FQTB1\GoogleEarthWin[1].exe" -d "C:\Users\***\Desktop"
Task: {486BD830-4346-4533-AED1-738300F0ACC8} - System32\Tasks\{709C0F60-DE90-4ED2-8283-3AAEBB72426C} => C:\Program Files (x86)\Vstep\ShipSim2008\ShipSim2008.exe [2007-06-28] ()
Task: {56166B22-6E64-4427-B7BF-E3E86748D672} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {59335F67-06F6-47E9-9E4F-F33D91F4A0C3} - System32\Tasks\RtlVistaStart => C:\Program Files (x86)\ASUS WiFi-AP Solo\RtWLan.exe
Task: {5A8F972B-852F-40D7-A7F8-E38D4BB248DA} - System32\Tasks\{6A03F8F3-A602-4340-9BA1-0AAD04CFA28F} => pcalua.exe -a E:\Support\DrvSetup.exe -d E:\Support
Task: {64681C2F-79D9-4AF1-AF3B-BC65B7F0B26B} - System32\Tasks\{73626F9F-D357-4E78-B7C0-77E80B07E20C} => C:\Users\***\Downloads\AFUDOS236\AFU236U.exe
Task: {712C6861-2B14-4E72-92BA-22B6921FE2B7} - System32\Tasks\Microsoft\Windows\Wired\GatherWiredInfo => C:\Windows\system32\gatherWiredInfo.vbs
Task: {767CEC7B-AE75-426A-865E-906BE482AB6E} - System32\Tasks\Norton Internet Security CBE\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security CBE\Engine\21.6.0.32\SymErr.exe
Task: {86B4A5EE-E4BC-4EFF-80CD-3857CEFD87F4} - System32\Tasks\{DD19D21F-4BCC-45E1-9870-35FF910C8D0E} => C:\Users\***\Downloads\AFUDOS236\AFU236U.exe
Task: {8A78377C-F10D-4DC2-A764-A3822A571872} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-05] (Adobe Systems Incorporated)
Task: {8FBD7F4A-7780-41E3-ADA7-EF3118C1FE77} - System32\Tasks\{963D4366-3D38-4FC2-8558-644FCD87746C} => pcalua.exe -a "C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KKBJ2XOE\PedalToTheMetalSetup[1].exe" -d "C:\Users\***\Desktop"
Task: {90BD586E-1F96-4354-82E5-4CC02140FAB7} - System32\Tasks\{E91DFE1E-A2E1-4164-9BF2-A693507D2254} => C:\Users\***\Desktop\AFUDOS236\AFU236U.exe
Task: {90CD7150-A8F6-4D93-B2D4-352663259FDC} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-18] (Google Inc.)
Task: {A4E9AD23-49E8-407B-8EC9-6875999184DD} - System32\Tasks\{41DD3D30-AAFE-4C89-B082-74C8977F3B07} => pcalua.exe -a "D:\Flusi\Aicraft-Traffic.Scenerydwonloads\Installer Trafic\WOAI Installer.exe" -d "D:\Flusi\Aicraft-Traffic.Scenerydwonloads\Installer Trafic"
Task: {B67B69A8-6095-4676-8E48-894246602564} - System32\Tasks\{A4DAC35A-2B07-4112-9678-12FF53EA1832} => C:\Program Files (x86)\Piraten\Piraten.exe
Task: {C677E78C-DEB2-4F84-9492-4C7F5F282ED7} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - *** => C:\Program Files\Windows Calendar\wincal.exe
Task: {DDAC0899-955D-4045-BDB7-F0F3C9472761} - System32\Tasks\ASUS\ASUS RegRun Loader => C:\Program Files (x86)\ASUS\AASP\1.00.95\AsLoader.exe [2009-12-11] ()
Task: {E91D6474-70CC-42BE-80FF-8BED8AF557ED} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs
Task: {E9D00FF6-E9D9-4E52-8A5A-715059B7F900} - System32\Tasks\{2A60FCBE-9A28-4F76-BEC4-6992962C5DD8} => C:\Program Files (x86)\Piraten\Piraten.exe
Task: {EC089098-2739-4A44-B850-A0ACA5866480} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-18] (Google Inc.)
Task: {EF85E6C6-0118-4432-A027-9A373CFD3EA1} - System32\Tasks\{550086CD-6669-4A37-ACD3-88757F7F2D00} => pcalua.exe -a D:\Flusi\Aicraft-Traffic.Scenerydwonloads\SwissAirways_AI-Traffic_So_06_invisible\AI_So_06_invisible.exe -d D:\Flusi\Aicraft-Traffic.Scenerydwonloads\SwissAirways_AI-Traffic_So_06_invisible
Task: {F5B57249-EA97-44C2-989C-6688C6EAD962} - System32\Tasks\{ECEE8034-539C-4DE4-A636-785B7A54BF75} => pcalua.exe -a E:\Setup.exe -d E:\
Task: {F9739011-2BEC-477C-9BDC-F2B449F194C8} - System32\Tasks\{1D2703F2-CF99-42DC-976E-9CF4F0C9DB87} => D:\Flusi\installer\UT_Europe-1\UT_Europe-1.exe [2011-07-25] ( Flight1, Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\RtlVistaStart.job => C:\Program Files (x86)\ASUS WiFi-AP Solo\RtWLan.exe

==================== Loaded Modules (whitelisted) ==============

2012-03-31 13:26 - 2014-07-02 20:55 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2009-10-03 11:09 - 2009-08-16 17:06 - 00166400 _____ () C:\Program Files\WinRAR\rarext.dll
2013-01-13 15:15 - 2005-03-12 02:07 - 00087040 _____ () C:\Windows\System32\pdfcmnnt.dll
2009-09-04 14:47 - 2008-06-03 01:06 - 05964800 _____ () C:\Program Files\ASUS\Six Engine\SixEngine.exe
2014-07-21 23:50 - 2014-07-21 23:50 - 00063400 _____ () C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll
2009-09-04 14:47 - 2005-05-11 16:39 - 00565248 _____ () C:\Program Files\ASUS\Six Engine\pngio.dll
2009-11-05 19:24 - 2009-02-06 18:52 - 00073728 _____ () C:\Windows\SysWOW64\CmdRtr.DLL
2009-11-05 19:24 - 2009-03-26 14:46 - 00148480 _____ () C:\Windows\SysWOW64\APOMngr.DLL

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:A1D5C6AA

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2348180457-2134729463-1863465213-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\***\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 10.10.8.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: !SASCORE => 2
MSCONFIG\Services: Apple Mobile Device => 2
MSCONFIG\Services: Bonjour Service => 2
MSCONFIG\Services: NvStreamSvc => 2
MSCONFIG\Services: nvUpdatusService => 2
MSCONFIG\Services: Prosieben => 2
MSCONFIG\Services: Stereo Service => 2
MSCONFIG\Services: UpdateCenterService => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk => C:\Windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Mausometer 3.0.lnk => C:\Windows\pss\Mausometer 3.0.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^maxdome Download Manager.lnk => C:\Windows\pss\maxdome Download Manager.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk => C:\Windows\pss\Microsoft Office.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^***^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^EvernoteClipper.lnk => C:\Windows\pss\EvernoteClipper.lnk.Startup
MSCONFIG\startupfolder: C:^Users^***^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Game Alarm.lnk => C:\Windows\pss\Game Alarm.lnk.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: AmazonMP3DownloaderHelper => C:\Users\***\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: boincmgr => "C:\Program Files\BOINC\boincmgr.exe" /a /s
MSCONFIG\startupreg: boinctray => "C:\Program Files\BOINC\boinctray.exe"
MSCONFIG\startupreg: DivXUpdate => "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
MSCONFIG\startupreg: HP Software Update => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: hpqSRMon => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: NokiaMServer => C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
MSCONFIG\startupreg: NokiaOviSuite2 => C:\Program Files (x86)\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe -tray
MSCONFIG\startupreg: NokiaSuite.exe => C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe -tray
MSCONFIG\startupreg: Nvtmru => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
MSCONFIG\startupreg: PC Suite Tray => "C:\Program Files (x86)\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: ShadowPlay => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
MSCONFIG\startupreg: Speech Recognition => "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
MSCONFIG\startupreg: Start WingMan Profiler => C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: SweetIM => C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe

==================== Accounts: =============================

Administrator (S-1-5-21-2348180457-2134729463-1863465213-500 - Administrator - Disabled)
Gast (S-1-5-21-2348180457-2134729463-1863465213-501 - Limited - Enabled)
HomeGroupUser$ (S-1-5-21-2348180457-2134729463-1863465213-1002 - Limited - Enabled)
*** (S-1-5-21-2348180457-2134729463-1863465213-1000 - Administrator - Enabled) => C:\Users\***

==================== Faulty Device Manager Devices =============

Name: Photosmart C6200 series
Description: Photosmart C6200 series
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (04/12/2015 11:05:37 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT-AUTORITÄT)
Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden.

Error: (04/12/2015 11:04:15 PM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcNvVAD initialization failed [0]

Error: (04/12/2015 11:04:15 PM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcFailed to open Audio Capture session [6]

Error: (04/12/2015 10:58:01 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (04/12/2015 10:56:31 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm notepad.exe, Version 6.1.7600.16385 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 85c

Startzeit: 01d075631f8e43bf

Endzeit: 16

Anwendungspfad: C:\Windows\system32\notepad.exe

Berichts-ID: 6310e7a7-e156-11e4-b839-0022155bfc5f

Error: (04/12/2015 10:03:59 PM) (Source: Windows Backup) (EventID: 4103) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "J:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"

Error: (04/12/2015 09:53:44 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT-AUTORITÄT)
Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden.

Error: (04/12/2015 09:53:16 PM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcNvVAD initialization failed [0]

Error: (04/12/2015 09:53:16 PM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcFailed to open Audio Capture session [6]

Error: (04/12/2015 09:43:17 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT-AUTORITÄT)
Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden.


System errors:
=============
Error: (04/12/2015 11:04:48 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
acedrv05

Error: (04/12/2015 11:04:02 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SQL Server (SQLEXPRESS)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (04/12/2015 11:04:02 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst SQL Server (SQLEXPRESS) erreicht.

Error: (04/12/2015 11:03:25 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "NIKLASHERRMA-PC:0" konnte nicht auf der Schnittstelle mit IP-Adresse 169.254.183.153
registriert werden. Der Computer mit IP-Adresse 169.254.101.65 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (04/12/2015 11:02:24 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎12.‎04.‎2015 um 22:58:43 unerwartet heruntergefahren.

Error: (04/12/2015 10:47:24 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (04/12/2015 10:47:24 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (04/12/2015 10:47:23 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (04/12/2015 09:53:39 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
acedrv05

Error: (04/12/2015 09:53:04 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SQL Server (SQLEXPRESS)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053


Microsoft Office Sessions:
=========================
Error: (04/12/2015 11:05:37 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT-AUTORITÄT)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/12/2015 11:04:15 PM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcNvVAD initialization failed [0]

Error: (04/12/2015 11:04:15 PM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcFailed to open Audio Capture session [6]

Error: (04/12/2015 10:58:01 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\***\Desktop\viren\esetsmartinstaller_deu.exe

Error: (04/12/2015 10:56:31 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: notepad.exe6.1.7600.1638585c01d075631f8e43bf16C:\Windows\system32\notepad.exe6310e7a7-e156-11e4-b839-0022155bfc5f

Error: (04/12/2015 10:03:59 PM) (Source: Windows Backup) (EventID: 4103) (User: )
Description: J:\Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)

Error: (04/12/2015 09:53:44 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT-AUTORITÄT)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/12/2015 09:53:16 PM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcNvVAD initialization failed [0]

Error: (04/12/2015 09:53:16 PM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcFailed to open Audio Capture session [6]

Error: (04/12/2015 09:43:17 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT-AUTORITÄT)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


CodeIntegrity Errors:
===================================
  Date: 2015-04-12 23:02:01.158
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\acedrv05.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-04-12 23:02:01.080
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\acedrv05.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-04-12 21:51:18.763
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\acedrv05.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-04-12 21:51:18.685
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\acedrv05.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-04-12 21:41:51.523
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\acedrv05.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-04-12 21:41:51.461
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\acedrv05.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-04-12 21:40:33.742
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\acedrv05.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-04-12 21:40:33.664
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\acedrv05.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-03-04 00:41:25.384
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\acedrv05.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-03-04 00:41:25.322
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\acedrv05.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Duo CPU E8600 @ 3.33GHz
Percentage of memory in use: 63%
Total physical RAM: 4095.04 MB
Available physical RAM: 1485.57 MB
Total Pagefile: 8189.23 MB
Available Pagefile: 4925.2 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:146.48 GB) (Free:35.84 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Spiele) (Fixed) (Total:151.6 GB) (Free:69.52 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 8CE3E186)
Partition 1: (Active) - (Size=146.5 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=151.6 GB) - (Type=07 NTFS)

==================== End Of Log ============================

GMER

[code]
GMER Logfile:

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-04-12 23:53:33
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Scsi\mv61xx1Port1Path0Target0Lun0 SAMSUNG_ rev. 298,09GB
Running: c8zhvc7x.exe; Driver: C:\Users\NIKLAS~1\AppData\Local\Temp\afryauog.sys


---- Registry - GMER 2.1 ----

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{578B9792-AC31-AF30-2B8C-DBA85BE420C6}                                 
Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{578B9792-AC31-AF30-2B8C-DBA85BE420C6}@oajhfoonifpkfaagjdlegiadbgcacm  0x6B 0x61 0x63 0x6A ...
Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{578B9792-AC31-AF30-2B8C-DBA85BE420C6}@napflmcgdabojanafhmmohbdmnhi    0x6A 0x61 0x66 0x6A ...
Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{578B9792-AC31-AF30-2B8C-DBA85BE420C6}@oafhfmfjokecpbbckahicdjhaegobh  0x64 0x61 0x63 0x6A ...

---- EOF - GMER 2.1 ----

--- --- ---

Emsisoft

Code:

ATTFilter

Emsisoft Anti-Malware - Version 9.0
Letztes Update: 12.04.2015 22:12:24
Benutzerkonto: ***-PC\***

Scan-Einstellungen:

Scan Methode: Smart Scan
Objekte: Rootkits, Speicher, Traces, C:\Windows\, C:\Program Files\, C:\Program Files (x86)\

PUPs-Erkennung: An
Archiv-Scan: Aus
ADS Scan: An
Dateitypen-Filter: Aus
Erweitertes Caching: An
Direkter Festplattenzugriff: Aus

Scan-Beginn:	12.04.2015 23:22:23

Gescannt	105812
Gefunden	0

Scan-Ende:	12.04.2015 23:25:57
Scan-Zeit:	0:03:34

Malwarebytes fand im Quickscan nichts.

EDIT: Gerade aufgefallen, Emsisoft hatte beim Installationsscan damals wohl irgendwas gefunden... o.o

Code:

ATTFilter

Emsisoft Anti-Malware - Version 9.0
Quarantäne-Protokoll

Datum	Quelle	Vorgang	Fund	
04.03.2015 00:50:14	Key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\W3I	Unter Quarantäne	Application.InstallAd (A)	
04.03.2015 00:50:14	Value: HKEY_USERS\S-1-5-21-2348180457-2134729463-1863465213-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS	Unter Quarantäne	Setting.DisableRegistryTools (A)	
04.03.2015 00:50:14	Value: HKEY_USERS\S-1-5-21-2348180457-2134729463-1863465213-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLETASKMGR	Unter Quarantäne	Setting.DisableTaskMgr (A)

Danke für die HIlfe!

Programme lassen sich nicht mehr starten

Plagegeister aller Art und deren Bekämpfung: Programme lassen sich nicht mehr starten

Programme lassen sich nicht mehr starten

Ähnliche Themen: Programme lassen sich nicht mehr starten