| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Häufig Lags, Leistungseinbrüche/Freeze, Blaue DRVSTORE Datei in system32.Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
15.07.2015, 12:45
| #1 |
| |  Häufig Lags, Leistungseinbrüche/Freeze, Blaue DRVSTORE Datei in system32. Ich habe seit längerem Probleme mit meinem Rechner, seit neuestem habe ich allerdings mit Leistungseinbrüchen und Freezes, sowie anderen Macken zu kämpfen. So sind einige Prozesse wie rundll32 doppelt am Laufen. Selten habe ich einen BluesreenO.D. Ich habe ebenfalls eine blaue DRVSTORE Datei in meinem system32 Ordner. Antivir und Spybotscans blieben fundlos. Ich würde mich sehr freuen wenn mir jemand hilft. Hier die FRST.txt; Addition.txt; und Gmer.txt. Desweiteren hab ich eine Datei in Quarantäne: Typ: Datei Quelle: C:\Users\Erik\Downloads\pcmechanicpm.exe Status: Infiziert Quarantäne-Objekt: 53e6fac1.qua Wiederhergestellt: NEIN Zu Avira hochgeladen: NEIN Betriebssystem: Windows XP/VISTA Workstation/Windows 7 Suchengine: 8.03.30.40 Virendefinitionsdatei: 8.11.236.118 Gefunden: PUA/SpeedUpMyPC Datum/Uhrzeit: 01.06.2015, 15 FRST.txt: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:13-07-2015
Ran by Erik (administrator) on ERIK-PC on 15-07-2015 12:53:12
Running from C:\Users\Erik\Downloads
Loaded Profiles: Erik (Available Profiles: Erik & Ronja & Gast)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11545192 2010-11-15] (Realtek Semiconductor)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-02-13] (Apple Inc.)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-02-05] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-02-13] (Apple Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [730416 2015-06-09] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe [134368 2015-06-02] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-4148174342-3149974382-3542746328-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2892992 2015-06-04] (Valve Corporation)
HKU\S-1-5-21-4148174342-3149974382-3542746328-1000\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3632112 2015-06-29] (Electronic Arts)
HKU\S-1-5-21-4148174342-3149974382-3542746328-1000\...\Run: [Wisdom-soft ScreenHunter 5.1 Free] => 0
HKU\S-1-5-21-4148174342-3149974382-3542746328-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [53288576 2015-06-29] (Skype Technologies S.A.)
HKU\S-1-5-21-4148174342-3149974382-3542746328-1000\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [4566952 2014-06-24] (Safer-Networking Ltd.)
HKU\S-1-5-21-4148174342-3149974382-3542746328-1000\...\Run: [WTFast Tray] => C:\Program Files (x86)\WTFast\WTFast.exe [4711000 2015-06-02] (AAA Internet Publishing, Inc.)
HKU\S-1-5-21-4148174342-3149974382-3542746328-1000\...\Run: [Dropbox Update] => C:\Users\Erik\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-17] (Dropbox, Inc.)
HKU\S-1-5-21-4148174342-3149974382-3542746328-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Mystify.scr [242688 2010-11-20] (Microsoft Corporation)
Startup: C:\Users\Erik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-05-11]
ShortcutTarget: Dropbox.lnk -> C:\Users\Erik\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe
GroupPolicyScripts: Group Policy detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-4148174342-3149974382-3542746328-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKU\S-1-5-21-4148174342-3149974382-3542746328-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000 -> {4ECF8847-2EFA-4EAB-9EAB-0E966C321B2C} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms}
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> c:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> c:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
DPF: HKLM-x32 {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: abs - {E00957BD-D0E1-4eb9-A025-7743FDC8B27B} - C:\Windows\SysWOW64\mscoree.dll [2010-11-05] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Winsock: Catalog9 01 C:\Windows\SysWOW64\WTFastDrv.dll [72296 2015-06-01] (Initex)
Winsock: Catalog9 02 C:\Windows\SysWOW64\WTFastDrv.dll [72296 2015-06-01] (Initex)
Winsock: Catalog9 03 C:\Windows\SysWOW64\WTFastDrv.dll [72296 2015-06-01] (Initex)
Winsock: Catalog9 04 C:\Windows\SysWOW64\WTFastDrv.dll [72296 2015-06-01] (Initex)
Winsock: Catalog9 15 C:\Windows\SysWOW64\WTFastDrv.dll [72296 2015-06-01] (Initex)
Winsock: Catalog9-x64 01 C:\Windows\system32\WTFastDrv.dll [79464 2015-06-01] (Initex)
Winsock: Catalog9-x64 02 C:\Windows\system32\WTFastDrv.dll [79464 2015-06-01] (Initex)
Winsock: Catalog9-x64 03 C:\Windows\system32\WTFastDrv.dll [79464 2015-06-01] (Initex)
Winsock: Catalog9-x64 04 C:\Windows\system32\WTFastDrv.dll [79464 2015-06-01] (Initex)
Winsock: Catalog9-x64 15 C:\Windows\system32\WTFastDrv.dll [79464 2015-06-01] (Initex)
Tcpip\Parameters: [DhcpNameServer] 8.8.8.8
Tcpip\..\Interfaces\{28191E3A-C084-45C8-8C51-4D5001894677}: [NameServer] 192.168.111.1,62.72.64.241
Tcpip\..\Interfaces\{28191E3A-C084-45C8-8C51-4D5001894677}: [DhcpNameServer] 192.168.111.1
Tcpip\..\Interfaces\{BDCE9B38-96F3-4F5C-B5A6-76A1316B6617}: [DhcpNameServer] 8.8.8.8
FireFox:
========
FF ProfilePath: C:\Users\Erik\AppData\Roaming\Mozilla\Firefox\Profiles\bax1xnjs.default
FF Keyword.URL: hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=937811&p=
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_209.dll [2015-07-14] ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2014-10-28] (Tracker Software Products (Canada) Ltd.)
FF Plugin: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelogx64.dll [2015-01-13] (EA Digital Illusions CE AB)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_209.dll [2015-07-14] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2014-10-28] (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelog.dll [2015-01-13] (EA Digital Illusions CE AB)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-12-05] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-12-05] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No File
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-03-04] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-03-04] (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [2013-03-18] (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2012-09-23] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-4148174342-3149974382-3542746328-1000: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2014-10-28] (Tracker Software Products (Canada) Ltd.)
FF Plugin HKU\S-1-5-21-4148174342-3149974382-3542746328-1000: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [2013-03-18] (Pando Networks)
FF Plugin HKU\S-1-5-21-4148174342-3149974382-3542746328-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2014-07-24] ()
FF user.js: detected! => C:\Users\Erik\AppData\Roaming\Mozilla\Firefox\Profiles\bax1xnjs.default\user.js [2011-06-22]
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2012-09-23] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Erik\AppData\Roaming\Mozilla\Firefox\Profiles\bax1xnjs.default\searchplugins\leaguepedia--league-of-legends-wiki-en.xml [2015-02-27]
FF Extension: Avira Browser Safety - C:\Users\Erik\AppData\Roaming\Mozilla\Firefox\Profiles\bax1xnjs.default\Extensions\abs@avira.com [2015-07-03]
FF Extension: NoScript - C:\Users\Erik\AppData\Roaming\Mozilla\Firefox\Profiles\bax1xnjs.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-01-07]
FF Extension: Adblock Plus - C:\Users\Erik\AppData\Roaming\Mozilla\Firefox\Profiles\bax1xnjs.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-05-15]
Chrome:
=======
CHR Profile: C:\Users\Erik\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Erik\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-11-18]
CHR Extension: (Google Drive) - C:\Users\Erik\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-11-18]
CHR Extension: (YouTube) - C:\Users\Erik\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-11-18]
CHR Extension: (Google Search) - C:\Users\Erik\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-11-18]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Erik\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-17]
CHR Extension: (Google Wallet) - C:\Users\Erik\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-18]
CHR Extension: (Gmail) - C:\Users\Erik\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-11-18]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [827184 2015-06-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [450808 2015-06-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [450808 2015-06-09] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1188360 2015-06-09] (Avira Operations GmbH & Co. KG)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [217280 2015-06-02] (Avira Operations GmbH & Co. KG)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-02-05] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16941856 2014-02-05] (NVIDIA Corporation)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2004488 2015-06-29] (Electronic Arts)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2014-06-01] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2010-12-24] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [153256 2015-06-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132656 2015-06-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2015-03-17] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-17] (Avira Operations GmbH & Co. KG)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2010-12-24] ()
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [28416 2008-04-16] (Research In Motion Limited)
S3 cpuz136; \??\C:\Program Files (x86)\CPUID\PC Wizard 2013\pcwiz_x64.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-15 12:51 - 2015-07-15 12:53 - 00065175 _____ C:\Users\Erik\Downloads\Addition.txt
2015-07-15 12:48 - 2015-07-15 12:53 - 00019751 _____ C:\Users\Erik\Downloads\FRST.txt
2015-07-15 12:47 - 2015-07-15 12:53 - 00000000 ____D C:\FRST
2015-07-15 12:46 - 2015-07-15 12:47 - 02133504 _____ (Farbar) C:\Users\Erik\Downloads\FRST64.exe
2015-07-15 12:45 - 2015-07-15 12:45 - 00000470 _____ C:\Users\Erik\Downloads\defogger_disable.log
2015-07-15 12:45 - 2015-07-15 12:45 - 00000000 _____ C:\Users\Erik\defogger_reenable
2015-07-15 12:44 - 2015-07-15 12:44 - 00050477 _____ C:\Users\Erik\Downloads\Defogger.exe
2015-07-10 19:19 - 2015-07-10 19:19 - 00000000 ____D C:\Users\Erik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-07-09 18:38 - 2012-07-30 01:28 - 00002940 _____ C:\Users\Erik\Downloads\PMD 2 - Top Menu Theme.mid
2015-07-06 15:19 - 2015-07-07 15:03 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-06-28 17:02 - 2015-06-28 17:02 - 00000000 ____D C:\Program Files (x86)\NAMCO BANDAI Games
2015-06-28 16:57 - 2015-06-28 16:57 - 00001338 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live ID.lnk
2015-06-28 16:54 - 2015-06-28 16:56 - 00018435 _____ C:\Windows\DirectX.log
2015-06-22 19:42 - 2015-06-22 19:42 - 00000000 ____D C:\Users\Erik\AppData\Local\NVIDIA Corporation
2015-06-22 19:31 - 2015-06-22 19:44 - 00000000 ____D C:\Users\Erik\AppData\Local\NVIDIA
2015-06-22 19:31 - 2015-06-22 19:31 - 00000000 ____D C:\Program Files (x86)\AGEIA Technologies
2015-06-22 19:31 - 2014-02-05 11:31 - 01048152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2015-06-22 19:31 - 2014-02-05 11:30 - 01179576 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2015-06-22 19:29 - 2014-03-04 13:32 - 00599840 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2015-06-22 19:25 - 2014-03-04 16:35 - 31474976 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2015-06-22 19:25 - 2014-03-04 16:35 - 25255256 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2015-06-22 19:25 - 2014-03-04 16:35 - 23716640 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2015-06-22 19:25 - 2014-03-04 16:35 - 17755424 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2015-06-22 19:25 - 2014-03-04 16:35 - 17561544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2015-06-22 19:25 - 2014-03-04 16:35 - 12708128 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2015-06-22 19:25 - 2014-03-04 16:35 - 11636176 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2015-06-22 19:25 - 2014-03-04 16:35 - 11589272 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2015-06-22 19:25 - 2014-03-04 16:35 - 09728064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2015-06-22 19:25 - 2014-03-04 16:35 - 09690424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2015-06-22 19:25 - 2014-03-04 16:35 - 03143456 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2015-06-22 19:25 - 2014-03-04 16:35 - 02958792 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2015-06-22 19:25 - 2014-03-04 16:35 - 02783008 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
2015-06-22 19:25 - 2014-03-04 16:35 - 02411976 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2015-06-22 19:25 - 2014-03-04 16:35 - 01885472 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433523.dll
2015-06-22 19:25 - 2014-03-04 16:35 - 01516488 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433523.dll
2015-06-22 19:25 - 2014-03-04 16:35 - 00892704 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2015-06-22 19:25 - 2014-03-04 16:35 - 00877856 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2015-06-22 19:25 - 2014-03-04 16:35 - 00863064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2015-06-22 19:25 - 2014-03-04 16:35 - 00846168 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2015-06-22 19:25 - 2014-03-04 16:35 - 00832936 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2015-06-22 19:25 - 2014-03-04 16:35 - 00353504 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2015-06-22 19:25 - 2014-03-04 16:35 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2015-06-22 19:25 - 2014-03-04 16:35 - 00174296 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2015-06-22 19:25 - 2014-03-04 16:35 - 00148016 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2015-06-22 19:25 - 2013-12-27 20:42 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2015-06-22 19:25 - 2013-12-27 20:42 - 00035104 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2015-06-22 19:25 - 2013-12-27 20:42 - 00033056 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2015-06-22 19:25 - 2013-11-28 15:38 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2015-06-22 19:25 - 2013-11-28 15:38 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2015-06-22 19:25 - 2013-11-22 10:36 - 01515296 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll
2015-06-22 19:20 - 2015-06-22 19:22 - 276762432 _____ (NVIDIA Corporation) C:\Users\Erik\Downloads\335.23-desktop-win8-win7-winvista-64bit-international-whql.exe
2015-06-22 19:12 - 2015-06-22 19:12 - 00000000 ____D C:\Users\Erik\AppData\Roaming\FiraxisLive
2015-06-17 12:12 - 2015-07-15 12:18 - 00001220 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-4148174342-3149974382-3542746328-1000UA.job
2015-06-17 12:12 - 2015-07-15 12:17 - 00001168 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-4148174342-3149974382-3542746328-1000Core.job
2015-06-17 12:12 - 2015-06-17 12:12 - 00004188 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-4148174342-3149974382-3542746328-1000UA
2015-06-17 12:12 - 2015-06-17 12:12 - 00003792 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-4148174342-3149974382-3542746328-1000Core
2015-06-17 12:12 - 2015-06-17 12:12 - 00000000 ____D C:\Users\Erik\AppData\Local\Dropbox
2015-06-17 12:12 - 2015-06-17 12:12 - 00000000 ____D C:\ProgramData\Dropbox
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-15 12:45 - 2010-12-23 14:24 - 00000000 ____D C:\Users\Erik
2015-07-15 12:44 - 2010-12-23 14:24 - 01984127 _____ C:\Windows\WindowsUpdate.log
2015-07-15 12:36 - 2009-07-14 06:45 - 00026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-07-15 12:36 - 2009-07-14 06:45 - 00026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-07-15 12:33 - 2011-02-23 00:11 - 00000000 ____D C:\Users\Erik\AppData\Roaming\Skype
2015-07-15 12:19 - 2015-02-22 17:33 - 00000000 ___RD C:\Users\Erik\Dropbox
2015-07-15 12:18 - 2015-02-22 17:30 - 00000000 ____D C:\Users\Erik\AppData\Roaming\Dropbox
2015-07-15 12:17 - 2012-09-18 17:11 - 00000000 ____D C:\ProgramData\Origin
2015-07-15 12:16 - 2011-05-19 22:54 - 00000000 ____D C:\Program Files (x86)\Steam
2015-07-15 12:15 - 2015-03-29 13:24 - 00020980 _____ C:\Windows\setupact.log
2015-07-15 12:15 - 2011-10-01 16:13 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-07-15 12:15 - 2010-12-09 11:54 - 00000000 ____D C:\ProgramData\NVIDIA
2015-07-15 12:15 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-15 01:09 - 2012-04-10 13:26 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-07-15 01:09 - 2011-10-01 16:13 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-07-14 23:52 - 2011-06-13 16:51 - 00000000 ____D C:\Users\Erik\AppData\Roaming\TS3Client
2015-07-14 23:09 - 2012-04-10 13:26 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-07-14 23:09 - 2012-04-10 13:26 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-07-14 23:09 - 2011-06-10 18:01 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-07-14 22:12 - 2013-11-18 20:03 - 00002175 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-07-14 13:07 - 2011-05-06 23:30 - 00000000 ____D C:\Users\Erik\AppData\Roaming\SoftGrid Client
2015-07-13 12:41 - 2011-02-23 00:11 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-07-13 12:41 - 2011-02-23 00:11 - 00000000 ____D C:\ProgramData\Skype
2015-07-07 15:03 - 2015-04-02 00:32 - 00171176 _____ C:\Windows\PFRO.log
2015-07-07 15:03 - 2012-05-23 08:59 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-07-06 14:21 - 2015-06-11 12:18 - 00001120 _____ C:\Users\Public\Desktop\Avira.lnk
2015-07-06 14:21 - 2015-03-28 23:42 - 00000000 ____D C:\Program Files (x86)\Avira
2015-07-06 14:21 - 2014-06-24 12:33 - 00000000 ____D C:\ProgramData\Package Cache
2015-07-06 14:21 - 2012-11-15 14:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-07-05 13:24 - 2014-12-05 02:50 - 00000000 ____D C:\Users\Erik\AppData\Roaming\.minecraft
2015-07-05 10:44 - 2012-09-30 19:20 - 00000000 ____D C:\Users\Erik\Desktop\Andere Spiele
2015-07-02 17:01 - 2013-03-18 19:42 - 00000000 ____D C:\Users\Erik\AppData\Local\PMB Files
2015-06-30 16:24 - 2013-03-18 19:42 - 00000000 ____D C:\ProgramData\PMB Files
2015-06-29 20:15 - 2012-09-18 17:10 - 00000000 ____D C:\Program Files (x86)\Origin
2015-06-28 17:06 - 2009-07-14 07:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-06-28 16:57 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2015-06-23 13:30 - 2010-12-25 17:50 - 00300704 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-06-22 19:42 - 2010-12-09 11:54 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2015-06-22 19:31 - 2012-11-19 12:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-06-22 19:31 - 2010-12-09 11:54 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2015-06-22 19:31 - 2010-12-09 11:53 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2015-06-22 19:19 - 2015-03-29 20:27 - 00001354 _____ C:\Users\Erik\Desktop\CoreTemp.ini
2015-06-22 19:12 - 2012-06-22 15:01 - 00000000 ____D C:\Users\Erik\AppData\Local\My Games
2015-06-22 19:12 - 2011-01-03 18:07 - 00000000 ____D C:\Users\Erik\Documents\My Games
2015-06-17 15:51 - 2009-07-14 07:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2015-06-17 11:50 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-06-16 00:33 - 2009-07-14 19:58 - 00712848 _____ C:\Windows\system32\perfh007.dat
2015-06-16 00:33 - 2009-07-14 19:58 - 00155680 _____ C:\Windows\system32\perfc007.dat
2015-06-16 00:33 - 2009-07-14 07:13 - 01653366 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-15 08:03 - 2014-09-10 12:13 - 00000000 ____D C:\Users\Erik\AppData\Local\Adobe
==================== Files in the root of some directories =======
2013-12-03 13:09 - 2013-12-03 13:09 - 49940480 _____ () C:\Program Files (x86)\GUTA776.tmp
2013-06-03 21:55 - 2013-06-03 21:55 - 0001181 _____ () C:\Users\Erik\AppData\Roaming\trace_FilterInstaller.1.txt
2013-06-03 21:55 - 2015-03-29 03:10 - 0000919 _____ () C:\Users\Erik\AppData\Roaming\trace_FilterInstaller.txt
2013-06-03 21:55 - 2015-03-29 03:10 - 0000000 _____ () C:\Users\Erik\AppData\Roaming\trace_FilterInstaller.txt-CRT.txt
2013-04-24 23:35 - 2013-04-24 23:35 - 0003584 _____ () C:\Users\Erik\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-03-24 16:39 - 2012-03-24 16:39 - 0000092 _____ () C:\Users\Erik\AppData\Local\fusioncache.dat
2014-07-15 20:52 - 2014-07-15 20:52 - 0000000 _____ () C:\Users\Erik\AppData\Local\{25B8D08D-2530-45CC-8EC2-12E99D23E482}
2011-02-23 00:12 - 2011-02-23 00:12 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2012-05-03 19:45 - 2012-05-15 13:32 - 0001631 _____ () C:\ProgramData\flcd_proxy.log
Files to move or delete:
====================
C:\Users\Erik\createfileassoc.exe
C:\Users\Erik\error_report.exe
C:\Users\Erik\libeay32.dll
C:\Users\Erik\msvcp110.dll
C:\Users\Erik\msvcr110.dll
C:\Users\Erik\OverwolfTeamSpeakInstaller.exe
C:\Users\Erik\package_inst.exe
C:\Users\Erik\Qt5Core.dll
C:\Users\Erik\Qt5Gui.dll
C:\Users\Erik\Qt5Network.dll
C:\Users\Erik\Qt5Sql.dll
C:\Users\Erik\Qt5Widgets.dll
C:\Users\Erik\quazip.dll
C:\Users\Erik\ssleay32.dll
C:\Users\Erik\ts3client_win64.exe
C:\Users\Erik\Uninstall.exe
C:\Users\Erik\update.exe
Some files in TEMP:
====================
C:\Users\Erik\AppData\Local\Temp\avgnt.exe
C:\Users\Erik\AppData\Local\Temp\drm_dialogs.dll
C:\Users\Erik\AppData\Local\Temp\drm_dyndata_7330014.dll
C:\Users\Erik\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpqx8szd.dll
C:\Users\Erik\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\Erik\AppData\Local\Temp\nvSCPAPISvr.exe
C:\Users\Erik\AppData\Local\Temp\nvStInst.exe
C:\Users\Erik\AppData\Local\Temp\tmp77AE.exe
C:\Users\Gast\AppData\Local\Temp\AskSLib.dll
C:\Users\Ronja\AppData\Local\Temp\AskSLib.dll
C:\Users\Ronja\AppData\Local\Temp\avgnt.exe
C:\Users\Ronja\AppData\Local\Temp\drm_dialogs.dll
C:\Users\Ronja\AppData\Local\Temp\drm_dyndata_7380012.dll
C:\Users\Ronja\AppData\Local\Temp\firefoxjre_exe-1.exe
C:\Users\Ronja\AppData\Local\Temp\firefoxjre_exe-2.exe
C:\Users\Ronja\AppData\Local\Temp\firefoxjre_exe.exe
C:\Users\Ronja\AppData\Local\Temp\ytb.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-07-04 19:34
==================== End of log ============================
Addition.txtFRST Additions Logfile: [CODE]Additional FRST Logfile: Code:
ATTFilter scan result of Farbar Recovery Scan Tool (x64) Version:13-07-2015
Ran by Erik at 2015-07-15 12:53:34
Running from C:\Users\Erik\Downloads
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-4148174342-3149974382-3542746328-500 - Administrator - Disabled)
ASPNET (S-1-5-21-4148174342-3149974382-3542746328-1005 - Limited - Enabled)
Erik (S-1-5-21-4148174342-3149974382-3542746328-1000 - Administrator - Enabled) => C:\Users\Erik
Gast (S-1-5-21-4148174342-3149974382-3542746328-501 - Limited - Enabled) => C:\Users\Gast
HomeGroupUser$ (S-1-5-21-4148174342-3149974382-3542746328-1002 - Limited - Enabled)
Ronja (S-1-5-21-4148174342-3149974382-3542746328-1003 - Administrator - Enabled) => C:\Users\Ronja
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
ACD/Labs Freeware in C:\ACD2012FREE\ (HKLM-x32\...\ACDLabs in C__ACD2012FREE_) (Version: v14.00, FREE - ACD/Labs)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.2.0.2070 - Adobe Systems Incorporated)
Adobe Flash Player 18 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 18.0.0.209 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.209 - Adobe Systems Incorporated)
Adobe Reader XI - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.00 - Adobe Systems Incorporated)
Age of Wonders III (HKLM-x32\...\Steam App 226840) (Version: - Triumph Studios)
Age of Wonders: Trilogy Soundtrack (HKLM-x32\...\Steam App 61530) (Version: - )
Anno 1404 (HKLM-x32\...\Steam App 33250) (Version: - Blue Byte)
Anno 1404: Venice (HKLM-x32\...\Steam App 33350) (Version: - Blue Byte)
Apple Application Support (32-Bit) (HKLM-x32\...\{447CDCE5-F555-429B-BFA6-642C3C6D684F}) (Version: 3.1.2 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{0DF7096B-715A-4233-8633-C7A16ED6D616}) (Version: 3.1.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Assassin's Creed (HKLM-x32\...\{8CFA9151-6404-409A-AF22-4632D04582FD}) (Version: 1.02 - Ubisoft)
Assassin's Creed Brotherhood (HKLM-x32\...\{BE4BA698-8533-4F77-9559-C7F3F78C0B05}) (Version: 1.03 - Ubisoft)
Assassin's Creed II (HKLM-x32\...\{8570BEE8-0CA3-4977-9AB1-80ED93F0513C}) (Version: 1.01 - Ubisoft)
Assassin's Creed Revelations 1.03 (HKLM-x32\...\{33A22B2D-55BA-4508-B767-BF2E9C21A73F}) (Version: 1.03 - Ubisoft)
ATI Catalyst Install Manager (HKLM\...\{33F02C0A-5C0E-B3AF-EB9F-831B6E42D732}) (Version: 3.0.795.0 - ATI Technologies, Inc.)
Avira (HKLM-x32\...\{8467e01f-0496-42ce-b247-88ef205b4880}) (Version: 1.1.40.29239 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.40.29239 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.11.579 - Avira Operations GmbH & Co. KG)
Avira Browser Safety (HKLM-x32\...\{9E10EA90-5E97-43B7-A246-FC7B4F5E9493}) (Version: 1.4.5.509 - Avira Operations GmbH & Co KG)
Bastion (HKLM-x32\...\Steam App 107100) (Version: - Supergiant Games)
Battle Realms Complete (German) (HKLM-x32\...\GOGPACKBATTLEREALMS_is1) (Version: 2.0.0.9 - GOG.com)
Battlefield 3™ (HKLM-x32\...\{76285C16-411A-488A-BCE3-C83CB933D8CF}) (Version: 1.6.0.0 - Electronic Arts)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Borderlands (HKLM-x32\...\Steam App 8980) (Version: - Gearbox Software)
CCleaner (HKLM\...\CCleaner) (Version: 5.04 - Piriform)
Dark Souls Prepare to Die Edition (HKLM-x32\...\GFWL_{4E4D0FA1-F880-4CCB-999A-501000008200}) (Version: 1.0.0000.130 - NAMCO BANDAI Games Europe S.A.S.)
Dark Souls Prepare to Die Edition (x32 Version: 1.0.0000.130 - NAMCO BANDAI Games Europe S.A.S.) Hidden
Drakensang - Am Fluss der Zeit (HKLM-x32\...\Drakensang_TRoT_is1) (Version: - dtp)
Drakensang (HKLM-x32\...\Drakensang_is1) (Version: - dtp)
Dropbox (HKU\S-1-5-21-4148174342-3149974382-3542746328-1000\...\Dropbox) (Version: 3.6.8 - Dropbox, Inc.)
Fallout: New Vegas (HKLM-x32\...\Steam App 22380) (Version: - Obsidian Entertainment)
FTL: Faster Than Light (HKLM-x32\...\Steam App 212680) (Version: - Subset Games)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.134 - Google Inc.)
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
Gothic (HKLM-x32\...\{BBF10B37-4ED3-11D5-A818-00500435FC18}) (Version: - )
Heroes of Might & Magic V: Hammers of Fate (HKLM-x32\...\{66FF4C48-0083-4E60-8556-B883AB200091}) (Version: - )
Heroes of Might and Magic V - Tribes of the East (HKLM-x32\...\{66FF4C48-0083-4E60-8556-B883AB200092}) (Version: - )
Heroes of Might and Magic V (HKLM-x32\...\{20071984-5EB1-4881-8EDB-082532ACEC6D}) (Version: - )
iTunes (HKLM\...\{D227565A-0033-40AD-89BA-653A205CDC11}) (Version: 12.1.1.4 - Apple Inc.)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Magicka (HKLM-x32\...\Steam App 42910) (Version: - Arrowhead Game Studios)
Mass Effect (HKLM-x32\...\{1B0FBB9A-995D-47cd-87CD-13E68B676E4F}) (Version: 1.00 - Electronic Arts, Inc.)
Mass Effect 2 (HKLM-x32\...\{75D84EF7-0D8C-4e70-B3FA-7B42A5D4E0EB}) (Version: 1.00 - Electronic Arts, Inc.)
Mass Effect™ 3 (HKLM-x32\...\{534A31BD-20F4-46b0-85CE-09778379663C}) (Version: 1.04.0.0 - Electronic Arts)
Microsoft .NET Framework 1.1 (HKLM-x32\...\Microsoft .NET Framework 1.1 (1033)) (Version: - )
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{F2508213-9989-4E85-A078-72BE483917EF}) (Version: 3.5.88.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Microsoft XNA Framework Redistributable 3.1 (HKLM-x32\...\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation)
Mozilla Firefox 39.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 39.0 (x86 de)) (Version: 39.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML4 Parser (HKLM-x32\...\{01501EBA-EC35-4F9F-8889-3BE346E5DA13}) (Version: 1.0.0 - Microsoft Game Studios)
NVIDIA 3D Vision Controller-Treiber 335.21 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 335.21 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 335.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 335.23 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.2.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.2.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 335.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 335.23 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA Virtual Audio 1.2.20 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.20 - NVIDIA Corporation)
Oblivion (HKLM-x32\...\{35CB6715-41F8-4F99-8881-6FC75BF054B0}) (Version: 1.00.0000 - Bethesda Softworks)
OpenOffice.org 3.2 (HKLM-x32\...\{8D1E61D1-1395-4E97-997F-D002DB3A5074}) (Version: 3.2.9502 - OpenOffice.org)
Origin (HKLM-x32\...\Origin) (Version: 9.0.11.77 - Electronic Arts, Inc.)
PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.311.0 - Tracker Software Products Ltd)
ProtectDisc Driver, Version 11 (HKLM-x32\...\ProtectDisc Driver 11) (Version: 11.0.0.12 - ProtectDisc Software GmbH)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.991 - Even Balance, Inc.)
Realtek Ethernet Controller Driver For Windows 7 (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.17.304.2010 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6235 - Realtek Semiconductor Corp.)
Risen (HKLM-x32\...\{155F4A0E-76ED-45A2-91FB-FF2A2133C31A}) (Version: 1.00.0000 - Deep Silver)
Risk of Rain (HKLM-x32\...\Steam App 248820) (Version: - )
scilab-5.5.2 (64-bit) (HKLM\...\scilab-5.5.2 (64-bit)_is1) (Version: - Scilab Enterprises)
SHIELD Streaming (Version: 1.7.321 - NVIDIA Corporation) Hidden
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version: - 2K Games, Inc.)
Sid Meier's Civilization: Beyond Earth (HKLM-x32\...\Steam App 65980) (Version: - Firaxis Games)
Skype™ 7.6 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.6.105 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
Star Wars: The Force Unleashed (HKLM-x32\...\Star Wars: The Force Unleashed_is1) (Version: 1.0 - Activision)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
TeamSpeak 3 Client (HKU\S-1-5-21-4148174342-3149974382-3542746328-1000\...\TeamSpeak 3 Client) (Version: 3.0.15 - TeamSpeak Systems GmbH)
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version: - Bethesda Game Studios)
The Witcher 2: Assassins of Kings Enhanced Edition (HKLM-x32\...\Steam App 20920) (Version: - CD Projekt RED)
The Witcher Enhanced Edition Version 1.6 (HKLM-x32\...\The Witcher Enhanced Edition_is1) (Version: 1.6 - CD Projekt RED)
Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VLC media player 2.1.0-pre1 (HKLM\...\VLC media player) (Version: 2.1.0-pre1 - VideoLAN)
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
WinRAR 4.00 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.00.0 - win.rar GmbH)
WTFast 3.5 (HKLM-x32\...\{12B4121D-5221-4AFC-9EDC-63B0CA139856}_is1) (Version: 3.5.6.464 - Initex & AAA Internet Publishing)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Erik\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{087B3AE3-E237-4467-B8DB-5A38AB959AC9}\InprocServer32 -> C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl_x64.dll (OpenOffice.org)
CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{3B092F0C-7696-40E3-A80F-68D74DA84210}\InprocServer32 -> C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl_x64.dll (OpenOffice.org)
CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{63542C48-9552-494A-84F7-73AA6A7C99C1}\InprocServer32 -> C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl_x64.dll (OpenOffice.org)
CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{67F2A879-82D5-4A6D-8CC5-FFB3C114B69D}\InprocServer32 -> C:\Program Files (x86)\OpenOffice.org 3\program\so_activex_x64.dll ()
CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{7BC0E710-5703-45BE-A29D-5D46D8B39262}\InprocServer32 -> C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\ooofiltproxy_x64.dll (OpenOffice.org)
CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\InprocServer32 -> C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl_x64.dll (OpenOffice.org)
CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4148174342-3149974382-3542746328-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Erik\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
==================== Restore Points =========================
28-06-2015 16:52:29 DirectX wurde installiert
30-06-2015 14:58:56 Windows Update
07-07-2015 08:51:31 Windows Update
10-07-2015 13:36:16 Windows Update
14-07-2015 09:36:02 Windows Update
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {0477ED1B-C89F-4E36-A74E-59B3BF1933F5} - System32\Tasks\{95CFF7D3-BF85-47C3-8108-813CE6408C8F} => C:\Users\Erik\Documents\Meine empfangenen Dateien\Blackjack.exe [2012-04-18] ()
Task: {0977A095-4853-4819-AEE7-3F8DA402BC6B} - System32\Tasks\{66660BC7-9621-47E0-9F05-5B228D39614E} => C:\Users\Erik\Documents\Meine empfangenen Dateien\Blackjack.exe [2012-04-18] ()
Task: {0EEE3178-5123-48C2-8D2E-08D8A0731A8A} - System32\Tasks\{0139D295-6C60-42A9-9C86-936E78CF5BC4} => C:\Users\Erik\Documents\Meine empfangenen Dateien\Blackjack.exe [2012-04-18] ()
Task: {230926BD-3699-47D4-8D0C-DF80E0AF2330} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {26EE68E4-A02F-482A-825C-D8238628BEF1} - System32\Tasks\{7C0387C3-5302-46E9-91D5-72F3BE7F452D} => C:\Users\Erik\Documents\Meine empfangenen Dateien\Blackjack.exe [2012-04-18] ()
Task: {4D50FF43-68FC-41BC-8545-6667B470808D} - System32\Tasks\{8C8FB235-038B-4BC5-B63B-49C09F0D970C} => C:\Users\Erik\Documents\Meine empfangenen Dateien\Blackjack.exe [2012-04-18] ()
Task: {51FA042C-BFA7-4F80-AC5A-087AD7A2028E} - System32\Tasks\{2820234E-6D53-4860-91CE-8FFE90DD1F18} => pcalua.exe -a C:\Users\Erik\Downloads\jxpiinstall(2).exe -d C:\Users\Erik\Downloads
Task: {527A459A-B5E3-426E-9E52-0F07B1682A60} - System32\Tasks\{97511E91-6183-4DB8-A2EA-A09E1E54758F} => pcalua.exe -a "C:\Program Files (x86)\Steam\steam.exe" -c steam://uninstall/8930
Task: {53E0A85B-56B9-49A0-B86B-1940AE747DDF} - System32\Tasks\{A5C236CC-7776-4DC3-93C0-611BDC47D311} => C:\Users\Erik\Documents\Meine empfangenen Dateien\Blackjack.exe [2012-04-18] ()
Task: {53E51652-AB22-4225-9318-1260A55B9C56} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {5FD3E1C1-EDC6-4E15-BC0D-ACFA29789A16} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-07-14] (Adobe Systems Incorporated)
Task: {6B794E37-50C3-4653-899E-43940D01A747} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {7DC0EAB5-E1CF-485D-9862-E6906F23E3A3} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-4148174342-3149974382-3542746328-1000UA => C:\Users\Erik\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-17] (Dropbox, Inc.)
Task: {8486E3F6-9396-4D52-B102-ADC13A328229} - System32\Tasks\{FEAEB795-8118-46B0-BD70-3A47DF9BC73F} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2015-06-29] (Skype Technologies S.A.)
Task: {85541A3D-0827-4DA7-B0DB-A9BAB9D71238} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-20] (Google Inc.)
Task: {8606B07D-A33D-43D9-A48E-7B97AC1E7352} - System32\Tasks\{F9B7A166-AAB0-4FBB-B382-A3D2D484CA68} => Firefox.exe hxxp://ui.skype.com/ui/0/6.6.0.106/de/abandoninstall?page=tsMain
Task: {8DE8F6DD-753A-434C-B510-DC00BCE7A40D} - System32\Tasks\{1F67813B-EE9F-4356-A6BF-03FA462174E5} => C:\Users\Erik\Documents\Meine empfangenen Dateien\Blackjack.exe [2012-04-18] ()
Task: {99674296-FC2D-49FB-A31D-24EE14803E6F} - System32\Tasks\{BCDBC41D-6545-429F-95DF-77681D46FB0F} => C:\Users\Erik\Documents\Meine empfangenen Dateien\Blackjack.exe [2012-04-18] ()
Task: {A04C2E99-60B1-4970-A2B2-FF37F29B51F8} - System32\Tasks\{135574F2-98F6-446A-9D84-441562CDB06B} => pcalua.exe -a D:\SETUP.EXE -d D:\
Task: {A44BA4E6-ACCB-4310-B739-CBF43D2AB2D2} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-03-13] (Piriform Ltd)
Task: {A97766C1-EC4C-410B-ACAD-2331BEFDAE80} - System32\Tasks\{9F12B632-00C7-415B-ACF2-D1ABED3B01DB} => C:\Users\Erik\Documents\Meine empfangenen Dateien\Blackjack.exe [2012-04-18] ()
Task: {B3FEBEED-5558-449E-A844-0DC5361D8BFE} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-20] (Google Inc.)
Task: {C37104EF-9B44-40BC-899C-365A0338070B} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-4148174342-3149974382-3542746328-1000Core => C:\Users\Erik\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-17] (Dropbox, Inc.)
Task: {CAD8D609-31F7-456D-B2C7-BF4A930A8A8D} - System32\Tasks\{557D624A-1922-4E3C-8C73-81B7922463B0} => pcalua.exe -a C:\Users\Erik\Downloads\MassEffect_BDtS_G.exe -d C:\Users\Erik\Downloads
Task: {D9AE1612-B64B-426A-92CE-0FE1A561EDE9} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-4148174342-3149974382-3542746328-1000Core.job => C:\Users\Erik\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-4148174342-3149974382-3542746328-1000UA.job => C:\Users\Erik\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (Whitelisted) ==============
2012-11-19 01:07 - 2014-03-04 15:05 - 00116056 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-02-13 04:20 - 2015-02-13 04:20 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-02-13 04:20 - 2015-02-13 04:20 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2013-06-03 19:42 - 2014-06-01 00:56 - 00075136 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2015-03-29 01:23 - 2014-05-13 13:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-03-29 01:23 - 2014-05-13 13:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-03-29 01:23 - 2014-05-13 13:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-03-29 01:23 - 2012-08-23 11:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-03-29 01:23 - 2012-04-03 18:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-4148174342-3149974382-3542746328-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Erik\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 8.8.8.8
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupfolder: C:^Users^Erik^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk => C:\Windows\pss\OpenOffice.org 3.2.lnk.Startup
MSCONFIG\startupreg: ISUSPM Startup => "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
MSCONFIG\startupreg: Logitech Download Assistant => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [TCP Query User{20077774-C64C-4FA7-8EA5-5EB752D3D7BB}C:\program files (x86)\activision\ef2\ef2.exe] => (Allow) C:\program files (x86)\activision\ef2\ef2.exe
FirewallRules: [UDP Query User{D17446DB-0385-48B6-83E8-64A6B89829AF}C:\program files (x86)\activision\ef2\ef2.exe] => (Allow) C:\program files (x86)\activision\ef2\ef2.exe
FirewallRules: [{8AADC0AD-1B22-4CE5-B017-8C11354457BB}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [VirtualPC-In-UDP-1] => (Allow) %SystemRoot%\System32\vpc.exe
FirewallRules: [VirtualPC-In-UDP-2] => (Allow) %SystemRoot%\System32\vpc.exe
FirewallRules: [VirtualPC-In-TCP-1] => (Allow) %SystemRoot%\System32\vpc.exe
FirewallRules: [TCP Query User{8218B01D-8A39-4502-818E-3AF109FD939F}C:\program files\java\jre6\bin\javaw.exe] => (Allow) C:\program files\java\jre6\bin\javaw.exe
FirewallRules: [UDP Query User{58CC0721-1C67-42CC-8CE9-AE930A30D0B5}C:\program files\java\jre6\bin\javaw.exe] => (Allow) C:\program files\java\jre6\bin\javaw.exe
FirewallRules: [{81A69630-9058-4405-AD4A-15717B5C01A7}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{86E510F2-8EA2-4CCE-AC2A-0048A4E6CF62}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [TCP Query User{CD8485DB-0663-4D42-8585-CD6BD37F6411}C:\program files (x86)\ubisoft\heroes of might and magic v - tribes of the east\bin\h5_game.exe] => (Block) C:\program files (x86)\ubisoft\heroes of might and magic v - tribes of the east\bin\h5_game.exe
FirewallRules: [UDP Query User{980694A3-F2F1-4F87-A2B0-2A97A2B26318}C:\program files (x86)\ubisoft\heroes of might and magic v - tribes of the east\bin\h5_game.exe] => (Block) C:\program files (x86)\ubisoft\heroes of might and magic v - tribes of the east\bin\h5_game.exe
FirewallRules: [{D80EAE77-80D7-4431-BC1A-FDF6B2498FA0}] => (Allow) C:\Program Files (x86)\Dragon Age\bin_ship\daorigins.exe
FirewallRules: [{3058BF29-C0F0-40D8-A228-67DAD9591322}] => (Allow) C:\Program Files (x86)\Dragon Age\bin_ship\daorigins.exe
FirewallRules: [{5C562A02-DA94-4544-8B39-2622A0834B02}] => (Allow) C:\Program Files (x86)\Dragon Age\DAOriginsLauncher.exe
FirewallRules: [{21CFC8A4-07A4-487F-B37C-8F95D3D993CF}] => (Allow) C:\Program Files (x86)\Dragon Age\DAOriginsLauncher.exe
FirewallRules: [{57C54F75-F60C-455F-AF25-6E9397CBD8C7}] => (Allow) C:\Program Files (x86)\Dragon Age\bin_ship\daupdatersvc.service.exe
FirewallRules: [{D675BBFD-EC46-4D28-A4A7-9C5A51E61A5D}] => (Allow) C:\Program Files (x86)\Dragon Age\bin_ship\daupdatersvc.service.exe
FirewallRules: [{0481E6E6-B202-4D8B-AF09-72CC998AD4AE}] => (Allow) C:\Program Files (x86)\Mass Effect\Binaries\MassEffect.exe
FirewallRules: [{A833A81A-FB17-453C-98C3-227D4610DE3E}] => (Allow) C:\Program Files (x86)\Mass Effect\Binaries\MassEffect.exe
FirewallRules: [{8E7CFF1F-24E9-4DB2-A331-AEA4E9D72448}] => (Allow) C:\Program Files (x86)\Mass Effect\MassEffectLauncher.exe
FirewallRules: [{DA448CC6-1BE0-49F2-8C26-7A5DD21566A3}] => (Allow) C:\Program Files (x86)\Mass Effect\MassEffectLauncher.exe
FirewallRules: [{69F0FEFF-5DB2-47D9-953A-B3551FBD026C}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed\AssassinsCreed_Dx9.exe
FirewallRules: [{44E57D33-2C43-4714-A30F-3E7E3C69ABB0}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed\AssassinsCreed_Dx9.exe
FirewallRules: [{78F133A5-6FC8-47A7-9BD7-6F109860C32B}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed\AssassinsCreed_Dx10.exe
FirewallRules: [{307AD621-2138-4154-866E-B22E24EC9251}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed\AssassinsCreed_Dx10.exe
FirewallRules: [{38AF4F5F-7F37-4AE9-9FF2-8343739F1C1D}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed\AssassinsCreed_Launcher.exe
FirewallRules: [{02FFA2B9-DA56-4592-BB72-451479D6FA3C}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed\AssassinsCreed_Launcher.exe
FirewallRules: [{8B39C3D3-C1DE-42B3-BD38-6F01AF9E4867}] => (Allow) C:\Program Files (x86)\Mass Effect 2\Binaries\MassEffect2.exe
FirewallRules: [{9CB43ED2-7067-4693-9E91-2E073440BE34}] => (Allow) C:\Program Files (x86)\Mass Effect 2\Binaries\MassEffect2.exe
FirewallRules: [{F75C8456-76A0-4DCB-AAE5-9EEC13AD27DF}] => (Allow) C:\Program Files (x86)\Mass Effect 2\MassEffect2Launcher.exe
FirewallRules: [{BB8EAC95-2364-456D-8A36-4785FD7C84BB}] => (Allow) C:\Program Files (x86)\Mass Effect 2\MassEffect2Launcher.exe
FirewallRules: [TCP Query User{E80A2F84-43DA-46F1-856D-B6C0A0907FC7}C:\program files (x86)\turbine\der herr der ringe online\lotroclient.exe] => (Allow) C:\program files (x86)\turbine\der herr der ringe online\lotroclient.exe
FirewallRules: [UDP Query User{E0B8B6C9-9733-4724-AAB7-EE0311E65F5F}C:\program files (x86)\turbine\der herr der ringe online\lotroclient.exe] => (Allow) C:\program files (x86)\turbine\der herr der ringe online\lotroclient.exe
FirewallRules: [TCP Query User{F7185820-7858-4FA5-AB08-301E33BEEF3F}C:\program files (x86)\ubisoft\blue byte\die siedler - das erbe der könige\bin\settlershok.exe] => (Allow) C:\program files (x86)\ubisoft\blue byte\die siedler - das erbe der könige\bin\settlershok.exe
FirewallRules: [UDP Query User{04C68E80-2190-4CC0-8FE2-07B46693F4A9}C:\program files (x86)\ubisoft\blue byte\die siedler - das erbe der könige\bin\settlershok.exe] => (Allow) C:\program files (x86)\ubisoft\blue byte\die siedler - das erbe der könige\bin\settlershok.exe
FirewallRules: [TCP Query User{25C8DF2B-DD21-4ED7-9611-42AA84381C1C}C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.icd] => (Allow) C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.icd
FirewallRules: [UDP Query User{B35B1B40-DFC0-46CA-92DB-629A338480DB}C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.icd] => (Allow) C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.icd
FirewallRules: [TCP Query User{FC5440E8-1159-4C9F-87A1-42E5D43FDD66}C:\program files (x86)\microsoft games\age of empires ii\empires2.icd] => (Allow) C:\program files (x86)\microsoft games\age of empires ii\empires2.icd
FirewallRules: [UDP Query User{2307D80F-FF77-4728-9C82-622B0A9E4AD0}C:\program files (x86)\microsoft games\age of empires ii\empires2.icd] => (Allow) C:\program files (x86)\microsoft games\age of empires ii\empires2.icd
FirewallRules: [{A8E3397F-6DEA-4ECD-AFE9-3D6D4E0D244B}] => (Block) %ProgramFiles% (x86)\MAGIX\Video_deluxe_17_Premium_Download-Version\Videodeluxe.exe
FirewallRules: [{3DB300E6-1735-4B26-B0FE-4609FCA2F788}] => (Block) %ProgramFiles% (x86)\MAGIX\Video_deluxe_17_Premium_Download-Version\Video_deluxe_17_premium_de-DE_setup.exe
FirewallRules: [{F6980C79-FC03-43B0-8753-7F429480F085}] => (Block) %ProgramFiles% (x86)\MAGIX\Video_deluxe_17_Premium_Download-Version\Trayserver.exe
FirewallRules: [TCP Query User{E56803E0-AFF4-4740-B7F6-701AB179B71B}C:\program files\java\jre6\bin\javaw.exe] => (Block) C:\program files\java\jre6\bin\javaw.exe
FirewallRules: [UDP Query User{EC61426E-54CD-4797-81A7-A6986A83AB7C}C:\program files\java\jre6\bin\javaw.exe] => (Block) C:\program files\java\jre6\bin\javaw.exe
FirewallRules: [{A3D1B127-A9B4-4923-9E07-2261F5BA4CBC}] => (Allow) C:\Program Files (x86)\Origin Games\Mass Effect 3\Binaries\Win32\MassEffect3.exe
FirewallRules: [{20476545-C14A-4152-9EE3-AB36C8FB97AD}] => (Allow) C:\Program Files (x86)\Origin Games\Mass Effect 3\Binaries\Win32\MassEffect3.exe
FirewallRules: [TCP Query User{E6B1F283-3CD9-47F1-845E-8874FD203398}C:\users\erik\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\erik\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{28B41AFC-3B51-43BB-92D5-E691F5D08D65}C:\users\erik\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\erik\appdata\roaming\spotify\spotify.exe
FirewallRules: [{580A8A38-629F-45C2-902B-A36374FE7705}] => (Allow) C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
FirewallRules: [{6F9116FB-34C0-47CB-8D66-15599181EBBD}] => (Allow) C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
FirewallRules: [{9AFD8D4D-E2EF-47BE-A88F-FEAE319C3AB9}] => (Allow) C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
FirewallRules: [{9DE1BA38-C71B-40BF-B461-05BE93A608BE}] => (Allow) C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
FirewallRules: [{A29600F8-BE3E-4F92-B8A0-29D9E62CBB3A}] => (Allow) LPort=57021
FirewallRules: [{C5D9411C-D714-441A-B877-2ECC9A704A0C}] => (Allow) LPort=57021
FirewallRules: [{813BD5FF-8799-4FB6-95E0-2204D3BCB106}] => (Allow) LPort=57021
FirewallRules: [{DB29828B-C0C7-41AF-983F-995019EAD2C5}] => (Allow) LPort=57021
FirewallRules: [{076E418D-EBCA-4610-A736-E8F4CB16DF40}] => (Allow) C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
FirewallRules: [{49C75E15-733B-466F-BB5C-EDA964163E62}] => (Allow) C:\Program Files (x86)\UBISOFT\Ubisoft Game Launcher\UbisoftGameLauncher.exe
FirewallRules: [{346FDD84-FDA2-43BA-911B-A2C2B1B4C486}] => (Allow) C:\Program Files (x86)\UBISOFT\Ubisoft Game Launcher\UbisoftGameLauncher.exe
FirewallRules: [{11D9725F-1DD4-439E-A5F8-69FE019B0EEF}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed II\AssassinsCreedIIGame.exe
FirewallRules: [{F8C53F55-2266-4BC4-A044-2709E1984211}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed II\AssassinsCreedIIGame.exe
FirewallRules: [{C71B1DEB-125B-443B-BA14-D8FC0089CE30}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed II\AssassinsCreedII.exe
FirewallRules: [{DDE36807-488E-49D0-B5B2-20CB46FB5ACD}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed II\AssassinsCreedII.exe
FirewallRules: [{43A36CEB-B87E-455B-80C9-D44DDBF470CB}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed II\UPlayBrowser.exe
FirewallRules: [{2C95D061-ACBF-4E80-9204-9B399294C6E2}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed II\UPlayBrowser.exe
FirewallRules: [{E312DE2E-E70C-42E0-A48F-E7013C1AA231}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\skyrim\SkyrimLauncher.exe
FirewallRules: [{532062F2-4B61-4BF7-8E15-94D31C7C532A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\skyrim\SkyrimLauncher.exe
FirewallRules: [{C0E94608-66AF-4145-9164-0AD9EB4EE056}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{3C7BDEC9-501B-42A3-A628-39C06A6187E5}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{AD8C345D-C826-4A90-9083-3815404C7A72}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\dota.exe
FirewallRules: [{1AC69E79-CF02-4226-8DD4-536D5C8BDCDB}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\dota.exe
FirewallRules: [{833889C9-D61E-43CC-B24D-EE2BCFE4CC1C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\dota.exe
FirewallRules: [{F8112543-B1B5-427A-8175-CCE360FD49EC}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\dota.exe
FirewallRules: [TCP Query User{3A712F0B-17F5-4F4C-926D-0C053BC3B66E}C:\program files (x86)\steam\steam.exe] => (Allow) C:\program files (x86)\steam\steam.exe
FirewallRules: [UDP Query User{4960BB11-205A-4577-B8F6-03864D2705EB}C:\program files (x86)\steam\steam.exe] => (Allow) C:\program files (x86)\steam\steam.exe
FirewallRules: [{69AC9734-FD46-40F0-A53C-D2570FB2A47B}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\dota.exe
FirewallRules: [{43846475-386A-4CF5-9320-21022A78FBAF}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\dota.exe
FirewallRules: [{8BA25A61-B409-4451-8299-FA5725FAA28C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\dota.exe
FirewallRules: [{874A0C00-34B3-45F1-926F-6456DB7AF0C7}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\dota.exe
FirewallRules: [{728D4B74-ACEA-4DC3-9468-EC72E152065D}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\dota.exe
FirewallRules: [{F2034150-4947-437E-B11C-3FFA376A0007}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\dota.exe
FirewallRules: [{42551875-79C1-48EB-935B-0F13622C4390}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{D6F4C13E-4B63-4618-999A-56E830EC8714}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{9B149FFA-B830-49AA-96A7-60D528D3173A}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{FBF28483-51C6-45C7-895B-C6AAF1543854}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{410CF5AE-718C-4A03-B6CD-E945C80BF547}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed Brotherhood\ACBSP.exe
FirewallRules: [{E9F195D9-02EC-4A25-B42A-86A7FDFA1AEA}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed Brotherhood\ACBSP.exe
FirewallRules: [{6C48ED88-B482-4D32-B1A0-115E2B419420}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed Brotherhood\ACBMP.exe
FirewallRules: [{84478C58-44B4-4FFE-9885-4C298D5BD6BC}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed Brotherhood\ACBMP.exe
FirewallRules: [{E92E87AC-6BB9-489B-ABD5-5398AE9414CD}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed Brotherhood\AssassinsCreedBrotherhood.exe
FirewallRules: [{8B2ED7A2-E796-4796-B67A-6C59A2637F9B}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed Brotherhood\AssassinsCreedBrotherhood.exe
FirewallRules: [{DF81655D-D4C2-442D-AE18-789D0FCB98A7}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed Brotherhood\UPlayBrowser.exe
FirewallRules: [{157B8FD9-3ED1-4321-AD63-35A69616F4CA}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed Brotherhood\UPlayBrowser.exe
FirewallRules: [{8A23FF01-84C2-4846-B9E2-F34627F5E19A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\FTL Faster Than Light\FTLGame.exe
FirewallRules: [{0AB11AE1-12B7-48A9-BE35-DA3B164213C1}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\FTL Faster Than Light\FTLGame.exe
FirewallRules: [{93ABDF5C-3CDC-4B92-BB02-94412752DB55}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{A405351E-FAD5-4E47-A0F7-8C969464A095}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{BB70B170-F68E-48FE-BA1E-74AC0C30C062}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{3367F24E-322F-4C6F-B984-698BC23C0336}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{5A650AB3-7F9E-4E69-BD5E-A8C4339D76A4}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 3\bf3.exe
FirewallRules: [{C808DAC3-F71D-4C71-AD21-658616B4982D}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 3\bf3.exe
FirewallRules: [{190F9B04-483E-435B-B8F1-CEB4D2133C7B}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\the witcher 2\Launcher.exe
FirewallRules: [{FE0F4DC0-8D16-41A6-9B0C-0E8B7FEC6AD3}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\the witcher 2\Launcher.exe
FirewallRules: [{43A79202-B9C7-42B0-BFFB-CC7986137634}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Borderlands\Binaries\Borderlands.exe
FirewallRules: [{7BE2AF3B-DF64-4115-BB3B-487F6D31B459}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Borderlands\Binaries\Borderlands.exe
FirewallRules: [{BAE1B1CB-8013-4F6B-9E94-B9B5C6F0A98B}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Risk of Rain\Risk of Rain.exe
FirewallRules: [{1F27EF17-6E46-46E5-8E8C-6794E7E76686}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Risk of Rain\Risk of Rain.exe
FirewallRules: [{57110BC1-0A04-482C-BB32-61287F256039}] => (Allow) C:\Program Files (x86)\Tunngle\TnglCtrl.exe
FirewallRules: [{1FEA1C63-3835-4D89-BEB5-378A6E850F9C}] => (Allow) C:\Program Files (x86)\Tunngle\TnglCtrl.exe
FirewallRules: [{2B0BB2F6-0C99-41C4-9E33-438C3B7D070F}] => (Allow) C:\Program Files (x86)\Tunngle\Tunngle.exe
FirewallRules: [{05940ACE-CA44-48E1-8B8E-0635D25111E4}] => (Allow) C:\Program Files (x86)\Tunngle\Tunngle.exe
FirewallRules: [{C8CFA6E7-D5E8-46AC-8CDF-B3C9E9AE4E5A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Bastion\Bastion.exe
FirewallRules: [{24862C5E-A21D-4396-B699-4D53ED9C496E}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Bastion\Bastion.exe
FirewallRules: [{08A4D089-5F22-4DE6-AA2C-50669A0B12EB}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed Revelations\ACRSP.exe
FirewallRules: [{3818FBA9-1F99-4E4F-8972-8893353D6455}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed Revelations\ACRSP.exe
FirewallRules: [{B5DCBBEF-D86C-4CFF-85E2-F88C192EB725}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed Revelations\ACRMP.exe
FirewallRules: [{F1D640E7-EC25-4838-A80C-BE7296D11404}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed Revelations\ACRMP.exe
FirewallRules: [{4E38AB44-EF37-4E6C-BD9B-15F47684EFA4}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed Revelations\AssassinsCreedRevelations.exe
FirewallRules: [{49B71011-64A2-460C-B012-CB5B77D1AF6E}] => (Allow) C:\Program Files (x86)\UBISOFT\Assassin's Creed Revelations\AssassinsCreedRevelations.exe
FirewallRules: [{FF899131-72FF-44AF-A690-48B2F7A4A4D2}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{1E41A557-7CAE-4C6F-B183-81BDB0AABE41}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{0F94700D-F699-48A0-BDFB-7FBC6FDC9A05}] => (Allow) C:\Riot Games\League of Legends\lol.launcher.exe
FirewallRules: [{15CD5871-9B2D-48FC-B875-EBCCEF5CB67D}] => (Allow) C:\Riot Games\League of Legends\lol.launcher.exe
FirewallRules: [{C6E80F1B-011C-443F-A531-D5F1AB28EEFC}] => (Allow) C:\Riot Games\League of Legends\lol.launcher.exe
FirewallRules: [{25C35556-FCC1-42EB-8471-AB6FBF031984}] => (Allow) C:\Riot Games\League of Legends\lol.launcher.exe
FirewallRules: [{1002F735-15D5-4ACA-8084-74C41DBE7E19}] => (Allow) C:\Riot Games\League of Legends\lol.launcher.admin.exe
FirewallRules: [{145A46EF-E455-4447-A1BB-CF2B4179D821}] => (Allow) C:\Riot Games\League of Legends\lol.launcher.admin.exe
FirewallRules: [{7171EC86-C3CA-43C8-90E8-F3588DB008CB}] => (Allow) C:\Riot Games\League of Legends\lol.launcher.admin.exe
FirewallRules: [{21A55747-3AC6-4129-8CFD-5B657EE03EF2}] => (Allow) C:\Riot Games\League of Legends\lol.launcher.admin.exe
FirewallRules: [{36ABB1D9-FAC1-4991-8904-F4BF5408048E}] => (Allow) C:\Program Files (x86)\CPUID\PC Wizard 2013\unins000.exe
FirewallRules: [{9F4EAFA1-A679-4854-A34D-225508BB55AC}] => (Allow) C:\Program Files (x86)\CPUID\PC Wizard 2013\unins000.exe
FirewallRules: [{06B63C34-0703-4925-9622-196ECC1CB1C9}] => (Allow) C:\Program Files (x86)\CPUID\PC Wizard 2013\unins000.exe
FirewallRules: [{CF74E6F6-9F7D-4619-9BE5-E0866220D8A6}] => (Allow) C:\Program Files (x86)\CPUID\PC Wizard 2013\unins000.exe
FirewallRules: [{5D493837-9B5B-4F28-A15A-865904CACA08}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Magicka\Magicka.exe
FirewallRules: [{18B09183-46B0-4689-B91F-44B175D6A050}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Magicka\Magicka.exe
FirewallRules: [TCP Query User{D41B184E-57EA-4D93-B6C3-BD68A56AAF45}C:\program files (x86)\java\jre1.8.0_25\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{4FCE6684-97BB-4C92-BC30-9B06C99D24B7}C:\program files (x86)\java\jre1.8.0_25\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre1.8.0_25\bin\javaw.exe
FirewallRules: [{C6F05162-A841-4CB6-AAA4-482799076211}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{735BDDFF-2CF7-4C45-A984-19181198C8A5}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{A079BBB3-F574-4DE6-A109-5AB0C6047783}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Anno 1404\Addon.exe
FirewallRules: [{07A88457-D54D-4C15-80FD-DC4A12102EC8}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Anno 1404\Addon.exe
FirewallRules: [{40D7BC4C-64D5-4993-AC52-27327EA2C23C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Anno 1404\Anno4.exe
FirewallRules: [{11356878-A312-4544-90B1-BCE510B8DC3E}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Anno 1404\Anno4.exe
FirewallRules: [TCP Query User{DB183B21-E5C8-4D7A-B640-BE1169337DD5}C:\program files (x86)\steam\steamapps\common\anno 1404\tools\addonweb.exe] => (Block) C:\program files (x86)\steam\steamapps\common\anno 1404\tools\addonweb.exe
FirewallRules: [UDP Query User{72DD149E-4849-435E-B10B-260D2E75A29E}C:\program files (x86)\steam\steamapps\common\anno 1404\tools\addonweb.exe] => (Block) C:\program files (x86)\steam\steamapps\common\anno 1404\tools\addonweb.exe
FirewallRules: [{84731A56-D436-493B-BD2D-A898296D3359}] => (Allow) C:\Users\Erik\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{21BF4CF5-F802-459A-A98A-8193BCA50AD2}] => (Allow) C:\Users\Erik\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [TCP Query User{728AF7D3-9280-4B43-A5F6-CE407847BAAC}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{4E4EF94C-DD7C-4A4C-B80D-434D284FAC81}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{FF91AC75-E478-4E85-B969-47719789FB56}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{501EB100-6DD9-42CB-A21C-8D8D4D06267E}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Age of Wonders Trilogy Soundtrack\Launcher.exe
FirewallRules: [{DA5A63DD-5B2D-4577-BD6A-DA2F91B45AEA}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Age of Wonders Trilogy Soundtrack\Launcher.exe
FirewallRules: [{A1C1C963-5936-40EA-885F-C1C6B7CBF92A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\AoW3\AoW3.exe
FirewallRules: [{3CAF6357-0FA9-4894-8AF2-D5DFD506D3A8}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\AoW3\AoW3.exe
FirewallRules: [{8929B7F4-A0C4-4C30-9264-CECD3441774E}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\AoW3\AoW3_Debug.exe
FirewallRules: [{2802F551-4DBD-4992-9D40-D5F2F95BD643}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\AoW3\AoW3_Debug.exe
FirewallRules: [{DC789024-B20F-4B32-BFDE-6613DBF1F478}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\AoW3\AoW3Launcher.exe
FirewallRules: [{D386769D-03A7-4D95-B771-BFFFA7CB4180}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\AoW3\AoW3Launcher.exe
FirewallRules: [{06F59295-91E5-4E08-BA64-249FD4389701}] => (Allow) C:\Program Files (x86)\WTFast\WTFast.exe
FirewallRules: [{9372A82C-55E7-424A-AA48-780BAA1C9995}] => (Allow) C:\Program Files (x86)\WTFast\WTFast.exe
FirewallRules: [{4FE2F023-1099-4884-9F1A-8866C91AFB7E}] => (Allow) C:\Program Files (x86)\WTFast\WTFast.exe
FirewallRules: [{B109D346-19AD-4302-9696-CD67E95B2C40}] => (Allow) C:\Program Files (x86)\WTFast\WTFast.exe
FirewallRules: [{457A2348-838E-4E05-B3E9-B6FFA08CA223}] => (Allow) C:\ACD2012FREE\SHOW3D.EXE
FirewallRules: [{75B5698B-8660-4C11-83C6-A443C2B1F7F5}] => (Allow) C:\ACD2012FREE\SHOW3D.EXE
FirewallRules: [{961C1961-7413-452C-9D28-3017F903CC58}] => (Allow) C:\ACD2012FREE\SHOW3D.EXE
FirewallRules: [{AC5348D7-AC06-437E-9EAD-92D5A593F410}] => (Allow) C:\ACD2012FREE\SHOW3D.EXE
FirewallRules: [{AE8026E8-A9A6-49C5-AD98-5A91DDA883E0}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Fallout New Vegas\FalloutNVLauncher.exe
FirewallRules: [{D691569D-CF38-4C46-B03C-16F838B338C8}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Fallout New Vegas\FalloutNVLauncher.exe
FirewallRules: [{69628E5E-A3FA-405D-A17A-A591EDFCCE7C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sid Meier's Civilization Beyond Earth\CivilizationBE_DX11.exe
FirewallRules: [{B66A5C84-A69D-4231-9073-D3DFD6547F7C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sid Meier's Civilization Beyond Earth\CivilizationBE_DX11.exe
FirewallRules: [{57DBA508-6747-4F70-9101-82FCB8E98EBC}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sid Meier's Civilization Beyond Earth\CivilizationBE_Mantle.exe
FirewallRules: [{900516F1-F967-4D4F-B549-5000E6E01B47}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sid Meier's Civilization Beyond Earth\CivilizationBE_Mantle.exe
FirewallRules: [{4D9343A9-89EC-4771-BCCA-105E6221C965}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{4D669274-C5AE-4890-8054-BB5CE39CB219}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{6017BCD6-8E24-46A6-B5FA-56AA5793E81E}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{6ABCDA1A-9C74-467B-9203-B5DC7DAC4043}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{3AA4DEDA-CBEE-4CB9-83CA-B240687AA198}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{7DF35A0D-03AF-4813-A89C-2630343144DA}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{73A0B3E2-9934-4FB8-938B-1DDCC2F91BEC}] => (Allow) C:\Program Files (x86)\NAMCO BANDAI Games\DarkSouls\DARKSOULS.exe
FirewallRules: [{FA311607-D08B-44BB-AB03-9A5AED377058}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service
==================== Faulty Device Manager Devices =============
Name: Atheros AR5005G-Drahtlosnetzwerkadapter
Description: Atheros AR5005G-Drahtlosnetzwerkadapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Atheros Communications Inc.
Service: athr
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (07/13/2015 12:29:43 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]
Error: (07/12/2015 01:48:07 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]
Error: (07/11/2015 10:37:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Uplay.exe, Version: 4.6.1.3217, Zeitstempel: 0x53b41990
Name des fehlerhaften Moduls: Uplay.exe, Version: 4.6.1.3217, Zeitstempel: 0x53b41990
Ausnahmecode: 0xc0000417
Fehleroffset: 0x01194140
ID des fehlerhaften Prozesses: 0x180c
Startzeit der fehlerhaften Anwendung: 0xUplay.exe0
Pfad der fehlerhaften Anwendung: Uplay.exe1
Pfad des fehlerhaften Moduls: Uplay.exe2
Berichtskennung: Uplay.exe3
Error: (07/11/2015 10:36:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Uplay.exe, Version: 4.6.1.3217, Zeitstempel: 0x53b41990
Name des fehlerhaften Moduls: Uplay.exe, Version: 4.6.1.3217, Zeitstempel: 0x53b41990
Ausnahmecode: 0xc0000417
Fehleroffset: 0x01194140
ID des fehlerhaften Prozesses: 0x19d4
Startzeit der fehlerhaften Anwendung: 0xUplay.exe0
Pfad der fehlerhaften Anwendung: Uplay.exe1
Pfad des fehlerhaften Moduls: Uplay.exe2
Berichtskennung: Uplay.exe3
Error: (07/11/2015 10:35:54 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Uplay.exe, Version: 4.6.1.3217, Zeitstempel: 0x53b41990
Name des fehlerhaften Moduls: Uplay.exe, Version: 4.6.1.3217, Zeitstempel: 0x53b41990
Ausnahmecode: 0xc0000417
Fehleroffset: 0x01194140
ID des fehlerhaften Prozesses: 0x1028
Startzeit der fehlerhaften Anwendung: 0xUplay.exe0
Pfad der fehlerhaften Anwendung: Uplay.exe1
Pfad des fehlerhaften Moduls: Uplay.exe2
Berichtskennung: Uplay.exe3
Error: (07/10/2015 09:39:07 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]
Error: (07/10/2015 01:05:06 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]
Error: (07/09/2015 06:35:20 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Error: (07/05/2015 04:16:17 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Origin.exe, Version 9.6.1.5336 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: ce4
Startzeit: 01d0b6fe9d253815
Endzeit: 0
Anwendungspfad: C:\Program Files (x86)\Origin\Origin.exe
Berichts-ID:
Error: (07/01/2015 06:43:31 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]
System errors:
=============
Error: (07/14/2015 09:48:13 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 14.07.2015 um 09:46:39 unerwartet heruntergefahren.
Error: (07/13/2015 04:32:57 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (07/13/2015 04:32:57 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Scanner Service erreicht.
Error: (07/13/2015 12:44:19 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Windows Update" wurde nicht richtig gestartet.
Error: (07/12/2015 02:15:12 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (07/12/2015 02:15:12 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Scanner Service erreicht.
Error: (07/12/2015 10:24:23 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (07/12/2015 10:24:23 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Scanner Service erreicht.
Error: (07/12/2015 02:20:29 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
Error: (07/11/2015 01:38:49 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Microsoft Office:
=========================
Error: (07/13/2015 12:29:43 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]
Error: (07/12/2015 01:48:07 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]
Error: (07/11/2015 10:37:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Uplay.exe4.6.1.321753b41990Uplay.exe4.6.1.321753b41990c000041701194140180c01d0bc195450a5caC:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exeC:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exe9406d396-280c-11e5-b5d7-1c6f6581e1a7
Error: (07/11/2015 10:36:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Uplay.exe4.6.1.321753b41990Uplay.exe4.6.1.321753b41990c00004170119414019d401d0bc194bbc04f0C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exeC:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exe8b86f38a-280c-11e5-b5d7-1c6f6581e1a7
Error: (07/11/2015 10:35:54 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Uplay.exe4.6.1.321753b41990Uplay.exe4.6.1.321753b41990c000041701194140102801d0bc1923efe7f2C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exeC:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exe6d007a7e-280c-11e5-b5d7-1c6f6581e1a7
Error: (07/10/2015 09:39:07 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]
Error: (07/10/2015 01:05:06 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]
Error: (07/09/2015 06:35:20 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifestC:\Users\Erik\Downloads\SoftonicDownloader_fuer_visualboyadvance.exe
Error: (07/05/2015 04:16:17 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Origin.exe9.6.1.5336ce401d0b6fe9d2538150C:\Program Files (x86)\Origin\Origin.exe
Error: (07/01/2015 06:43:31 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]
==================== Memory info ===========================
Processor: AMD Phenom(tm) II X4 965 Processor
Percentage of memory in use: 50%
Total physical RAM: 4092.54 MB
Available physical RAM: 2037.86 MB
Total Virtual: 8183.28 MB
Available Virtual: 5188.79 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:465.66 GB) (Free:89.45 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: B1AEEADF)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465.7 GB) - (Type=07 NTFS)
==================== End of log ============================
--- --- --- Gmer.txt GMER Logfile: Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-07-15 13:22:08
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000006b WDC_WD50 rev.05.0 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\Erik\AppData\Local\Temp\kxldapoc.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075cf1401 2 bytes JMP 7645b21b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075cf1419 2 bytes JMP 7645b346 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075cf1431 2 bytes JMP 764d8f29 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075cf144a 2 bytes CALL 7643489d C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075cf14dd 2 bytes JMP 764d8822 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075cf14f5 2 bytes JMP 764d89f8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075cf150d 2 bytes JMP 764d8718 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075cf1525 2 bytes JMP 764d8ae2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075cf153d 2 bytes JMP 7644fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075cf1555 2 bytes JMP 764568ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075cf156d 2 bytes JMP 764d8fe3 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075cf1585 2 bytes JMP 764d8b42 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075cf159d 2 bytes JMP 764d86dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075cf15b5 2 bytes JMP 7644fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075cf15cd 2 bytes JMP 7645b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075cf16b2 2 bytes JMP 764d8ea4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075cf16bd 2 bytes JMP 764d8671 C:\Windows\syswow64\kernel32.dll
---- EOF - GMER 2.1 ----
Geändert von Filbsmo (15.07.2015 um 12:54 Uhr) |
| Themen zu Häufig Lags, Leistungseinbrüche/Freeze, Blaue DRVSTORE Datei in system32. |
| .dll, adware, antivir, antivirus, avira, bonjour, browser, defender, desktop, drvstore, error, explorer, firefox, firefox 39.0, flash player, freezes, leistungseinbruch, mozilla, programm, realtek, registry, rundll, security, services.exe, software, svchost.exe, system, tracker, udp, winlogon.exe |
Baum-Darstellung