| Heimdal82 | 02.02.2014 15:48 |
Probleme beim Hochfahren und zunehmende Anzahl der Abstürze
Hallo,
ich habe vor gut 3 Wochen das Spiel Star Wolves 2 auf meinem Rechner installiert. Dabei wurde der Kopierschutz StarForce mit installiert. Im Nachhinein habe ich dann mitbekommen, daß eben dieser Kopierschutz bei Windows 7 (64 Bit) zu massiven Problemen führen kann (wie bei mir dann auch: Rechner ließ sich nur noch im abgesicherten Modus hochfahren usw.). Nach einigem Rumdoktern habe ich StarForce auch wieder von meinem Rechner entfernen können.
Allerdings verhält sich mein Rechner seit nunmehr gut 2 Wochen seltsam. Zuerst brauchte er relativ lange zum Hochfahren, bis er sich teilweise gar nicht mehr starten ließ und wie in einer Bootschleife gefangen war. Ich habe es bisher dann aber doch immer wieder irgendwie in den Griff bekommen.
Ich habe den Rechner sowohl mit AVG scannen lassen als auch mit Malewarebytes Anti-Maleware. Das Antimalewareprogramm hat auch was gefunden und in Charantäne gesteckt, als ich die Logfile heute auslesen wollte, war sie nicht mehr verfügbar.
In den letzten Tagen werden die Symptome immer schlimmer: Programme stürzen ab (Internet-Explorer, Firefox, Cyberlink Power-DVD), ich komme teilweise gar nicht mehr ins Internet (weshalb ich den Thread auch auf dem Rechner meiner Freundin schreibe) und es wird immer schwieriger den Rechner hochzufahren.
Deshalb wollte ich nachfragen, ob ich mir mal wieder was eingefangen habe, noch Rest von StarForce für die Probleme verantwortlich sind oder ob es doch ein Hardwareproblem ist.
Ach ja, Windows habe ich erst vor 3 bis 4 Monaten neu aufgesetzt. Also sollten es keine Probleme direkt von Windows sein (hoffe ich zumindest).
So, hier nun die Logfiles:
Defogger Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:45 on 02/02/2014 (Master of Desaster)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST
FRST Logfile:
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2014 04
Ran by Master of Desaster (administrator) on HORT-DES-CHAOS on 02-02-2014 13:46:37
Running from C:\Users\Master of Desaster\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Nero AG) C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe
(Pandora.TV) C:\Program Files (x86)\PANDORA.TV\PanService\KMPService.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe
(Prolific Technology Inc.) C:\Windows\SysWOW64\IoctlSvc.exe
() C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(PandoraTV) C:\Program Files (x86)\PANDORA.TV\PanService\KMPProcess.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [AVG_UI] - C:\Program Files (x86)\AVG\AVG2014\avgui.exe [4956176 2013-11-07] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.)
HKU\S-1-5-21-2282248442-3872130878-3282906147-1000\...\MountPoints2: {2a5073f1-05a1-11e3-93f8-806e6f6e6963} - D:\SETUP.EXE
HKU\S-1-5-21-2282248442-3872130878-3282906147-1000\...\MountPoints2: {2a5073f2-05a1-11e3-93f8-806e6f6e6963} - E:\Start.exe
HKU\S-1-5-21-2282248442-3872130878-3282906147-1000\...\MountPoints2: {79fbe8cc-08b2-11e3-9c2e-806e6f6e6963} - D:\BSAutoRun.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x046AB6A1B199CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO-x32: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files (x86)\PDF Architect\PDFIEPlugin.dll (pdfforge GmbH)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
FireFox:
========
FF ProfilePath: C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default
FF user.js: detected! => C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\user.js
FF Homepage: www.web.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.7 - C:\Program Files\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nullsoft.com/winampDetector;version=1 - C:\Programme\Winamp Detect\npwachk.dll (Nullsoft, Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\Master of Desaster\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\searchplugins\aol-suche.xml
FF SearchPlugin: C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: DownloadHelper - C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013-08-28]
FF Extension: Ghostery - C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\Extensions\firefox@ghostery.com.xpi [2013-08-17]
FF Extension: Adblock Plus - C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-08-15]
FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ []
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-09-29]
FF HKCU\...\Firefox\Extensions: [{9309FA47-1B48-4768-AFA4-9E0556F5DC81}] - C:\Program Files (x86)\LyricsPal\128.xpi
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (DealPly Shopping) - C:\Users\Master of Desaster\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejnmnhkgiphcaeefbaooconkceehicfi [2013-08-15]
CHR HKLM-x32\...\Chrome\Extension: [pnbbffeddnekkhjmokkhdebbfbibbflc] - C:\Program Files (x86)\LyricsPal\128.crx [2013-08-15]
==================== Services (Whitelisted) =================
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [143120 2013-05-23] (SUPERAntiSpyware.com)
R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [4161512 2013-12-06] (Emsisoft GmbH)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3478544 2013-11-11] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [348008 2013-09-24] (AVG Technologies CZ, s.r.o.)
R2 Nero BackItUp Scheduler 3; C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe [877864 2008-02-18] (Nero AG)
S3 NMIndexingService; C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe [529704 2008-02-28] (Nero AG)
R2 PanService; C:\Program Files (x86)\PANDORA.TV\PanService\KMPService.exe [1922600 2013-07-08] (Pandora.TV)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
S2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 PLFlash DeviceIoControl Service; C:\Windows\SysWOW64\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe [167936 2005-08-07] ()
==================== Drivers (Whitelisted) ====================
S3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [70960 2013-11-05] (Emsisoft GmbH)
R1 A2DDA; C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [26176 2013-08-15] (Emsisoft GmbH)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2013-11-14] ()
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [150808 2013-11-05] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [240920 2013-11-04] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [194872 2013-10-24] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [212280 2013-10-31] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [294712 2013-10-31] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123704 2013-10-01] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31544 2013-09-10] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [251192 2013-08-01] (AVG Technologies CZ, s.r.o.)
S3 cleanhlp; C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [57024 2013-12-06] (Emsisoft GmbH)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2013-11-14] ()
R3 Ph3xIB64; C:\Windows\System32\DRIVERS\Ph3xIB64.sys [1627520 2009-06-10] (NXP Semiconductors)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [33048 2006-11-30] (X10 Wireless Technology, Inc.)
S4 nvlddmkm; system32\DRIVERS\nvlddmkm.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-02-02 13:46 - 2014-02-02 13:46 - 00017154 _____ () C:\Users\Master of Desaster\Desktop\FRST.txt
2014-02-02 13:46 - 2014-02-02 13:46 - 00000000 ____D () C:\FRST
2014-02-02 13:45 - 2014-02-02 13:45 - 00000498 _____ () C:\Users\Master of Desaster\Desktop\defogger_disable.log
2014-02-02 13:45 - 2014-02-02 13:45 - 00000000 _____ () C:\Users\Master of Desaster\defogger_reenable
2014-02-02 13:45 - 2014-02-02 13:44 - 00050477 _____ () C:\Users\Master of Desaster\Desktop\Defogger.exe
2014-02-02 13:42 - 2014-02-02 13:42 - 00001217 _____ () C:\Users\Master of Desaster\Desktop\Continue Mipony Download Accelerator Installation.lnk
2014-02-02 13:42 - 2014-02-02 13:40 - 02080256 _____ (Farbar) C:\Users\Master of Desaster\Desktop\FRST64.exe
2014-02-02 13:42 - 2014-02-02 13:40 - 00380416 _____ () C:\Users\Master of Desaster\Desktop\Gmer-19357.exe
2014-02-02 12:31 - 2014-02-02 12:37 - 00000000 ____D () C:\Users\Master of Desaster\Downloads\MemTest4
2014-02-02 12:31 - 2008-10-11 15:03 - 00024576 _____ () C:\Users\Master of Desaster\Desktop\memtest.exe
2014-02-02 12:29 - 2014-02-02 12:29 - 00013507 _____ () C:\Users\Master of Desaster\Downloads\MemTest4.zip
2014-02-02 09:57 - 2014-02-02 09:57 - 00274496 _____ () C:\Windows\Minidump\020214-64412-01.dmp
2014-02-02 09:54 - 2014-02-02 09:54 - 00274496 _____ () C:\Windows\Minidump\020214-26707-01.dmp
2014-02-01 11:45 - 2014-02-01 15:52 - 00000000 ____D () C:\Program Files\Unknown Device Identifier
2014-01-29 08:17 - 2014-01-29 08:20 - 01069512 _____ (Solid State Networks) C:\Users\Master of Desaster\Downloads\install_flashplayer12x32au_ltr5x64d_awc_aih.exe
2014-01-29 08:08 - 2014-02-02 09:57 - 00000000 ____D () C:\Windows\Minidump
2014-01-29 08:08 - 2014-01-29 08:08 - 00262448 _____ () C:\Windows\Minidump\012914-38969-01.dmp
2014-01-29 08:07 - 2014-02-02 09:57 - 423783748 _____ () C:\Windows\MEMORY.DMP
2014-01-28 19:40 - 2014-01-28 19:40 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\MPC-HC
2014-01-28 18:03 - 2014-01-28 18:04 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-28 18:03 - 2014-01-28 18:04 - 00000000 ____D () C:\Program Files\iTunes
2014-01-28 18:03 - 2014-01-28 18:04 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-01-28 18:03 - 2014-01-28 18:03 - 00000000 ____D () C:\Program Files\iPod
2014-01-22 10:02 - 2014-01-22 10:07 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\Darksiders2
2014-01-22 07:43 - 2014-01-22 07:43 - 00000000 ____D () C:\ProgramData\McAfee
2014-01-21 07:56 - 2014-01-28 20:03 - 00000000 ___HD () C:\Windows\msdownld.tmp
2014-01-21 07:56 - 2014-01-28 20:03 - 00000000 ____D () C:\Windows\SysWOW64\directx
2014-01-21 07:56 - 2014-01-21 07:56 - 00000000 ____D () C:\Program Files (x86)\THQ
2014-01-20 10:03 - 2014-01-20 10:05 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\Darksiders
2014-01-15 16:18 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 16:18 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 16:18 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 16:18 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 16:18 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 16:18 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 16:18 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 16:18 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 16:18 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-08 10:43 - 2014-01-15 15:33 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\Bioshock
2014-01-08 10:43 - 2014-01-08 10:53 - 00000000 ____D () C:\Users\Master of Desaster\Documents\Bioshock
2014-01-08 10:03 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll
2014-01-08 09:55 - 2014-01-08 09:55 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\InstallShield
2014-01-07 20:28 - 2014-01-07 20:28 - 00000000 ____D () C:\Users\Master of Desaster\Documents\NBGI
2014-01-07 20:27 - 2014-01-28 17:21 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\NBGI
2014-01-03 17:26 - 2014-01-03 17:26 - 00000000 ____D () C:\Program Files (x86)\1C
2014-01-03 17:21 - 2014-01-03 17:21 - 00000000 ____D () C:\Xbow Software
2014-01-03 16:53 - 2014-01-03 16:58 - 22414108 _____ () C:\Users\Master of Desaster\Downloads\StarWolves2_GermanPatch1.zip
==================== One Month Modified Files and Folders =======
2014-02-02 13:46 - 2014-02-02 13:46 - 00017154 _____ () C:\Users\Master of Desaster\Desktop\FRST.txt
2014-02-02 13:46 - 2014-02-02 13:46 - 00000000 ____D () C:\FRST
2014-02-02 13:45 - 2014-02-02 13:45 - 00000498 _____ () C:\Users\Master of Desaster\Desktop\defogger_disable.log
2014-02-02 13:45 - 2014-02-02 13:45 - 00000000 _____ () C:\Users\Master of Desaster\defogger_reenable
2014-02-02 13:45 - 2013-08-15 13:06 - 00000000 ____D () C:\Users\Master of Desaster
2014-02-02 13:44 - 2014-02-02 13:45 - 00050477 _____ () C:\Users\Master of Desaster\Desktop\Defogger.exe
2014-02-02 13:43 - 2010-11-21 07:50 - 00702700 _____ () C:\Windows\system32\perfh007.dat
2014-02-02 13:43 - 2010-11-21 07:50 - 00150340 _____ () C:\Windows\system32\perfc007.dat
2014-02-02 13:43 - 2009-07-14 06:13 - 01628300 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-02 13:42 - 2014-02-02 13:42 - 00001217 _____ () C:\Users\Master of Desaster\Desktop\Continue Mipony Download Accelerator Installation.lnk
2014-02-02 13:42 - 2013-08-15 13:02 - 01217269 _____ () C:\Windows\WindowsUpdate.log
2014-02-02 13:40 - 2014-02-02 13:42 - 02080256 _____ (Farbar) C:\Users\Master of Desaster\Desktop\FRST64.exe
2014-02-02 13:40 - 2014-02-02 13:42 - 00380416 _____ () C:\Users\Master of Desaster\Desktop\Gmer-19357.exe
2014-02-02 13:13 - 2009-07-14 05:45 - 00021808 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-02 13:13 - 2009-07-14 05:45 - 00021808 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-02 13:06 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-02 13:06 - 2009-07-14 05:51 - 00075724 _____ () C:\Windows\setupact.log
2014-02-02 12:37 - 2014-02-02 12:31 - 00000000 ____D () C:\Users\Master of Desaster\Downloads\MemTest4
2014-02-02 12:37 - 2013-08-15 15:05 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-02-02 12:29 - 2014-02-02 12:29 - 00013507 _____ () C:\Users\Master of Desaster\Downloads\MemTest4.zip
2014-02-02 11:56 - 2013-08-15 14:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-02 10:22 - 2013-08-15 15:16 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-02 10:04 - 2013-08-15 13:57 - 00000000 ____D () C:\ProgramData\MFAData
2014-02-02 09:57 - 2014-02-02 09:57 - 00274496 _____ () C:\Windows\Minidump\020214-64412-01.dmp
2014-02-02 09:57 - 2014-01-29 08:08 - 00000000 ____D () C:\Windows\Minidump
2014-02-02 09:57 - 2014-01-29 08:07 - 423783748 _____ () C:\Windows\MEMORY.DMP
2014-02-02 09:54 - 2014-02-02 09:54 - 00274496 _____ () C:\Windows\Minidump\020214-26707-01.dmp
2014-02-01 16:35 - 2014-01-02 08:12 - 01601644 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-02-01 16:15 - 2013-08-16 07:25 - 00035328 _____ () C:\Users\Master of Desaster\Desktop\Abrechnung.xls
2014-02-01 15:52 - 2014-02-01 11:45 - 00000000 ____D () C:\Program Files\Unknown Device Identifier
2014-02-01 15:52 - 2013-08-15 15:11 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\Winamp
2014-02-01 15:52 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2014-02-01 15:51 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2014-01-29 15:39 - 2013-08-15 20:34 - 00000000 ____D () C:\Users\Master of Desaster\Desktop\Arbeit
2014-01-29 15:38 - 2013-08-18 17:52 - 00000000 ____D () C:\Users\Master of Desaster\Documents\Outlook-Dateien
2014-01-29 08:20 - 2014-01-29 08:17 - 01069512 _____ (Solid State Networks) C:\Users\Master of Desaster\Downloads\install_flashplayer12x32au_ltr5x64d_awc_aih.exe
2014-01-29 08:08 - 2014-01-29 08:08 - 00262448 _____ () C:\Windows\Minidump\012914-38969-01.dmp
2014-01-28 20:03 - 2014-01-21 07:56 - 00000000 ___HD () C:\Windows\msdownld.tmp
2014-01-28 20:03 - 2014-01-21 07:56 - 00000000 ____D () C:\Windows\SysWOW64\directx
2014-01-28 19:46 - 2013-08-15 14:51 - 00000000 ____D () C:\Users\Master of Desaster\Desktop\Programme
2014-01-28 19:40 - 2014-01-28 19:40 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\MPC-HC
2014-01-28 18:04 - 2014-01-28 18:03 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-28 18:04 - 2014-01-28 18:03 - 00000000 ____D () C:\Program Files\iTunes
2014-01-28 18:04 - 2014-01-28 18:03 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-01-28 18:03 - 2014-01-28 18:03 - 00000000 ____D () C:\Program Files\iPod
2014-01-28 17:24 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files\Windows Sidebar
2014-01-28 17:23 - 2013-12-12 07:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-01-28 17:23 - 2013-08-16 07:37 - 00000000 ____D () C:\Users\Master of Desaster\Desktop\Spiele
2014-01-28 17:23 - 2013-08-15 20:53 - 00000000 ____D () C:\Program Files (x86)\WinRAR
2014-01-28 17:23 - 2013-08-15 20:51 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2014-01-28 17:23 - 2013-08-15 20:45 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-28 17:23 - 2013-08-15 15:03 - 00000000 ____D () C:\Users\Master of Desaster\Documents\Audible
2014-01-28 17:23 - 2013-08-15 14:42 - 00000000 ____D () C:\ProgramData\FLEXnet
2014-01-28 17:22 - 2013-12-13 08:20 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\Two Worlds II
2014-01-28 17:22 - 2013-12-11 22:42 - 00000000 ____D () C:\Users\Master of Desaster\Documents\The Witcher
2014-01-28 17:22 - 2013-12-04 12:37 - 00000000 ____D () C:\Users\Master of Desaster\Documents\Witcher 2
2014-01-28 17:22 - 2013-11-18 16:14 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\Skype
2014-01-28 17:22 - 2013-08-17 08:43 - 00000000 ____D () C:\Users\Master of Desaster\Documents\My Games
2014-01-28 17:21 - 2014-01-07 20:27 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\NBGI
2014-01-28 17:21 - 2014-01-02 10:58 - 00000000 ____D () C:\Program Files (x86)\K-Lite Codec Pack
2014-01-28 17:21 - 2014-01-02 08:19 - 00000000 ____D () C:\Program Files (x86)\AMD AVT
2014-01-28 17:21 - 2014-01-02 08:16 - 00000000 ____D () C:\Program Files\AMD
2014-01-28 17:21 - 2014-01-02 08:08 - 00000000 ____D () C:\ProgramData\Package Cache
2014-01-28 17:21 - 2014-01-02 08:07 - 00000000 ____D () C:\AMD
2014-01-28 17:21 - 2014-01-01 16:16 - 00000000 ____D () C:\Program Files (x86)\Ubisoft
2014-01-28 17:21 - 2013-12-16 16:32 - 00000000 ____D () C:\Program Files\QGIS Dufour
2014-01-28 17:21 - 2013-11-18 16:13 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-01-28 17:21 - 2013-11-18 16:13 - 00000000 ____D () C:\ProgramData\Skype
2014-01-28 17:21 - 2013-11-14 08:52 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\Atari
2014-01-28 17:21 - 2013-08-29 11:55 - 00000000 __RHD () C:\MSOCache
2014-01-28 17:21 - 2013-08-15 19:39 - 00000000 ____D () C:\ProgramData\Apple
2014-01-27 13:34 - 2013-08-15 15:04 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\Audible
2014-01-23 17:43 - 2013-08-16 14:41 - 00000108 _____ () C:\Users\Master of Desaster\AppData\default.pls
2014-01-22 10:07 - 2014-01-22 10:02 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\Darksiders2
2014-01-22 09:50 - 2013-08-15 20:37 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\MySQL
2014-01-22 07:43 - 2014-01-22 07:43 - 00000000 ____D () C:\ProgramData\McAfee
2014-01-21 07:56 - 2014-01-21 07:56 - 00000000 ____D () C:\Program Files (x86)\THQ
2014-01-20 19:55 - 2013-10-24 09:56 - 00000000 ____D () C:\Users\Master of Desaster\Desktop\Bewerbungen
2014-01-20 10:05 - 2014-01-20 10:03 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\Darksiders
2014-01-16 19:20 - 2014-01-01 16:17 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\Might & Magic Heroes VI
2014-01-15 19:02 - 2009-07-14 05:45 - 00417096 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-01-15 17:45 - 2013-08-15 14:52 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-15 17:43 - 2013-08-15 14:52 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-15 15:33 - 2014-01-08 10:43 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\Bioshock
2014-01-14 18:27 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-08 10:53 - 2014-01-08 10:43 - 00000000 ____D () C:\Users\Master of Desaster\Documents\Bioshock
2014-01-08 10:03 - 2013-08-15 14:23 - 00431428 _____ () C:\Windows\DirectX.log
2014-01-08 09:56 - 2013-08-16 21:32 - 00000000 ____D () C:\Spiele
2014-01-08 09:56 - 2013-08-15 14:12 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-01-08 09:55 - 2014-01-08 09:55 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\InstallShield
2014-01-07 20:28 - 2014-01-07 20:28 - 00000000 ____D () C:\Users\Master of Desaster\Documents\NBGI
2014-01-07 20:27 - 2013-09-30 14:46 - 00000000 ____D () C:\Program Files (x86)\Microsoft Games for Windows - LIVE
2014-01-03 17:26 - 2014-01-03 17:26 - 00000000 ____D () C:\Program Files (x86)\1C
2014-01-03 17:21 - 2014-01-03 17:21 - 00000000 ____D () C:\Xbow Software
2014-01-03 16:58 - 2014-01-03 16:53 - 22414108 _____ () C:\Users\Master of Desaster\Downloads\StarWolves2_GermanPatch1.zip
Some content of TEMP:
====================
C:\Users\Master of Desaster\AppData\Local\Temp\drm_dyndata_7340007.dll
C:\Users\Master of Desaster\AppData\Local\Temp\ICReinstall_DownloadAcceleratorSetup.exe
C:\Users\Master of Desaster\AppData\Local\Temp\_is4C4B.exe
C:\Users\Master of Desaster\AppData\Local\Temp\_is99AF.exe
C:\Users\Master of Desaster\AppData\Local\Temp\_isFAF1.exe
C:\Users\Master of Desaster\AppData\Local\Temp\_isFEA8.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-29 20:56
==================== End Of Log ============================
--- --- ---
--- --- ---
und die Addition.txt Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-02-2014 04
Ran by Master of Desaster at 2014-02-02 13:47:05
Running from C:\Users\Master of Desaster\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}
==================== Installed Programs ======================
Adobe Acrobat 8 Standard - English, Français, Deutsch (x32 Version: 8.0.0 - Adobe Systems)
Adobe Acrobat 8 Standard - English, Français, Deutsch (x32 Version: 8.0.0 - Adobe Systems) Hidden
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (x32 Version: 11.0.06 - Adobe Systems Incorporated)
Alan Wake (x32 Version: - Remedy Entertainment)
Amazon MP3-Downloader 1.0.18 (HKCU Version: 1.0.18 - Amazon Services LLC)
AMD Accelerated Video Transcoding (Version: 13.20.100.31206 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.938.2 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Control Center (x32 Version: 2013.1206.1603.28764 - Ihr Firmenname) Hidden
AMD Catalyst Install Manager (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.81206.1620 - Advanced Micro Devices, Inc.) Hidden
AMD Wireless Display v3.0 (Version: 1.0.0.14 - Advanced Micro Devices, Inc.) Hidden
Amnesia: The Dark Descent (x32 Version: - Frictional Games)
Apple Application Support (x32 Version: 3.0 - Apple Inc.)
Apple Mobile Device Support (Version: 7.1.0.32 - Apple Inc.)
Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.)
AudibleManager (x32 Version: 2010791118.48.56.10882282 - Audible, Inc.)
AVG 2014 (Version: 14.0.3684 - AVG Technologies) Hidden
AVG 2014 (Version: 14.0.4259 - AVG Technologies) Hidden
AVG 2014 (Version: 2014.0.4259 - AVG Technologies)
Biet-O-Matic v2.14.12 (x32 Version: 2.14.12 - BOM Development Team)
BioShock (x32 Version: 2.62.0000 - 2K Games)
BioShock Infinite (x32 Version: - Irrational Games)
Bonjour (Version: 3.0.0.10 - Apple Inc.)
Brothers - A Tale of Two Sons (x32 Version: - Starbreeze Studios AB)
Canon Inkjet Printer Driver Add-On Module V2.00 (Version: - )
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
ConvertHelper 2.2 (x32 Version: - DownloadHelper)
CPUID CPU-Z 1.64.0 (Version: - )
Dark Souls: Prepare to Die Edition (x32 Version: - FromSoftware)
Darksiders (x32 Version: - Vigil Games)
Darksiders II (x32 Version: - Vigil Games)
Dead Space™ (x32 Version: 1.0.222.0 - Electronic Arts)
Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition (Version: - Microsoft)
DeskPins (remove only) (x32 Version: - )
Deus Ex: Human Revolution (x32 Version: - Eidos Montreal)
Dishonored (x32 Version: 1.0 - Bethesda Softworks)
Dropbox (HKCU Version: 2.2.13 - Dropbox, Inc.)
Emsisoft Anti-Malware (x32 Version: 6.0 - Emsi Software GmbH)
EndNote X6 (x32 Version: 16.0.0.6348 - Thomson Reuters)
Free YouTube to MP3 Converter version 3.12.12.827 (x32 Version: 3.12.12.827 - DVDVideoSoft Ltd.)
Ghostbusters: The Video Game (x32 Version: - Terminal Reality)
Google Update Helper (x32 Version: 1.3.23.0 - DealPly Technologies Ltd) Hidden <==== ATTENTION
iTunes (Version: 11.1.4.62 - Apple Inc.)
Java 7 Update 25 (64-bit) (Version: 7.0.250 - Oracle)
K-Lite Codec Pack 10.2.0 Full (x32 Version: 10.2.0 - )
KMP Service (x32 Version: - KMP)
Lyrics-Pal (x32 Version: - LyricsPal Soft. LTD) <==== ATTENTION
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
Metro 2033 (x32 Version: - 4A Games)
Metro: Last Light (x32 Version: - 4A Games)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Games for Windows - LIVE Redistributable (x32 Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (x32 Version: 3.5.50.0 - Microsoft Corporation)
Microsoft Office Access MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 32-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 32-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (x32 Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (x32 Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Might & Magic: Heroes VI (x32 Version: - Blackhole)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation)
Nero 8 Essentials (x32 Version: 8.3.124 - Nero AG)
neroxml (x32 Version: 1.0.0 - Nero AG) Hidden
Neverwinter Nights 2 (x32 Version: 1.00.0000 - Obsidian)
NVIDIA PhysX (x32 Version: 9.13.0604 - NVIDIA Corporation)
Orcs Must Die! 2 (x32 Version: - Robot Entertainment)
Outlast (x32 Version: - Red Barrels)
PDF Architect (x32 Version: 1.1.83.9982 - pdfforge GmbH)
PDFCreator (x32 Version: 1.7.1 - pdfforge)
Picasa 3 (x32 Version: 3.9 - Google, Inc.)
Portal (x32 Version: - Valve)
Portal 2 (x32 Version: - Valve)
PowerDVD (x32 Version: 7.0.2414.0 - CyberLink Corporation)
QGIS Dufour 2.0.1 Dufour (Version: - QGIS Development Team)
QuickTime (x32 Version: 7.74.80.86 - Apple Inc.)
ResearchSoft Direct Export Helper (x32 Version: - )
Risen 2 - Dark Waters (x32 Version: - Piranha Bytes)
Secure Download Manager (x32 Version: 3.1.20 - Kivuto Solutions Inc.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version: - Microsoft) Hidden
SigmaPlot 10.0 (x32 Version: 10.0.0 - Systat Software, Inc.)
Skype™ 6.11 (x32 Version: 6.11.102 - Skype Technologies S.A.)
Steam (x32 Version: 1.0.0.0 - Valve Corporation)
SUPERAntiSpyware (Version: 5.6.1030 - SUPERAntiSpyware.com)
The Chronicles of Riddick: Assault on Dark Athena (x32 Version: - Starbreeze Studios AB)
The Elder Scrolls V: Skyrim (x32 Version: - Bethesda Game Studios)
The Inner World (x32 Version: - )
The KMPlayer (remove only) (x32 Version: 3.7.0.113 - KMP Media co., Ltd)
The Walking Dead (x32 Version: - )
The Witcher 2: Assassins of Kings Enhanced Edition (x32 Version: - CD Projekt RED)
The Witcher Enhanced Edition (x32 Version: 1.00.0000 - CD Projekt Red)
Titan Quest (x32 Version: - Iron Lore Entertainment)
Titan Quest: Immortal Throne (x32 Version: - Iron Lore Entertainment)
Torchlight II (x32 Version: - White Rabbit Interactive)
Trine 2 (x32 Version: - Frozenbyte)
Two Worlds II (x32 Version: - Reality Pump Studios)
Ubisoft Game Launcher (x32 Version: 1.0.0.0 - UBISOFT)
Update for Microsoft Access 2010 (KB2553446) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2810071) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2826026) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2810072) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Word 2010 (KB2837593) 64-Bit Edition (Version: - Microsoft)
VCRedistSetup (x32 Version: 1.0.0 - Nero AG) Hidden
Visual Studio 2010 x64 Redistributables (Version: 13.0.0.1 - AVG Technologies)
Visual Studio 2012 x64 Redistributables (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (x32 Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.0.7 (Version: 2.0.7 - VideoLAN)
Warhammer® 40,000™: Dawn of War® II - Chaos Rising™ (x32 Version: - Relic Entertainment)
Warhammer® 40,000™: Dawn of War® II – Retribution™ (x32 Version: - Relic Entertainment)
Warhammer® 40,000™: Dawn of War® II (x32 Version: - Relic Entertainment)
Winamp (x32 Version: 5.65 - Nullsoft, Inc)
Winamp Erkennungs-Plug-in (HKCU Version: 1.0.0.1 - Nullsoft, Inc)
Winamp Essentials Pack (x32 Version: v5.64 - Christoph Grether)
Windows Live ID Sign-in Assistant (Version: 6.500.3165.0 - Microsoft Corporation)
WinRAR (x32 Version: - )
x64 Components v4.2.2 (Version: 4.2.2 - Shark007)
Xfire (remove only) (x32 Version: - )
==================== Restore Points =========================
21-01-2014 06:53:44 Microsoft Visual C++ 2005 Redistributable wird installiert
21-01-2014 06:56:15 Installed DarksidersInstaller.
28-01-2014 21:06:39 Geplanter Prüfpunkt
29-01-2014 21:19:00 Windows Update
30-01-2014 16:12:20 Windows Update
01-02-2014 15:30:37 Windows Update
==================== Hosts content: ==========================
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {1CB9C954-B0D7-45AE-8B83-7519F5B1825F} - System32\Tasks\Apple\AppleSoftwareUpdate => c:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {8CE39ED2-DD40-4B15-AF76-A811A75F4F73} - System32\Tasks\{14BBE0E6-EF0F-4F8C-A518-200CE967060A} => Firefox.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&ver=6.10.0.104&LastError=12007
Task: {8E90FA96-BDCB-495B-A0A2-BE02B39D2B4D} - System32\Tasks\{435EE627-87A3-402F-B74E-57D291748A61} => Firefox.exe hxxp://ui.skype.com/ui/0/6.11.0.102/de/abandoninstall?source=lightinstaller&page=tsInstall
Task: {9BE95EDC-855E-45A0-A97E-E2F0C217F97D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-11] (Adobe Systems Incorporated)
Task: {BB69E8A4-909B-471F-87D4-E1C39C445536} - \Dealply No Task File
Task: {C9BD0143-5E25-41C5-B340-1841E04FBD34} - \DealPlyUpdate No Task File
Task: {DD933F73-5CF0-4711-859A-B0889362368B} - System32\Tasks\{00F22BFA-20E6-4FFC-8D1C-193B91792321} => Firefox.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&ver=6.10.0.104&LastError=12007
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2013-08-15 20:53 - 2006-12-11 01:14 - 00043008 _____ () C:\Program Files (x86)\WinRAR\rarext64.dll
2014-01-20 13:17 - 2014-01-20 13:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 13:16 - 2014-01-20 13:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-10-22 09:42 - 2012-10-22 10:21 - 01277952 _____ () C:\Program Files (x86)\PANDORA.TV\PanService\avformat-53.dll
2013-10-22 09:42 - 2012-07-09 16:57 - 02090496 _____ () C:\Program Files (x86)\PANDORA.TV\PanService\avcodec-53.dll
2013-10-22 09:42 - 2011-12-06 15:19 - 00133632 _____ () C:\Program Files (x86)\PANDORA.TV\PanService\avutil-51.dll
2013-10-22 09:42 - 2012-03-23 09:07 - 00224768 _____ () C:\Program Files (x86)\PANDORA.TV\PanService\libupnp.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData:gs5sys
AlternateDataStreams: C:\Users\All Users:gs5sys
AlternateDataStreams: C:\Users\Master of Desaster:gs5sys
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:gs5sys
AlternateDataStreams: C:\ProgramData\Application Data:gs5sys
AlternateDataStreams: C:\ProgramData\Templates:gs5sys
AlternateDataStreams: C:\ProgramData\Vorlagen:gs5sys
AlternateDataStreams: C:\Users\Master of Desaster\Anwendungsdaten:gs5sys
AlternateDataStreams: C:\Users\Master of Desaster\Cookies:gs5sys
AlternateDataStreams: C:\Users\Master of Desaster\Lokale Einstellungen:gs5sys
AlternateDataStreams: C:\Users\Master of Desaster\Vorlagen:gs5sys
AlternateDataStreams: C:\Users\Master of Desaster\Desktop\desktop.ini:gs5sys
AlternateDataStreams: C:\Users\Master of Desaster\AppData\Local:gs5sys
AlternateDataStreams: C:\Users\Master of Desaster\AppData\Roaming:gs5sys
AlternateDataStreams: C:\Users\Master of Desaster\AppData\Local\Anwendungsdaten:gs5sys
AlternateDataStreams: C:\Users\Master of Desaster\AppData\Local\Verlauf:gs5sys
AlternateDataStreams: C:\Users\Master of Desaster\Documents\desktop.ini:gs5sys
AlternateDataStreams: C:\Users\Public\Documents\desktop.ini:gs5sys
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys => ""="Driver"
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (02/02/2014 01:24:06 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.16428, Zeitstempel: 0x525b664c
Name des fehlerhaften Moduls: aticfx32.dll, Version: 8.17.10.1247, Zeitstempel: 0x52a23930
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0008f3cd
ID des fehlerhaften Prozesses: 0xe84
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3
Error: (02/02/2014 01:22:02 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.16428, Zeitstempel: 0x525b664c
Name des fehlerhaften Moduls: aticfx32.dll, Version: 8.17.10.1247, Zeitstempel: 0x52a23930
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0008f3cd
ID des fehlerhaften Prozesses: 0x14f4
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3
Error: (02/02/2014 01:22:02 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.16428, Zeitstempel: 0x525b664c
Name des fehlerhaften Moduls: aticfx32.dll, Version: 8.17.10.1247, Zeitstempel: 0x52a23930
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0008f3cd
ID des fehlerhaften Prozesses: 0x50c
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3
Error: (02/02/2014 01:21:54 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.16428, Zeitstempel: 0x525b664c
Name des fehlerhaften Moduls: aticfx32.dll, Version: 8.17.10.1247, Zeitstempel: 0x52a23930
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0008f3cd
ID des fehlerhaften Prozesses: 0x1330
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3
Error: (02/02/2014 01:07:10 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/02/2014 01:06:28 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: ConversionService.exe, Version: 1.1.83.9982, Zeitstempel: 0x5162ddc7
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0034d8c8
ID des fehlerhaften Prozesses: 0x9fc
Startzeit der fehlerhaften Anwendung: 0xConversionService.exe0
Pfad der fehlerhaften Anwendung: ConversionService.exe1
Pfad des fehlerhaften Moduls: ConversionService.exe2
Berichtskennung: ConversionService.exe3
Error: (02/02/2014 01:06:14 PM) (Source: KMPService.exe) (User: )
Description: Socket Error # 11001
Host not found.
Error: (02/02/2014 10:02:01 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: BioShockInfinite.exe, Version: 1.1.24.21018, Zeitstempel: 0x52ab5a1a
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0x107c
Startzeit der fehlerhaften Anwendung: 0xBioShockInfinite.exe0
Pfad der fehlerhaften Anwendung: BioShockInfinite.exe1
Pfad des fehlerhaften Moduls: BioShockInfinite.exe2
Berichtskennung: BioShockInfinite.exe3
Error: (02/02/2014 10:00:50 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: BioShockInfinite.exe, Version: 1.1.24.21018, Zeitstempel: 0x52ab5a1a
Name des fehlerhaften Moduls: BioShockInfinite.exe, Version: 1.1.24.21018, Zeitstempel: 0x52ab5a1a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x005c4c87
ID des fehlerhaften Prozesses: 0xd04
Startzeit der fehlerhaften Anwendung: 0xBioShockInfinite.exe0
Pfad der fehlerhaften Anwendung: BioShockInfinite.exe1
Pfad des fehlerhaften Moduls: BioShockInfinite.exe2
Berichtskennung: BioShockInfinite.exe3
Error: (02/02/2014 10:00:42 AM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall
System errors:
=============
Error: (02/02/2014 01:06:32 PM) (Source: Service Control Manager) (User: )
Description: Dienst "PDF Architect Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (02/02/2014 10:00:41 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (02/02/2014 10:00:41 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht.
Error: (02/02/2014 09:57:41 AM) (Source: BugCheck) (User: )
Description: 0x0000001e (0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000)C:\Windows\MEMORY.DMP020214-64412-01
Error: (02/02/2014 09:54:42 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "AVGIDSAgent" wurde mit folgendem dienstspezifischem Fehler beendet: %%-536753637.
Error: (02/02/2014 09:54:24 AM) (Source: BugCheck) (User: )
Description: 0x0000007e (0xffffffffc0000096, 0xfffff80002ec37d4, 0xfffff880033167a8, 0xfffff88003316000)C:\Windows\MEMORY.DMP020214-26707-01
Error: (02/02/2014 09:52:14 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DNS-Client" ist vom Dienst "NetIO-Legacy-TDI-Supporttreiber" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%577
Error: (02/02/2014 09:52:14 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "NetIO-Legacy-TDI-Supporttreiber" wurde aufgrund folgenden Fehlers nicht gestartet:
%%577
Error: (02/02/2014 09:52:13 AM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
Avgldx64
Avgtdia
NetBT
Psched
tdx
Error: (02/02/2014 09:52:02 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "AVGIDSAgent" wurde mit folgendem dienstspezifischem Fehler beendet: %%-536753637.
Microsoft Office Sessions:
=========================
Error: (02/02/2014 01:24:06 PM) (Source: Application Error)(User: )
Description: IEXPLORE.EXE11.0.9600.16428525b664caticfx32.dll8.17.10.124752a23930c00000050008f3cde8401cf201198f038e3C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Windows\system32\aticfx32.dlle84a3b30-8c04-11e3-ba8d-0021850a468a
Error: (02/02/2014 01:22:02 PM) (Source: Application Error)(User: )
Description: IEXPLORE.EXE11.0.9600.16428525b664caticfx32.dll8.17.10.124752a23930c00000050008f3cd14f401cf2010756b51e5C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Windows\system32\aticfx32.dll9e2a1425-8c04-11e3-ba8d-0021850a468a
Error: (02/02/2014 01:22:02 PM) (Source: Application Error)(User: )
Description: IEXPLORE.EXE11.0.9600.16428525b664caticfx32.dll8.17.10.124752a23930c00000050008f3cd50c01cf20112601ea63C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Windows\system32\aticfx32.dll9e258033-8c04-11e3-ba8d-0021850a468a
Error: (02/02/2014 01:21:54 PM) (Source: Application Error)(User: )
Description: IEXPLORE.EXE11.0.9600.16428525b664caticfx32.dll8.17.10.124752a23930c00000050008f3cd133001cf20110b9ceff3C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Windows\system32\aticfx32.dll99a93613-8c04-11e3-ba8d-0021850a468a
Error: (02/02/2014 01:07:10 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/02/2014 01:06:28 PM) (Source: Application Error)(User: )
Description: ConversionService.exe1.1.83.99825162ddc7unknown0.0.0.000000000c00000050034d8c89fc01cf200f2a0a1255C:\Program Files (x86)\PDF Architect\ConversionService.exeunknown718d484f-8c02-11e3-ba8d-0021850a468a
Error: (02/02/2014 01:06:14 PM) (Source: KMPService.exe)(User: )
Description: Socket Error # 11001
Host not found.
Error: (02/02/2014 10:02:01 AM) (Source: Application Error)(User: )
Description: BioShockInfinite.exe1.1.24.2101852ab5a1aunknown0.0.0.000000000c000000500000000107c01cf1ff5699a56eaC:\Program Files (x86)\Steam\steamapps\common\BioShock Infinite\Binaries\Win32\BioShockInfinite.exeunknownad4c2b44-8be8-11e3-819c-0021850a468a
Error: (02/02/2014 10:00:50 AM) (Source: Application Error)(User: )
Description: BioShockInfinite.exe1.1.24.2101852ab5a1aBioShockInfinite.exe1.1.24.2101852ab5a1ac0000005005c4c87d0401cf1ff53e4b2082C:\Program Files (x86)\Steam\steamapps\common\BioShock Infinite\Binaries\Win32\BioShockInfinite.exeC:\Program Files (x86)\Steam\steamapps\common\BioShock Infinite\Binaries\Win32\BioShockInfinite.exe8319b3a7-8be8-11e3-819c-0021850a468a
Error: (02/02/2014 10:00:42 AM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall
CodeIntegrity Errors:
===================================
Date: 2014-02-02 09:52:14.641
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tdx.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-02-02 09:52:14.602
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tdx.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-02-02 09:51:15.269
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-02-02 09:51:15.222
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-02-02 09:51:15.176
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\netbt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-02-02 09:51:15.144
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\netbt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-02-02 09:51:15.098
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\avgtdia.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-02-02 09:51:15.066
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\avgtdia.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-02-02 09:51:15.020
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tdx.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-02-02 09:51:14.988
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tdx.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 20%
Total physical RAM: 8190.18 MB
Available physical RAM: 6491.63 MB
Total Pagefile: 16378.53 MB
Available Pagefile: 14347.82 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB
==================== Drives ================================
Drive c: (Hort des Chaos) (Fixed) (Total:465.66 GB) (Free:127.73 GB) NTFS
Drive d: (BIOSHOCK) (CDROM) (Total:4.38 GB) (Free:0 GB) UDF
Drive e: (GUARDIAN_OF_THE_SPIRIT_5) (CDROM) (Total:7.13 GB) (Free:0 GB) UDF
Drive i: (ASGARD) (Fixed) (Total:465.65 GB) (Free:108.86 GB) FAT32
Drive j: (BIFRÖST) (Removable) (Total:14.95 GB) (Free:14.23 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 341942CD)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=466 GB) - (Type=07 NTFS)
========================================================
Disk: 4 (MBR Code: Windows XP) (Size: 466 GB) (Disk ID: EAB39E2C)
Partition 1: (Active) - (Size=466 GB) - (Type=0C)
========================================================
Disk: 5 (Size: 15 GB) (Disk ID: 00000000)
Partition 1: (Not Active) - (Size=15 GB) - (Type=0C)
==================== End Of Log ============================
Und zu guter letzt die Logfile von GMER
[code]
GMER Logfile: Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-02-02 14:12:37
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP4T0L0-4 WDC_WD5000AACS-00ZUB0 rev.01.01B01 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\MASTER~1\AppData\Local\Temp\axldyfob.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff8000d7f0000 45 bytes [00, 00, 15, 02, 46, 69, 6C, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575 fffff8000d7f002f 16 bytes [00, 00, 00, 00, 00, 00, 00, ...]
---- User code sections - GMER 2.1 ----
.text C:\Windows\system32\csrss.exe[764] C:\Windows\system32\GDI32.dll!GetRandomRgn + 116 000007fefce921dc 1 byte [35]
.text C:\Windows\System32\spoolsv.exe[1688] C:\Windows\System32\spoolsv.exe!PrvEnumPortsW + 457 00000000ffa5d65d 1 byte [72]
.text C:\Windows\System32\spoolsv.exe[1688] C:\Windows\System32\spoolsv.exe!PrvConfigurePortW + 214 00000000ffa5dc16 1 byte [20]
.text C:\Program Files (x86)\PANDORA.TV\PanService\KMPService.exe[2428] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000767c1465 2 bytes [7C, 76]
.text C:\Program Files (x86)\PANDORA.TV\PanService\KMPService.exe[2428] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000767c14bb 2 bytes [7C, 76]
.text ... * 2
.text C:\Program Files (x86)\PANDORA.TV\PanService\KMPProcess.exe[3152] C:\Program Files (x86)\PANDORA.TV\PanService\avformat-53.dll!ff_http_auth_create_response + 294 000000006ab32c36 4 bytes [24, D9, B9, 68]
.text C:\Program Files (x86)\PANDORA.TV\PanService\KMPProcess.exe[3152] C:\Program Files (x86)\PANDORA.TV\PanService\avformat-53.dll!ff_mp4_read_dec_config_descr + 435 000000006ab37e43 4 bytes [74, 4C, 09, 66]
.text C:\Program Files (x86)\PANDORA.TV\PanService\KMPProcess.exe[3152] C:\Program Files (x86)\PANDORA.TV\PanService\avformat-53.dll!ff_nut_add_sp + 70 000000006ab75de6 4 bytes [20, EF, B9, 68]
.text C:\Program Files (x86)\PANDORA.TV\PanService\KMPProcess.exe[3152] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000767c1465 2 bytes [7C, 76]
.text C:\Program Files (x86)\PANDORA.TV\PanService\KMPProcess.exe[3152] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000767c14bb 2 bytes [7C, 76]
.text ... * 2
---- EOF - GMER 2.1 ----
--- --- ---
Danke schonmal im Vorraus.
Liebe Grüße
Holger Saar |
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
SecurityCheck und:
