![]() |
|
Plagegeister aller Art und deren Bekämpfung: Häufig Lags, Leistungseinbrüche/Freeze, Blaue DRVSTORE Datei in system32.Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
![]() | #1 |
| ![]() Häufig Lags, Leistungseinbrüche/Freeze, Blaue DRVSTORE Datei in system32. Ich habe seit längerem Probleme mit meinem Rechner, seit neuestem habe ich allerdings mit Leistungseinbrüchen und Freezes, sowie anderen Macken zu kämpfen. So sind einige Prozesse wie rundll32 doppelt am Laufen. Selten habe ich einen BluesreenO.D. Ich habe ebenfalls eine blaue DRVSTORE Datei in meinem system32 Ordner. Antivir und Spybotscans blieben fundlos. Ich würde mich sehr freuen wenn mir jemand hilft. Hier die FRST.txt; Addition.txt; und Gmer.txt. Desweiteren hab ich eine Datei in Quarantäne: Typ: Datei Quelle: C:\Users\Erik\Downloads\pcmechanicpm.exe Status: Infiziert Quarantäne-Objekt: 53e6fac1.qua Wiederhergestellt: NEIN Zu Avira hochgeladen: NEIN Betriebssystem: Windows XP/VISTA Workstation/Windows 7 Suchengine: 8.03.30.40 Virendefinitionsdatei: 8.11.236.118 Gefunden: PUA/SpeedUpMyPC Datum/Uhrzeit: 01.06.2015, 15 FRST.txt: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:13-07-2015 Ran by Erik (administrator) on ERIK-PC on 15-07-2015 12:53:12 Running from C:\Users\Erik\Downloads Loaded Profiles: Erik (Available Profiles: Erik & Ronja & Gast) Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe () C:\Windows\SysWOW64\PnkBstrA.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe (Microsoft Corporation) C:\Windows\System32\taskmgr.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11545192 2010-11-15] (Realtek Semiconductor) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-02-13] (Apple Inc.) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-02-05] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-02-13] (Apple Inc.) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [730416 2015-06-09] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.) HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe [134368 2015-06-02] (Avira Operations GmbH & Co. KG) Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X] HKU\S-1-5-21-4148174342-3149974382-3542746328-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2892992 2015-06-04] (Valve Corporation) HKU\S-1-5-21-4148174342-3149974382-3542746328-1000\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3632112 2015-06-29] (Electronic Arts) HKU\S-1-5-21-4148174342-3149974382-3542746328-1000\...\Run: [Wisdom-soft ScreenHunter 5.1 Free] => 0 HKU\S-1-5-21-4148174342-3149974382-3542746328-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [53288576 2015-06-29] (Skype Technologies S.A.) HKU\S-1-5-21-4148174342-3149974382-3542746328-1000\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [4566952 2014-06-24] (Safer-Networking Ltd.) HKU\S-1-5-21-4148174342-3149974382-3542746328-1000\...\Run: [WTFast Tray] => C:\Program Files (x86)\WTFast\WTFast.exe [4711000 2015-06-02] (AAA Internet Publishing, Inc.) HKU\S-1-5-21-4148174342-3149974382-3542746328-1000\...\Run: [Dropbox Update] => C:\Users\Erik\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-17] (Dropbox, Inc.) HKU\S-1-5-21-4148174342-3149974382-3542746328-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Mystify.scr [242688 2010-11-20] (Microsoft Corporation) Startup: C:\Users\Erik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-05-11] ShortcutTarget: Dropbox.lnk -> C:\Users\Erik\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.) BootExecute: autocheck autochk * sdnclean64.exe GroupPolicyScripts: Group Policy detected <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-4148174342-3149974382-3542746328-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ HKU\S-1-5-21-4148174342-3149974382-3542746328-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp SearchScopes: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000 -> {4ECF8847-2EFA-4EAB-9EAB-0E966C321B2C} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms} BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> c:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation) BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> c:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation) DPF: HKLM-x32 {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler-x32: abs - {E00957BD-D0E1-4eb9-A025-7743FDC8B27B} - C:\Windows\SysWOW64\mscoree.dll [2010-11-05] (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies) Winsock: Catalog9 01 C:\Windows\SysWOW64\WTFastDrv.dll [72296 2015-06-01] (Initex) Winsock: Catalog9 02 C:\Windows\SysWOW64\WTFastDrv.dll [72296 2015-06-01] (Initex) Winsock: Catalog9 03 C:\Windows\SysWOW64\WTFastDrv.dll [72296 2015-06-01] (Initex) Winsock: Catalog9 04 C:\Windows\SysWOW64\WTFastDrv.dll [72296 2015-06-01] (Initex) Winsock: Catalog9 15 C:\Windows\SysWOW64\WTFastDrv.dll [72296 2015-06-01] (Initex) Winsock: Catalog9-x64 01 C:\Windows\system32\WTFastDrv.dll [79464 2015-06-01] (Initex) Winsock: Catalog9-x64 02 C:\Windows\system32\WTFastDrv.dll [79464 2015-06-01] (Initex) Winsock: Catalog9-x64 03 C:\Windows\system32\WTFastDrv.dll [79464 2015-06-01] (Initex) Winsock: Catalog9-x64 04 C:\Windows\system32\WTFastDrv.dll [79464 2015-06-01] (Initex) Winsock: Catalog9-x64 15 C:\Windows\system32\WTFastDrv.dll [79464 2015-06-01] (Initex) Tcpip\Parameters: [DhcpNameServer] 8.8.8.8 Tcpip\..\Interfaces\{28191E3A-C084-45C8-8C51-4D5001894677}: [NameServer] 192.168.111.1,62.72.64.241 Tcpip\..\Interfaces\{28191E3A-C084-45C8-8C51-4D5001894677}: [DhcpNameServer] 192.168.111.1 Tcpip\..\Interfaces\{BDCE9B38-96F3-4F5C-B5A6-76A1316B6617}: [DhcpNameServer] 8.8.8.8 FireFox: ======== FF ProfilePath: C:\Users\Erik\AppData\Roaming\Mozilla\Firefox\Profiles\bax1xnjs.default FF Keyword.URL: hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=937811&p= FF NetworkProxy: "type", 0 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_209.dll [2015-07-14] () FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2014-10-28] (Tracker Software Products (Canada) Ltd.) FF Plugin: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelogx64.dll [2015-01-13] (EA Digital Illusions CE AB) FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_209.dll [2015-07-14] () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] () FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2014-10-28] (Tracker Software Products (Canada) Ltd.) FF Plugin-x32: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelog.dll [2015-01-13] (EA Digital Illusions CE AB) FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-12-05] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-12-05] (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No File FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-03-04] (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-03-04] (NVIDIA Corporation) FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [2013-03-18] (Pando Networks) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2012-09-23] (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-4148174342-3149974382-3542746328-1000: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2014-10-28] (Tracker Software Products (Canada) Ltd.) FF Plugin HKU\S-1-5-21-4148174342-3149974382-3542746328-1000: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [2013-03-18] (Pando Networks) FF Plugin HKU\S-1-5-21-4148174342-3149974382-3542746328-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2014-07-24] () FF user.js: detected! => C:\Users\Erik\AppData\Roaming\Mozilla\Firefox\Profiles\bax1xnjs.default\user.js [2011-06-22] FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2012-09-23] (Adobe Systems Inc.) FF SearchPlugin: C:\Users\Erik\AppData\Roaming\Mozilla\Firefox\Profiles\bax1xnjs.default\searchplugins\leaguepedia--league-of-legends-wiki-en.xml [2015-02-27] FF Extension: Avira Browser Safety - C:\Users\Erik\AppData\Roaming\Mozilla\Firefox\Profiles\bax1xnjs.default\Extensions\abs@avira.com [2015-07-03] FF Extension: NoScript - C:\Users\Erik\AppData\Roaming\Mozilla\Firefox\Profiles\bax1xnjs.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-01-07] FF Extension: Adblock Plus - C:\Users\Erik\AppData\Roaming\Mozilla\Firefox\Profiles\bax1xnjs.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-05-15] Chrome: ======= CHR Profile: C:\Users\Erik\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Docs) - C:\Users\Erik\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-11-18] CHR Extension: (Google Drive) - C:\Users\Erik\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-11-18] CHR Extension: (YouTube) - C:\Users\Erik\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-11-18] CHR Extension: (Google Search) - C:\Users\Erik\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-11-18] CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Erik\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-17] CHR Extension: (Google Wallet) - C:\Users\Erik\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-18] CHR Extension: (Gmail) - C:\Users\Erik\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-11-18] CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [827184 2015-06-09] (Avira Operations GmbH & Co. KG) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [450808 2015-06-09] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [450808 2015-06-09] (Avira Operations GmbH & Co. KG) S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1188360 2015-06-09] (Avira Operations GmbH & Co. KG) R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.) R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [217280 2015-06-02] (Avira Operations GmbH & Co. KG) S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed] R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-02-05] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16941856 2014-02-05] (NVIDIA Corporation) S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2004488 2015-06-29] (Electronic Arts) R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2014-06-01] () R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.) R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2010-12-24] () R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [153256 2015-06-09] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132656 2015-06-09] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2015-03-17] (Avira Operations GmbH & Co. KG) R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-17] (Avira Operations GmbH & Co. KG) R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2010-12-24] () R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation) S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [28416 2008-04-16] (Research In Motion Limited) S3 cpuz136; \??\C:\Program Files (x86)\CPUID\PC Wizard 2013\pcwiz_x64.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-07-15 12:51 - 2015-07-15 12:53 - 00065175 _____ C:\Users\Erik\Downloads\Addition.txt 2015-07-15 12:48 - 2015-07-15 12:53 - 00019751 _____ C:\Users\Erik\Downloads\FRST.txt 2015-07-15 12:47 - 2015-07-15 12:53 - 00000000 ____D C:\FRST 2015-07-15 12:46 - 2015-07-15 12:47 - 02133504 _____ (Farbar) C:\Users\Erik\Downloads\FRST64.exe 2015-07-15 12:45 - 2015-07-15 12:45 - 00000470 _____ C:\Users\Erik\Downloads\defogger_disable.log 2015-07-15 12:45 - 2015-07-15 12:45 - 00000000 _____ C:\Users\Erik\defogger_reenable 2015-07-15 12:44 - 2015-07-15 12:44 - 00050477 _____ C:\Users\Erik\Downloads\Defogger.exe 2015-07-10 19:19 - 2015-07-10 19:19 - 00000000 ____D C:\Users\Erik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2015-07-09 18:38 - 2012-07-30 01:28 - 00002940 _____ C:\Users\Erik\Downloads\PMD 2 - Top Menu Theme.mid 2015-07-06 15:19 - 2015-07-07 15:03 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2015-06-28 17:02 - 2015-06-28 17:02 - 00000000 ____D C:\Program Files (x86)\NAMCO BANDAI Games 2015-06-28 16:57 - 2015-06-28 16:57 - 00001338 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live ID.lnk 2015-06-28 16:54 - 2015-06-28 16:56 - 00018435 _____ C:\Windows\DirectX.log 2015-06-22 19:42 - 2015-06-22 19:42 - 00000000 ____D C:\Users\Erik\AppData\Local\NVIDIA Corporation 2015-06-22 19:31 - 2015-06-22 19:44 - 00000000 ____D C:\Users\Erik\AppData\Local\NVIDIA 2015-06-22 19:31 - 2015-06-22 19:31 - 00000000 ____D C:\Program Files (x86)\AGEIA Technologies 2015-06-22 19:31 - 2014-02-05 11:31 - 01048152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll 2015-06-22 19:31 - 2014-02-05 11:30 - 01179576 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll 2015-06-22 19:29 - 2014-03-04 13:32 - 00599840 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe 2015-06-22 19:25 - 2014-03-04 16:35 - 31474976 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll 2015-06-22 19:25 - 2014-03-04 16:35 - 25255256 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll 2015-06-22 19:25 - 2014-03-04 16:35 - 23716640 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll 2015-06-22 19:25 - 2014-03-04 16:35 - 17755424 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll 2015-06-22 19:25 - 2014-03-04 16:35 - 17561544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll 2015-06-22 19:25 - 2014-03-04 16:35 - 12708128 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys 2015-06-22 19:25 - 2014-03-04 16:35 - 11636176 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll 2015-06-22 19:25 - 2014-03-04 16:35 - 11589272 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll 2015-06-22 19:25 - 2014-03-04 16:35 - 09728064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll 2015-06-22 19:25 - 2014-03-04 16:35 - 09690424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll 2015-06-22 19:25 - 2014-03-04 16:35 - 03143456 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll 2015-06-22 19:25 - 2014-03-04 16:35 - 02958792 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll 2015-06-22 19:25 - 2014-03-04 16:35 - 02783008 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll 2015-06-22 19:25 - 2014-03-04 16:35 - 02411976 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll 2015-06-22 19:25 - 2014-03-04 16:35 - 01885472 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433523.dll 2015-06-22 19:25 - 2014-03-04 16:35 - 01516488 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433523.dll 2015-06-22 19:25 - 2014-03-04 16:35 - 00892704 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll 2015-06-22 19:25 - 2014-03-04 16:35 - 00877856 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll 2015-06-22 19:25 - 2014-03-04 16:35 - 00863064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll 2015-06-22 19:25 - 2014-03-04 16:35 - 00846168 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll 2015-06-22 19:25 - 2014-03-04 16:35 - 00832936 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll 2015-06-22 19:25 - 2014-03-04 16:35 - 00353504 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll 2015-06-22 19:25 - 2014-03-04 16:35 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll 2015-06-22 19:25 - 2014-03-04 16:35 - 00174296 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll 2015-06-22 19:25 - 2014-03-04 16:35 - 00148016 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll 2015-06-22 19:25 - 2013-12-27 20:42 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys 2015-06-22 19:25 - 2013-12-27 20:42 - 00035104 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll 2015-06-22 19:25 - 2013-12-27 20:42 - 00033056 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll 2015-06-22 19:25 - 2013-11-28 15:38 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys 2015-06-22 19:25 - 2013-11-28 15:38 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll 2015-06-22 19:25 - 2013-11-22 10:36 - 01515296 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll 2015-06-22 19:20 - 2015-06-22 19:22 - 276762432 _____ (NVIDIA Corporation) C:\Users\Erik\Downloads\335.23-desktop-win8-win7-winvista-64bit-international-whql.exe 2015-06-22 19:12 - 2015-06-22 19:12 - 00000000 ____D C:\Users\Erik\AppData\Roaming\FiraxisLive 2015-06-17 12:12 - 2015-07-15 12:18 - 00001220 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-4148174342-3149974382-3542746328-1000UA.job 2015-06-17 12:12 - 2015-07-15 12:17 - 00001168 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-4148174342-3149974382-3542746328-1000Core.job 2015-06-17 12:12 - 2015-06-17 12:12 - 00004188 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-4148174342-3149974382-3542746328-1000UA 2015-06-17 12:12 - 2015-06-17 12:12 - 00003792 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-4148174342-3149974382-3542746328-1000Core 2015-06-17 12:12 - 2015-06-17 12:12 - 00000000 ____D C:\Users\Erik\AppData\Local\Dropbox 2015-06-17 12:12 - 2015-06-17 12:12 - 00000000 ____D C:\ProgramData\Dropbox ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-07-15 12:45 - 2010-12-23 14:24 - 00000000 ____D C:\Users\Erik 2015-07-15 12:44 - 2010-12-23 14:24 - 01984127 _____ C:\Windows\WindowsUpdate.log 2015-07-15 12:36 - 2009-07-14 06:45 - 00026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-07-15 12:36 - 2009-07-14 06:45 - 00026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-07-15 12:33 - 2011-02-23 00:11 - 00000000 ____D C:\Users\Erik\AppData\Roaming\Skype 2015-07-15 12:19 - 2015-02-22 17:33 - 00000000 ___RD C:\Users\Erik\Dropbox 2015-07-15 12:18 - 2015-02-22 17:30 - 00000000 ____D C:\Users\Erik\AppData\Roaming\Dropbox 2015-07-15 12:17 - 2012-09-18 17:11 - 00000000 ____D C:\ProgramData\Origin 2015-07-15 12:16 - 2011-05-19 22:54 - 00000000 ____D C:\Program Files (x86)\Steam 2015-07-15 12:15 - 2015-03-29 13:24 - 00020980 _____ C:\Windows\setupact.log 2015-07-15 12:15 - 2011-10-01 16:13 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-07-15 12:15 - 2010-12-09 11:54 - 00000000 ____D C:\ProgramData\NVIDIA 2015-07-15 12:15 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2015-07-15 01:09 - 2012-04-10 13:26 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-07-15 01:09 - 2011-10-01 16:13 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-07-14 23:52 - 2011-06-13 16:51 - 00000000 ____D C:\Users\Erik\AppData\Roaming\TS3Client 2015-07-14 23:09 - 2012-04-10 13:26 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-07-14 23:09 - 2012-04-10 13:26 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2015-07-14 23:09 - 2011-06-10 18:01 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2015-07-14 22:12 - 2013-11-18 20:03 - 00002175 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2015-07-14 13:07 - 2011-05-06 23:30 - 00000000 ____D C:\Users\Erik\AppData\Roaming\SoftGrid Client 2015-07-13 12:41 - 2011-02-23 00:11 - 00000000 ___RD C:\Program Files (x86)\Skype 2015-07-13 12:41 - 2011-02-23 00:11 - 00000000 ____D C:\ProgramData\Skype 2015-07-07 15:03 - 2015-04-02 00:32 - 00171176 _____ C:\Windows\PFRO.log 2015-07-07 15:03 - 2012-05-23 08:59 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2015-07-06 14:21 - 2015-06-11 12:18 - 00001120 _____ C:\Users\Public\Desktop\Avira.lnk 2015-07-06 14:21 - 2015-03-28 23:42 - 00000000 ____D C:\Program Files (x86)\Avira 2015-07-06 14:21 - 2014-06-24 12:33 - 00000000 ____D C:\ProgramData\Package Cache 2015-07-06 14:21 - 2012-11-15 14:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2015-07-05 13:24 - 2014-12-05 02:50 - 00000000 ____D C:\Users\Erik\AppData\Roaming\.minecraft 2015-07-05 10:44 - 2012-09-30 19:20 - 00000000 ____D C:\Users\Erik\Desktop\Andere Spiele 2015-07-02 17:01 - 2013-03-18 19:42 - 00000000 ____D C:\Users\Erik\AppData\Local\PMB Files 2015-06-30 16:24 - 2013-03-18 19:42 - 00000000 ____D C:\ProgramData\PMB Files 2015-06-29 20:15 - 2012-09-18 17:10 - 00000000 ____D C:\Program Files (x86)\Origin 2015-06-28 17:06 - 2009-07-14 07:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games 2015-06-28 16:57 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared 2015-06-23 13:30 - 2010-12-25 17:50 - 00300704 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2015-06-22 19:42 - 2010-12-09 11:54 - 00000000 ____D C:\ProgramData\NVIDIA Corporation 2015-06-22 19:31 - 2012-11-19 12:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation 2015-06-22 19:31 - 2010-12-09 11:54 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation 2015-06-22 19:31 - 2010-12-09 11:53 - 00000000 ____D C:\Program Files\NVIDIA Corporation 2015-06-22 19:19 - 2015-03-29 20:27 - 00001354 _____ C:\Users\Erik\Desktop\CoreTemp.ini 2015-06-22 19:12 - 2012-06-22 15:01 - 00000000 ____D C:\Users\Erik\AppData\Local\My Games 2015-06-22 19:12 - 2011-01-03 18:07 - 00000000 ____D C:\Users\Erik\Documents\My Games 2015-06-17 15:51 - 2009-07-14 07:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD 2015-06-17 11:50 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2015-06-16 00:33 - 2009-07-14 19:58 - 00712848 _____ C:\Windows\system32\perfh007.dat 2015-06-16 00:33 - 2009-07-14 19:58 - 00155680 _____ C:\Windows\system32\perfc007.dat 2015-06-16 00:33 - 2009-07-14 07:13 - 01653366 _____ C:\Windows\system32\PerfStringBackup.INI 2015-06-15 08:03 - 2014-09-10 12:13 - 00000000 ____D C:\Users\Erik\AppData\Local\Adobe ==================== Files in the root of some directories ======= 2013-12-03 13:09 - 2013-12-03 13:09 - 49940480 _____ () C:\Program Files (x86)\GUTA776.tmp 2013-06-03 21:55 - 2013-06-03 21:55 - 0001181 _____ () C:\Users\Erik\AppData\Roaming\trace_FilterInstaller.1.txt 2013-06-03 21:55 - 2015-03-29 03:10 - 0000919 _____ () C:\Users\Erik\AppData\Roaming\trace_FilterInstaller.txt 2013-06-03 21:55 - 2015-03-29 03:10 - 0000000 _____ () C:\Users\Erik\AppData\Roaming\trace_FilterInstaller.txt-CRT.txt 2013-04-24 23:35 - 2013-04-24 23:35 - 0003584 _____ () C:\Users\Erik\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2012-03-24 16:39 - 2012-03-24 16:39 - 0000092 _____ () C:\Users\Erik\AppData\Local\fusioncache.dat 2014-07-15 20:52 - 2014-07-15 20:52 - 0000000 _____ () C:\Users\Erik\AppData\Local\{25B8D08D-2530-45CC-8EC2-12E99D23E482} 2011-02-23 00:12 - 2011-02-23 00:12 - 0000056 ____H () C:\ProgramData\ezsidmv.dat 2012-05-03 19:45 - 2012-05-15 13:32 - 0001631 _____ () C:\ProgramData\flcd_proxy.log Files to move or delete: ==================== C:\Users\Erik\createfileassoc.exe C:\Users\Erik\error_report.exe C:\Users\Erik\libeay32.dll C:\Users\Erik\msvcp110.dll C:\Users\Erik\msvcr110.dll C:\Users\Erik\OverwolfTeamSpeakInstaller.exe C:\Users\Erik\package_inst.exe C:\Users\Erik\Qt5Core.dll C:\Users\Erik\Qt5Gui.dll C:\Users\Erik\Qt5Network.dll C:\Users\Erik\Qt5Sql.dll C:\Users\Erik\Qt5Widgets.dll C:\Users\Erik\quazip.dll C:\Users\Erik\ssleay32.dll C:\Users\Erik\ts3client_win64.exe C:\Users\Erik\Uninstall.exe C:\Users\Erik\update.exe Some files in TEMP: ==================== C:\Users\Erik\AppData\Local\Temp\avgnt.exe C:\Users\Erik\AppData\Local\Temp\drm_dialogs.dll C:\Users\Erik\AppData\Local\Temp\drm_dyndata_7330014.dll C:\Users\Erik\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpqx8szd.dll C:\Users\Erik\AppData\Local\Temp\nvSCPAPI.dll C:\Users\Erik\AppData\Local\Temp\nvSCPAPISvr.exe C:\Users\Erik\AppData\Local\Temp\nvStInst.exe C:\Users\Erik\AppData\Local\Temp\tmp77AE.exe C:\Users\Gast\AppData\Local\Temp\AskSLib.dll C:\Users\Ronja\AppData\Local\Temp\AskSLib.dll C:\Users\Ronja\AppData\Local\Temp\avgnt.exe C:\Users\Ronja\AppData\Local\Temp\drm_dialogs.dll C:\Users\Ronja\AppData\Local\Temp\drm_dyndata_7380012.dll C:\Users\Ronja\AppData\Local\Temp\firefoxjre_exe-1.exe C:\Users\Ronja\AppData\Local\Temp\firefoxjre_exe-2.exe C:\Users\Ronja\AppData\Local\Temp\firefoxjre_exe.exe C:\Users\Ronja\AppData\Local\Temp\ytb.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-07-04 19:34 ==================== End of log ============================ Addition.txtFRST Additions Logfile: [CODE]Additional FRST Logfile: Code:
ATTFilter scan result of Farbar Recovery Scan Tool (x64) Version:13-07-2015 Ran by Erik at 2015-07-15 12:53:34 Running from C:\Users\Erik\Downloads Boot Mode: Normal ========================================================== ==================== Accounts: ============================= Administrator (S-1-5-21-4148174342-3149974382-3542746328-500 - Administrator - Disabled) ASPNET (S-1-5-21-4148174342-3149974382-3542746328-1005 - Limited - Enabled) Erik (S-1-5-21-4148174342-3149974382-3542746328-1000 - Administrator - Enabled) => C:\Users\Erik Gast (S-1-5-21-4148174342-3149974382-3542746328-501 - Limited - Enabled) => C:\Users\Gast HomeGroupUser$ (S-1-5-21-4148174342-3149974382-3542746328-1002 - Limited - Enabled) Ronja (S-1-5-21-4148174342-3149974382-3542746328-1003 - Administrator - Enabled) => C:\Users\Ronja ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859} AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) ACD/Labs Freeware in C:\ACD2012FREE\ (HKLM-x32\...\ACDLabs in C__ACD2012FREE_) (Version: v14.00, FREE - ACD/Labs) Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.2.0.2070 - Adobe Systems Incorporated) Adobe Flash Player 18 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 18.0.0.209 - Adobe Systems Incorporated) Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.209 - Adobe Systems Incorporated) Adobe Reader XI - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.00 - Adobe Systems Incorporated) Age of Wonders III (HKLM-x32\...\Steam App 226840) (Version: - Triumph Studios) Age of Wonders: Trilogy Soundtrack (HKLM-x32\...\Steam App 61530) (Version: - ) Anno 1404 (HKLM-x32\...\Steam App 33250) (Version: - Blue Byte) Anno 1404: Venice (HKLM-x32\...\Steam App 33350) (Version: - Blue Byte) Apple Application Support (32-Bit) (HKLM-x32\...\{447CDCE5-F555-429B-BFA6-642C3C6D684F}) (Version: 3.1.2 - Apple Inc.) Apple Application Support (64-Bit) (HKLM\...\{0DF7096B-715A-4233-8633-C7A16ED6D616}) (Version: 3.1.2 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.) Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) Assassin's Creed (HKLM-x32\...\{8CFA9151-6404-409A-AF22-4632D04582FD}) (Version: 1.02 - Ubisoft) Assassin's Creed Brotherhood (HKLM-x32\...\{BE4BA698-8533-4F77-9559-C7F3F78C0B05}) (Version: 1.03 - Ubisoft) Assassin's Creed II (HKLM-x32\...\{8570BEE8-0CA3-4977-9AB1-80ED93F0513C}) (Version: 1.01 - Ubisoft) Assassin's Creed Revelations 1.03 (HKLM-x32\...\{33A22B2D-55BA-4508-B767-BF2E9C21A73F}) (Version: 1.03 - Ubisoft) ATI Catalyst Install Manager (HKLM\...\{33F02C0A-5C0E-B3AF-EB9F-831B6E42D732}) (Version: 3.0.795.0 - ATI Technologies, Inc.) Avira (HKLM-x32\...\{8467e01f-0496-42ce-b247-88ef205b4880}) (Version: 1.1.40.29239 - Avira Operations GmbH & Co. KG) Avira (x32 Version: 1.1.40.29239 - Avira Operations GmbH & Co. KG) Hidden Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.11.579 - Avira Operations GmbH & Co. KG) Avira Browser Safety (HKLM-x32\...\{9E10EA90-5E97-43B7-A246-FC7B4F5E9493}) (Version: 1.4.5.509 - Avira Operations GmbH & Co KG) Bastion (HKLM-x32\...\Steam App 107100) (Version: - Supergiant Games) Battle Realms Complete (German) (HKLM-x32\...\GOGPACKBATTLEREALMS_is1) (Version: 2.0.0.9 - GOG.com) Battlefield 3™ (HKLM-x32\...\{76285C16-411A-488A-BCE3-C83CB933D8CF}) (Version: 1.6.0.0 - Electronic Arts) Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.) Borderlands (HKLM-x32\...\Steam App 8980) (Version: - Gearbox Software) CCleaner (HKLM\...\CCleaner) (Version: 5.04 - Piriform) Dark Souls Prepare to Die Edition (HKLM-x32\...\GFWL_{4E4D0FA1-F880-4CCB-999A-501000008200}) (Version: 1.0.0000.130 - NAMCO BANDAI Games Europe S.A.S.) Dark Souls Prepare to Die Edition (x32 Version: 1.0.0000.130 - NAMCO BANDAI Games Europe S.A.S.) Hidden Drakensang - Am Fluss der Zeit (HKLM-x32\...\Drakensang_TRoT_is1) (Version: - dtp) Drakensang (HKLM-x32\...\Drakensang_is1) (Version: - dtp) Dropbox (HKU\S-1-5-21-4148174342-3149974382-3542746328-1000\...\Dropbox) (Version: 3.6.8 - Dropbox, Inc.) Fallout: New Vegas (HKLM-x32\...\Steam App 22380) (Version: - Obsidian Entertainment) FTL: Faster Than Light (HKLM-x32\...\Steam App 212680) (Version: - Subset Games) GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.134 - Google Inc.) Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden Gothic (HKLM-x32\...\{BBF10B37-4ED3-11D5-A818-00500435FC18}) (Version: - ) Heroes of Might & Magic V: Hammers of Fate (HKLM-x32\...\{66FF4C48-0083-4E60-8556-B883AB200091}) (Version: - ) Heroes of Might and Magic V - Tribes of the East (HKLM-x32\...\{66FF4C48-0083-4E60-8556-B883AB200092}) (Version: - ) Heroes of Might and Magic V (HKLM-x32\...\{20071984-5EB1-4881-8EDB-082532ACEC6D}) (Version: - ) iTunes (HKLM\...\{D227565A-0033-40AD-89BA-653A205CDC11}) (Version: 12.1.1.4 - Apple Inc.) Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation) League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games ) League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden Magicka (HKLM-x32\...\Steam App 42910) (Version: - Arrowhead Game Studios) Mass Effect (HKLM-x32\...\{1B0FBB9A-995D-47cd-87CD-13E68B676E4F}) (Version: 1.00 - Electronic Arts, Inc.) Mass Effect 2 (HKLM-x32\...\{75D84EF7-0D8C-4e70-B3FA-7B42A5D4E0EB}) (Version: 1.00 - Electronic Arts, Inc.) Mass Effect™ 3 (HKLM-x32\...\{534A31BD-20F4-46b0-85CE-09778379663C}) (Version: 1.04.0.0 - Electronic Arts) Microsoft .NET Framework 1.1 (HKLM-x32\...\Microsoft .NET Framework 1.1 (1033)) (Version: - ) Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation) Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{F2508213-9989-4E85-A078-72BE483917EF}) (Version: 3.5.88.0 - Microsoft Corporation) Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation) Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation) Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation) Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation) Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.) Microsoft XNA Framework Redistributable 3.1 (HKLM-x32\...\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation) Mozilla Firefox 39.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 39.0 (x86 de)) (Version: 39.0 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla) MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) MSXML4 Parser (HKLM-x32\...\{01501EBA-EC35-4F9F-8889-3BE346E5DA13}) (Version: 1.0.0 - Microsoft Game Studios) NVIDIA 3D Vision Controller-Treiber 335.21 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 335.21 - NVIDIA Corporation) NVIDIA 3D Vision Treiber 335.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 335.23 - NVIDIA Corporation) NVIDIA GeForce Experience 1.8.2.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.2.1 - NVIDIA Corporation) NVIDIA Grafiktreiber 335.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 335.23 - NVIDIA Corporation) NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation) NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation) NVIDIA Virtual Audio 1.2.20 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.20 - NVIDIA Corporation) Oblivion (HKLM-x32\...\{35CB6715-41F8-4F99-8881-6FC75BF054B0}) (Version: 1.00.0000 - Bethesda Softworks) OpenOffice.org 3.2 (HKLM-x32\...\{8D1E61D1-1395-4E97-997F-D002DB3A5074}) (Version: 3.2.9502 - OpenOffice.org) Origin (HKLM-x32\...\Origin) (Version: 9.0.11.77 - Electronic Arts, Inc.) PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.311.0 - Tracker Software Products Ltd) ProtectDisc Driver, Version 11 (HKLM-x32\...\ProtectDisc Driver 11) (Version: 11.0.0.12 - ProtectDisc Software GmbH) PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.991 - Even Balance, Inc.) Realtek Ethernet Controller Driver For Windows 7 (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.17.304.2010 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6235 - Realtek Semiconductor Corp.) Risen (HKLM-x32\...\{155F4A0E-76ED-45A2-91FB-FF2A2133C31A}) (Version: 1.00.0000 - Deep Silver) Risk of Rain (HKLM-x32\...\Steam App 248820) (Version: - ) scilab-5.5.2 (64-bit) (HKLM\...\scilab-5.5.2 (64-bit)_is1) (Version: - Scilab Enterprises) SHIELD Streaming (Version: 1.7.321 - NVIDIA Corporation) Hidden Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version: - 2K Games, Inc.) Sid Meier's Civilization: Beyond Earth (HKLM-x32\...\Steam App 65980) (Version: - Firaxis Games) Skype™ 7.6 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.6.105 - Skype Technologies S.A.) Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.) Star Wars: The Force Unleashed (HKLM-x32\...\Star Wars: The Force Unleashed_is1) (Version: 1.0 - Activision) Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation) TeamSpeak 3 Client (HKU\S-1-5-21-4148174342-3149974382-3542746328-1000\...\TeamSpeak 3 Client) (Version: 3.0.15 - TeamSpeak Systems GmbH) The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version: - Bethesda Game Studios) The Witcher 2: Assassins of Kings Enhanced Edition (HKLM-x32\...\Steam App 20920) (Version: - CD Projekt RED) The Witcher Enhanced Edition Version 1.6 (HKLM-x32\...\The Witcher Enhanced Edition_is1) (Version: 1.6 - CD Projekt RED) Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT) VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden VLC media player 2.1.0-pre1 (HKLM\...\VLC media player) (Version: 2.1.0-pre1 - VideoLAN) Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation) WinRAR 4.00 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.00.0 - win.rar GmbH) WTFast 3.5 (HKLM-x32\...\{12B4121D-5221-4AFC-9EDC-63B0CA139856}_is1) (Version: 3.5.6.464 - Initex & AAA Internet Publishing) ==================== Custom CLSID (Whitelisted): ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Erik\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{087B3AE3-E237-4467-B8DB-5A38AB959AC9}\InprocServer32 -> C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl_x64.dll (OpenOffice.org) CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{3B092F0C-7696-40E3-A80F-68D74DA84210}\InprocServer32 -> C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl_x64.dll (OpenOffice.org) CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{63542C48-9552-494A-84F7-73AA6A7C99C1}\InprocServer32 -> C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl_x64.dll (OpenOffice.org) CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{67F2A879-82D5-4A6D-8CC5-FFB3C114B69D}\InprocServer32 -> C:\Program Files (x86)\OpenOffice.org 3\program\so_activex_x64.dll () CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{7BC0E710-5703-45BE-A29D-5D46D8B39262}\InprocServer32 -> C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\ooofiltproxy_x64.dll (OpenOffice.org) CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\InprocServer32 -> C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl_x64.dll (OpenOffice.org) CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.) ==================== Restore Points ========================= 28-06-2015 16:52:29 DirectX wurde installiert 30-06-2015 14:58:56 Windows Update 07-07-2015 08:51:31 Windows Update 10-07-2015 13:36:16 Windows Update 14-07-2015 09:36:02 Windows Update ==================== Hosts content: =============================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (Whitelisted) ============= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) Task: {0477ED1B-C89F-4E36-A74E-59B3BF1933F5} - System32\Tasks\{95CFF7D3-BF85-47C3-8108-813CE6408C8F} => C:\Users\Erik\Documents\Meine empfangenen Dateien\Blackjack.exe [2012-04-18] () Task: {0977A095-4853-4819-AEE7-3F8DA402BC6B} - System32\Tasks\{66660BC7-9621-47E0-9F05-5B228D39614E} => C:\Users\Erik\Documents\Meine empfangenen Dateien\Blackjack.exe [2012-04-18] () Task: {0EEE3178-5123-48C2-8D2E-08D8A0731A8A} - System32\Tasks\{0139D295-6C60-42A9-9C86-936E78CF5BC4} => C:\Users\Erik\Documents\Meine empfangenen Dateien\Blackjack.exe [2012-04-18] () Task: {230926BD-3699-47D4-8D0C-DF80E0AF2330} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {26EE68E4-A02F-482A-825C-D8238628BEF1} - System32\Tasks\{7C0387C3-5302-46E9-91D5-72F3BE7F452D} => C:\Users\Erik\Documents\Meine empfangenen Dateien\Blackjack.exe [2012-04-18] () Task: {4D50FF43-68FC-41BC-8545-6667B470808D} - System32\Tasks\{8C8FB235-038B-4BC5-B63B-49C09F0D970C} => C:\Users\Erik\Documents\Meine empfangenen Dateien\Blackjack.exe [2012-04-18] () Task: {51FA042C-BFA7-4F80-AC5A-087AD7A2028E} - System32\Tasks\{2820234E-6D53-4860-91CE-8FFE90DD1F18} => pcalua.exe -a C:\Users\Erik\Downloads\jxpiinstall(2).exe -d C:\Users\Erik\Downloads Task: {527A459A-B5E3-426E-9E52-0F07B1682A60} - System32\Tasks\{97511E91-6183-4DB8-A2EA-A09E1E54758F} => pcalua.exe -a "C:\Program Files (x86)\Steam\steam.exe" -c steam://uninstall/8930 Task: {53E0A85B-56B9-49A0-B86B-1940AE747DDF} - System32\Tasks\{A5C236CC-7776-4DC3-93C0-611BDC47D311} => C:\Users\Erik\Documents\Meine empfangenen Dateien\Blackjack.exe [2012-04-18] () Task: {53E51652-AB22-4225-9318-1260A55B9C56} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.) Task: {5FD3E1C1-EDC6-4E15-BC0D-ACFA29789A16} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-07-14] (Adobe Systems Incorporated) Task: {6B794E37-50C3-4653-899E-43940D01A747} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.) Task: {7DC0EAB5-E1CF-485D-9862-E6906F23E3A3} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-4148174342-3149974382-3542746328-1000UA => C:\Users\Erik\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-17] (Dropbox, Inc.) Task: {8486E3F6-9396-4D52-B102-ADC13A328229} - System32\Tasks\{FEAEB795-8118-46B0-BD70-3A47DF9BC73F} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2015-06-29] (Skype Technologies S.A.) Task: {85541A3D-0827-4DA7-B0DB-A9BAB9D71238} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-20] (Google Inc.) Task: {8606B07D-A33D-43D9-A48E-7B97AC1E7352} - System32\Tasks\{F9B7A166-AAB0-4FBB-B382-A3D2D484CA68} => Firefox.exe hxxp://ui.skype.com/ui/0/6.6.0.106/de/abandoninstall?page=tsMain Task: {8DE8F6DD-753A-434C-B510-DC00BCE7A40D} - System32\Tasks\{1F67813B-EE9F-4356-A6BF-03FA462174E5} => C:\Users\Erik\Documents\Meine empfangenen Dateien\Blackjack.exe [2012-04-18] () Task: {99674296-FC2D-49FB-A31D-24EE14803E6F} - System32\Tasks\{BCDBC41D-6545-429F-95DF-77681D46FB0F} => C:\Users\Erik\Documents\Meine empfangenen Dateien\Blackjack.exe [2012-04-18] () Task: {A04C2E99-60B1-4970-A2B2-FF37F29B51F8} - System32\Tasks\{135574F2-98F6-446A-9D84-441562CDB06B} => pcalua.exe -a D:\SETUP.EXE -d D:\ Task: {A44BA4E6-ACCB-4310-B739-CBF43D2AB2D2} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-03-13] (Piriform Ltd) Task: {A97766C1-EC4C-410B-ACAD-2331BEFDAE80} - System32\Tasks\{9F12B632-00C7-415B-ACF2-D1ABED3B01DB} => C:\Users\Erik\Documents\Meine empfangenen Dateien\Blackjack.exe [2012-04-18] () Task: {B3FEBEED-5558-449E-A844-0DC5361D8BFE} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-20] (Google Inc.) Task: {C37104EF-9B44-40BC-899C-365A0338070B} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-4148174342-3149974382-3542746328-1000Core => C:\Users\Erik\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-17] (Dropbox, Inc.) Task: {CAD8D609-31F7-456D-B2C7-BF4A930A8A8D} - System32\Tasks\{557D624A-1922-4E3C-8C73-81B7922463B0} => pcalua.exe -a C:\Users\Erik\Downloads\MassEffect_BDtS_G.exe -d C:\Users\Erik\Downloads Task: {D9AE1612-B64B-426A-92CE-0FE1A561EDE9} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.) (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-4148174342-3149974382-3542746328-1000Core.job => C:\Users\Erik\AppData\Local\Dropbox\Update\DropboxUpdate.exe Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-4148174342-3149974382-3542746328-1000UA.job => C:\Users\Erik\AppData\Local\Dropbox\Update\DropboxUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (Whitelisted) ============== 2012-11-19 01:07 - 2014-03-04 15:05 - 00116056 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll 2015-02-13 04:20 - 2015-02-13 04:20 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll 2015-02-13 04:20 - 2015-02-13 04:20 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll 2013-06-03 19:42 - 2014-06-01 00:56 - 00075136 _____ () C:\Windows\SysWOW64\PnkBstrA.exe 2015-03-29 01:23 - 2014-05-13 13:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl 2015-03-29 01:23 - 2014-05-13 13:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl 2015-03-29 01:23 - 2014-05-13 13:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl 2015-03-29 01:23 - 2012-08-23 11:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll 2015-03-29 01:23 - 2012-04-03 18:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll ==================== Alternate Data Streams (Whitelisted) ========= (If an entry is included in the fixlist, only the ADS will be removed.) ==================== Safe Mode (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (Whitelisted) =============== (If an entry is included in the fixlist, the registry item will be restored to default or removed.) ==================== Internet Explorer trusted/restricted =============== (If an entry is included in the fixlist, it will be removed from the registry.) ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-4148174342-3149974382-3542746328-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Erik\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg DNS Servers: 8.8.8.8 ==================== MSCONFIG/TASK MANAGER disabled items == (Currently there is no automatic fix for this section.) MSCONFIG\startupfolder: C:^Users^Erik^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk => C:\Windows\pss\OpenOffice.org 3.2.lnk.Startup MSCONFIG\startupreg: ISUSPM Startup => "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup MSCONFIG\startupreg: Logitech Download Assistant => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" ==================== FirewallRules (Whitelisted) =============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe FirewallRules: [TCP Query User{20077774-C64C-4FA7-8EA5-5EB752D3D7BB}C:\program files (x86)\activision\ef2\ef2.exe] => (Allow) C:\program files (x86)\activision\ef2\ef2.exe FirewallRules: [UDP Query User{D17446DB-0385-48B6-83E8-64A6B89829AF}C:\program files (x86)\activision\ef2\ef2.exe] => (Allow) C:\program files (x86)\activision\ef2\ef2.exe FirewallRules: [{8AADC0AD-1B22-4CE5-B017-8C11354457BB}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe FirewallRules: [VirtualPC-In-UDP-1] => (Allow) %SystemRoot%\System32\vpc.exe FirewallRules: [VirtualPC-In-UDP-2] => (Allow) %SystemRoot%\System32\vpc.exe FirewallRules: [VirtualPC-In-TCP-1] => (Allow) %SystemRoot%\System32\vpc.exe FirewallRules: [TCP Query User{8218B01D-8A39-4502-818E-3AF109FD939F}C:\program files\java\jre6\bin\javaw.exe] => (Allow) C:\program files\java\jre6\bin\javaw.exe FirewallRules: [UDP Query User{58CC0721-1C67-42CC-8CE9-AE930A30D0B5}C:\program files\java\jre6\bin\javaw.exe] => (Allow) C:\program files\java\jre6\bin\javaw.exe FirewallRules: [{81A69630-9058-4405-AD4A-15717B5C01A7}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe FirewallRules: [{86E510F2-8EA2-4CCE-AC2A-0048A4E6CF62}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe FirewallRules: [TCP Query User{CD8485DB-0663-4D42-8585-CD6BD37F6411}C:\program files (x86)\ubisoft\heroes of might and magic v - tribes of the east\bin\h5_game.exe] => (Block) C:\program files (x86)\ubisoft\heroes of might and magic v - tribes of the east\bin\h5_game.exe FirewallRules: [UDP Query User{980694A3-F2F1-4F87-A2B0-2A97A2B26318}C:\program files (x86)\ubisoft\heroes of might and magic v - tribes of the east\bin\h5_game.exe] => (Block) C:\program files (x86)\ubisoft\heroes of might and magic v - tribes of the east\bin\h5_game.exe FirewallRules: [{D80EAE77-80D7-4431-BC1A-FDF6B2498FA0}] => (Allow) C:\Program Files (x86)\Dragon Age\bin_ship\daorigins.exe FirewallRules: [{3058BF29-C0F0-40D8-A228-67DAD9591322}] => (Allow) C:\Program Files (x86)\Dragon Age\bin_ship\daorigins.exe FirewallRules: [{5C562A02-DA94-4544-8B39-2622A0834B02}] => (Allow) C:\Program Files (x86)\Dragon Age\DAOriginsLauncher.exe FirewallRules: [{21CFC8A4-07A4-487F-B37C-8F95D3D993CF}] => (Allow) C:\Program Files (x86)\Dragon Age\DAOriginsLauncher.exe FirewallRules: [{57C54F75-F60C-455F-AF25-6E9397CBD8C7}] => (Allow) C:\Program Files (x86)\Dragon Age\bin_ship\daupdatersvc.service.exe FirewallRules: [{D675BBFD-EC46-4D28-A4A7-9C5A51E61A5D}] => (Allow) C:\Program Files (x86)\Dragon Age\bin_ship\daupdatersvc.service.exe FirewallRules: [{0481E6E6-B202-4D8B-AF09-72CC998AD4AE}] => (Allow) C:\Program Files (x86)\Mass Effect\Binaries\MassEffect.exe FirewallRules: [{A833A81A-FB17-453C-98C3-227D4610DE3E}] => (Allow) C:\Program Files (x86)\Mass Effect\Binaries\MassEffect.exe FirewallRules: [{8E7CFF1F-24E9-4DB2-A331-AEA4E9D72448}] => (Allow) C:\Program Files (x86)\Mass Effect\MassEffectLauncher.exe FirewallRules: [{DA448CC6-1BE0-49F2-8C26-7A5DD21566A3}] => (Allow) C:\Program Files (x86)\Mass Effect\MassEffectLauncher.exe FirewallRules: [{69F0FEFF-5DB2-47D9-953A-B3551FBD026C}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed\AssassinsCreed_Dx9.exe FirewallRules: [{44E57D33-2C43-4714-A30F-3E7E3C69ABB0}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed\AssassinsCreed_Dx9.exe FirewallRules: [{78F133A5-6FC8-47A7-9BD7-6F109860C32B}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed\AssassinsCreed_Dx10.exe FirewallRules: [{307AD621-2138-4154-866E-B22E24EC9251}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed\AssassinsCreed_Dx10.exe FirewallRules: [{38AF4F5F-7F37-4AE9-9FF2-8343739F1C1D}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed\AssassinsCreed_Launcher.exe FirewallRules: [{02FFA2B9-DA56-4592-BB72-451479D6FA3C}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed\AssassinsCreed_Launcher.exe FirewallRules: [{8B39C3D3-C1DE-42B3-BD38-6F01AF9E4867}] => (Allow) C:\Program Files (x86)\Mass Effect 2\Binaries\MassEffect2.exe FirewallRules: [{9CB43ED2-7067-4693-9E91-2E073440BE34}] => (Allow) C:\Program Files (x86)\Mass Effect 2\Binaries\MassEffect2.exe FirewallRules: [{F75C8456-76A0-4DCB-AAE5-9EEC13AD27DF}] => (Allow) C:\Program Files (x86)\Mass Effect 2\MassEffect2Launcher.exe FirewallRules: [{BB8EAC95-2364-456D-8A36-4785FD7C84BB}] => (Allow) C:\Program Files (x86)\Mass Effect 2\MassEffect2Launcher.exe FirewallRules: [TCP Query User{E80A2F84-43DA-46F1-856D-B6C0A0907FC7}C:\program files (x86)\turbine\der herr der ringe online\lotroclient.exe] => (Allow) C:\program files (x86)\turbine\der herr der ringe online\lotroclient.exe FirewallRules: [UDP Query User{E0B8B6C9-9733-4724-AAB7-EE0311E65F5F}C:\program files (x86)\turbine\der herr der ringe online\lotroclient.exe] => (Allow) C:\program files (x86)\turbine\der herr der ringe online\lotroclient.exe FirewallRules: [TCP Query User{F7185820-7858-4FA5-AB08-301E33BEEF3F}C:\program files (x86)\ubisoft\blue byte\die siedler - das erbe der könige\bin\settlershok.exe] => (Allow) C:\program files (x86)\ubisoft\blue byte\die siedler - das erbe der könige\bin\settlershok.exe FirewallRules: [UDP Query User{04C68E80-2190-4CC0-8FE2-07B46693F4A9}C:\program files (x86)\ubisoft\blue byte\die siedler - das erbe der könige\bin\settlershok.exe] => (Allow) C:\program files (x86)\ubisoft\blue byte\die siedler - das erbe der könige\bin\settlershok.exe FirewallRules: [TCP Query User{25C8DF2B-DD21-4ED7-9611-42AA84381C1C}C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.icd] => (Allow) C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.icd FirewallRules: [UDP Query User{B35B1B40-DFC0-46CA-92DB-629A338480DB}C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.icd] => (Allow) C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.icd FirewallRules: [TCP Query User{FC5440E8-1159-4C9F-87A1-42E5D43FDD66}C:\program files (x86)\microsoft games\age of empires ii\empires2.icd] => (Allow) C:\program files (x86)\microsoft games\age of empires ii\empires2.icd FirewallRules: [UDP Query User{2307D80F-FF77-4728-9C82-622B0A9E4AD0}C:\program files (x86)\microsoft games\age of empires ii\empires2.icd] => (Allow) C:\program files (x86)\microsoft games\age of empires ii\empires2.icd FirewallRules: [{A8E3397F-6DEA-4ECD-AFE9-3D6D4E0D244B}] => (Block) %ProgramFiles% (x86)\MAGIX\Video_deluxe_17_Premium_Download-Version\Videodeluxe.exe FirewallRules: [{3DB300E6-1735-4B26-B0FE-4609FCA2F788}] => (Block) %ProgramFiles% (x86)\MAGIX\Video_deluxe_17_Premium_Download-Version\Video_deluxe_17_premium_de-DE_setup.exe FirewallRules: [{F6980C79-FC03-43B0-8753-7F429480F085}] => (Block) %ProgramFiles% (x86)\MAGIX\Video_deluxe_17_Premium_Download-Version\Trayserver.exe FirewallRules: [TCP Query User{E56803E0-AFF4-4740-B7F6-701AB179B71B}C:\program files\java\jre6\bin\javaw.exe] => (Block) C:\program files\java\jre6\bin\javaw.exe FirewallRules: [UDP Query User{EC61426E-54CD-4797-81A7-A6986A83AB7C}C:\program files\java\jre6\bin\javaw.exe] => (Block) C:\program files\java\jre6\bin\javaw.exe FirewallRules: [{A3D1B127-A9B4-4923-9E07-2261F5BA4CBC}] => (Allow) C:\Program Files (x86)\Origin Games\Mass Effect 3\Binaries\Win32\MassEffect3.exe FirewallRules: [{20476545-C14A-4152-9EE3-AB36C8FB97AD}] => (Allow) C:\Program Files (x86)\Origin Games\Mass Effect 3\Binaries\Win32\MassEffect3.exe FirewallRules: [TCP Query User{E6B1F283-3CD9-47F1-845E-8874FD203398}C:\users\erik\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\erik\appdata\roaming\spotify\spotify.exe FirewallRules: [UDP Query User{28B41AFC-3B51-43BB-92D5-E691F5D08D65}C:\users\erik\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\erik\appdata\roaming\spotify\spotify.exe FirewallRules: [{580A8A38-629F-45C2-902B-A36374FE7705}] => (Allow) C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe FirewallRules: [{6F9116FB-34C0-47CB-8D66-15599181EBBD}] => (Allow) C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe FirewallRules: [{9AFD8D4D-E2EF-47BE-A88F-FEAE319C3AB9}] => (Allow) C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe FirewallRules: [{9DE1BA38-C71B-40BF-B461-05BE93A608BE}] => (Allow) C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe FirewallRules: [{A29600F8-BE3E-4F92-B8A0-29D9E62CBB3A}] => (Allow) LPort=57021 FirewallRules: [{C5D9411C-D714-441A-B877-2ECC9A704A0C}] => (Allow) LPort=57021 FirewallRules: [{813BD5FF-8799-4FB6-95E0-2204D3BCB106}] => (Allow) LPort=57021 FirewallRules: [{DB29828B-C0C7-41AF-983F-995019EAD2C5}] => (Allow) LPort=57021 FirewallRules: [{076E418D-EBCA-4610-A736-E8F4CB16DF40}] => (Allow) C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe FirewallRules: [{49C75E15-733B-466F-BB5C-EDA964163E62}] => (Allow) C:\Program Files (x86)\UBISOFT\Ubisoft Game Launcher\UbisoftGameLauncher.exe FirewallRules: [{346FDD84-FDA2-43BA-911B-A2C2B1B4C486}] => (Allow) C:\Program Files (x86)\UBISOFT\Ubisoft Game Launcher\UbisoftGameLauncher.exe FirewallRules: [{11D9725F-1DD4-439E-A5F8-69FE019B0EEF}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed II\AssassinsCreedIIGame.exe FirewallRules: [{F8C53F55-2266-4BC4-A044-2709E1984211}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed II\AssassinsCreedIIGame.exe FirewallRules: [{C71B1DEB-125B-443B-BA14-D8FC0089CE30}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed II\AssassinsCreedII.exe FirewallRules: [{DDE36807-488E-49D0-B5B2-20CB46FB5ACD}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed II\AssassinsCreedII.exe FirewallRules: [{43A36CEB-B87E-455B-80C9-D44DDBF470CB}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed II\UPlayBrowser.exe FirewallRules: [{2C95D061-ACBF-4E80-9204-9B399294C6E2}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed II\UPlayBrowser.exe FirewallRules: [{E312DE2E-E70C-42E0-A48F-E7013C1AA231}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\skyrim\SkyrimLauncher.exe FirewallRules: [{532062F2-4B61-4BF7-8E15-94D31C7C532A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\skyrim\SkyrimLauncher.exe FirewallRules: [{C0E94608-66AF-4145-9164-0AD9EB4EE056}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sid Meier's Civilization V\Launcher.exe FirewallRules: [{3C7BDEC9-501B-42A3-A628-39C06A6187E5}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sid Meier's Civilization V\Launcher.exe FirewallRules: [{AD8C345D-C826-4A90-9083-3815404C7A72}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\dota.exe FirewallRules: [{1AC69E79-CF02-4226-8DD4-536D5C8BDCDB}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\dota.exe FirewallRules: [{833889C9-D61E-43CC-B24D-EE2BCFE4CC1C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\dota.exe FirewallRules: [{F8112543-B1B5-427A-8175-CCE360FD49EC}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\dota.exe FirewallRules: [TCP Query User{3A712F0B-17F5-4F4C-926D-0C053BC3B66E}C:\program files (x86)\steam\steam.exe] => (Allow) C:\program files (x86)\steam\steam.exe FirewallRules: [UDP Query User{4960BB11-205A-4577-B8F6-03864D2705EB}C:\program files (x86)\steam\steam.exe] => (Allow) C:\program files (x86)\steam\steam.exe FirewallRules: [{69AC9734-FD46-40F0-A53C-D2570FB2A47B}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\dota.exe FirewallRules: [{43846475-386A-4CF5-9320-21022A78FBAF}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\dota.exe FirewallRules: [{8BA25A61-B409-4451-8299-FA5725FAA28C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\dota.exe FirewallRules: [{874A0C00-34B3-45F1-926F-6456DB7AF0C7}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\dota.exe FirewallRules: [{728D4B74-ACEA-4DC3-9468-EC72E152065D}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\dota.exe FirewallRules: [{F2034150-4947-437E-B11C-3FFA376A0007}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\dota.exe FirewallRules: [{42551875-79C1-48EB-935B-0F13622C4390}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{D6F4C13E-4B63-4618-999A-56E830EC8714}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{9B149FFA-B830-49AA-96A7-60D528D3173A}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{FBF28483-51C6-45C7-895B-C6AAF1543854}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{410CF5AE-718C-4A03-B6CD-E945C80BF547}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed Brotherhood\ACBSP.exe FirewallRules: [{E9F195D9-02EC-4A25-B42A-86A7FDFA1AEA}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed Brotherhood\ACBSP.exe FirewallRules: [{6C48ED88-B482-4D32-B1A0-115E2B419420}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed Brotherhood\ACBMP.exe FirewallRules: [{84478C58-44B4-4FFE-9885-4C298D5BD6BC}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed Brotherhood\ACBMP.exe FirewallRules: [{E92E87AC-6BB9-489B-ABD5-5398AE9414CD}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed Brotherhood\AssassinsCreedBrotherhood.exe FirewallRules: [{8B2ED7A2-E796-4796-B67A-6C59A2637F9B}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed Brotherhood\AssassinsCreedBrotherhood.exe FirewallRules: [{DF81655D-D4C2-442D-AE18-789D0FCB98A7}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed Brotherhood\UPlayBrowser.exe FirewallRules: [{157B8FD9-3ED1-4321-AD63-35A69616F4CA}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed Brotherhood\UPlayBrowser.exe FirewallRules: [{8A23FF01-84C2-4846-B9E2-F34627F5E19A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\FTL Faster Than Light\FTLGame.exe FirewallRules: [{0AB11AE1-12B7-48A9-BE35-DA3B164213C1}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\FTL Faster Than Light\FTLGame.exe FirewallRules: [{93ABDF5C-3CDC-4B92-BB02-94412752DB55}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe FirewallRules: [{A405351E-FAD5-4E47-A0F7-8C969464A095}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe FirewallRules: [{BB70B170-F68E-48FE-BA1E-74AC0C30C062}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe FirewallRules: [{3367F24E-322F-4C6F-B984-698BC23C0336}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe FirewallRules: [{5A650AB3-7F9E-4E69-BD5E-A8C4339D76A4}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 3\bf3.exe FirewallRules: [{C808DAC3-F71D-4C71-AD21-658616B4982D}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 3\bf3.exe FirewallRules: [{190F9B04-483E-435B-B8F1-CEB4D2133C7B}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\the witcher 2\Launcher.exe FirewallRules: [{FE0F4DC0-8D16-41A6-9B0C-0E8B7FEC6AD3}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\the witcher 2\Launcher.exe FirewallRules: [{43A79202-B9C7-42B0-BFFB-CC7986137634}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Borderlands\Binaries\Borderlands.exe FirewallRules: [{7BE2AF3B-DF64-4115-BB3B-487F6D31B459}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Borderlands\Binaries\Borderlands.exe FirewallRules: [{BAE1B1CB-8013-4F6B-9E94-B9B5C6F0A98B}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Risk of Rain\Risk of Rain.exe FirewallRules: [{1F27EF17-6E46-46E5-8E8C-6794E7E76686}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Risk of Rain\Risk of Rain.exe FirewallRules: [{57110BC1-0A04-482C-BB32-61287F256039}] => (Allow) C:\Program Files (x86)\Tunngle\TnglCtrl.exe FirewallRules: [{1FEA1C63-3835-4D89-BEB5-378A6E850F9C}] => (Allow) C:\Program Files (x86)\Tunngle\TnglCtrl.exe FirewallRules: [{2B0BB2F6-0C99-41C4-9E33-438C3B7D070F}] => (Allow) C:\Program Files (x86)\Tunngle\Tunngle.exe FirewallRules: [{05940ACE-CA44-48E1-8B8E-0635D25111E4}] => (Allow) C:\Program Files (x86)\Tunngle\Tunngle.exe FirewallRules: [{C8CFA6E7-D5E8-46AC-8CDF-B3C9E9AE4E5A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Bastion\Bastion.exe FirewallRules: [{24862C5E-A21D-4396-B699-4D53ED9C496E}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Bastion\Bastion.exe FirewallRules: [{08A4D089-5F22-4DE6-AA2C-50669A0B12EB}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed Revelations\ACRSP.exe FirewallRules: [{3818FBA9-1F99-4E4F-8972-8893353D6455}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed Revelations\ACRSP.exe FirewallRules: [{B5DCBBEF-D86C-4CFF-85E2-F88C192EB725}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed Revelations\ACRMP.exe FirewallRules: [{F1D640E7-EC25-4838-A80C-BE7296D11404}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed Revelations\ACRMP.exe FirewallRules: [{4E38AB44-EF37-4E6C-BD9B-15F47684EFA4}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed Revelations\AssassinsCreedRevelations.exe FirewallRules: [{49B71011-64A2-460C-B012-CB5B77D1AF6E}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed Revelations\AssassinsCreedRevelations.exe FirewallRules: [{FF899131-72FF-44AF-A690-48B2F7A4A4D2}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe FirewallRules: [{1E41A557-7CAE-4C6F-B183-81BDB0AABE41}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe FirewallRules: [{0F94700D-F699-48A0-BDFB-7FBC6FDC9A05}] => (Allow) C:\Riot Games\League of Legends\lol.launcher.exe FirewallRules: [{15CD5871-9B2D-48FC-B875-EBCCEF5CB67D}] => (Allow) C:\Riot Games\League of Legends\lol.launcher.exe FirewallRules: [{C6E80F1B-011C-443F-A531-D5F1AB28EEFC}] => (Allow) C:\Riot Games\League of Legends\lol.launcher.exe FirewallRules: [{25C35556-FCC1-42EB-8471-AB6FBF031984}] => (Allow) C:\Riot Games\League of Legends\lol.launcher.exe FirewallRules: [{1002F735-15D5-4ACA-8084-74C41DBE7E19}] => (Allow) C:\Riot Games\League of Legends\lol.launcher.admin.exe FirewallRules: [{145A46EF-E455-4447-A1BB-CF2B4179D821}] => (Allow) C:\Riot Games\League of Legends\lol.launcher.admin.exe FirewallRules: [{7171EC86-C3CA-43C8-90E8-F3588DB008CB}] => (Allow) C:\Riot Games\League of Legends\lol.launcher.admin.exe FirewallRules: [{21A55747-3AC6-4129-8CFD-5B657EE03EF2}] => (Allow) C:\Riot Games\League of Legends\lol.launcher.admin.exe FirewallRules: [{36ABB1D9-FAC1-4991-8904-F4BF5408048E}] => (Allow) C:\Program Files (x86)\CPUID\PC Wizard 2013\unins000.exe FirewallRules: [{9F4EAFA1-A679-4854-A34D-225508BB55AC}] => (Allow) C:\Program Files (x86)\CPUID\PC Wizard 2013\unins000.exe FirewallRules: [{06B63C34-0703-4925-9622-196ECC1CB1C9}] => (Allow) C:\Program Files (x86)\CPUID\PC Wizard 2013\unins000.exe FirewallRules: [{CF74E6F6-9F7D-4619-9BE5-E0866220D8A6}] => (Allow) C:\Program Files (x86)\CPUID\PC Wizard 2013\unins000.exe FirewallRules: [{5D493837-9B5B-4F28-A15A-865904CACA08}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Magicka\Magicka.exe FirewallRules: [{18B09183-46B0-4689-B91F-44B175D6A050}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Magicka\Magicka.exe FirewallRules: [TCP Query User{D41B184E-57EA-4D93-B6C3-BD68A56AAF45}C:\program files (x86)\java\jre1.8.0_25\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre1.8.0_25\bin\javaw.exe FirewallRules: [UDP Query User{4FCE6684-97BB-4C92-BC30-9B06C99D24B7}C:\program files (x86)\java\jre1.8.0_25\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre1.8.0_25\bin\javaw.exe FirewallRules: [{C6F05162-A841-4CB6-AAA4-482799076211}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{735BDDFF-2CF7-4C45-A984-19181198C8A5}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{A079BBB3-F574-4DE6-A109-5AB0C6047783}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Anno 1404\Addon.exe FirewallRules: [{07A88457-D54D-4C15-80FD-DC4A12102EC8}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Anno 1404\Addon.exe FirewallRules: [{40D7BC4C-64D5-4993-AC52-27327EA2C23C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Anno 1404\Anno4.exe FirewallRules: [{11356878-A312-4544-90B1-BCE510B8DC3E}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Anno 1404\Anno4.exe FirewallRules: [TCP Query User{DB183B21-E5C8-4D7A-B640-BE1169337DD5}C:\program files (x86)\steam\steamapps\common\anno 1404\tools\addonweb.exe] => (Block) C:\program files (x86)\steam\steamapps\common\anno 1404\tools\addonweb.exe FirewallRules: [UDP Query User{72DD149E-4849-435E-B10B-260D2E75A29E}C:\program files (x86)\steam\steamapps\common\anno 1404\tools\addonweb.exe] => (Block) C:\program files (x86)\steam\steamapps\common\anno 1404\tools\addonweb.exe FirewallRules: [{84731A56-D436-493B-BD2D-A898296D3359}] => (Allow) C:\Users\Erik\AppData\Roaming\Dropbox\bin\Dropbox.exe FirewallRules: [{21BF4CF5-F802-459A-A98A-8193BCA50AD2}] => (Allow) C:\Users\Erik\AppData\Roaming\Dropbox\bin\Dropbox.exe FirewallRules: [TCP Query User{728AF7D3-9280-4B43-A5F6-CE407847BAAC}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe FirewallRules: [UDP Query User{4E4EF94C-DD7C-4A4C-B80D-434D284FAC81}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe FirewallRules: [{FF91AC75-E478-4E85-B969-47719789FB56}] => (Allow) C:\Program Files\iTunes\iTunes.exe FirewallRules: [{501EB100-6DD9-42CB-A21C-8D8D4D06267E}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Age of Wonders Trilogy Soundtrack\Launcher.exe FirewallRules: [{DA5A63DD-5B2D-4577-BD6A-DA2F91B45AEA}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Age of Wonders Trilogy Soundtrack\Launcher.exe FirewallRules: [{A1C1C963-5936-40EA-885F-C1C6B7CBF92A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\AoW3\AoW3.exe FirewallRules: [{3CAF6357-0FA9-4894-8AF2-D5DFD506D3A8}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\AoW3\AoW3.exe FirewallRules: [{8929B7F4-A0C4-4C30-9264-CECD3441774E}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\AoW3\AoW3_Debug.exe FirewallRules: [{2802F551-4DBD-4992-9D40-D5F2F95BD643}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\AoW3\AoW3_Debug.exe FirewallRules: [{DC789024-B20F-4B32-BFDE-6613DBF1F478}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\AoW3\AoW3Launcher.exe FirewallRules: [{D386769D-03A7-4D95-B771-BFFFA7CB4180}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\AoW3\AoW3Launcher.exe FirewallRules: [{06F59295-91E5-4E08-BA64-249FD4389701}] => (Allow) C:\Program Files (x86)\WTFast\WTFast.exe FirewallRules: [{9372A82C-55E7-424A-AA48-780BAA1C9995}] => (Allow) C:\Program Files (x86)\WTFast\WTFast.exe FirewallRules: [{4FE2F023-1099-4884-9F1A-8866C91AFB7E}] => (Allow) C:\Program Files (x86)\WTFast\WTFast.exe FirewallRules: [{B109D346-19AD-4302-9696-CD67E95B2C40}] => (Allow) C:\Program Files (x86)\WTFast\WTFast.exe FirewallRules: [{457A2348-838E-4E05-B3E9-B6FFA08CA223}] => (Allow) C:\ACD2012FREE\SHOW3D.EXE FirewallRules: [{75B5698B-8660-4C11-83C6-A443C2B1F7F5}] => (Allow) C:\ACD2012FREE\SHOW3D.EXE FirewallRules: [{961C1961-7413-452C-9D28-3017F903CC58}] => (Allow) C:\ACD2012FREE\SHOW3D.EXE FirewallRules: [{AC5348D7-AC06-437E-9EAD-92D5A593F410}] => (Allow) C:\ACD2012FREE\SHOW3D.EXE FirewallRules: [{AE8026E8-A9A6-49C5-AD98-5A91DDA883E0}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Fallout New Vegas\FalloutNVLauncher.exe FirewallRules: [{D691569D-CF38-4C46-B03C-16F838B338C8}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Fallout New Vegas\FalloutNVLauncher.exe FirewallRules: [{69628E5E-A3FA-405D-A17A-A591EDFCCE7C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sid Meier's Civilization Beyond Earth\CivilizationBE_DX11.exe FirewallRules: [{B66A5C84-A69D-4231-9073-D3DFD6547F7C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sid Meier's Civilization Beyond Earth\CivilizationBE_DX11.exe FirewallRules: [{57DBA508-6747-4F70-9101-82FCB8E98EBC}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sid Meier's Civilization Beyond Earth\CivilizationBE_Mantle.exe FirewallRules: [{900516F1-F967-4D4F-B549-5000E6E01B47}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sid Meier's Civilization Beyond Earth\CivilizationBE_Mantle.exe FirewallRules: [{4D9343A9-89EC-4771-BCCA-105E6221C965}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe FirewallRules: [{4D669274-C5AE-4890-8054-BB5CE39CB219}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe FirewallRules: [{6017BCD6-8E24-46A6-B5FA-56AA5793E81E}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe FirewallRules: [{6ABCDA1A-9C74-467B-9203-B5DC7DAC4043}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe FirewallRules: [{3AA4DEDA-CBEE-4CB9-83CA-B240687AA198}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe FirewallRules: [{7DF35A0D-03AF-4813-A89C-2630343144DA}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe FirewallRules: [{73A0B3E2-9934-4FB8-938B-1DDCC2F91BEC}] => (Allow) C:\Program Files (x86)\NAMCO BANDAI Games\DarkSouls\DARKSOULS.exe FirewallRules: [{FA311607-D08B-44BB-AB03-9A5AED377058}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service ==================== Faulty Device Manager Devices ============= Name: Atheros AR5005G-Drahtlosnetzwerkadapter Description: Atheros AR5005G-Drahtlosnetzwerkadapter Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: Atheros Communications Inc. Service: athr Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. ==================== Event log errors: ========================= Application errors: ================== Error: (07/13/2015 12:29:43 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: ) Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008] Error: (07/12/2015 01:48:07 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: ) Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008] Error: (07/11/2015 10:37:00 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: Uplay.exe, Version: 4.6.1.3217, Zeitstempel: 0x53b41990 Name des fehlerhaften Moduls: Uplay.exe, Version: 4.6.1.3217, Zeitstempel: 0x53b41990 Ausnahmecode: 0xc0000417 Fehleroffset: 0x01194140 ID des fehlerhaften Prozesses: 0x180c Startzeit der fehlerhaften Anwendung: 0xUplay.exe0 Pfad der fehlerhaften Anwendung: Uplay.exe1 Pfad des fehlerhaften Moduls: Uplay.exe2 Berichtskennung: Uplay.exe3 Error: (07/11/2015 10:36:46 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: Uplay.exe, Version: 4.6.1.3217, Zeitstempel: 0x53b41990 Name des fehlerhaften Moduls: Uplay.exe, Version: 4.6.1.3217, Zeitstempel: 0x53b41990 Ausnahmecode: 0xc0000417 Fehleroffset: 0x01194140 ID des fehlerhaften Prozesses: 0x19d4 Startzeit der fehlerhaften Anwendung: 0xUplay.exe0 Pfad der fehlerhaften Anwendung: Uplay.exe1 Pfad des fehlerhaften Moduls: Uplay.exe2 Berichtskennung: Uplay.exe3 Error: (07/11/2015 10:35:54 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: Uplay.exe, Version: 4.6.1.3217, Zeitstempel: 0x53b41990 Name des fehlerhaften Moduls: Uplay.exe, Version: 4.6.1.3217, Zeitstempel: 0x53b41990 Ausnahmecode: 0xc0000417 Fehleroffset: 0x01194140 ID des fehlerhaften Prozesses: 0x1028 Startzeit der fehlerhaften Anwendung: 0xUplay.exe0 Pfad der fehlerhaften Anwendung: Uplay.exe1 Pfad des fehlerhaften Moduls: Uplay.exe2 Berichtskennung: Uplay.exe3 Error: (07/10/2015 09:39:07 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: ) Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008] Error: (07/10/2015 01:05:06 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: ) Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008] Error: (07/09/2015 06:35:20 PM) (Source: SideBySide) (EventID: 80) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest. Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest. Error: (07/05/2015 04:16:17 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Programm Origin.exe, Version 9.6.1.5336 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: ce4 Startzeit: 01d0b6fe9d253815 Endzeit: 0 Anwendungspfad: C:\Program Files (x86)\Origin\Origin.exe Berichts-ID: Error: (07/01/2015 06:43:31 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: ) Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008] System errors: ============= Error: (07/14/2015 09:48:13 AM) (Source: EventLog) (EventID: 6008) (User: ) Description: Das System wurde zuvor am 14.07.2015 um 09:46:39 unerwartet heruntergefahren. Error: (07/13/2015 04:32:57 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (07/13/2015 04:32:57 PM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Scanner Service erreicht. Error: (07/13/2015 12:44:19 PM) (Source: Service Control Manager) (EventID: 7022) (User: ) Description: Der Dienst "Windows Update" wurde nicht richtig gestartet. Error: (07/12/2015 02:15:12 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (07/12/2015 02:15:12 PM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Scanner Service erreicht. Error: (07/12/2015 10:24:23 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (07/12/2015 10:24:23 AM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Scanner Service erreicht. Error: (07/12/2015 02:20:29 AM) (Source: DCOM) (EventID: 10010) (User: ) Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF} Error: (07/11/2015 01:38:49 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Microsoft Office: ========================= Error: (07/13/2015 12:29:43 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: ) Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008] Error: (07/12/2015 01:48:07 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: ) Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008] Error: (07/11/2015 10:37:00 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Uplay.exe4.6.1.321753b41990Uplay.exe4.6.1.321753b41990c000041701194140180c01d0bc195450a5caC:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exeC:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exe9406d396-280c-11e5-b5d7-1c6f6581e1a7 Error: (07/11/2015 10:36:46 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Uplay.exe4.6.1.321753b41990Uplay.exe4.6.1.321753b41990c00004170119414019d401d0bc194bbc04f0C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exeC:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exe8b86f38a-280c-11e5-b5d7-1c6f6581e1a7 Error: (07/11/2015 10:35:54 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Uplay.exe4.6.1.321753b41990Uplay.exe4.6.1.321753b41990c000041701194140102801d0bc1923efe7f2C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exeC:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exe6d007a7e-280c-11e5-b5d7-1c6f6581e1a7 Error: (07/10/2015 09:39:07 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: ) Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008] Error: (07/10/2015 01:05:06 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: ) Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008] Error: (07/09/2015 06:35:20 PM) (Source: SideBySide) (EventID: 80) (User: ) Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifestC:\Users\Erik\Downloads\SoftonicDownloader_fuer_visualboyadvance.exe Error: (07/05/2015 04:16:17 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Origin.exe9.6.1.5336ce401d0b6fe9d2538150C:\Program Files (x86)\Origin\Origin.exe Error: (07/01/2015 06:43:31 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: ) Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008] ==================== Memory info =========================== Processor: AMD Phenom(tm) II X4 965 Processor Percentage of memory in use: 50% Total physical RAM: 4092.54 MB Available physical RAM: 2037.86 MB Total Virtual: 8183.28 MB Available Virtual: 5188.79 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:465.66 GB) (Free:89.45 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: B1AEEADF) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=465.7 GB) - (Type=07 NTFS) ==================== End of log ============================ --- --- --- Gmer.txt GMER Logfile: Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2015-07-15 13:22:08 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000006b WDC_WD50 rev.05.0 465,76GB Running: Gmer-19357.exe; Driver: C:\Users\Erik\AppData\Local\Temp\kxldapoc.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075cf1401 2 bytes JMP 7645b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075cf1419 2 bytes JMP 7645b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075cf1431 2 bytes JMP 764d8f29 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075cf144a 2 bytes CALL 7643489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075cf14dd 2 bytes JMP 764d8822 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075cf14f5 2 bytes JMP 764d89f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075cf150d 2 bytes JMP 764d8718 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075cf1525 2 bytes JMP 764d8ae2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075cf153d 2 bytes JMP 7644fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075cf1555 2 bytes JMP 764568ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075cf156d 2 bytes JMP 764d8fe3 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075cf1585 2 bytes JMP 764d8b42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075cf159d 2 bytes JMP 764d86dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075cf15b5 2 bytes JMP 7644fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075cf15cd 2 bytes JMP 7645b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075cf16b2 2 bytes JMP 764d8ea4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075cf16bd 2 bytes JMP 764d8671 C:\Windows\syswow64\kernel32.dll ---- EOF - GMER 2.1 ---- Geändert von Filbsmo (15.07.2015 um 12:54 Uhr) |
Themen zu Häufig Lags, Leistungseinbrüche/Freeze, Blaue DRVSTORE Datei in system32. |
.dll, adware, antivir, antivirus, avira, bonjour, browser, defender, desktop, drvstore, error, explorer, firefox, firefox 39.0, flash player, freezes, leistungseinbruch, mozilla, programm, realtek, registry, rundll, security, services.exe, software, svchost.exe, system, tracker, udp, winlogon.exe |