Trojaner-Board - Laptop fährt hoch, CPU-Auslastung dauerhaft 100% und hängt sich dann auf; im abgesicherten Modus alles ok

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Laptop fährt hoch, CPU-Auslastung dauerhaft 100% und hängt sich dann auf; im abgesicherten Modus alles ok (https://www.trojaner-board.de/168743-laptop-faehrt-hoch-cpu-auslastung-dauerhaft-100-haengt-dann-abgesicherten-modus-alles-ok.html)

Laptop fährt hoch, CPU-Auslastung dauerhaft 100% und hängt sich dann auf; im abgesicherten Modus alles ok

Hi,

mein Laptop ist schon 7-8 Jahre alt und es ist auch ne Menge drauf, aber seit ein paar Tagen bekomme ich das Ding kaum noch zum Laufen.

Ich fahre ihn hoch, dann rattert das Ding ohne Ende bei dauerhafter 100% Auslastung der CPU. Laut Task Manager hauptsächlich mehrere svchost.exe - Prozesse. Irgendwann bleibt er dann einfach stehen oder es kommt Blue Screen.

Im Abgesicherten Modus ist alles ok. Anbei 2 Log-Files. GMER bekomme ich leider nicht zum Laufen.

Reicht euch das für die erste Diagnose?

Hi und :hallo:

Logs bitte nicht anhängen, notfalls splitten und über mehrere Postings verteilt posten

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

http://www.trojaner-board.de/picture...&pictureid=307

FRST.txt:
FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-07-2015

Ran by noki (administrator) on NOKI-PC on 16-07-2015 00:54:05

Running from D:\

Loaded Profiles: noki & postgres (Available Profiles: noki & postgres)

Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)

Internet Explorer Version 9 (Default browser: IE)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Geeks to Go Forum

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe

() C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe

() C:\Program Files\ASUS\ATK Hotkey\AsLdrSrv.exe

() C:\Program Files\ATKGFNEX\GFNEXSrv.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(ASUS) C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe

(ASUS) C:\Program Files\ASUS\ATK Hotkey\HControl.exe

() C:\Program Files\Wireless Console 2\wcourier.exe

(ATK) C:\Program Files\P4G\BatteryLife.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

() C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1db.exe

(MAGIX AG) C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe

(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe

(ASUS) C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe

(ASUS) C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe

(ASUS) C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe

(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe

(ASUS) C:\Program Files\ASUS\ATK Hotkey\KBFiltr.exe

(ASUS) C:\Program Files\ASUS\ATK Hotkey\WDC.exe

(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

() C:\Program Files\P4P\P4P.exe

(ASUSTek.) C:\Program Files\ASUS\Direct Console\Direct Console.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

() C:\Program Files\Dell Printers\OpenManage\OMPMv2.0\client\OMPMWatchdogService.exe

(Dell Inc.) C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1pl.exe

(Nuance Communications, Inc.) C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe

(Nuance Communications, Inc.) C:\Program Files\Nuance\PaperPort\pptd40nt.exe

(Nuance Communications, Inc.) C:\Program Files\Nuance\PDFViewer\PdfPro7Hook.exe

(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(Microsoft Corporation) C:\Windows\ehome\ehtray.exe

(TomTom) C:\Program Files\MyDrive Connect\MyDriveConnect.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\8.4\bin\pg_ctl.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

(Panasonic Corporation) C:\Program Files\Common Files\Panasonic\HD Writer AutoStart\HDWriterAutoStart.exe

(Logitech Inc.) C:\Program Files\SetPoint\SetPoint.exe

() C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\8.4\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\8.4\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\8.4\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\8.4\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\8.4\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\8.4\bin\postgres.exe

(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe

(Microsoft Corporation) C:\Windows\System32\iashost.exe

(Logitech Inc.) C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avmailc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe

(Nokia) C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

(Nokia) C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe

(Nokia) C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe

(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Microsoft Corporation) C:\Windows\System32\wuauclt.exe

(Nokia) C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe

(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe

(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe

(Microsoft Corporation) C:\Windows\System32\msiexec.exe
 

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [HControlUser] => C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe [98304 2008-08-18] (ASUS)

HKLM\...\Run: [ATKOSD2] => C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe [8105984 2008-09-03] (ASUS)

HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [6265376 2008-08-12] (Realtek Semiconductor)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1029416 2007-12-06] (Synaptics, Inc.)

HKLM\...\Run: [PowerForPhone] => C:\Program Files\P4P\P4P.exe [778240 2008-01-26] ()

HKLM\...\Run: [DirectConsole2] => C:\Program Files\ASUS\Direct Console\Direct Console.exe [2705976 2008-08-21] (ASUSTek.)

HKLM\...\Run: [TrayServer] => C:\Program Files\MAGIX\Filme_auf_DVD_8\TrayServer.exe [90112 2008-01-17] (MAGIX AG)

HKLM\...\Run: [Kernel and Hardware Abstraction Layer] => C:\Windows\KHALMNPR.EXE [56080 2007-04-12] (Logitech Inc.)

HKLM\...\Run: [ALDI_NORD_FotoSuite_Download] => C:\Program Files\ALDI Nord Foto Service\ALDI_Foto_Service\FotoSuite.exe [1257472 2008-11-13] (MAGIX AG)

HKLM\...\Run: [NeroFilterCheck] => C:\Windows\system32\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)

HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1833504 2008-08-12] (Realtek Semiconductor Corp.)

HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-04-23] (Apple Inc.)

HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [730416 2015-06-10] (Avira Operations GmbH & Co. KG)

HKLM\...\Run: [Greenshot] => C:\Program Files\Greenshot\Greenshot.exe [495616 2013-10-27] (Greenshot)

HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-05-26] (Apple Inc.)

HKLM\...\Run: [LauncherC1765nf] => C:\Program Files\Dell Printers\Printer SSW\Launcher\dlm1launcher.exe [2471928 2013-08-13] (Dell Inc.)

HKLM\...\Run: [StatusAutoRunC1765nf] => C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1pl.exe [3024360 2013-02-06] (Dell Inc.)

HKLM\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\\isuspm.exe [2068856 2011-10-12] (Flexera Software LLC.)

HKLM\...\Run: [PaperPort PTD] => C:\Program Files\Nuance\PaperPort\pptd40nt.exe [36168 2013-05-29] (Nuance Communications, Inc.)

HKLM\...\Run: [IndexSearch] => C:\Program Files\Nuance\PaperPort\IndexSearch.exe [18248 2013-05-29] (Nuance Communications, Inc.)

HKLM\...\Run: [PPort14reminder] => C:\Program Files\Nuance\PaperPort\Ereg\Ereg.exe [330056 2013-03-14] (Nuance Communications, Inc.)

HKLM\...\Run: [PDFProHook] => C:\Program Files\Nuance\PDFViewer\pdfpro7hook.exe [641864 2013-03-20] (Nuance Communications, Inc.)

HKLM\...\Run: [InstallValidator.exe.FA87EC44_C38F_4148_93A1_FF4A64A2B707] => C:\Program Files\National Instruments\Shared\NIUninstaller\InstallValidator.exe [265608 2013-11-21] ()

HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)

HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)

HKU\S-1-5-21-1619064115-466689268-4177747022-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)

HKU\S-1-5-21-1619064115-466689268-4177747022-1000\...\Run: [] => [X]

HKU\S-1-5-21-1619064115-466689268-4177747022-1000\...\Run: [NokiaSuite.exe] => C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe [1084840 2012-05-16] (Nokia)

HKU\S-1-5-21-1619064115-466689268-4177747022-1000\...\Run: [MyDriveConnect.exe] => C:\Program Files\MyDrive Connect\MyDriveConnect.exe [1792376 2014-08-22] (TomTom)

HKU\S-1-5-21-1619064115-466689268-4177747022-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk [2009-03-25]

ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2008-12-04]

ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HD Writer.lnk [2013-03-29]

ShortcutTarget: HD Writer.lnk -> C:\Program Files\Common Files\Panasonic\HD Writer AutoStart\HDWriterAutoStart.exe (Panasonic Corporation)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SetPoint.lnk [2008-12-04]

ShortcutTarget: SetPoint.lnk -> C:\Program Files\SetPoint\SetPoint.exe (Logitech Inc.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk [2014-12-21]

ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files\WISO\Steuersoftware 2014\mshaktuell.exe ()

ShellIconOverlayIdentifiers: [ADSMOverlayIcon] -> {A825576B-0042-4F0F-8FB0-93CE0F054E69} => C:\Program Files\ASUS\ASUS Data Security Manager\OverlayIconShlExt.dll [2007-06-15] ()

ShellIconOverlayIdentifiers: [ADSMOverlayIcon1] -> {A8D448F4-0431-45AC-9F5E-E1B434AB2249} => C:\Program Files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll [2007-06-02] ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\S-1-5-21-1619064115-466689268-4177747022-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Google

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = MSN Deutschland ? mit Hotmail Nachfolger Outlook und Messenger Skype

HKU\S-1-5-21-1619064115-466689268-4177747022-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\S-1-5-21-1619064115-466689268-4177747022-1000\Software\Microsoft\Internet Explorer\Main,Start Page = Wetter aktuell, Wettervorhersage und Wetterbericht - WetterOnline

SearchScopes: HKLM -> DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = {searchTerms} - Google Search

SearchScopes: HKLM -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = {searchTerms} - Google Search

SearchScopes: HKU\S-1-5-21-1619064115-466689268-4177747022-1000 -> DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = {searchTerms} - Google Search

SearchScopes: HKU\S-1-5-21-1619064115-466689268-4177747022-1000 -> {42F85EF5-86CF-4D1F-B473-ACDA9AD99AC8} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=93c032c4-0bf8-430e-ad40-0dc3b271a391&apn_sauid=0A1FD2C1-4874-4C04-BADE-CB4863AF08D4

SearchScopes: HKU\S-1-5-21-1619064115-466689268-4177747022-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = {searchTerms} - Google Search

BHO: PlusIEEventHelper Class -> {551A852F-39A6-44A7-9C13-AFBEC9185A9D} -> C:\Program Files\Nuance\PDFViewer\Bin\PlusIEContextMenu.dll [2011-06-30] (Zeon Corporation)

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-05-21] (Oracle Corporation)

BHO: Skype Plug-In -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-11-22] (Skype Technologies S.A.)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-05-21] (Oracle Corporation)

Toolbar: HKU\S-1-5-21-1619064115-466689268-4177747022-1000 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File

DPF: {22E5D91F-89E6-4405-AD9C-0AF27BA6F06B} file:///E:/components/hidinputmonitorx.ocx

DPF: {4F63D44B-6274-4D60-8AB1-CAA7116B8AF3} file:///E:/components/A9.ocx

DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1375990510233

DPF: {7030CC6C-1A88-4591-BB5A-651B9F7F0C30} file:///E:/components/wmvhdrating.ocx

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-11-22] (Skype Technologies S.A.)

ShellExecuteHooks:  - {AEB6717E-7E19-11d0-97EE-00C04FD91972} -  No File [ ]

Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2012-12-02] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2012-12-02] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2012-12-02] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2012-12-02] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2012-12-02] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2012-12-02] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2012-12-02] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2012-12-02] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 20 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2012-12-02] (Avira Operations GmbH & Co. KG)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

Tcpip\..\Interfaces\{FEA61DD9-6138-4BB7-83A2-5A1E647F7064}: [DhcpNameServer] 192.168.178.1

FireFox:

========

FF ProfilePath: C:\Users\noki\AppData\Roaming\Mozilla\Firefox\Profiles\p25m8g9e.default

FF SearchEngineOrder.1: Ask.com

FF SelectedSearchEngine: Ask.com

FF Homepage: hxxp://www.wetteronline.de

FF Keyword.URL: 

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_191.dll [2015-07-09] ()

FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2014-02-21] ()

FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)

FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-21] (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-21] (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)

FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-30] (Microsoft Corporation)

FF Plugin: @nokia.com/EnablerPlugin -> C:\Program Files\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll [2012-05-16] ( )

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)

FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-04-30] (Adobe Systems Inc.)

FF Plugin: ZEON/PDF,version=2.0 -> C:\Program Files\Nuance\PDFViewer\bin\nppdf.dll [2011-07-15] (Zeon Corporation)

FF Plugin HKU\S-1-5-21-1619064115-466689268-4177747022-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin1017325.dll [2012-10-04] (Amazon.com, Inc.)

FF Extension: Avira Browser Safety - C:\Users\noki\AppData\Roaming\Mozilla\Firefox\Profiles\p25m8g9e.default\Extensions\abs@avira.com [2015-06-18]

FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-02-17]

FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\itms.js [2015-05-03]

Chrome: 

=======

CHR Profile: C:\Users\noki\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (YouTube) - C:\Users\noki\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-08-25]

CHR Extension: (Google Search) - C:\Users\noki\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-08-25]

CHR Extension: (Gmail) - C:\Users\noki\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-08-25]

CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [68096 2009-03-25] () [File not signed]

R2 ADSMService; C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe [73728 2007-05-18] () [File not signed]

R2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc.exe [825136 2015-06-10] (Avira Operations GmbH & Co. KG)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [450808 2015-06-10] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [450808 2015-06-10] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1187336 2015-06-10] (Avira Operations GmbH & Co. KG)

R2 ASLDRService; C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe [100920 2008-08-14] ()

R2 ATKGFNEXSrv; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [94208 2007-08-08] () [File not signed]

R2 DLNBDB; C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1db.exe [191464 2013-02-06] ()

R2 Fabs; C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe [1155072 2009-02-03] (MAGIX AG) [File not signed]

S3 FirebirdServerMAGIXInstance; C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2008-08-07] (MAGIX®) [File not signed]

R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728 2008-06-09] (Hewlett-Packard Company) [File not signed]

S2 OMPM Service; C:\Program Files\Dell Printers\OpenManage\OMPMv2.0\client\rdmf_clientd.exe [5738823 2014-03-06] () [File not signed]

S2 OMPMJBASSVC; C:\Program Files\Dell Printers\OpenManage\OMPMv2.0\server\jboss-as\bin\jbosssvc.exe [61440 2011-08-11] (Red Hat®, Inc.) [File not signed]

R2 OMPMWatchdogService; C:\Program Files\Dell Printers\OpenManage\OMPMv2.0\client\OMPMWatchdogService.exe [199633 2014-03-18] () [File not signed]

R2 PDFProFiltSrvPP; C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe [77640 2013-05-29] (Nuance Communications, Inc.)

R2 postgresql-8.4; C:\Program Files\PostgreSQL\8.4\bin\pg_ctl.exe [66048 2012-08-16] (PostgreSQL Global Development Group) [File not signed]

R2 spmgr; C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe [125496 2007-08-03] ()

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-21] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 61883; C:\Windows\System32\DRIVERS\61883.sys [45696 2008-01-21] (Microsoft Corporation)

R0 AsDsm; C:\Windows\system32\Drivers\AsDsm.sys [29752 2007-08-11] (Windows (R) Codename Longhorn DDK provider)

R2 ASMMAP; C:\Program Files\ATKGFNEX\ASMMAP.sys [13880 2007-07-24] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108448 2015-06-10] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136728 2015-06-10] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37896 2015-05-07] (Avira Operations GmbH & Co. KG)

R2 ghaio; C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys [20936 2007-08-03] ()

S3 GigasetGenericUSB; C:\Windows\System32\DRIVERS\GigasetGenericUSB.sys [44032 2009-02-20] (Siemens Home and Office Communication Devices GmbH & Co. KG)

R3 itecir; C:\Windows\System32\DRIVERS\itecir.sys [54784 2007-12-19] (ITE Tech. Inc. )

R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15928 2008-06-03] ( )

R0 lullaby; C:\Windows\System32\DRIVERS\lullaby.sys [15416 2008-05-29] (Windows (R) Codename Longhorn DDK provider)

R3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [28688 2007-04-12] (Logitech, Inc.)

R3 MTsensor; C:\Windows\System32\DRIVERS\ATKACPI.sys [7680 2006-12-14] (ATK0100)

S3 PhotoFrame; C:\Windows\System32\DRIVERS\PhotoFrame.sys [30464 2007-09-11] (ETC) [File not signed]

R0 PxHelp20; C:\Windows\System32\Drivers\PxHelp20.sys [45744 2011-10-04] (Rovi Corporation)

R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1748352 2008-06-09] ()

R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [31848 2015-06-10] (Avira Operations GmbH & Co. KG)

S3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [25984 2009-12-12] (The OpenVPN Project)

S3 USB28xxBGA; C:\Windows\System32\DRIVERS\emBDA.sys [530944 2008-03-06] (eMPIA Technology, Inc.)

S3 USB28xxOEM; C:\Windows\System32\DRIVERS\emOEM.sys [45696 2007-04-25] (eMPIA Technology, Inc.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)

S3 catchme; \??\C:\Users\noki\AppData\Local\Temp\catchme.sys [X]

S4 Eskgfroc; No ImagePath

S3 IpInIp; system32\DRIVERS\ipinip.sys [X]

S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]

S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-15 23:56 - 2015-07-15 23:56 - 00004880 ____N C:\bootex.log

2015-07-15 23:52 - 2015-07-15 23:52 - 00000000 __SHD C:\found.002

2015-07-15 23:14 - 2015-07-15 23:14 - 00160408 _____ C:\Windows\Minidump\Mini071515-01.dmp

2015-07-15 23:09 - 2015-06-23 18:02 - 00501248 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2015-07-15 22:49 - 2015-07-15 22:49 - 00000000 ____D C:\Users\noki\Documents\SapWorkDir

2015-07-15 22:28 - 2015-05-31 10:11 - 00225792 _____ (Microsoft Corporation) C:\Windows\system32\cewmdm.dll

2015-07-15 22:27 - 2015-07-16 00:54 - 00000000 ____D C:\FRST

2015-07-15 22:24 - 2015-07-15 22:24 - 00000000 _____ C:\Users\noki\defogger_reenable

2015-07-11 09:40 - 2015-07-11 09:40 - 00160408 _____ C:\Windows\Minidump\Mini071115-01.dmp

2015-07-08 22:09 - 2015-07-08 22:09 - 00160408 _____ C:\Windows\Minidump\Mini070815-01.dmp

2015-06-29 13:15 - 2015-06-29 13:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

2015-06-25 20:04 - 2015-06-25 20:04 - 00000000 __SHD C:\found.001

2015-06-25 07:37 - 2015-06-25 07:55 - 00000000 ___RD C:\Musik

2015-06-24 23:39 - 2015-06-24 23:39 - 00000000 __RSH C:\MSDOS.SYS

2015-06-24 23:39 - 2015-06-24 23:39 - 00000000 __RSH C:\IO.SYS

2015-06-19 20:35 - 2015-06-19 20:35 - 00160408 _____ C:\Windows\Minidump\Mini061915-01.dmp

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-16 00:50 - 2013-07-28 01:07 - 00000000 ____D C:\Windows\system32\MRT

2015-07-16 00:48 - 2010-11-19 14:55 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-07-16 00:48 - 2010-11-19 14:55 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-07-16 00:42 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2015-07-16 00:41 - 2006-11-02 15:01 - 00032606 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2015-07-16 00:35 - 2008-12-04 21:13 - 01517376 _____ C:\Windows\WindowsUpdate.log

2015-07-16 00:26 - 2012-04-06 09:10 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-07-16 00:01 - 2009-02-11 00:55 - 00151688 _____ C:\ProgramData\nvModes.001

2015-07-16 00:01 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

2015-07-16 00:01 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

2015-07-15 23:59 - 2009-02-11 00:54 - 00151688 _____ C:\ProgramData\nvModes.dat

2015-07-15 23:25 - 2014-07-28 13:45 - 00000000 _____ C:\sparkraw.log

2015-07-15 23:14 - 2010-01-16 01:49 - 00000000 ____D C:\Windows\Minidump

2015-07-15 23:13 - 2013-03-21 22:13 - 454217748 _____ C:\Windows\MEMORY.DMP

2015-07-15 22:56 - 2009-02-08 23:40 - 00114168 _____ C:\Users\noki\AppData\Local\GDIPFONTCACHEV1.DAT

2015-07-15 22:56 - 2006-11-02 14:47 - 00399544 _____ C:\Windows\system32\FNTCACHE.DAT

2015-07-15 22:50 - 2010-07-08 15:19 - 00000000 ____D C:\Program Files\OpenVPN

2015-07-15 22:49 - 2010-07-13 16:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Business Explorer

2015-07-15 22:49 - 2010-07-13 16:02 - 00000000 ____D C:\Users\noki\SapWorkDir

2015-07-15 22:27 - 2006-11-02 12:33 - 01567488 _____ C:\Windows\system32\PerfStringBackup.INI

2015-07-15 22:24 - 2009-02-08 23:39 - 00000000 ____D C:\Users\noki

2015-07-14 09:07 - 2008-12-04 21:14 - 00003613 _____ C:\Windows\bthservsdp.dat

2015-07-12 23:09 - 2009-02-12 00:34 - 00000000 ____D C:\Users\noki\AppData\Roaming\Adobe

2015-07-12 23:09 - 2009-02-08 23:43 - 00000000 ____D C:\ProgramData\Adobe

2015-07-09 07:23 - 2012-04-06 09:10 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2015-07-09 07:23 - 2011-05-16 08:44 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2015-07-07 08:08 - 2013-12-09 20:51 - 00000000 ____D C:\Users\noki\AppData\Local\Greenshot

2015-07-03 08:49 - 2006-11-02 12:24 - 127070192 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

2015-07-01 07:02 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\LogFiles

2015-06-29 13:15 - 2015-05-07 19:11 - 00001856 _____ C:\Users\Public\Desktop\Avira Antivirus.lnk

2015-06-23 13:27 - 2009-10-02 22:08 - 00246952 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2015-06-20 20:03 - 2014-08-25 12:33 - 00000000 ____D C:\Users\noki\AppData\Local\Adobe

==================== Files in the root of some directories =======

2007-06-12 20:34 - 2007-06-12 20:34 - 0035822 _____ () C:\Program Files\Common Files\ASPG_icon.ico

2008-05-22 19:35 - 2008-05-22 19:35 - 0051962 _____ () C:\Program Files\Common Files\banner.jpg

2008-08-09 00:48 - 2008-08-09 00:48 - 0090112 _____ () C:\Program Files\Common Files\CPInstallAction.dll

2014-05-15 23:10 - 2014-05-15 23:10 - 0000008 _____ () C:\Users\noki\AppData\Roaming\NMM-MetaData.db

2011-07-20 22:28 - 2012-06-03 17:36 - 0001188 _____ () C:\Users\noki\AppData\Local\crc32list11.txt

2010-03-14 13:04 - 2010-03-14 13:04 - 0000552 _____ () C:\Users\noki\AppData\Local\d3d8caps.dat

2013-01-13 13:53 - 2015-06-15 13:57 - 0000680 _____ () C:\Users\noki\AppData\Local\d3d9caps.dat

2009-02-09 00:23 - 2015-04-12 23:33 - 0103936 _____ () C:\Users\noki\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2013-02-22 22:44 - 2013-05-10 12:11 - 0004096 ____H () C:\Users\noki\AppData\Local\keyfile3.drm

2013-08-27 22:12 - 2013-08-27 22:12 - 0000011 _____ () C:\ProgramData\.tv7

2010-12-22 13:54 - 2010-12-22 13:54 - 0000056 ____H () C:\ProgramData\ezsidmv.dat

2009-02-11 00:55 - 2015-07-16 00:01 - 0151688 _____ () C:\ProgramData\nvModes.001

2009-02-11 00:54 - 2015-07-15 23:59 - 0151688 _____ () C:\ProgramData\nvModes.dat

Some files in TEMP:

====================

C:\Users\noki\AppData\Local\temp\A12003E4-7CB1-49C0-BD80-700AF775A509.exe

C:\Users\noki\AppData\Local\temp\avgnt.exe

C:\Users\noki\AppData\Local\temp\BBDEBD21-36D1-47A6-B80E-22B5655A2521.exe

C:\Users\noki\AppData\Local\temp\jre-7u11-windows-i586-iftw.exe

C:\Users\noki\AppData\Local\temp\jre-7u21-windows-i586-iftw.exe

C:\Users\noki\AppData\Local\temp\jre-7u51-windows-i586-iftw.exe

C:\Users\noki\AppData\Local\temp\jre-7u55-windows-i586-iftw.exe

C:\Users\noki\AppData\Local\temp\jre-7u67-windows-i586-iftw.exe

C:\Users\noki\AppData\Local\temp\jre-7u71-windows-i586-iftw.exe

C:\Users\noki\AppData\Local\temp\jre-8u31-windows-au.exe

C:\Users\noki\AppData\Local\temp\NOSEventMessages.dll

C:\Users\noki\AppData\Local\temp\SapSmartDel.exe

C:\Users\noki\AppData\Local\temp\vcredist_x86.exe

C:\Users\noki\AppData\Local\temp\_isF1ED.exe
 

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 

LastRegBack: 2015-07-16 00:04

==================== End of log ============================

--- --- ---

FRST Additions Logfile:
[CODE]Additional
FRST Logfile:

Code:

scan result of Farbar Recovery Scan Tool (x86) Version: 12-07-2015

Ran by noki at 2015-07-16 00:55:15

Running from D:\

Boot Mode: Normal

==========================================================

 

==================== Accounts: =============================

Administrator (S-1-5-21-1619064115-466689268-4177747022-500 - Administrator - Disabled)

Gast (S-1-5-21-1619064115-466689268-4177747022-501 - Limited - Disabled)

noki (S-1-5-21-1619064115-466689268-4177747022-1000 - Administrator - Enabled) => C:\Users\noki

postgres (S-1-5-21-1619064115-466689268-4177747022-1001 - Limited - Enabled) => C:\Users\postgres

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 17 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 17.0.0.191 - Adobe Systems Incorporated)

Adobe Flash Player 18 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 18.0.0.203 - Adobe Systems Incorporated)

Adobe Photoshop CS (HKLM\...\{EFB21DE7-8C19-4A88-BB28-A766E16493BC}) (Version: CS - Adobe Systems, Inc.)

Adobe Reader X (10.1.14) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.14 - Adobe Systems Incorporated)

Albelli Fotobücher (HKU\S-1-5-21-1619064115-466689268-4177747022-1000\...\{EE20E438-B675-4421-AB07-928F0EC9FB22}_is1) (Version: - Albelli)

ALDI NORD Bestellsoftware 4.13 (HKLM\...\ALDI NORD Bestellsoftware) (Version: 4.13 - ORWO Net)

ALDI Nord Foto Manager Free (HKLM\...\ALDI Nord Foto Manager Free D) (Version: 6.0.1.471 - MAGIX AG)

ALDI Nord Foto Service (HKLM\...\ALDI Nord Foto Service D) (Version: 1.13.0.111 - MAGIX AG)

ALDI Nord Online Druck Service (HKLM\...\ALDI Nord Online Druck Service D) (Version: 4.5.1.0 - MAGIX AG)

Amazon MP3-Downloader 1.0.17 (HKLM\...\Amazon MP3-Downloader) (Version: 1.0.17 - Amazon Services LLC)

Apple Application Support (HKLM\...\{D9DAD0FF-495A-472B-9F10-BAE430A26682}) (Version: 3.0.3 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{18D47FA1-0440-48D3-A7E0-DA09537FF471}) (Version: 7.1.1.3 - Apple Inc.)

Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

ASUS CopyProtect (HKLM\...\{6B77A7F6-DD63-4F13-A6FF-83137A5AC354}) (Version: 1.0.0008 - ASUS)

ASUS Data Security Manager (HKLM\...\{1C8521E5-5A7B-4A4E-A9CD-AD53116EAEE0}) (Version: 1.00.0006 - ASUS)

ASUS LifeFrame3 (HKLM\...\{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}) (Version: 3.0.13 - ASUS)

ASUS Live Update (HKLM\...\{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}) (Version: 2.5.6 - ASUS)

ASUS Power4Gear eXtreme (HKLM\...\{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}) (Version: 1.0.19 - ASUS)

ASUS SmartLogon (HKLM\...\{64452561-169F-4A36-A2FF-B5E118EC65F5}) (Version: 1.0.0005 - ASUS)

ASUS Virtual Camera (HKLM\...\{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}) (Version: 1.0.11 - ASUS)

ATK Generic Function Service (HKLM\...\{D3D54F3E-C5C3-443D-978F-87A72E5616E8}) (Version: 1.00.0008 - ATK)

ATK Hotkey (HKLM\...\{7C05592D-424B-46CB-B505-E0013E8E75C9}) (Version: 1.0.0042 - ASUS)

ATKOSD2 (HKLM\...\{3B05F2FB-745B-4012-ADF2-439F36B2E70B}) (Version: 7.0.0002 - ASUS)

Audacity 1.2.6 (HKLM\...\Audacity_is1) (Version: - )

AudibleManager (HKLM\...\AudibleManager) (Version: 49582374.-2.1996386486.1996385500 - Audible, Inc.)

Avira Antivirus (HKLM\...\Avira Antivirus) (Version: 15.0.11.579 - Avira Operations GmbH & Co. KG)

Bild Albelli Fotoservice (HKU\S-1-5-21-1619064115-466689268-4177747022-1000\...\{4E97552A-D0D2-47E3-B4A0-82E5A57A4198}_is1) (Version: - Bild Albelli)

CCleaner (HKLM\...\CCleaner) (Version: 3.01 - Piriform)

CDDRV_Installer (Version: 1.00.0000 - Logitech) Hidden

Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)

Dell C1765 Color MFP (HKLM\...\InstallShield_{B03A2793-A8FF-4242-B23D-88D2D5FAE56A}) (Version: 1.039.0 - Dell Inc.)

Dell C1765 Color MFP (Version: 1.039.0 - Dell Inc.) Hidden

Direct Console 2.0 (HKLM\...\{E616A5EE-B7F4-4807-800B-79EB4EB2182B}) (Version: 2.0.5 - ASUS)

Dolby Control Center (HKLM\...\{A23E5590-6799-437B-9723-2627BA800B6F}) (Version: 2.0.0706 - Dolby)

Express Gate (HKLM\...\{2862A3C1-0CD9-4D8B-A28C-8C337D4DD5EB}) (Version: 0.8.6.0 - devicevm)

Firebird SQL Server - MAGIX Edition (HKLM\...\{3E6F0CAD-EE38-42A5-9EEA-AE17A55BF2D4}) (Version: 2.1.23.0 - MAGIX AG)

FormatFactory 2.20 (HKLM\...\FormatFactory) (Version: 2.20 - Free Time)

Free M4a to MP3 Converter 8.2 (HKLM\...\Free M4a to MP3 Converter_is1) (Version: - ManiacTools.com)

Gigaset QuickSync (HKLM\...\{7b7e564b-0c70-4506-9ab6-b7a2044425ab}) (Version: 5.1.0001.14719 - Gigaset Communications GmbH)

Google Earth Plug-in (HKLM\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)

Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden

Google Update Helper (Version: 1.3.28.1 - Google Inc.) Hidden

Greenshot 1.1.6.2779 (HKLM\...\Greenshot_is1) (Version: 1.1.6.2779 - Greenshot)

HD Writer AE 4.0 (HKLM\...\{DAC69A3A-89E6-4B70-B486-B974C2C95BE9}) (Version: 4.00.022.1031 - Panasonic Corporation)

HijackThis 2.0.2 (HKLM\...\HijackThis) (Version: 2.0.2 - TrendMicro)

ITECIR (HKLM\...\{40580068-9B10-40B5-9548-536CE88AB23C}) (Version: 1.00.0000 - ITE)

iTunes (HKLM\...\{0718A90E-93AA-49AF-A4FE-0165ACD91DF0}) (Version: 11.2.2.3 - Apple Inc.)

Java 7 Update 67 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.670 - Oracle)

Java 8 Update 45 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)

KhalInstallWrapper (Version: 4.00.121 - Logitech) Hidden

LEGO MINDSTORMS EV3 (HKLM\...\LEGO_SW.{5B0CB826-E499-4E6B-94F0-75B6327ED934}) (Version: 1.0.0 - The LEGO Group)

LEGO MINDSTORMS EV3 Home Content (Version: 1.1.41 - The LEGO Group) Hidden

LEGO MINDSTORMS EV3 Home deutscher Support (Version: 1.1.41 - The LEGO Group) Hidden

LEGO MINDSTORMS EV3 Home Edition (Version: 1.1.41 - The LEGO Group) Hidden

LEGO MINDSTORMS EV3 Uninstaller (Version: 1.0.11 - The LEGO Group) Hidden

LEGO MINDSTORMS NXT Driver (HKLM\...\{FA2B75F7-6037-4C34-9F3B-3E4320C4CC61}) (Version: 1.20.111.0 - LEGO)

LightScribe System Software 1.14.17.1 (HKLM\...\{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}) (Version: 1.14.17.1 - LightScribe)

MAGIX Filme auf DVD 8 8.0.0.11 (D) (HKLM\...\MAGIX Filme auf DVD 8 D) (Version: 8.0.0.11 - MAGIX AG)

MAGIX Online Druck Service 3.4.3.0 (D) (HKLM\...\MAGIX Online Druck Service D) (Version: 3.4.3.0 - MAGIX AG)

MAGIX Screenshare 4.3.6.1987 (D) (HKLM\...\MAGIX Screenshare D) (Version: 4.3.6.1987 - MAGIX AG)

MAGIX USB-Videowandler 2 (HKLM\...\InstallShield_{91065458-A5CF-474C-9160-B44B974B3C25}) (Version: 1.00.0000 - MAGIX)

MAGIX USB-Videowandler 2 (Version: 1.00.0000 - MAGIX) Hidden

MAGIXUSB-Videowandler 2 Device Driver (HKLM\...\TVEpaDrv) (Version: - )

MediaManager (HKLM\...\MediaManager) (Version: 3.0.3 (60) - PacketVideo)

Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version: - Microsoft Corporation)

Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)

Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)

Microsoft Office Professional Edition 2003 (HKLM\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)

Microsoft redistributable runtime DLLs VS2005(x86) (HKLM\...\{C0DB380B-97B5-4BB8-AC8D-1835E61439B6}) (Version: 1.0.0.0 - SAP)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)

Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4048 (HKLM\...\{5B1F2843-B379-3FF2-B0D3-64DD143ED53A}) (Version: 9.0.30729.4048 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Mozilla Firefox 37.0.1 (x86 de) (HKLM\...\Mozilla Firefox 37.0.1 (x86 de)) (Version: 37.0.1 - Mozilla)

Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)

MSVC80_x86_v2 (Version: 1.0.3.0 - Nokia) Hidden

MSVC90_x86 (Version: 1.0.1.2 - Nokia) Hidden

MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

MSXML4.0 redistributable (HKLM\...\{44D66AD9-AE19-4AFD-BE7E-A1B44C856697}) (Version: 4.0.0.0 - SAP)

MyDriveConnect 3.3.0.1756 (HKLM\...\MyDriveConnect) (Version: 3.3.0.1756 - TomTom)

NB Probe (HKLM\...\{6324A1EF-CEF4-43E3-8BCD-9EF3F67317FD}) (Version: - )

Nero 6 Demo (HKLM\...\Nero - Burning Rom!UninstallKey) (Version: - )

NI .NET Framework 4 (Version: 4.00.49152 - National Instruments) Hidden

NI EulaDepot (Version: 3.20.363 - National Instruments) Hidden

NI MDF Support (Version: 3.20.363 - National Instruments) Hidden

NI Security Update (KB 67L8LCQW) (Version: 1.0.29.0 - National Instruments) Hidden

NI Uninstaller (Version: 3.20.363 - National Instruments) Hidden

NI VC2008MSMs x86 (Version: 9.0.401 - National Instruments) Hidden

Nokia Connectivity Cable Driver (HKLM\...\{A57025CC-5F2E-4D01-B387-06DB10500D43}) (Version: 7.1.78.0 - Nokia)

Nokia PC Suite (HKLM\...\{531317A5-586A-4E36-87C1-CA823447B375}) (Version: 6.81.13.0 - Nokia)

Nokia Suite (HKLM\...\Nokia Suite) (Version: 3.4.49.0 - Nokia)

Nokia Suite (Version: 3.4.49.0 - Nokia) Hidden

Nuance PaperPort 14 (HKLM\...\{08BCE67B-6305-4D8A-B749-F381E7E3DDA2}) (Version: 14.5.0000 - Nuance Communications, Inc.)

Nuance PDF Viewer Plus (HKLM\...\{FC984E39-43D0-4AB2-ACC7-A7B87977B009}) (Version: 7.20.3274 - Nuance Communications, Inc.)

NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.4 - NVIDIA Corporation)

NVIDIA HD-Audiotreiber 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation)

OMPM v2.0 (HKLM\...\InstallShield_{0A7245F9-B454-4FAA-9A94-61617B6039A1}) (Version: 2.7.4.7 - Ihr Firmenname)

OMPM v2.0 (Version: 2.7.4.7 - Ihr Firmenname) Hidden

P4P (HKLM\...\{FC3D290D-79BE-44B7-ABF9-FDD110925930}) (Version: 1.0.0.17 - P4P)

PaperPort Image Printer (HKLM\...\{6EF2FDAB-7FBF-4AB9-92CD-594BDDB6A56B}) (Version: 14.00.0000 - Nuance Communications, Inc.)

PC Connectivity Solution (HKLM\...\{DA5B2BDC-F654-4A88-A669-4D34BC7846A1}) (Version: 12.0.17.0 - Nokia)

PhotoFrame (HKLM\...\PhotoFrame) (Version: - )

PostgreSQL 8.4 (HKLM\...\PostgreSQL 8.4) (Version: 8.4 - PostgreSQL Global Development Group)

QuickTime 7 (HKLM\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)

Ravensburger tiptoi (HKLM\...\Ravensburger tiptoi) (Version: - )

Realtek 8169 8168 8101E 8102E Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0000 - Realtek)

Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5683 - Realtek Semiconductor Corp.)

RICOH R5C83x/84x Flash Media Controller Driver Ver.3.55.03 (HKLM\...\{59F6A514-9813-47A3-948C-8A155460CC2A}) (Version: 3.55.03 - RICOH)

Scansoft PDF Professional (Version: - ) Hidden

SetPoint (HKLM\...\{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}) (Version: 4.00 - Logitech)

Skype Toolbars (HKLM\...\{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}) (Version: 5.0.4137 - Skype Technologies S.A.)

Skype™ 7.0 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 10.1.8.0 - Synaptics)

USB 2.0 2.0M UVC WebCam (HKLM\...\USB 2.0 2.0M UVC WebCam) (Version: - )

vcredist_x86 (HKLM\...\{CEC7A786-A9C8-4EF7-BB59-6518E3B3C878}) (Version: 1.0.0 - SAP)

Visual Studio C++ 10.0 Runtime (HKLM\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)

WIDCOMM Bluetooth Software (HKLM\...\{03D1988F-469F-4843-8E6E-E5FE9D17889D}) (Version: 5.2.0.800 - Broadcom Corporation)

Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0) (HKLM\...\504244733D18C8F63FF584AEB290E3904E791693) (Version: 08/22/2008 7.0.0.0 - Nokia)

WinFlash (HKLM\...\{DE10AB76-4756-4913-BE25-55D1C1051F9A}) (Version: - )

WinRAR Archivierer (HKLM\...\WinRAR archiver) (Version: - )

WinZip (HKLM\...\WinZip) (Version: 8.1 SR-1 (5266) - WinZip Computing, Inc.)

Wireless Console 2 (HKLM\...\{83F73CB1-7705-49D1-9852-84D839CA2A45}) (Version: 2.0.10 - ATK)

WISO Steuer 2012 (HKLM\...\{0CC1DAFB-40C8-4903-953D-471E541477C7}) (Version: 19.00.7304 - Buhl Data Service GmbH)

WISO Steuer 2013 (HKLM\...\{D6CC2FAF-F827-4091-96A1-D32CC9B69C79}) (Version: 20.00.8137 - Buhl Data Service GmbH)

WISO Steuer 2014 (HKLM\...\{3C5C5344-25D3-4013-BCA1-A0711FE7B3AD}) (Version: 21.00.8480 - Buhl Data Service GmbH)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1619064115-466689268-4177747022-1000_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File

CustomCLSID: HKU\S-1-5-21-1619064115-466689268-4177747022-1000_Classes\CLSID\{3f04dadf-6ea4-44d1-a507-03cad176f443}\InprocServer32 -> C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin1017325.dll (Amazon.com, Inc.)

CustomCLSID: HKU\S-1-5-21-1619064115-466689268-4177747022-1000_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File

CustomCLSID: HKU\S-1-5-21-1619064115-466689268-4177747022-1000_Classes\CLSID\{BB6410D8-F879-4184-9C5C-6A02D16AE0B3}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File

CustomCLSID: HKU\S-1-5-21-1619064115-466689268-4177747022-1000_Classes\CLSID\{CA1073A2-5F3F-4445-8E5E-7109BDCEDDBE}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File

CustomCLSID: HKU\S-1-5-21-1619064115-466689268-4177747022-1000_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File

CustomCLSID: HKU\S-1-5-21-1619064115-466689268-4177747022-1000_Classes\CLSID\{D5A55D2D-C59D-42C3-A5BF-4C08EEE74339}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File

==================== Restore Points =========================

 

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 12:23 - 2010-12-12 22:24 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 localhost

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {19411A74-991C-4A16-BF7C-166E4E49D856} - System32\Tasks\ASUS Live Update => C:\Program Files\ASUS\ASUS Live Update\ALU.exe [2007-11-30] ()

Task: {29ABCCCA-1A0B-4415-A3E1-FDE7BDDECDBB} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)

Task: {414841C6-91CC-4966-933A-D71E285DCD6D} - System32\Tasks\{ED30B319-CC19-424F-846E-0F8ECB82F999} => pcalua.exe -a E:\Setup.exe -d E:\

Task: {4776059D-376A-4ACD-B3A9-3778FFDE026E} - System32\Tasks\ASUS SmartLogon Console Sensor => C:\Program Files\ASUS\SmartLogon\sensorsrv.exe [2008-06-18] (ASUS)

Task: {518721D2-0013-4B19-A46B-4B51B04559C6} - System32\Tasks\{663C24D5-10FA-4FAA-84B9-CD94B89A69AB} => pcalua.exe -a D:\Downloads\3gp\3GP_Converter034\Setup.exe -d D:\Downloads\3gp\3GP_Converter034

Task: {819AAF3C-60E3-448E-BFF7-D5CD780E3594} - System32\Tasks\{F7BB27B9-C40B-43A9-95C2-530FBC73558A} => pcalua.exe -a E:\Software\Bluetooth\Setup.exe -d E:\Software\Bluetooth

Task: {98F3527B-8354-4119-8577-E0DA25B224E0} - System32\Tasks\{89C29468-C381-4F13-8FA7-ABDD6BF2A3DA} => C:\Program Files\Skype\\Phone\Skype.exe [2014-12-11] (Skype Technologies S.A.)

Task: {C26BC1A5-691B-414B-BF54-1E492181F57F} - System32\Tasks\Direct Console 2.0 => C:\Program Files\ASUS\Direct Console\DCHelper.exe [2008-03-25] (ASUSTek.)

Task: {C51BD195-A428-4355-AC9F-8097D6A0BC5B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-20] (Google Inc.)

Task: {C8F76C46-2FC5-4E64-91D7-5124505E2CEB} - System32\Tasks\{C6C7E2A8-77AA-4E25-958E-511E0167322E} => pcalua.exe -a D:\Downloads\directx_nov2008_redist.exe -d D:\Downloads

Task: {D5E3E87C-0880-453A-A1C5-529B75FD0756} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-20] (Google Inc.)

Task: {E725020D-5EE0-40D0-8EE4-98F9EF122DE0} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-07-09] (Adobe Systems Incorporated)

Task: {F0E726A4-0AA3-413F-B6B4-517E315170AC} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)

Task: {FA7B7F3A-545E-4E08-AA17-43391A52A2F3} - System32\Tasks\ASPG => C:\Program Files\ASUS\ASUS CopyProtect\aspg.exe [2008-06-19] (ASUS)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2008-12-04 23:53 - 2007-05-18 12:31 - 00073728 _____ () C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe

2008-08-14 06:59 - 2008-08-14 06:59 - 00100920 _____ () C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe

2008-12-04 23:14 - 2007-08-08 10:08 - 00094208 _____ () C:\Program Files\ATKGFNEX\GFNEXSrv.exe

2014-07-17 10:37 - 2012-06-07 17:48 - 00019968 _____ () C:\Windows\system32\spool\PRTPROCS\W32X86\dltfm1zPP.dll

2014-04-23 16:05 - 2014-04-23 16:05 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

2014-04-23 16:04 - 2014-04-23 16:04 - 01044808 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

2008-12-04 23:53 - 2007-06-15 20:28 - 00147456 _____ () C:\Program Files\ASUS\ASUS Data Security Manager\OverlayIconShlExt.dll

2008-12-04 23:53 - 2007-06-02 03:08 - 00143360 _____ () C:\Program Files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll

2008-12-04 23:53 - 2007-08-08 12:52 - 00331776 _____ () C:\Program Files\ASUS\ASUS Data Security Manager\AdsmendecExt.dll

2009-02-21 01:23 - 2003-05-19 22:16 - 00120320 _____ () C:\Program Files\WinRAR\rarext.dll

2004-05-28 04:13 - 2004-05-28 04:13 - 00057344 _____ () C:\Program Files\ASUS\ATK Hotkey\CMSSC.dll

2008-12-04 23:27 - 2007-07-06 02:53 - 01040384 _____ () C:\Program Files\Wireless Console 2\wcourier.exe

2013-02-06 17:37 - 2013-02-06 17:37 - 00191464 _____ () C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1db.exe

2007-11-13 01:41 - 2007-11-13 01:41 - 00106496 _____ () C:\Program Files\ASUS\ATK Hotkey\MsgTran.dll

2008-12-04 23:57 - 2008-01-26 04:32 - 00778240 _____ () C:\Program Files\P4P\P4P.exe

2008-05-29 07:40 - 2008-05-29 07:40 - 00049152 _____ () C:\Program Files\ASUS\Direct Console\OLED.dll

2008-05-29 07:39 - 2008-05-29 07:39 - 00053248 _____ () C:\Program Files\ASUS\Direct Console\SysInfo.dll

2007-12-28 02:04 - 2007-12-28 02:04 - 00032768 _____ () C:\Program Files\ASUS\Direct Console\LED.dll

2008-02-19 08:32 - 2008-02-19 08:32 - 00012288 _____ () C:\Program Files\ASUS\Direct Console\OvrClk.dll

2008-12-04 23:14 - 2007-03-10 02:16 - 00106496 _____ () C:\Program Files\ATKGFNEX\AGFNEX.dll

2007-12-12 02:07 - 2007-12-12 02:07 - 00090112 _____ () C:\Program Files\ASUS\Direct Console\OUTLOOK.dll

2007-12-08 01:32 - 2007-12-08 01:32 - 00061440 _____ () C:\Program Files\ASUS\Direct Console\MSN.dll

2014-03-18 18:20 - 2014-03-18 18:20 - 00199633 _____ () C:\Program Files\Dell Printers\OpenManage\OMPMv2.0\client\OMPMWatchdogService.exe

2014-08-22 10:38 - 2014-08-22 10:38 - 00026488 _____ () C:\Program Files\MyDrive Connect\DeviceDetection.dll

2014-08-22 10:38 - 2014-08-22 10:38 - 00087416 _____ () C:\Program Files\MyDrive Connect\TomTomSupporterBase.dll

2014-08-22 10:38 - 2014-08-22 10:38 - 00398712 _____ () C:\Program Files\MyDrive Connect\TomTomSupporterProxy.dll

2014-06-27 23:22 - 2012-08-16 12:25 - 00172032 _____ () C:\Program Files\PostgreSQL\8.4\bin\LIBPQ.dll

2008-12-04 23:55 - 2007-08-03 22:24 - 00125496 _____ () C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

2008-12-04 23:55 - 2007-09-14 20:00 - 00147456 _____ () C:\Program Files\ASUS\NB Probe\SPM\spdiskex.dll

2008-12-04 23:55 - 2003-11-28 12:11 - 00135168 _____ () C:\Program Files\ASUS\NB Probe\SPM\spos.dll

2008-12-04 23:55 - 2005-08-30 01:24 - 00081920 _____ () C:\Program Files\ASUS\NB Probe\SPM\spnbacpi.dll

2008-12-04 23:55 - 2003-09-10 02:08 - 00049152 _____ () C:\Program Files\ASUS\NB Probe\SPM\spdmi.dll

2008-12-04 23:55 - 2006-04-04 20:24 - 00036864 _____ () C:\Program Files\ASUS\NB Probe\SPM\ghadmi.dll

2008-12-04 23:55 - 2005-04-08 05:25 - 00077824 _____ () C:\Program Files\ASUS\NB Probe\SPM\spmemory.dll

2014-06-27 23:24 - 2012-08-14 15:19 - 00999424 _____ () C:\Program Files\PostgreSQL\8.4\bin\libxml2.dll

2014-07-17 10:32 - 2012-08-16 19:33 - 00041984 _____ () C:\Windows\system32\dltsm1zwia.dll

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

 

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

 

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

 

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1619064115-466689268-4177747022-1000\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\img24.jpg

HKU\S-1-5-21-1619064115-466689268-4177747022-1001\Control Panel\Desktop\\Wallpaper -> C:\windows\Web\Wallpaper\img24.jpg

DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

 

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [WinCollab-Out-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe

FirewallRules: [WinCollab-In-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe

FirewallRules: [WinCollab-Out-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe

FirewallRules: [WinCollab-In-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe

FirewallRules: [WinCollab-DFSR-Out-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe

FirewallRules: [WinCollab-DFSR-In-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe

FirewallRules: [TCP Query User{28AA2FEE-D481-4D84-913E-1CF0E59B80CA}C:\program files\internet explorer\iexplore.exe] => (Block) C:\program files\internet explorer\iexplore.exe

FirewallRules: [UDP Query User{832088FB-DCA6-4627-AA07-BF2CF73BCB70}C:\program files\internet explorer\iexplore.exe] => (Block) C:\program files\internet explorer\iexplore.exe

FirewallRules: [TCP Query User{C831918A-6B6B-423E-9978-475C8A4BF60E}C:\program files\openvpn\bin\openvpn.exe] => (Block) C:\program files\openvpn\bin\openvpn.exe

FirewallRules: [UDP Query User{8C46CC16-25BB-4736-8AC9-ED1E19731AC4}C:\program files\openvpn\bin\openvpn.exe] => (Block) C:\program files\openvpn\bin\openvpn.exe

FirewallRules: [TCP Query User{1C164927-BB8D-478C-9964-F8D6BC59A2A9}C:\program files\openvpn\bin\openvpn.exe] => (Allow) C:\program files\openvpn\bin\openvpn.exe

FirewallRules: [UDP Query User{5F013047-4D01-4CAA-9A45-F35743BCCDA2}C:\program files\openvpn\bin\openvpn.exe] => (Allow) C:\program files\openvpn\bin\openvpn.exe

FirewallRules: [TCP Query User{84EB3341-6966-4163-BF72-289A70024253}C:\windows\system32\taskeng.exe] => (Block) C:\windows\system32\taskeng.exe

FirewallRules: [UDP Query User{471DE340-B595-4E19-8032-A6C916BA3AC9}C:\windows\system32\taskeng.exe] => (Block) C:\windows\system32\taskeng.exe

FirewallRules: [TCP Query User{D7A3CCF0-0385-44BF-A902-715B7FACC26E}C:\windows\explorer.exe] => (Block) C:\windows\explorer.exe

FirewallRules: [UDP Query User{14B1B00C-0309-41A0-BDE9-77AF78337780}C:\windows\explorer.exe] => (Block) C:\windows\explorer.exe

FirewallRules: [TCP Query User{750408C6-979C-4A2E-8C08-EBD76DD2A813}C:\windows\explorer.exe] => (Block) C:\windows\explorer.exe

FirewallRules: [UDP Query User{01DBCC36-310E-4CF7-BAF6-C766E0CEC184}C:\windows\explorer.exe] => (Block) C:\windows\explorer.exe

FirewallRules: [{C304B180-0E0B-4081-AC0E-42E22FE45F78}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe

FirewallRules: [{1AB83C35-B101-4B79-BF6B-191A0C947D48}] => (Allow) LPort=80

FirewallRules: [{7DA1E521-4A3A-4461-8445-F8F4905E0A18}] => (Allow) LPort=80

FirewallRules: [{F863D41D-BFE3-4F1D-8B11-D8781843CE57}] => (Allow) LPort=80

FirewallRules: [TCP Query User{AAB4ED21-1406-4629-9AC3-44B3404EC5B3}C:\program files\nokia\nokia ovi suite\nokiaovisuite.exe] => (Allow) C:\program files\nokia\nokia ovi suite\nokiaovisuite.exe

FirewallRules: [UDP Query User{19CC29C9-60AA-4BA3-9D86-6F983DE52361}C:\program files\nokia\nokia ovi suite\nokiaovisuite.exe] => (Allow) C:\program files\nokia\nokia ovi suite\nokiaovisuite.exe

FirewallRules: [TCP Query User{5BF834D1-FC3F-45F4-9C69-40DFD0EAEBB1}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe] => (Allow) C:\program files\common files\nokia\service layer\a\nsl_host_process.exe

FirewallRules: [UDP Query User{5719C01C-2E21-4EE4-B1EB-6AFFC59CAE1B}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe] => (Allow) C:\program files\common files\nokia\service layer\a\nsl_host_process.exe

FirewallRules: [{47725C01-D394-4560-BBA2-D84DF721F3AA}] => (Allow) C:\Program Files\Nakido\nakido.exe

FirewallRules: [{B59BB5F2-B4F0-48A9-A43E-EB884E336BB6}] => (Allow) C:\Program Files\Nakido\nakido.exe

FirewallRules: [{C9B20076-4909-431E-A146-617230B20DA3}] => (Allow) C:\Program Files\Twonky\TwonkyServer\twonkystarter.exe

FirewallRules: [{69869431-6331-4CC0-BD48-C94BE8C22F37}] => (Allow) C:\Program Files\Twonky\TwonkyServer\twonkystarter.exe

FirewallRules: [{5354F5F7-6EC2-4C1D-B108-2EFB0B616032}] => (Allow) C:\Program Files\Twonky\TwonkyServer\twonkyserver.exe

FirewallRules: [{D6768DFC-208E-42A3-8C26-51709369EE04}] => (Allow) C:\Program Files\Twonky\TwonkyServer\twonkyserver.exe

FirewallRules: [TCP Query User{5078F6E3-CE57-4B62-9F40-96204765B386}C:\program files\philips\mediamanager\twonkyrenderer.exe] => (Allow) C:\program files\philips\mediamanager\twonkyrenderer.exe

FirewallRules: [UDP Query User{23AB7648-7C1B-43B9-93C3-B2C2E4B2E69F}C:\program files\philips\mediamanager\twonkyrenderer.exe] => (Allow) C:\program files\philips\mediamanager\twonkyrenderer.exe

FirewallRules: [TCP Query User{8203D92A-BC7A-458B-B873-72EDDEE13569}C:\program files\philips\mediamanager\twonkymanager.exe] => (Allow) C:\program files\philips\mediamanager\twonkymanager.exe

FirewallRules: [UDP Query User{06C64734-4B88-4416-B7CD-D71712E5F646}C:\program files\philips\mediamanager\twonkymanager.exe] => (Allow) C:\program files\philips\mediamanager\twonkymanager.exe

FirewallRules: [{00ADE940-2B0D-48A6-8C9B-03C51A49CE12}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe

FirewallRules: [{EE2A595D-30AA-48F0-A82D-9460A22625AC}] => (Allow) C:\Program Files\iTunes\iTunes.exe

FirewallRules: [UDP Query User{68E46633-8DC3-499C-A590-8A85F5FE92AD}C:\Program Files\LEGO Software\LEGO MINDSTORMS EV3 Home Edition\MindstormsEV3.exe] => (Allow) C:\Program Files\LEGO Software\LEGO MINDSTORMS EV3 Home Edition\MindstormsEV3.exe

FirewallRules: [TCP Query User{F468232A-782C-4386-AF14-03CFA72EB0FB}C:\Program Files\LEGO Software\LEGO MINDSTORMS EV3 Home Edition\MindstormsEV3.exe] => (Allow) C:\Program Files\LEGO Software\LEGO MINDSTORMS EV3 Home Edition\MindstormsEV3.exe

FirewallRules: [{B309BC33-1C71-4BF2-94C6-904F3873BA5C}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe

FirewallRules: [{63E9A5E2-7F26-4E64-ACB3-D673BBA32FF3}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe

==================== Faulty Device Manager Devices =============

 

==================== Event log errors: =========================

Application errors:

==================

Error: (07/16/2015 12:43:25 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/16/2015 12:26:32 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Fehlerhafte Anwendung svchost.exe_EMDMgmt, Version 6.0.6001.18000, Zeitstempel 0x47918b89, fehlerhaftes Modul kernel32.dll, Version 6.0.6002.19381, Zeitstempel 0x554d42a0, Ausnahmecode 0xc0000005, Fehleroffset 0x000be6ca,

Prozess-ID 0x450, Anwendungsstartzeit svchost.exe_EMDMgmt0.

Error: (07/16/2015 12:26:17 AM) (Source: VSS) (EventID: 12293) (User: )

Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen einer Routine auf einem Volumeschattenkopieanbieter "{b5946137-7b9f-4925-af80-51abd60b20d5}" ist ein Fehler aufgetreten. Routinedetails GetSnapshotProperties({638939ab-055f-4165-b266-f4894e5c201a}) [hr = 0x80042308].

 

Vorgang:

Asynchroner Vorgang wird ausgeführt

Kontext:

Aktueller Status: DoSnapshotSet

Error: (07/16/2015 12:20:56 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Fehlerhafte Anwendung wmpnscfg.exe, Version 11.0.6001.7000, Zeitstempel 0x47919371, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode 0xc0000005, Fehleroffset 0x00620022,

Prozess-ID 0xf88, Anwendungsstartzeit wmpnscfg.exe0.

Error: (07/16/2015 12:01:46 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/15/2015 11:42:24 PM) (Source: ESENT) (EventID: 474) (User: )

Description: avguard (316) GaviDB_0: Bei Überprüfung der aus Datei "C:\ProgramData\Avira\Antivirus\EVENTDB\gavi3.db" bei Offset 147456 (0x0000000000024000) (Datenbankseite avguard0) für 4096 (0x00001000) Bytes gelesenen Datenbankseite ist durch eine Inkonsistenz der Seitenprüfsumme ein Fehler aufgetreten. Die erwartete Prüfsumme war 6975619314087216752 (0x60ce60cec885c670), die tatsächliche Prüfsumme 8046824586773644825 (0x6fac1053e885c619). Fehler -1018 (0xfffffc06) bei Leseoperation. Wenn dieser Zustand andauert, stellen Sie die Datenbank aus einer vorherigen Sicherung wieder her. Dieses Problem ist vermutlich durch fehlerhafte Hardware bedingt. Wenden Sie sich für weitere Unterstützung bei der Diagnose des Problems an Ihren Hardwarehersteller.

Error: (07/15/2015 11:42:17 PM) (Source: ESENT) (EventID: 474) (User: )

Description: Windows (3448) Windows: Bei Überprüfung der aus Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb" bei Offset 91275264 (0x000000000570c000) (Datenbankseite Windows0) für 8192 (0x00002000) Bytes gelesenen Datenbankseite ist durch eine Inkonsistenz der Seitenprüfsumme ein Fehler aufgetreten. Die erwartete Prüfsumme war -157623583016329501 (0xfdd0022fb6165ee3), die tatsächliche Prüfsumme -166630644832115416 (0xfdb0024fb6166528). Fehler -1018 (0xfffffc06) bei Leseoperation. Wenn dieser Zustand andauert, stellen Sie die Datenbank aus einer vorherigen Sicherung wieder her. Dieses Problem ist vermutlich durch fehlerhafte Hardware bedingt. Wenden Sie sich für weitere Unterstützung bei der Diagnose des Problems an Ihren Hardwarehersteller.

Error: (07/15/2015 11:35:33 PM) (Source: Perflib) (EventID: 1008) (User: )

Description: WmiApRplC:\Windows\system32\wbem\wmiaprpl.dll4

Error: (07/15/2015 11:35:01 PM) (Source: Perflib) (EventID: 1010) (User: )

Description: EmdCacheC:\Windows\system32\emdmgmt.dll4

Error: (07/15/2015 11:34:29 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

 

System errors:

=============

Error: (07/16/2015 12:51:22 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: OMPM Service%%1053

Error: (07/16/2015 12:51:22 AM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: 30000OMPM Service

Error: (07/16/2015 12:46:22 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: OMPM Service%%1053

Error: (07/16/2015 12:46:22 AM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: 30000OMPM Service

Error: (07/16/2015 12:45:51 AM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT)

Description: 0x80070032

Error: (07/16/2015 12:44:49 AM) (Source: DCOM) (EventID: 10010) (User: )

Description: {9B1F122C-2982-4E91-AA8B-E071D54F2A4D}

Error: (07/16/2015 12:36:22 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: OMPM Service%%1053

Error: (07/16/2015 12:36:22 AM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: 30000OMPM Service

Error: (07/16/2015 12:32:59 AM) (Source: Microsoft-Windows-Servicing) (EventID: 4375) (User: NT-AUTORITÄT)

Description: Windows-Wartung konnte das Paket KB3067505 (Security Update) nicht in den Status Aufgelöst(Resolved) setzen.

Error: (07/16/2015 12:32:59 AM) (Source: Microsoft-Windows-Servicing) (EventID: 4375) (User: NT-AUTORITÄT)

Description: Windows-Wartung konnte das Paket KB3067505 (Security Update) nicht in den Status Aufgelöst(Resolved) setzen.

 

Microsoft Office:

=========================

Error: (07/16/2015 12:43:25 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/16/2015 12:26:32 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: svchost.exe_EMDMgmt6.0.6001.1800047918b89kernel32.dll6.0.6002.19381554d42a0c0000005000be6ca45001d0bf497afca015

Error: (07/16/2015 12:26:17 AM) (Source: VSS) (EventID: 12293) (User: )

Description: {b5946137-7b9f-4925-af80-51abd60b20d5}GetSnapshotProperties({638939ab-055f-4165-b266-f4894e5c201a})0x80042308

Vorgang:

Asynchroner Vorgang wird ausgeführt

Kontext:

Aktueller Status: DoSnapshotSet

Error: (07/16/2015 12:20:56 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: wmpnscfg.exe11.0.6001.700047919371unknown0.0.0.000000000c000000500620022f8801d0bf49b1851d45

Error: (07/16/2015 12:01:46 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/15/2015 11:42:24 PM) (Source: ESENT) (EventID: 474) (User: )

Description: avguard316GaviDB_0: C:\ProgramData\Avira\Antivirus\EVENTDB\gavi3.db147456 (0x0000000000024000)4096 (0x00001000)-1018 (0xfffffc06)6975619314087216752 (0x60ce60cec885c670)8046824586773644825 (0x6fac1053e885c619)35 (0x23)

Error: (07/15/2015 11:42:17 PM) (Source: ESENT) (EventID: 474) (User: )

Description: Windows3448Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb91275264 (0x000000000570c000)8192 (0x00002000)-1018 (0xfffffc06)-157623583016329501 (0xfdd0022fb6165ee3)-166630644832115416 (0xfdb0024fb6166528)11141 (0x2B85)

Error: (07/15/2015 11:35:33 PM) (Source: Perflib) (EventID: 1008) (User: )

Description: WmiApRplC:\Windows\system32\wbem\wmiaprpl.dll4

Error: (07/15/2015 11:35:01 PM) (Source: Perflib) (EventID: 1010) (User: )

Description: EmdCacheC:\Windows\system32\emdmgmt.dll4

Error: (07/15/2015 11:34:29 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

 

CodeIntegrity Errors:

===================================

Date: 2013-12-20 16:12:14.138

Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\SetPoint\lgscroll.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2013-12-20 16:12:13.264

Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\SetPoint\lgscroll.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2013-12-20 16:12:09.195

Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\SetPoint\lgscroll.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2013-12-20 16:12:08.386

Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\SetPoint\lgscroll.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2013-12-20 16:12:02.587

Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\SetPoint\lgscroll.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2013-12-20 16:12:01.676

Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\SetPoint\lgscroll.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2013-12-20 16:11:55.557

Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\SetPoint\lgscroll.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2013-12-20 16:11:54.462

Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\SetPoint\lgscroll.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2013-12-20 16:11:47.923

Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\SetPoint\lgscroll.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2013-12-20 16:11:46.685

Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\SetPoint\lgscroll.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

 

==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Duo CPU T9400 @ 2.53GHz

Percentage of memory in use: 45%

Total physical RAM: 3070.17 MB

Available physical RAM: 1666.24 MB

Total Virtual: 6343.35 MB

Available Virtual: 4832.77 MB

==================== Drives ================================

Drive c: (VistaOS) (Fixed) (Total:232.88 GB) (Free:101.56 GB) NTFS ==>[drive with boot components (obtained from BCD)]

Drive d: (DATA) (Fixed) (Total:223.12 GB) (Free:37.63 GB) NTFS

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (Size: 465.8 GB) (Disk ID: 97646C29)

Partition 1: (Not Active) - (Size=9.8 GB) - (Type=1C)

Partition 2: (Active) - (Size=232.9 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=223.1 GB) - (Type=OF Extended)

==================== End of log ============================

--- --- ---

--- --- ---

Adware/Junkware/Toolbars entfernen

1. Schritt: Malwarebytes

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

(alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!)

2. Schritt: adwCleaner

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

3. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

4. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Der Malwarebytes-Scan startet nicht. Verstrichene Zeit über 15 Minuten und noch nicht 1 Datei gescannt. Soll ich mal im Abgesicherten Modus probieren?

Dann überspringen wir MBAM, mach mit dem nächsten Schritt weiter

adw cleaner:AdwCleaner Logfile:

Code:

# AdwCleaner v4.208 - Bericht erstellt 16/07/2015 um 12:31:40

# Aktualisiert 09/07/2015 von Xplode

# Datenbank : 2015-07-09.2 [Lokal]

# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (x86)

# Benutzername : noki - NOKI-PC

# Gestarted von : D:\AdwCleaner_4.208.exe

# Option : Löschen

***** [ Dienste ] *****

 

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\DownloadManager

Ordner Gelöscht : C:\Users\noki\AppData\Local\Temp\AskSearch

Datei Gelöscht : C:\Program Files\Mozilla Firefox\defaults\pref\itms.js

***** [ Geplante Tasks ] *****

 

***** [ Verknüpfungen ] *****

 

***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{38122A36-83B2-46B8-B39A-EC72A4614A07}

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{42F85EF5-86CF-4D1F-B473-ACDA9AD99AC8}

Schlüssel Gelöscht : HKLM\SOFTWARE\DeviceVM

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}

***** [ Internetbrowser ] *****

-\\ Internet Explorer v9.0.8112.16659

 

-\\ Mozilla Firefox v37.0.1 (x86 de)

[p25m8g9e.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.order.1", "Ask.com");

[p25m8g9e.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.selectedEngine", "Ask.com");

-\\ Google Chrome v

 

*************************

AdwCleaner[R0].txt - [2142 Bytes] - [16/07/2015 12:27:50]

AdwCleaner[S0].txt - [2080 Bytes] - [16/07/2015 12:31:40]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2139  Bytes] ##########

--- --- ---

Weiter mit JRT?

Ja weiter mit dem nächsten Schritt

Habe es jetzt 2x probiert. Während JRT läuft, bleibt der Laptop einfach stehen und sagt keinen Mucks mehr. Beim letzten Mal zeigte er noch an:

Create restore Point: Success
Checking Startup
Checking Processes
Checking Services

Tippe so langsam auf Hardware-Schaden, oder? :-(

Beim 3. Versuch lief das Programm ziemlich schnell und kam genau so weit wie oben aufgeführt. Dann kam allerdings ein Bluescreen mit Hinweis auf Datei "msrpc.sys".

Hm...mach mal bitte mit CF weiter:
Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Bevor ich die combofix.txt einstelle, weitere Erkenntnisse. Ich habe ein Windows Update gemacht bzw. finalisiert, da aufgrund der ständigen Abbrüche einige Updates nicht endgültig durchgeführt wurden. Zudem habe ich JAVA deinstalliert.

Seitdem läuft der Laptop zumindest nun deutlich ruhiger und der Prozess-Overflow ist vorbei. Nichtsdestotrotz bleibt der Laptop immer noch relativ oft einfach stehen, v.a. wenn nach einer Deinstallation eine weitere Deinstallation durchgeführt werden soll.

Combofix lief aber ganz gut durch, Dauer: ca. 20 Minuten!

Hier das Logfile:
Combofix Logfile:

Code:

ComboFix 15-07-16.01 - noki 16.07.2015  16:07:32.2.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3070.1763 [GMT 2:00]

ausgeführt von:: c:\users\noki\Desktop\ComboFix.exe

AV: Avira Antivirus *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}

SP: Avira Antivirus *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 * Neuer Wiederherstellungspunkt wurde erstellt

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files\Common Files\ASPG_icon.ico

c:\windows\system32\CddbCdda.dll

.

.

(((((((((((((((((((((((   Dateien erstellt von 2015-06-16 bis 2015-07-16  ))))))))))))))))))))))))))))))

.

.

2015-07-16 14:19 . 2015-07-16 14:19 -------- d-----w- c:\users\Public\AppData\Local\temp

2015-07-16 14:19 . 2015-07-16 14:19 -------- d-----w- c:\users\postgres\AppData\Local\temp

2015-07-16 14:19 . 2015-07-16 14:19 -------- d-----w- c:\users\Default\AppData\Local\temp

2015-07-16 12:33 . 2015-06-17 16:50 2264576 ----a-w- c:\windows\system32\msi.dll

2015-07-16 12:33 . 2015-06-17 15:09 73216 ----a-w- c:\windows\system32\msiexec.exe

2015-07-16 10:27 . 2015-07-16 10:31 -------- d-----w- C:\AdwCleaner

2015-07-16 09:57 . 2015-07-16 10:14 119512 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys

2015-07-16 09:56 . 2015-04-14 07:37 51928 ----a-w- c:\windows\system32\drivers\mwac.sys

2015-07-16 09:56 . 2015-04-14 07:37 92888 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys

2015-07-16 09:56 . 2015-04-14 07:37 23256 ----a-w- c:\windows\system32\drivers\mbam.sys

2015-07-16 09:56 . 2015-07-16 09:56 -------- d-----w- c:\program files\Malwarebytes Anti-Malware

2015-07-16 09:56 . 2015-07-16 09:56 -------- d-----w- c:\programdata\Malwarebytes

2015-07-16 09:00 . 2015-06-25 02:57 2066432 ----a-w- c:\windows\system32\win32k.sys

2015-07-16 09:00 . 2015-07-03 16:04 1316864 ----a-w- c:\windows\system32\ole32.dll

2015-07-16 08:23 . 2015-06-12 16:01 298496 ----a-w- c:\windows\system32\gdi32.dll

2015-07-15 22:34 . 2015-07-07 15:58 34304 ----a-w- c:\windows\system32\atmlib.dll

2015-07-15 22:34 . 2015-07-07 14:22 296960 ----a-w- c:\windows\system32\atmfd.dll

2015-07-15 21:52 . 2015-07-15 21:52 -------- d-----w- C:\found.002

2015-07-15 21:09 . 2015-06-23 16:02 501248 ----a-w- c:\windows\system32\kerberos.dll

2015-07-15 20:28 . 2015-05-31 08:11 225792 ----a-w- c:\windows\system32\cewmdm.dll

2015-07-15 20:27 . 2015-07-15 22:55 -------- d-----w- C:\FRST

2015-07-14 20:10 . 2015-07-03 05:19 474624 ----a-w- c:\program files\Internet Explorer\ieinstal.exe

2015-07-14 20:10 . 2015-07-03 05:18 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2015-07-14 18:32 . 2015-06-12 07:54 9252600 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{AEAD43C9-A9D5-4575-BF07-43A3A4B7E307}\mpengine.dll

2015-06-25 18:04 . 2015-06-25 18:04 -------- d-----w- C:\found.001

2015-06-25 05:37 . 2015-06-25 05:55 -------- d-----r- C:\Musik

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2015-07-09 05:23 . 2012-04-06 07:10 778416 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2015-07-09 05:23 . 2011-05-16 06:44 142512 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2015-06-23 11:27 . 2009-10-02 20:08 246952 ------w- c:\windows\system32\MpSigStub.exe

2015-06-10 09:50 . 2012-12-02 20:44 136728 ----a-w- c:\windows\system32\drivers\avipbb.sys

2015-06-10 09:50 . 2012-12-02 20:44 108448 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2015-05-27 20:05 . 2015-05-27 20:48 6292119151 ----a-w- C:\P51_N60S3MIBS2_EU_NT_Q3.14.zip

2015-05-07 17:09 . 2012-12-02 20:44 37896 ----a-w- c:\windows\system32\drivers\avkmgr.sys

2015-05-04 22:50 . 2015-06-10 07:09 4096 ----a-w- c:\windows\system32\msdxm.ocx

2015-05-04 22:50 . 2015-06-10 07:09 4096 ----a-w- c:\windows\system32\dxmasf.dll

2015-05-04 22:50 . 2015-06-10 07:09 7680 ----a-w- c:\windows\system32\spwmp.dll

2015-05-04 21:21 . 2015-06-10 07:09 8147456 ----a-w- c:\windows\system32\wmploc.DLL

2015-04-30 16:03 . 2015-05-13 07:13 279040 ----a-w- c:\windows\system32\schannel.dll

2015-04-30 13:14 . 2015-05-13 07:11 102608 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll

2015-04-24 15:54 . 2015-06-10 07:20 532480 ----a-w- c:\windows\system32\comctl32.dll

2015-04-19 21:24 . 2015-05-13 07:12 219648 ----a-w- c:\windows\system32\d3d10_1core.dll

2015-04-19 21:24 . 2015-05-13 07:12 189952 ----a-w- c:\windows\system32\d3d10core.dll

2015-04-19 21:24 . 2015-05-13 07:12 160768 ----a-w- c:\windows\system32\d3d10_1.dll

2015-04-19 21:24 . 2015-05-13 07:12 1029120 ----a-w- c:\windows\system32\d3d10.dll

2015-04-19 20:19 . 2015-05-13 07:12 1172480 ----a-w- c:\windows\system32\d3d10warp.dll

2015-04-19 20:18 . 2015-05-13 07:12 486400 ----a-w- c:\windows\system32\d3d10level9.dll

2015-04-19 20:13 . 2015-05-13 07:12 682496 ----a-w- c:\windows\system32\d2d1.dll

2015-04-19 20:12 . 2015-05-13 07:12 1072640 ----a-w- c:\windows\system32\DWrite.dll

2015-04-19 20:12 . 2015-05-13 07:12 801792 ----a-w- c:\windows\system32\FntCache.dll

2008-08-08 22:48 . 2008-08-08 22:48 90112 ----a-w- c:\program files\Common Files\CPInstallAction.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1]

@="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}"

[HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}]

2007-06-02 01:08 143360 ----a-w- c:\program files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

"NokiaSuite.exe"="c:\program files\Nokia\Nokia Suite\NokiaSuite.exe" [2012-05-16 1084840]

"MyDriveConnect.exe"="c:\program files\MyDrive Connect\MyDriveConnect.exe" [2014-08-22 1792376]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HControlUser"="c:\program files\ASUS\ATK Hotkey\HControlUser.exe" [2008-08-18 98304]

"ATKOSD2"="c:\program files\ASUS\ATKOSD2\ATKOSD2.exe" [2008-09-03 8105984]

"RtHDVCpl"="RtHDVCpl.exe" [2008-08-12 6265376]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416]

"PowerForPhone"="c:\program files\P4P\P4P.exe" [2008-01-26 778240]

"DirectConsole2"="c:\program files\ASUS\Direct Console\Direct Console.exe" [2008-08-21 2705976]

"TrayServer"="c:\progra~1\MAGIX\FILME_~1\TrayServer.exe" [2008-01-17 90112]

"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 56080]

"ALDI_NORD_FotoSuite_Download"="c:\program files\ALDI Nord Foto Service\ALDI_Foto_Service\FotoSuite.exe" [2008-11-13 1257472]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"Skytel"="Skytel.exe" [2008-08-12 1833504]

"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-04-23 43848]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2015-06-10 730416]

"Greenshot"="c:\program files\Greenshot\Greenshot.exe" [2013-10-27 495616]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2014-01-17 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2014-05-26 152392]

"LauncherC1765nf"="c:\program files\Dell Printers\Printer SSW\Launcher\dlm1launcher.exe" [2013-08-13 2471928]

"StatusAutoRunC1765nf"="c:\program files\Dell Printers\Printer SSW\Status Monitor\dlm1pl.exe" [2013-02-06 3024360]

"ISUSPM"="c:\programdata\FLEXnet\Connect\11\\isuspm.exe" [2011-10-12 2068856]

"PaperPort PTD"="c:\program files\Nuance\PaperPort\pptd40nt.exe" [2013-05-29 36168]

"IndexSearch"="c:\program files\Nuance\PaperPort\IndexSearch.exe" [2013-05-29 18248]

"PPort14reminder"="c:\program files\Nuance\PaperPort\Ereg\Ereg.exe" [2013-03-14 330056]

"PDFProHook"="c:\program files\Nuance\PDFViewer\pdfpro7hook.exe" [2013-03-20 641864]

"InstallValidator.exe.FA87EC44_C38F_4148_93A1_FF4A64A2B707"="c:\program files\National Instruments\Shared\NIUninstaller\InstallValidator.exe" [2013-11-21 265608]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-02 13789728]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-12-19 1022152]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-3-25 113664]

Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-7-30 752168]

HD Writer.lnk - c:\program files\Common Files\Panasonic\HD Writer AutoStart\HDWriterAutoStart.exe [2013-3-29 292736]

SetPoint.lnk - c:\program files\SetPoint\SetPoint.exe [2008-12-4 692224]

WISO Mein Steuer-Sparbuch heute.lnk - c:\program files\WISO\Steuersoftware 2014\mshaktuell.exe [2014-2-12 1428760]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

@="Service"

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - WS2IFSL

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bthsvcs REG_MULTI_SZ    BthServ

LocalServiceAndNoImpersonation REG_MULTI_SZ    FontCache

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2008-06-09 09:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe

.

Inhalt des "geplante Tasks" Ordners

.

2015-07-16 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-06 05:23]

.

2015-07-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-19 05:42]

.

2015-07-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-19 05:42]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.wetteronline.de/

mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS

TCP: DhcpNameServer = 192.168.178.1

FF - ProfilePath - c:\users\noki\AppData\Roaming\Mozilla\Firefox\Profiles\p25m8g9e.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.wetteronline.de

FF - prefs.js: keyword.URL - 

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

SafeBoot-WudfPf

SafeBoot-WudfRd

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2015-07-16 16:20

Windows 6.0.6002 Service Pack 2 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\postgresql-8.4]

"ImagePath"="C:/Program Files/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N \"postgresql-8.4\" -D \"C:/Program Files/PostgreSQL/8.4/data\" -w"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\postgresql-8.4]

"ImagePath"="C:/Program Files/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N \"postgresql-8.4\" -D \"C:/Program Files/PostgreSQL/8.4/data\" -w"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'Explorer.exe'(2112)

c:\program files\SetPoint\lgscroll.dll

c:\program files\ASUS\ASUS Data Security Manager\OverlayIconShlExt.dll

c:\program files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll

c:\windows\system32\btmmhook.dll

.

Zeit der Fertigstellung: 2015-07-16  16:22:47

ComboFix-quarantined-files.txt  2015-07-16 14:22

.

Vor Suchlauf: 19 Verzeichnis(se), 110.385.999.872 Bytes frei

Nach Suchlauf: 23 Verzeichnis(se), 112.939.659.264 Bytes frei

.

- - End Of File - - CDB9E1E1A36AF618C9F51FCE76C1D063

--- --- ---
64B1E91C5C6C2157642651010728F90F

Ok, dann mach jetzt wieder mit JRT und FRST weiter...

Geschafft! Aber kleine Info noch. Nach Combofix gab es erst mal wieder einen Absturz. Vista hat dann Chkdsk durchgeführt und ca. 30 verwaiste Dateien (sehr kryptische Dateinamen) wieder hergestellt.

JRT:JRT Logfile:

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Malwarebytes

Version: 7.5.0 (07.15.2015:1)

OS: Windows Vista (TM) Home Premium x86

Ran by noki on 16.07.2015 at 17:10:01,29

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 
 

~~~ Services

 

~~~ Tasks

 

~~~ Registry Values

 

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer

 

~~~ Files

 

~~~ Folders

 

~~~ FireFox

Emptied folder: C:\Users\noki\AppData\Roaming\mozilla\firefox\profiles\p25m8g9e.default\minidumps [7 files]

 

~~~ Chrome
 

[C:\Users\noki\appdata\local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

[C:\Users\noki\appdata\local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:

[C:\Users\noki\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

[C:\Users\noki\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:

[]

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 16.07.2015 at 17:16:12,60

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

--- --- ---
FRST:
FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-07-2015

Ran by noki (administrator) on NOKI-PC on 16-07-2015 17:18:10

Running from D:\

Loaded Profiles: noki (Available Profiles: noki & postgres)

Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)

Internet Explorer Version 9 (Default browser: IE)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Geeks to Go Forum

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe

(Microsoft Corporation) C:\Windows\System32\cmd.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe

(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

(Microsoft Corporation) C:\Windows\System32\wermgr.exe
 

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [HControlUser] => C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe [98304 2008-08-18] (ASUS)

HKLM\...\Run: [ATKOSD2] => C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe [8105984 2008-09-03] (ASUS)

HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [6265376 2008-08-12] (Realtek Semiconductor)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1029416 2007-12-06] (Synaptics, Inc.)

HKLM\...\Run: [PowerForPhone] => C:\Program Files\P4P\P4P.exe [778240 2008-01-26] ()

HKLM\...\Run: [DirectConsole2] => C:\Program Files\ASUS\Direct Console\Direct Console.exe [2705976 2008-08-21] (ASUSTek.)

HKLM\...\Run: [TrayServer] => C:\Program Files\MAGIX\Filme_auf_DVD_8\TrayServer.exe [90112 2008-01-17] (MAGIX AG)

HKLM\...\Run: [Kernel and Hardware Abstraction Layer] => C:\Windows\KHALMNPR.EXE [56080 2007-04-12] (Logitech Inc.)

HKLM\...\Run: [ALDI_NORD_FotoSuite_Download] => C:\Program Files\ALDI Nord Foto Service\ALDI_Foto_Service\FotoSuite.exe [1257472 2008-11-13] (MAGIX AG)

HKLM\...\Run: [NeroFilterCheck] => C:\Windows\system32\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)

HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1833504 2008-08-12] (Realtek Semiconductor Corp.)

HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-04-23] (Apple Inc.)

HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [730416 2015-06-10] (Avira Operations GmbH & Co. KG)

HKLM\...\Run: [Greenshot] => C:\Program Files\Greenshot\Greenshot.exe [495616 2013-10-27] (Greenshot)

HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-05-26] (Apple Inc.)

HKLM\...\Run: [LauncherC1765nf] => C:\Program Files\Dell Printers\Printer SSW\Launcher\dlm1launcher.exe [2471928 2013-08-13] (Dell Inc.)

HKLM\...\Run: [StatusAutoRunC1765nf] => C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1pl.exe [3024360 2013-02-06] (Dell Inc.)

HKLM\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\\isuspm.exe [2068856 2011-10-12] (Flexera Software LLC.)

HKLM\...\Run: [PaperPort PTD] => C:\Program Files\Nuance\PaperPort\pptd40nt.exe [36168 2013-05-29] (Nuance Communications, Inc.)

HKLM\...\Run: [IndexSearch] => C:\Program Files\Nuance\PaperPort\IndexSearch.exe [18248 2013-05-29] (Nuance Communications, Inc.)

HKLM\...\Run: [PPort14reminder] => C:\Program Files\Nuance\PaperPort\Ereg\Ereg.exe [330056 2013-03-14] (Nuance Communications, Inc.)

HKLM\...\Run: [PDFProHook] => C:\Program Files\Nuance\PDFViewer\pdfpro7hook.exe [641864 2013-03-20] (Nuance Communications, Inc.)

HKLM\...\Run: [InstallValidator.exe.FA87EC44_C38F_4148_93A1_FF4A64A2B707] => C:\Program Files\National Instruments\Shared\NIUninstaller\InstallValidator.exe [265608 2013-11-21] ()

HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)

HKU\S-1-5-21-1619064115-466689268-4177747022-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)

HKU\S-1-5-21-1619064115-466689268-4177747022-1000\...\Run: [NokiaSuite.exe] => C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe [1084840 2012-05-16] (Nokia)

HKU\S-1-5-21-1619064115-466689268-4177747022-1000\...\Run: [MyDriveConnect.exe] => C:\Program Files\MyDrive Connect\MyDriveConnect.exe [1792376 2014-08-22] (TomTom)

HKU\S-1-5-21-1619064115-466689268-4177747022-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk [2009-03-25]

ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2008-12-04]

ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HD Writer.lnk [2013-03-29]

ShortcutTarget: HD Writer.lnk -> C:\Program Files\Common Files\Panasonic\HD Writer AutoStart\HDWriterAutoStart.exe (Panasonic Corporation)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SetPoint.lnk [2008-12-04]

ShortcutTarget: SetPoint.lnk -> C:\Program Files\SetPoint\SetPoint.exe (Logitech Inc.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk [2014-12-21]

ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files\WISO\Steuersoftware 2014\mshaktuell.exe ()

ShellIconOverlayIdentifiers: [ADSMOverlayIcon] -> {A825576B-0042-4F0F-8FB0-93CE0F054E69} => C:\Program Files\ASUS\ASUS Data Security Manager\OverlayIconShlExt.dll [2007-06-15] ()

ShellIconOverlayIdentifiers: [ADSMOverlayIcon1] -> {A8D448F4-0431-45AC-9F5E-E1B434AB2249} => C:\Program Files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll [2007-06-02] ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Google

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = MSN Deutschland ? mit Hotmail Nachfolger Outlook und Messenger Skype

HKU\S-1-5-21-1619064115-466689268-4177747022-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\S-1-5-21-1619064115-466689268-4177747022-1000\Software\Microsoft\Internet Explorer\Main,Start Page = Wetter aktuell, Wettervorhersage und Wetterbericht - WetterOnline

SearchScopes: HKLM -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = {searchTerms} - Google Search

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-1619064115-466689268-4177747022-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = {searchTerms} - Google Search

BHO: PlusIEEventHelper Class -> {551A852F-39A6-44A7-9C13-AFBEC9185A9D} -> C:\Program Files\Nuance\PDFViewer\Bin\PlusIEContextMenu.dll [2011-06-30] (Zeon Corporation)

BHO: Skype Plug-In -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-11-22] (Skype Technologies S.A.)

DPF: {22E5D91F-89E6-4405-AD9C-0AF27BA6F06B} file:///E:/components/hidinputmonitorx.ocx

DPF: {4F63D44B-6274-4D60-8AB1-CAA7116B8AF3} file:///E:/components/A9.ocx

DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1375990510233

DPF: {7030CC6C-1A88-4591-BB5A-651B9F7F0C30} file:///E:/components/wmvhdrating.ocx

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-11-22] (Skype Technologies S.A.)

ShellExecuteHooks:  - {AEB6717E-7E19-11d0-97EE-00C04FD91972} -  No File [ ]

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

Tcpip\..\Interfaces\{FEA61DD9-6138-4BB7-83A2-5A1E647F7064}: [DhcpNameServer] 192.168.178.1

FireFox:

========

FF ProfilePath: C:\Users\noki\AppData\Roaming\Mozilla\Firefox\Profiles\p25m8g9e.default

FF Homepage: hxxp://www.wetteronline.de

FF Keyword.URL: 

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_191.dll [2015-07-09] ()

FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2014-02-21] ()

FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)

FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-30] (Microsoft Corporation)

FF Plugin: @nokia.com/EnablerPlugin -> C:\Program Files\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll [2012-05-16] ( )

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)

FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-04-30] (Adobe Systems Inc.)

FF Plugin: ZEON/PDF,version=2.0 -> C:\Program Files\Nuance\PDFViewer\bin\nppdf.dll [2011-07-15] (Zeon Corporation)

FF Plugin HKU\S-1-5-21-1619064115-466689268-4177747022-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin1017325.dll [2012-10-04] (Amazon.com, Inc.)

FF Extension: Avira Browser Safety - C:\Users\noki\AppData\Roaming\Mozilla\Firefox\Profiles\p25m8g9e.default\Extensions\abs@avira.com [2015-06-18]

FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-02-17]

Chrome: 

=======

CHR RestoreOnStartup: Default -> "hxxp://www.google.com/"

CHR Plugin: (Remoting Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\20.0.1132.57\ppGoogleNaClPluginChrome.dll No File

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\20.0.1132.57\pdf.dll No File

CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\20.0.1132.57\gcswf32.dll No File

CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll No File

CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin6.dll No File

CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin7.dll No File

CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File

CHR Plugin: (Nokia Suite Enabler Plugin) - C:\Program Files\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )

CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

CHR Profile: C:\Users\noki\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (YouTube) - C:\Users\noki\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-08-25]

CHR Extension: (Google Search) - C:\Users\noki\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-08-25]

CHR Extension: (Gmail) - C:\Users\noki\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-08-25]

CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [68096 2009-03-25] () [File not signed]

S2 ADSMService; C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe [73728 2007-05-18] () [File not signed]

S2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc.exe [825136 2015-06-10] (Avira Operations GmbH & Co. KG)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [450808 2015-06-10] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [450808 2015-06-10] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1187336 2015-06-10] (Avira Operations GmbH & Co. KG)

S2 ASLDRService; C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe [100920 2008-08-14] ()

S2 ATKGFNEXSrv; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [94208 2007-08-08] () [File not signed]

S2 DLNBDB; C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1db.exe [191464 2013-02-06] ()

S2 Fabs; C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe [1155072 2009-02-03] (MAGIX AG) [File not signed]

S3 FirebirdServerMAGIXInstance; C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2008-08-07] (MAGIX®) [File not signed]

S2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728 2008-06-09] (Hewlett-Packard Company) [File not signed]

S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)

S2 OMPM Service; C:\Program Files\Dell Printers\OpenManage\OMPMv2.0\client\rdmf_clientd.exe [5738823 2014-03-06] () [File not signed]

S2 OMPMJBASSVC; C:\Program Files\Dell Printers\OpenManage\OMPMv2.0\server\jboss-as\bin\jbosssvc.exe [61440 2011-08-11] (Red Hat®, Inc.) [File not signed]

S2 OMPMWatchdogService; C:\Program Files\Dell Printers\OpenManage\OMPMv2.0\client\OMPMWatchdogService.exe [199633 2014-03-18] () [File not signed]

S2 PDFProFiltSrvPP; C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe [77640 2013-05-29] (Nuance Communications, Inc.)

S2 postgresql-8.4; C:\Program Files\PostgreSQL\8.4\bin\pg_ctl.exe [66048 2012-08-16] (PostgreSQL Global Development Group) [File not signed]

S2 spmgr; C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe [125496 2007-08-03] ()

S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-21] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 61883; C:\Windows\System32\DRIVERS\61883.sys [45696 2008-01-21] (Microsoft Corporation)

R0 AsDsm; C:\Windows\system32\Drivers\AsDsm.sys [29752 2007-08-11] (Windows (R) Codename Longhorn DDK provider)

R2 ASMMAP; C:\Program Files\ATKGFNEX\ASMMAP.sys [13880 2007-07-24] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108448 2015-06-10] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136728 2015-06-10] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37896 2015-05-07] (Avira Operations GmbH & Co. KG)

R2 ghaio; C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys [20936 2007-08-03] ()

R3 itecir; C:\Windows\System32\DRIVERS\itecir.sys [54784 2007-12-19] (ITE Tech. Inc. )

R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15928 2008-06-03] ( )

R0 lullaby; C:\Windows\System32\DRIVERS\lullaby.sys [15416 2008-05-29] (Windows (R) Codename Longhorn DDK provider)

R3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [28688 2007-04-12] (Logitech, Inc.)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-04-14] (Malwarebytes Corporation)

S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2015-07-16] (Malwarebytes Corporation)

S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-04-14] (Malwarebytes Corporation)

R3 MTsensor; C:\Windows\System32\DRIVERS\ATKACPI.sys [7680 2006-12-14] (ATK0100)

S3 PhotoFrame; C:\Windows\System32\DRIVERS\PhotoFrame.sys [30464 2007-09-11] (ETC) [File not signed]

R0 PxHelp20; C:\Windows\System32\Drivers\PxHelp20.sys [45744 2011-10-04] (Rovi Corporation)

R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1748352 2008-06-09] ()

R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [31848 2015-06-10] (Avira Operations GmbH & Co. KG)

S3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [25984 2009-12-12] (The OpenVPN Project)

S3 USB28xxBGA; C:\Windows\System32\DRIVERS\emBDA.sys [530944 2008-03-06] (eMPIA Technology, Inc.)

S3 USB28xxOEM; C:\Windows\System32\DRIVERS\emOEM.sys [45696 2007-04-25] (eMPIA Technology, Inc.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)

S3 catchme; \??\C:\Users\noki\AppData\Local\Temp\catchme.sys [X]

S4 Eskgfroc; No ImagePath

S3 GigasetGenericUSB; system32\DRIVERS\GigasetGenericUSB.sys [X]

S3 IpInIp; system32\DRIVERS\ipinip.sys [X]

S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]

S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-16 17:16 - 2015-07-16 17:16 - 00001301 _____ C:\Users\noki\Desktop\JRT.txt

2015-07-16 16:38 - 2015-07-16 16:38 - 00000000 __SHD C:\found.003

2015-07-16 16:22 - 2015-07-16 16:22 - 00013389 _____ C:\ComboFix.txt

2015-07-16 16:03 - 2015-07-16 16:22 - 00000000 ____D C:\ComboFix

2015-07-16 15:47 - 2015-07-16 14:38 - 05634275 ____R (Swearware) C:\Users\noki\Desktop\ComboFix.exe

2015-07-16 14:33 - 2015-06-17 18:50 - 02264576 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

2015-07-16 14:33 - 2015-06-17 17:09 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe

2015-07-16 14:13 - 2015-07-16 14:13 - 00160408 _____ C:\Windows\Minidump\Mini071615-01.dmp

2015-07-16 12:27 - 2015-07-16 12:31 - 00000000 ____D C:\AdwCleaner

2015-07-16 11:57 - 2015-07-16 12:14 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-07-16 11:56 - 2015-07-16 11:56 - 00000866 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-07-16 11:56 - 2015-07-16 11:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-07-16 11:56 - 2015-07-16 11:56 - 00000000 ____D C:\ProgramData\Malwarebytes

2015-07-16 11:56 - 2015-07-16 11:56 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware

2015-07-16 11:56 - 2015-04-14 09:37 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-07-16 11:56 - 2015-04-14 09:37 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2015-07-16 11:56 - 2015-04-14 09:37 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2015-07-16 11:00 - 2015-07-03 18:04 - 01316864 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll

2015-07-16 11:00 - 2015-06-25 04:57 - 02066432 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2015-07-16 10:23 - 2015-06-12 18:01 - 00298496 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll

2015-07-16 00:34 - 2015-07-07 17:58 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll

2015-07-16 00:34 - 2015-07-07 16:22 - 00296960 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll

2015-07-15 23:52 - 2015-07-15 23:52 - 00000000 ____D C:\found.002

2015-07-15 23:14 - 2015-07-15 23:14 - 00160408 _____ C:\Windows\Minidump\Mini071515-01.dmp

2015-07-15 23:09 - 2015-06-23 18:02 - 00501248 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2015-07-15 22:49 - 2015-07-15 22:49 - 00000000 ____D C:\Users\noki\Documents\SapWorkDir

2015-07-15 22:28 - 2015-05-31 10:11 - 00225792 _____ (Microsoft Corporation) C:\Windows\system32\cewmdm.dll

2015-07-15 22:27 - 2015-07-16 17:18 - 00000000 ____D C:\FRST

2015-07-15 22:24 - 2015-07-15 22:24 - 00000000 _____ C:\Users\noki\defogger_reenable

2015-07-14 22:10 - 2015-07-03 07:31 - 12386304 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2015-07-14 22:10 - 2015-07-03 07:18 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2015-07-14 22:09 - 2015-06-17 03:14 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2015-07-14 22:09 - 2015-06-17 03:12 - 09750528 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2015-07-14 22:09 - 2015-06-17 03:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\html.iec

2015-07-14 22:09 - 2015-06-17 03:10 - 01139712 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2015-07-14 22:09 - 2015-06-17 03:09 - 01804288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2015-07-14 22:09 - 2015-06-17 03:09 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2015-07-14 22:09 - 2015-06-17 03:09 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2015-07-14 22:09 - 2015-06-17 03:09 - 00421888 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2015-07-14 22:09 - 2015-06-17 03:08 - 00718336 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2015-07-14 22:09 - 2015-06-17 03:08 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2015-07-14 22:09 - 2015-06-17 03:08 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2015-07-14 22:09 - 2015-06-17 03:08 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll

2015-07-14 22:09 - 2015-06-17 03:08 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2015-07-14 22:09 - 2015-06-17 03:08 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2015-07-14 22:09 - 2015-06-17 03:08 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2015-07-14 22:09 - 2015-06-17 03:08 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2015-07-14 22:09 - 2015-06-17 03:08 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2015-07-14 22:09 - 2015-06-17 03:08 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll

2015-07-14 22:09 - 2015-06-17 03:08 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe

2015-07-14 22:09 - 2015-06-17 03:08 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe

2015-07-11 09:40 - 2015-07-11 09:40 - 00160408 _____ C:\Windows\Minidump\Mini071115-01.dmp

2015-07-08 22:09 - 2015-07-08 22:09 - 00160408 _____ C:\Windows\Minidump\Mini070815-01.dmp

2015-06-29 13:15 - 2015-06-29 13:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

2015-06-25 20:04 - 2015-06-25 20:04 - 00000000 ____D C:\found.001

2015-06-25 07:37 - 2015-06-25 07:55 - 00000000 ___RD C:\Musik

2015-06-24 23:39 - 2015-06-24 23:39 - 00000000 __RSH C:\MSDOS.SYS

2015-06-24 23:39 - 2015-06-24 23:39 - 00000000 __RSH C:\IO.SYS

2015-06-19 20:35 - 2015-06-19 20:35 - 00160408 _____ C:\Windows\Minidump\Mini061915-01.dmp

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-16 17:15 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

2015-07-16 17:15 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

2015-07-16 17:08 - 2008-12-04 21:13 - 01768890 _____ C:\Windows\WindowsUpdate.log

2015-07-16 17:03 - 2010-11-19 14:55 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-07-16 17:03 - 2009-02-11 00:55 - 00151688 _____ C:\ProgramData\nvModes.001

2015-07-16 17:03 - 2009-02-11 00:54 - 00151688 _____ C:\ProgramData\nvModes.dat

2015-07-16 17:03 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2015-07-16 16:48 - 2010-11-19 14:55 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-07-16 16:44 - 2012-12-02 21:08 - 00568532 _____ C:\Windows\PFRO.log

2015-07-16 16:23 - 2012-04-06 09:10 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-07-16 16:22 - 2010-12-12 21:46 - 00000000 ____D C:\Qoobox

2015-07-16 16:20 - 2006-11-02 12:23 - 00000215 _____ C:\Windows\system.ini

2015-07-16 15:21 - 2009-02-08 23:39 - 00000000 ____D C:\Users\noki

2015-07-16 15:00 - 2013-08-08 21:13 - 00000000 ____D C:\Program Files\Java

2015-07-16 14:36 - 2008-12-04 21:14 - 00003613 _____ C:\Windows\bthservsdp.dat

2015-07-16 14:36 - 2006-11-02 15:01 - 00032606 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2015-07-16 14:13 - 2013-03-21 22:13 - 401666068 _____ C:\Windows\MEMORY.DMP

2015-07-16 14:13 - 2010-01-16 01:49 - 00000000 ____D C:\Windows\Minidump

2015-07-16 11:06 - 2006-11-02 14:47 - 00399544 _____ C:\Windows\system32\FNTCACHE.DAT

2015-07-16 00:50 - 2013-07-28 01:07 - 00000000 ____D C:\Windows\system32\MRT

2015-07-15 22:56 - 2009-02-08 23:40 - 00114168 _____ C:\Users\noki\AppData\Local\GDIPFONTCACHEV1.DAT

2015-07-15 22:50 - 2010-07-08 15:19 - 00000000 ____D C:\Program Files\OpenVPN

2015-07-15 22:49 - 2010-07-13 16:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Business Explorer

2015-07-15 22:49 - 2010-07-13 16:02 - 00000000 ____D C:\Users\noki\SapWorkDir

2015-07-15 22:27 - 2006-11-02 12:33 - 01567488 _____ C:\Windows\system32\PerfStringBackup.INI

2015-07-12 23:09 - 2009-02-12 00:34 - 00000000 ____D C:\Users\noki\AppData\Roaming\Adobe

2015-07-12 23:09 - 2009-02-08 23:43 - 00000000 ____D C:\ProgramData\Adobe

2015-07-09 07:23 - 2012-04-06 09:10 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2015-07-09 07:23 - 2011-05-16 08:44 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2015-07-07 08:08 - 2013-12-09 20:51 - 00000000 ____D C:\Users\noki\AppData\Local\Greenshot

2015-07-03 08:49 - 2006-11-02 12:24 - 127070192 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

2015-07-01 07:02 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\LogFiles

2015-06-29 13:15 - 2015-05-07 19:11 - 00001856 _____ C:\Users\Public\Desktop\Avira Antivirus.lnk

2015-06-23 13:27 - 2009-10-02 22:08 - 00246952 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2015-06-20 20:03 - 2014-08-25 12:33 - 00000000 ____D C:\Users\noki\AppData\Local\Adobe

==================== Files in the root of some directories =======

2008-05-22 19:35 - 2008-05-22 19:35 - 0051962 _____ () C:\Program Files\Common Files\banner.jpg

2008-08-09 00:48 - 2008-08-09 00:48 - 0090112 _____ () C:\Program Files\Common Files\CPInstallAction.dll

2014-05-15 23:10 - 2014-05-15 23:10 - 0000008 _____ () C:\Users\noki\AppData\Roaming\NMM-MetaData.db

2011-07-20 22:28 - 2012-06-03 17:36 - 0001188 _____ () C:\Users\noki\AppData\Local\crc32list11.txt

2010-03-14 13:04 - 2010-03-14 13:04 - 0000552 _____ () C:\Users\noki\AppData\Local\d3d8caps.dat

2013-01-13 13:53 - 2015-06-15 13:57 - 0000680 _____ () C:\Users\noki\AppData\Local\d3d9caps.dat

2009-02-09 00:23 - 2015-04-12 23:33 - 0103936 _____ () C:\Users\noki\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2013-02-22 22:44 - 2013-05-10 12:11 - 0004096 ____H () C:\Users\noki\AppData\Local\keyfile3.drm

2013-08-27 22:12 - 2013-08-27 22:12 - 0000011 _____ () C:\ProgramData\.tv7

2010-12-22 13:54 - 2010-12-22 13:54 - 0000056 ____H () C:\ProgramData\ezsidmv.dat

2009-02-11 00:55 - 2015-07-16 17:03 - 0151688 _____ () C:\ProgramData\nvModes.001

2009-02-11 00:54 - 2015-07-16 17:03 - 0151688 _____ () C:\ProgramData\nvModes.dat

Some files in TEMP:

====================

C:\Users\noki\AppData\Local\temp\avgnt.exe

C:\Users\noki\AppData\Local\temp\NOSEventMessages.dll
 

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 

LastRegBack: 2015-07-16 17:15

==================== End of log ============================

--- --- ---

Also das mit deiner Festplatte gefällt mit so nicht - ständige Filesystemchecks sind ungewöhnlich. Bitte erstmal so fortfahren: Zustand der Festplatte herausfinden - so gehts - Anleitungen

Poste mir am besten ein komplettes Log von CDI :)

Status "Vorsicht"!

----------------------------------------------------------------------------
CrystalDiskInfo 6.5.2 (C) 2008-2015 hiyohiyo
Crystal Dew World : Crystal Dew World
----------------------------------------------------------------------------
OS : Windows Vista Home Premium SP2 [6.0 Build 6002] (x86)
Date : 2015/07/17 7:50:35
-- Controller Map ----------------------------------------------------------
- Ricoh SD/MMC Host Controller [ATA]
- Ricoh Memory Stick Controller [ATA]
- Ricoh xD-Picture Card Controller [ATA]
+ Intel(R) ICH9M-E/M SATA AHCI Controller [ATA]
- Hitachi HTS545050KTA300
- MATSHITA DVD-RAM UJ870BJ
- Microsoft iSCSI-Initiator [SCSI]
-- Disk List ---------------------------------------------------------------
(1) Hitachi HTS545050KTA300 : 500,1 GB [0/0/0, pd1]
----------------------------------------------------------------------------
(1) Hitachi HTS545050KTA300
----------------------------------------------------------------------------
Model : Hitachi HTS545050KTA300
Firmware : BKFOC60G
Serial Number : 081119BK0F00VEGDZ8PB
Disk Size : 500,1 GB (8,4/137,4/500,1/500,1)
Buffer Size : 7015 KB
Queue Depth : 32
# of Sectors : 976773168
Rotation Rate : Unbekannt
Interface : Serial ATA
Major Version : ATA8-ACS
Minor Version : ATA8-ACS version 3f
Transfer Mode : ---- | SATA/300
Power On Hours : 16368 Std.
Power On Count : 7565 mal
Temperature : 41 C (105 F)
Health Status : Vorsicht
Features : S.M.A.R.T., APM, AAM, 48bit LBA, NCQ
APM Level : 4080h [ON]
AAM Level : 80FEh [OFF]
-- S.M.A.R.T. --------------------------------------------------------------
ID Cur Wor Thr RawValues(6) Attribute Name
01 100 100 _62 000000000000 Lesefehlerrate
02 100 100 _40 000000000000 Datendurchsatz-Leistung
03 216 216 _33 001200000001 Mittlere Anlaufzeit
04 _93 _93 __0 000000002BA7 Start/Stopp-Zyklen der Spindel
05 100 100 __5 000000000000 Wiederzugewiesene Sektoren
07 100 100 _67 000000000000 Suchfehler
08 100 100 _40 000000000000 Güte der Suchoperationen
09 _63 _63 __0 000000003FF0 Betriebsstunden
0A 100 100 _60 000000000000 Misslungene Spindelanläufe
0C _96 _96 __0 000000001D8D Geräte-Einschaltvorgänge
BF 100 100 __0 000000000000 Beschleunigungssensor-Fehlerrate
C0 100 100 __0 00000000003D Ausschaltungsabbrüche
C1 _81 _81 __0 00000002EEB3 Laden/Entladen-Zyklen
C2 134 134 __0 003500120029 Temperatur
C4 100 100 __0 00000000000D Wiederzuweisungsereignisse
C5 100 100 __0 000000000005 Aktuell ausstehende Sektoren
C6 100 100 __0 000000000000 Nicht korrigierbare Sektoren
C7 200 200 __0 000000000000 UltraDMA-CRC-Fehler
DF 100 100 __0 000000000000 Laden/Entladen-Wiederholungen
-- IDENTIFY_DEVICE ---------------------------------------------------------
0 1 2 3 4 5 6 7 8 9
000: 045A 3FFF C837 0010 0000 0000 003F 0000 0000 0000
010: 3038 3131 3139 424B 3046 3030 5645 4744 5A38 5042
020: 0003 36CE 0004 424B 464F 4336 3047 4869 7461 6368
030: 6920 4854 5335 3435 3035 304B 5441 3330 3020 2020
040: 2020 2020 2020 2020 2020 2020 2020 8010 4000 0F00
050: 4000 0200 0200 0007 3FFF 0010 003F FC10 00FB 0110
060: FFFF 0FFF 0000 0007 0003 0078 0078 0078 0078 0000
070: 0000 0000 0000 0000 0000 001F 1706 0000 005E 0044
080: 01FC 0042 746B 7F69 6163 7469 BC49 6163 407F 006C
090: 006C 4080 FFFE 0000 80FE 0000 0000 0000 0000 0000
100: 6030 3A38 0000 0000 0000 0000 0000 8848 5000 CCA5
110: 56C5 E61F 0000 0000 0000 0000 0000 0000 0000 4014
120: 4014 0000 0000 0000 0000 0000 0000 0000 0029 000B
130: 000D 0000 0000 0000 0000 0000 0000 0000 0000 0000
140: 0000 0000 0000 0000 0000 0000 0000 0000 4001 0000
150: 8000 0000 4643 0000 0000 6253 5371 6262 0000 0000
160: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
170: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
180: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
190: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
200: 0000 0000 0000 0000 0000 0000 003D 0000 0000 0000
210: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
220: 0000 0000 100F 0021 0000 0000 0000 0000 0000 0000
230: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
240: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
250: 0000 0000 0000 0000 0000 5FA5
-- SMART_READ_DATA ---------------------------------------------------------
+0 +1 +2 +3 +4 +5 +6 +7 +8 +9 +A +B +C +D +E +F
000: 10 00 01 0B 00 64 64 00 00 00 00 00 00 00 02 05
010: 00 64 64 00 00 00 00 00 00 00 03 07 00 D8 D8 01
020: 00 00 00 12 00 00 04 12 00 5D 5D A7 2B 00 00 00
030: 00 00 05 33 00 64 64 00 00 00 00 00 00 00 07 0B
040: 00 64 64 00 00 00 00 00 00 00 08 05 00 64 64 00
050: 00 00 00 00 00 00 09 12 00 3F 3F F0 3F 00 00 00
060: 00 00 0A 13 00 64 64 00 00 00 00 00 00 00 0C 32
070: 00 60 60 8D 1D 00 00 00 00 00 BF 0A 00 64 64 00
080: 00 00 00 00 00 00 C0 32 00 64 64 3D 00 00 00 00
090: 00 00 C1 12 00 51 51 B3 EE 02 00 00 00 00 C2 02
0A0: 00 86 86 29 00 12 00 35 00 00 C4 32 00 64 64 0D
0B0: 00 00 00 00 00 00 C5 22 00 64 64 05 00 00 00 00
0C0: 00 00 C6 08 00 64 64 00 00 00 00 00 00 00 C7 0A
0D0: 00 C8 C8 00 00 00 00 00 00 00 DF 0A 00 64 64 00
0E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
160: 00 00 00 00 00 00 00 00 00 00 00 00 85 02 01 5B
170: 03 00 01 00 02 DA 00 00 00 00 00 00 00 00 00 00
180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10
-- SMART_READ_THRESHOLD ----------------------------------------------------
+0 +1 +2 +3 +4 +5 +6 +7 +8 +9 +A +B +C +D +E +F
000: 10 00 01 3E 00 00 00 00 00 00 00 00 00 00 02 28
010: 00 00 00 00 00 00 00 00 00 00 03 21 00 00 00 00
020: 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00
030: 00 00 05 05 00 00 00 00 00 00 00 00 00 00 07 43
040: 00 00 00 00 00 00 00 00 00 00 08 28 00 00 00 00
050: 00 00 00 00 00 00 09 00 00 00 00 00 00 00 00 00
060: 00 00 0A 3C 00 00 00 00 00 00 00 00 00 00 0C 00
070: 00 00 00 00 00 00 00 00 00 00 BF 00 00 00 00 00
080: 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00
090: 00 00 C1 00 00 00 00 00 00 00 00 00 00 00 C2 00
0A0: 00 00 00 00 00 00 00 00 00 00 C4 00 00 00 00 00
0B0: 00 00 00 00 00 00 C5 00 00 00 00 00 00 00 00 00
0C0: 00 00 C6 00 00 00 00 00 00 00 00 00 00 00 C7 00
0D0: 00 00 00 00 00 00 00 00 00 00 DF 00 00 00 00 00
0E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 89

Noch was zum aktuellen Status. Die ständige 100%-Auslastung hat sich erledigt. Bin jetzt immer so bei 10-20%. Laptop läuft auch ruhig und stabil. Es sei denn, ich Deinstalliere Programme. Das erste klappt meistens noch, aber beim zweiten Programm bleibt der Laptop dann einfach stehen. Als ob er sich ausschaltet, aber das Bild bleibt bestehen. Keine Festplattenaktivität mehr, kein Lüfter. Dann muss ich hart ausschalten und dann macht er bei jedem 2. oder 3. mal chkdsk.

Die Platte hat schon Alterserschinungen...

=> C5 100 100 __0 000000000005 Aktuell ausstehende Sektoren

Ist IMHO grenzwertig. Solltest du im Auge behalten. Daten gesichert?

Ja, mache ich ständig. Wie ursprünglich erwähnt, Laptop ist 7-8 Jahre alt und wird täglich mehrere Stunden benutzt.

Mehr kann man also jetzt nicht mehr machen. Hat aber alles auch schon eine Menge gebracht. :-)

Bitte auch ne neue Addition.txt erstellen, dazu FRST starten und einen Haken setzen bei Addition.txt, dann auf Scan klicken.

http://saved.im/mtg0mjy4yjlu/2014-04...ryscantool.png

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-07-2015

Ran by noki (administrator) on NOKI-PC on 17-07-2015 17:34:21

Running from D:\

Loaded Profiles: noki & postgres (Available Profiles: noki & postgres)

Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)

Internet Explorer Version 9 (Default browser: IE)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Geeks to Go Forum

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe

() C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe

() C:\Program Files\ASUS\ATK Hotkey\AsLdrSrv.exe

() C:\Program Files\ATKGFNEX\GFNEXSrv.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(ASUS) C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe

(ASUS) C:\Program Files\ASUS\ATK Hotkey\HControl.exe

() C:\Program Files\Wireless Console 2\wcourier.exe

(ATK) C:\Program Files\P4G\BatteryLife.exe

() C:\Program Files\ASUS\ASUS Live Update\ALU.exe

(ASUS) C:\Program Files\ASUS\SmartLogon\sensorsrv.exe

(ASUSTek.) C:\Program Files\ASUS\Direct Console\DCHelper.exe

(ASUS) C:\Program Files\ASUS\ASUS CopyProtect\ASPG.exe

(ASUS) C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe

(ASUS) C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe

(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe

(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

() C:\Program Files\P4P\P4P.exe

(ASUSTek.) C:\Program Files\ASUS\Direct Console\Direct Console.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

() C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1db.exe

(MAGIX AG) C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe

(Lavasoft Limited) C:\Program Files\Lavasoft\Web Companion\TcpService\2.3.4.7\LavasoftTcpService.exe

(ASUS) C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe

(ASUS) C:\Program Files\ASUS\ATK Hotkey\KBFiltr.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

(Greenshot) C:\Program Files\Greenshot\Greenshot.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

(ASUS) C:\Program Files\ASUS\ATK Hotkey\WDC.exe

(Dell Inc.) C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1pl.exe

(Nuance Communications, Inc.) C:\Program Files\Nuance\PaperPort\pptd40nt.exe

(Nuance Communications, Inc.) C:\Program Files\Nuance\PDFViewer\PdfPro7Hook.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(Microsoft Corporation) C:\Windows\ehome\ehtray.exe

(Nokia) C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe

(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe

(TomTom) C:\Program Files\MyDrive Connect\MyDriveConnect.exe

(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe

(Lavasoft) C:\Program Files\Lavasoft\Web Companion\Application\WebCompanion.exe

(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe

() C:\Program Files\Dell Printers\OpenManage\OMPMv2.0\client\OMPMWatchdogService.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

(Panasonic Corporation) C:\Program Files\Common Files\Panasonic\HD Writer AutoStart\HDWriterAutoStart.exe

(Logitech Inc.) C:\Program Files\SetPoint\SetPoint.exe

(Nuance Communications, Inc.) C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\8.4\bin\pg_ctl.exe

() C:\Program Files\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WinService.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\8.4\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\8.4\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\8.4\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\8.4\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\8.4\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\8.4\bin\postgres.exe

() C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Microsoft Corporation) C:\Program Files\Windows Mail\WinMail.exe

(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Logitech Inc.) C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe

(Nokia) C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

(Nokia) C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe

(Nokia) C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe

(Nokia) C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe

(Microsoft Corporation) C:\Windows\System32\conime.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
 

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [HControlUser] => C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe [98304 2008-08-18] (ASUS)

HKLM\...\Run: [ATKOSD2] => C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe [8105984 2008-09-03] (ASUS)

HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [6265376 2008-08-12] (Realtek Semiconductor)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1029416 2007-12-06] (Synaptics, Inc.)

HKLM\...\Run: [PowerForPhone] => C:\Program Files\P4P\P4P.exe [778240 2008-01-26] ()

HKLM\...\Run: [DirectConsole2] => C:\Program Files\ASUS\Direct Console\Direct Console.exe [2705976 2008-08-21] (ASUSTek.)

HKLM\...\Run: [TrayServer] => C:\Program Files\MAGIX\Filme_auf_DVD_8\TrayServer.exe [90112 2008-01-17] (MAGIX AG)

HKLM\...\Run: [Kernel and Hardware Abstraction Layer] => C:\Windows\KHALMNPR.EXE [56080 2007-04-12] (Logitech Inc.)

HKLM\...\Run: [ALDI_NORD_FotoSuite_Download] => C:\Program Files\ALDI Nord Foto Service\ALDI_Foto_Service\FotoSuite.exe [1257472 2008-11-13] (MAGIX AG)

HKLM\...\Run: [NeroFilterCheck] => C:\Windows\system32\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)

HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1833504 2008-08-12] (Realtek Semiconductor Corp.)

HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-04-23] (Apple Inc.)

HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [730416 2015-06-10] (Avira Operations GmbH & Co. KG)

HKLM\...\Run: [Greenshot] => C:\Program Files\Greenshot\Greenshot.exe [495616 2013-10-27] (Greenshot)

HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-05-26] (Apple Inc.)

HKLM\...\Run: [LauncherC1765nf] => C:\Program Files\Dell Printers\Printer SSW\Launcher\dlm1launcher.exe [2471928 2013-08-13] (Dell Inc.)

HKLM\...\Run: [StatusAutoRunC1765nf] => C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1pl.exe [3024360 2013-02-06] (Dell Inc.)

HKLM\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\\isuspm.exe [2068856 2011-10-12] (Flexera Software LLC.)

HKLM\...\Run: [PaperPort PTD] => C:\Program Files\Nuance\PaperPort\pptd40nt.exe [36168 2013-05-29] (Nuance Communications, Inc.)

HKLM\...\Run: [IndexSearch] => C:\Program Files\Nuance\PaperPort\IndexSearch.exe [18248 2013-05-29] (Nuance Communications, Inc.)

HKLM\...\Run: [PPort14reminder] => C:\Program Files\Nuance\PaperPort\Ereg\Ereg.exe [330056 2013-03-14] (Nuance Communications, Inc.)

HKLM\...\Run: [PDFProHook] => C:\Program Files\Nuance\PDFViewer\pdfpro7hook.exe [641864 2013-03-20] (Nuance Communications, Inc.)

HKLM\...\Run: [InstallValidator.exe.FA87EC44_C38F_4148_93A1_FF4A64A2B707] => C:\Program Files\National Instruments\Shared\NIUninstaller\InstallValidator.exe [265608 2013-11-21] ()

HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

HKU\S-1-5-21-1619064115-466689268-4177747022-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)

HKU\S-1-5-21-1619064115-466689268-4177747022-1000\...\Run: [NokiaSuite.exe] => C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe [1084840 2012-05-16] (Nokia)

HKU\S-1-5-21-1619064115-466689268-4177747022-1000\...\Run: [MyDriveConnect.exe] => C:\Program Files\MyDrive Connect\MyDriveConnect.exe [1792376 2014-08-22] (TomTom)

HKU\S-1-5-21-1619064115-466689268-4177747022-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)

HKU\S-1-5-21-1619064115-466689268-4177747022-1000\...\Run: [Web Companion] => C:\Program Files\Lavasoft\Web Companion\Application\WebCompanion.exe [1381648 2015-07-17] (Lavasoft)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk [2009-03-25]

ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2008-12-04]

ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HD Writer.lnk [2013-03-29]

ShortcutTarget: HD Writer.lnk -> C:\Program Files\Common Files\Panasonic\HD Writer AutoStart\HDWriterAutoStart.exe (Panasonic Corporation)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SetPoint.lnk [2008-12-04]

ShortcutTarget: SetPoint.lnk -> C:\Program Files\SetPoint\SetPoint.exe (Logitech Inc.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk [2014-12-21]

ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files\WISO\Steuersoftware 2014\mshaktuell.exe ()

ShellIconOverlayIdentifiers: [ADSMOverlayIcon] -> {A825576B-0042-4F0F-8FB0-93CE0F054E69} => C:\Program Files\ASUS\ASUS Data Security Manager\OverlayIconShlExt.dll [2007-06-15] ()

ShellIconOverlayIdentifiers: [ADSMOverlayIcon1] -> {A8D448F4-0431-45AC-9F5E-E1B434AB2249} => C:\Program Files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll [2007-06-02] ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Google

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = MSN Deutschland ? mit Hotmail Nachfolger Outlook und Messenger Skype

HKU\S-1-5-21-1619064115-466689268-4177747022-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\S-1-5-21-1619064115-466689268-4177747022-1000\Software\Microsoft\Internet Explorer\Main,Start Page = Wetter aktuell, Wettervorhersage und Wetterbericht - WetterOnline

SearchScopes: HKLM -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = {searchTerms} - Google Search

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-1619064115-466689268-4177747022-1000 -> DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = {searchTerms} - Google Search

SearchScopes: HKU\S-1-5-21-1619064115-466689268-4177747022-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = {searchTerms - Bing}

SearchScopes: HKU\S-1-5-21-1619064115-466689268-4177747022-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = {searchTerms} - Google Search

BHO: PlusIEEventHelper Class -> {551A852F-39A6-44A7-9C13-AFBEC9185A9D} -> C:\Program Files\Nuance\PDFViewer\Bin\PlusIEContextMenu.dll [2011-06-30] (Zeon Corporation)

BHO: Skype Plug-In -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-11-22] (Skype Technologies S.A.)

DPF: {22E5D91F-89E6-4405-AD9C-0AF27BA6F06B} file:///E:/components/hidinputmonitorx.ocx

DPF: {4F63D44B-6274-4D60-8AB1-CAA7116B8AF3} file:///E:/components/A9.ocx

DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1375990510233

DPF: {7030CC6C-1A88-4591-BB5A-651B9F7F0C30} file:///E:/components/wmvhdrating.ocx

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-11-22] (Skype Technologies S.A.)

ShellExecuteHooks:  - {AEB6717E-7E19-11d0-97EE-00C04FD91972} -  No File [ ]

Winsock: Catalog9 01 C:\Windows\system32\LavasoftTcpService.dll [342016 2015-07-17] (Lavasoft Limited)

Winsock: Catalog9 02 C:\Windows\system32\LavasoftTcpService.dll [342016 2015-07-17] (Lavasoft Limited)

Winsock: Catalog9 03 C:\Windows\system32\LavasoftTcpService.dll [342016 2015-07-17] (Lavasoft Limited)

Winsock: Catalog9 04 C:\Windows\system32\LavasoftTcpService.dll [342016 2015-07-17] (Lavasoft Limited)

Winsock: Catalog9 44 C:\Windows\system32\LavasoftTcpService.dll [342016 2015-07-17] (Lavasoft Limited)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

Tcpip\..\Interfaces\{FEA61DD9-6138-4BB7-83A2-5A1E647F7064}: [DhcpNameServer] 192.168.178.1

FireFox:

========

FF ProfilePath: C:\Users\noki\AppData\Roaming\Mozilla\Firefox\Profiles\p25m8g9e.default

FF Homepage: hxxp://www.bing.com/?pc=COSP&ptag=D071715-ABA01A7CCEB2146F8A7F&form=CONMHP&conlogo=CT3330961

FF Keyword.URL: 

FF DefaultSearchEngine: Bing

FF SelectedSearchEngine: Bing

FF NewTab: hxxp://www.bing.com/?pc=COSP&ptag=D071715-ABA01A7CCEB2146F8A7F&form=CONMHP&conlogo=CT3330961

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_18_0_0_209.dll [2015-07-17] ()

FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2014-02-21] ()

FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)

FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-30] (Microsoft Corporation)

FF Plugin: @nokia.com/EnablerPlugin -> C:\Program Files\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll [2012-05-16] ( )

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)

FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-06-27] (Adobe Systems Inc.)

FF Plugin: ZEON/PDF,version=2.0 -> C:\Program Files\Nuance\PDFViewer\bin\nppdf.dll [2011-07-15] (Zeon Corporation)

FF Plugin HKU\S-1-5-21-1619064115-466689268-4177747022-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin1017325.dll [2012-10-04] (Amazon.com, Inc.)

FF Extension: Avira Browser Safety - C:\Users\noki\AppData\Roaming\Mozilla\Firefox\Profiles\p25m8g9e.default\Extensions\abs@avira.com [2015-06-18]

FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-02-17]

Chrome: 

=======

CHR RestoreOnStartup: Default -> "hxxp://www.google.com/"

CHR Plugin: (Remoting Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\20.0.1132.57\ppGoogleNaClPluginChrome.dll No File

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\20.0.1132.57\pdf.dll No File

CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\20.0.1132.57\gcswf32.dll No File

CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll No File

CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin6.dll No File

CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin7.dll No File

CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll No File

CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File

CHR Plugin: (Nokia Suite Enabler Plugin) - C:\Program Files\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )

CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

CHR Profile: C:\Users\noki\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (YouTube) - C:\Users\noki\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-08-25]

CHR Extension: (Google Search) - C:\Users\noki\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-08-25]

CHR Extension: (Gmail) - C:\Users\noki\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-08-25]

CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [68096 2009-03-25] () [File not signed]

R2 ADSMService; C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe [73728 2007-05-18] () [File not signed]

S2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc.exe [825136 2015-06-10] (Avira Operations GmbH & Co. KG)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [450808 2015-06-10] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [450808 2015-06-10] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1187336 2015-06-10] (Avira Operations GmbH & Co. KG)

R2 ASLDRService; C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe [100920 2008-08-14] ()

R2 ATKGFNEXSrv; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [94208 2007-08-08] () [File not signed]

R2 DLNBDB; C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1db.exe [191464 2013-02-06] ()

R2 Fabs; C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe [1155072 2009-02-03] (MAGIX AG) [File not signed]

S3 FirebirdServerMAGIXInstance; C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2008-08-07] (MAGIX®) [File not signed]

R2 LavasoftTcpService; C:\Program Files\Lavasoft\Web Companion\TcpService\2.3.4.7\LavasoftTcpService.exe [2751792 2015-07-17] (Lavasoft Limited)

R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728 2008-06-09] (Hewlett-Packard Company) [File not signed]

S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)

S2 OMPM Service; C:\Program Files\Dell Printers\OpenManage\OMPMv2.0\client\rdmf_clientd.exe [5738823 2014-03-06] () [File not signed]

S2 OMPMJBASSVC; C:\Program Files\Dell Printers\OpenManage\OMPMv2.0\server\jboss-as\bin\jbosssvc.exe [61440 2011-08-11] (Red Hat®, Inc.) [File not signed]

R2 OMPMWatchdogService; C:\Program Files\Dell Printers\OpenManage\OMPMv2.0\client\OMPMWatchdogService.exe [199633 2014-03-18] () [File not signed]

R2 PDFProFiltSrvPP; C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe [77640 2013-05-29] (Nuance Communications, Inc.)

R2 postgresql-8.4; C:\Program Files\PostgreSQL\8.4\bin\pg_ctl.exe [66048 2012-08-16] (PostgreSQL Global Development Group) [File not signed]

R2 SearchProtectionService; C:\Program Files\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WinService.exe [13312 2015-07-17] () [File not signed]

R2 spmgr; C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe [125496 2007-08-03] ()

R3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-21] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 61883; C:\Windows\System32\DRIVERS\61883.sys [45696 2008-01-21] (Microsoft Corporation)

R0 AsDsm; C:\Windows\system32\Drivers\AsDsm.sys [29752 2007-08-11] (Windows (R) Codename Longhorn DDK provider)

R2 ASMMAP; C:\Program Files\ATKGFNEX\ASMMAP.sys [13880 2007-07-24] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108448 2015-06-10] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136728 2015-06-10] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37896 2015-05-07] (Avira Operations GmbH & Co. KG)

R2 ghaio; C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys [20936 2007-08-03] ()

R3 itecir; C:\Windows\System32\DRIVERS\itecir.sys [54784 2007-12-19] (ITE Tech. Inc. )

R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15928 2008-06-03] ( )

R0 lullaby; C:\Windows\System32\DRIVERS\lullaby.sys [15416 2008-05-29] (Windows (R) Codename Longhorn DDK provider)

R3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [28688 2007-04-12] (Logitech, Inc.)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-04-14] (Malwarebytes Corporation)

S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2015-07-16] (Malwarebytes Corporation)

S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-04-14] (Malwarebytes Corporation)

R3 MTsensor; C:\Windows\System32\DRIVERS\ATKACPI.sys [7680 2006-12-14] (ATK0100)

S3 PhotoFrame; C:\Windows\System32\DRIVERS\PhotoFrame.sys [30464 2007-09-11] (ETC) [File not signed]

R0 PxHelp20; C:\Windows\System32\Drivers\PxHelp20.sys [45744 2011-10-04] (Rovi Corporation)

R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1748352 2008-06-09] ()

R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [31848 2015-06-10] (Avira Operations GmbH & Co. KG)

S3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [25984 2009-12-12] (The OpenVPN Project)

S3 USB28xxBGA; C:\Windows\System32\DRIVERS\emBDA.sys [530944 2008-03-06] (eMPIA Technology, Inc.)

S3 USB28xxOEM; C:\Windows\System32\DRIVERS\emOEM.sys [45696 2007-04-25] (eMPIA Technology, Inc.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)

S3 catchme; \??\C:\Users\noki\AppData\Local\Temp\catchme.sys [X]

S4 Eskgfroc; No ImagePath

S3 GigasetGenericUSB; system32\DRIVERS\GigasetGenericUSB.sys [X]

S3 IpInIp; system32\DRIVERS\ipinip.sys [X]

S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]

S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-17 08:42 - 2015-07-17 08:42 - 00160408 _____ C:\Windows\Minidump\Mini071715-01.dmp

2015-07-17 07:48 - 2015-07-17 07:48 - 00342016 _____ (Lavasoft Limited) C:\Windows\system32\LavasoftTcpService.dll

2015-07-17 07:48 - 2015-07-17 07:48 - 00002920 _____ C:\Windows\system32\LavasoftTcpServiceOff.ini

2015-07-17 07:48 - 2015-07-17 07:48 - 00000000 ____D C:\Users\noki\AppData\Roaming\Lavasoft

2015-07-17 07:48 - 2015-07-17 07:48 - 00000000 ____D C:\Users\noki\AppData\Local\Lavasoft

2015-07-17 07:48 - 2015-07-17 07:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft

2015-07-17 07:48 - 2015-07-17 07:48 - 00000000 ____D C:\ProgramData\Lavasoft

2015-07-17 07:48 - 2015-07-17 07:48 - 00000000 ____D C:\Program Files\Lavasoft

2015-07-17 07:47 - 2015-07-17 07:48 - 00000000 ____D C:\Program Files\CrystalDiskInfo

2015-07-17 07:47 - 2015-07-17 07:47 - 00001732 _____ C:\Users\noki\Desktop\CrystalDiskInfo.lnk

2015-07-17 07:47 - 2015-07-17 07:47 - 00000000 ____D C:\Users\noki\AppData\Roaming\OpenCandy

2015-07-17 07:47 - 2015-07-17 07:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CrystalDiskInfo

2015-07-16 19:24 - 2015-07-16 19:24 - 00000000 __SHD C:\found.004

2015-07-16 17:16 - 2015-07-16 17:16 - 00001301 _____ C:\Users\noki\Desktop\JRT.txt

2015-07-16 16:38 - 2015-07-16 16:38 - 00000000 __SHD C:\found.003

2015-07-16 16:22 - 2015-07-16 16:22 - 00013389 _____ C:\ComboFix.txt

2015-07-16 16:03 - 2015-07-16 16:22 - 00000000 ____D C:\ComboFix

2015-07-16 15:47 - 2015-07-16 14:38 - 05634275 ____R (Swearware) C:\Users\noki\Desktop\ComboFix.exe

2015-07-16 14:33 - 2015-06-17 18:50 - 02264576 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

2015-07-16 14:33 - 2015-06-17 17:09 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe

2015-07-16 14:13 - 2015-07-16 14:13 - 00160408 _____ C:\Windows\Minidump\Mini071615-01.dmp

2015-07-16 12:27 - 2015-07-16 12:31 - 00000000 ____D C:\AdwCleaner

2015-07-16 11:57 - 2015-07-16 12:14 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-07-16 11:56 - 2015-07-16 11:56 - 00000866 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-07-16 11:56 - 2015-07-16 11:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-07-16 11:56 - 2015-07-16 11:56 - 00000000 ____D C:\ProgramData\Malwarebytes

2015-07-16 11:56 - 2015-07-16 11:56 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware

2015-07-16 11:56 - 2015-04-14 09:37 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-07-16 11:56 - 2015-04-14 09:37 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2015-07-16 11:56 - 2015-04-14 09:37 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2015-07-16 11:00 - 2015-07-03 18:04 - 01316864 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll

2015-07-16 11:00 - 2015-06-25 04:57 - 02066432 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2015-07-16 10:23 - 2015-06-12 18:01 - 00298496 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll

2015-07-16 00:34 - 2015-07-07 17:58 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll

2015-07-16 00:34 - 2015-07-07 16:22 - 00296960 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll

2015-07-15 23:52 - 2015-07-15 23:52 - 00000000 ____D C:\found.002

2015-07-15 23:14 - 2015-07-15 23:14 - 00160408 _____ C:\Windows\Minidump\Mini071515-01.dmp

2015-07-15 23:09 - 2015-06-23 18:02 - 00501248 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2015-07-15 22:49 - 2015-07-15 22:49 - 00000000 ____D C:\Users\noki\Documents\SapWorkDir

2015-07-15 22:28 - 2015-05-31 10:11 - 00225792 _____ (Microsoft Corporation) C:\Windows\system32\cewmdm.dll

2015-07-15 22:27 - 2015-07-17 17:34 - 00000000 ____D C:\FRST

2015-07-15 22:24 - 2015-07-15 22:24 - 00000000 _____ C:\Users\noki\defogger_reenable

2015-07-14 22:10 - 2015-07-03 07:31 - 12386304 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2015-07-14 22:10 - 2015-07-03 07:18 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2015-07-14 22:09 - 2015-06-17 03:14 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2015-07-14 22:09 - 2015-06-17 03:12 - 09750528 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2015-07-14 22:09 - 2015-06-17 03:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\html.iec

2015-07-14 22:09 - 2015-06-17 03:10 - 01139712 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2015-07-14 22:09 - 2015-06-17 03:09 - 01804288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2015-07-14 22:09 - 2015-06-17 03:09 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2015-07-14 22:09 - 2015-06-17 03:09 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2015-07-14 22:09 - 2015-06-17 03:09 - 00421888 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2015-07-14 22:09 - 2015-06-17 03:08 - 00718336 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2015-07-14 22:09 - 2015-06-17 03:08 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2015-07-14 22:09 - 2015-06-17 03:08 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2015-07-14 22:09 - 2015-06-17 03:08 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll

2015-07-14 22:09 - 2015-06-17 03:08 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2015-07-14 22:09 - 2015-06-17 03:08 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2015-07-14 22:09 - 2015-06-17 03:08 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2015-07-14 22:09 - 2015-06-17 03:08 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2015-07-14 22:09 - 2015-06-17 03:08 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2015-07-14 22:09 - 2015-06-17 03:08 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll

2015-07-14 22:09 - 2015-06-17 03:08 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe

2015-07-14 22:09 - 2015-06-17 03:08 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe

2015-07-11 09:40 - 2015-07-11 09:40 - 00160408 _____ C:\Windows\Minidump\Mini071115-01.dmp

2015-07-08 22:09 - 2015-07-08 22:09 - 00160408 _____ C:\Windows\Minidump\Mini070815-01.dmp

2015-06-29 13:15 - 2015-06-29 13:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

2015-06-25 20:04 - 2015-06-25 20:04 - 00000000 ____D C:\found.001

2015-06-25 07:37 - 2015-06-25 07:55 - 00000000 ___RD C:\Musik

2015-06-24 23:39 - 2015-06-24 23:39 - 00000000 __RSH C:\MSDOS.SYS

2015-06-24 23:39 - 2015-06-24 23:39 - 00000000 __RSH C:\IO.SYS

2015-06-19 20:35 - 2015-06-19 20:35 - 00160408 _____ C:\Windows\Minidump\Mini061915-01.dmp

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-17 17:23 - 2012-04-06 09:10 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-07-17 17:02 - 2008-12-04 21:13 - 02033851 _____ C:\Windows\WindowsUpdate.log

2015-07-17 16:48 - 2010-11-19 14:55 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-07-17 16:32 - 2010-11-19 14:55 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-07-17 16:32 - 2009-02-11 00:55 - 00151688 _____ C:\ProgramData\nvModes.001

2015-07-17 16:32 - 2009-02-11 00:54 - 00151688 _____ C:\ProgramData\nvModes.dat

2015-07-17 16:31 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2015-07-17 16:31 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

2015-07-17 16:31 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

2015-07-17 15:59 - 2013-01-13 13:53 - 00000680 _____ C:\Users\noki\AppData\Local\d3d9caps.dat

2015-07-17 08:42 - 2010-01-16 01:49 - 00000000 ____D C:\Windows\Minidump

2015-07-17 08:41 - 2013-03-21 22:13 - 425738260 _____ C:\Windows\MEMORY.DMP

2015-07-17 08:41 - 2012-12-02 21:08 - 00569166 _____ C:\Windows\PFRO.log

2015-07-17 00:25 - 2008-12-04 21:14 - 00003613 _____ C:\Windows\bthservsdp.dat

2015-07-17 00:25 - 2006-11-02 15:01 - 00032606 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2015-07-17 00:23 - 2012-04-06 09:10 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2015-07-17 00:23 - 2011-05-16 08:44 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2015-07-16 21:12 - 2011-06-23 20:22 - 00002425 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk

2015-07-16 16:22 - 2010-12-12 21:46 - 00000000 ____D C:\Qoobox

2015-07-16 16:20 - 2006-11-02 12:23 - 00000215 _____ C:\Windows\system.ini

2015-07-16 15:21 - 2009-02-08 23:39 - 00000000 ____D C:\Users\noki

2015-07-16 15:00 - 2013-08-08 21:13 - 00000000 ____D C:\Program Files\Java

2015-07-16 11:06 - 2006-11-02 14:47 - 00399544 _____ C:\Windows\system32\FNTCACHE.DAT

2015-07-16 00:50 - 2013-07-28 01:07 - 00000000 ____D C:\Windows\system32\MRT

2015-07-15 22:56 - 2009-02-08 23:40 - 00114168 _____ C:\Users\noki\AppData\Local\GDIPFONTCACHEV1.DAT

2015-07-15 22:50 - 2010-07-08 15:19 - 00000000 ____D C:\Program Files\OpenVPN

2015-07-15 22:49 - 2010-07-13 16:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Business Explorer

2015-07-15 22:49 - 2010-07-13 16:02 - 00000000 ____D C:\Users\noki\SapWorkDir

2015-07-15 22:27 - 2006-11-02 12:33 - 01567488 _____ C:\Windows\system32\PerfStringBackup.INI

2015-07-12 23:09 - 2009-02-12 00:34 - 00000000 ____D C:\Users\noki\AppData\Roaming\Adobe

2015-07-12 23:09 - 2009-02-08 23:43 - 00000000 ____D C:\ProgramData\Adobe

2015-07-07 08:08 - 2013-12-09 20:51 - 00000000 ____D C:\Users\noki\AppData\Local\Greenshot

2015-07-03 08:49 - 2006-11-02 12:24 - 127070192 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

2015-07-01 07:02 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\LogFiles

2015-06-29 13:15 - 2015-05-07 19:11 - 00001856 _____ C:\Users\Public\Desktop\Avira Antivirus.lnk

2015-06-23 13:27 - 2009-10-02 22:08 - 00246952 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2015-06-20 20:03 - 2014-08-25 12:33 - 00000000 ____D C:\Users\noki\AppData\Local\Adobe

==================== Files in the root of some directories =======

2008-05-22 19:35 - 2008-05-22 19:35 - 0051962 _____ () C:\Program Files\Common Files\banner.jpg

2008-08-09 00:48 - 2008-08-09 00:48 - 0090112 _____ () C:\Program Files\Common Files\CPInstallAction.dll

2014-05-15 23:10 - 2014-05-15 23:10 - 0000008 _____ () C:\Users\noki\AppData\Roaming\NMM-MetaData.db

2011-07-20 22:28 - 2012-06-03 17:36 - 0001188 _____ () C:\Users\noki\AppData\Local\crc32list11.txt

2010-03-14 13:04 - 2010-03-14 13:04 - 0000552 _____ () C:\Users\noki\AppData\Local\d3d8caps.dat

2013-01-13 13:53 - 2015-07-17 15:59 - 0000680 _____ () C:\Users\noki\AppData\Local\d3d9caps.dat

2009-02-09 00:23 - 2015-04-12 23:33 - 0103936 _____ () C:\Users\noki\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2013-02-22 22:44 - 2013-05-10 12:11 - 0004096 ____H () C:\Users\noki\AppData\Local\keyfile3.drm

2013-08-27 22:12 - 2013-08-27 22:12 - 0000011 _____ () C:\ProgramData\.tv7

2010-12-22 13:54 - 2010-12-22 13:54 - 0000056 ____H () C:\ProgramData\ezsidmv.dat

2009-02-11 00:55 - 2015-07-17 16:32 - 0151688 _____ () C:\ProgramData\nvModes.001

2009-02-11 00:54 - 2015-07-17 16:32 - 0151688 _____ () C:\ProgramData\nvModes.dat

Some files in TEMP:

====================

C:\Users\noki\AppData\Local\temp\avgnt.exe

C:\Users\noki\AppData\Local\temp\NOSEventMessages.dll
 

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 

LastRegBack: 2015-07-17 16:42

==================== End of log ============================

--- --- ---
FRST Additions Logfile:
[CODE]Additional
FRST Logfile:

Code:

scan result of Farbar Recovery Scan Tool (x86) Version: 12-07-2015

Ran by noki at 2015-07-17 17:35:07

Running from D:\

Boot Mode: Normal

==========================================================
 

==================== Accounts: =============================

Administrator (S-1-5-21-1619064115-466689268-4177747022-500 - Administrator - Disabled)

Gast (S-1-5-21-1619064115-466689268-4177747022-501 - Limited - Disabled)

noki (S-1-5-21-1619064115-466689268-4177747022-1000 - Administrator - Enabled) => C:\Users\noki

postgres (S-1-5-21-1619064115-466689268-4177747022-1001 - Limited - Enabled) => C:\Users\postgres

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 18 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 18.0.0.209 - Adobe Systems Incorporated)

Adobe Flash Player 18 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 18.0.0.209 - Adobe Systems Incorporated)

Adobe Photoshop CS (HKLM\...\{EFB21DE7-8C19-4A88-BB28-A766E16493BC}) (Version: CS - Adobe Systems, Inc.)

Adobe Reader X (10.1.15) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.15 - Adobe Systems Incorporated)

Albelli Fotobücher (HKU\S-1-5-21-1619064115-466689268-4177747022-1000\...\{EE20E438-B675-4421-AB07-928F0EC9FB22}_is1) (Version:  - Albelli)

ALDI NORD Bestellsoftware 4.13 (HKLM\...\ALDI NORD Bestellsoftware) (Version: 4.13 - ORWO Net)

ALDI Nord Foto Manager Free (HKLM\...\ALDI Nord Foto Manager Free D) (Version: 6.0.1.471 - MAGIX AG)

ALDI Nord Foto Service (HKLM\...\ALDI Nord Foto Service D) (Version: 1.13.0.111 - MAGIX AG)

ALDI Nord Online Druck Service (HKLM\...\ALDI Nord Online Druck Service D) (Version: 4.5.1.0 - MAGIX AG)

Amazon MP3-Downloader 1.0.17 (HKLM\...\Amazon MP3-Downloader) (Version: 1.0.17 - Amazon Services LLC)

Apple Application Support (HKLM\...\{D9DAD0FF-495A-472B-9F10-BAE430A26682}) (Version: 3.0.3 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{18D47FA1-0440-48D3-A7E0-DA09537FF471}) (Version: 7.1.1.3 - Apple Inc.)

Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

ASUS CopyProtect (HKLM\...\{6B77A7F6-DD63-4F13-A6FF-83137A5AC354}) (Version: 1.0.0008 - ASUS)

ASUS Data Security Manager (HKLM\...\{1C8521E5-5A7B-4A4E-A9CD-AD53116EAEE0}) (Version: 1.00.0006 - ASUS)

ASUS LifeFrame3 (HKLM\...\{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}) (Version: 3.0.13 - ASUS)

ASUS Live Update (HKLM\...\{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}) (Version: 2.5.6 - ASUS)

ASUS Power4Gear eXtreme (HKLM\...\{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}) (Version: 1.0.19 - ASUS)

ASUS SmartLogon (HKLM\...\{64452561-169F-4A36-A2FF-B5E118EC65F5}) (Version: 1.0.0005 - ASUS)

ASUS Virtual Camera (HKLM\...\{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}) (Version: 1.0.11 - ASUS)

ATK Generic Function Service (HKLM\...\{D3D54F3E-C5C3-443D-978F-87A72E5616E8}) (Version: 1.00.0008 - ATK)

ATK Hotkey (HKLM\...\{7C05592D-424B-46CB-B505-E0013E8E75C9}) (Version: 1.0.0042 - ASUS)

ATKOSD2 (HKLM\...\{3B05F2FB-745B-4012-ADF2-439F36B2E70B}) (Version: 7.0.0002 - ASUS)

Audacity 1.2.6 (HKLM\...\Audacity_is1) (Version:  - )

AudibleManager (HKLM\...\AudibleManager) (Version: 49582374.-2.1996386486.1996385500 - Audible, Inc.)

Avira Antivirus (HKLM\...\Avira Antivirus) (Version: 15.0.11.579 - Avira Operations GmbH & Co. KG)

Bild Albelli Fotoservice (HKU\S-1-5-21-1619064115-466689268-4177747022-1000\...\{4E97552A-D0D2-47E3-B4A0-82E5A57A4198}_is1) (Version:  - Bild Albelli)

CCleaner (HKLM\...\CCleaner) (Version: 3.01 - Piriform)

CDDRV_Installer (Version: 1.00.0000 - Logitech) Hidden

Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)

CrystalDiskInfo 6.5.2 (HKLM\...\CrystalDiskInfo_is1) (Version: 6.5.2 - Crystal Dew World)

Dell C1765 Color MFP (HKLM\...\InstallShield_{B03A2793-A8FF-4242-B23D-88D2D5FAE56A}) (Version: 1.039.0 - Dell Inc.)

Dell C1765 Color MFP (Version: 1.039.0 - Dell Inc.) Hidden

Direct Console 2.0 (HKLM\...\{E616A5EE-B7F4-4807-800B-79EB4EB2182B}) (Version: 2.0.5 - ASUS)

Dolby Control Center (HKLM\...\{A23E5590-6799-437B-9723-2627BA800B6F}) (Version: 2.0.0706 - Dolby)

Express Gate (HKLM\...\{2862A3C1-0CD9-4D8B-A28C-8C337D4DD5EB}) (Version: 0.8.6.0 - devicevm)

Firebird SQL Server - MAGIX Edition (HKLM\...\{3E6F0CAD-EE38-42A5-9EEA-AE17A55BF2D4}) (Version: 2.1.23.0 - MAGIX AG)

FormatFactory 2.20 (HKLM\...\FormatFactory) (Version: 2.20 - Free Time)

Free M4a to MP3 Converter 8.2 (HKLM\...\Free M4a to MP3 Converter_is1) (Version:  - ManiacTools.com)

Google Earth Plug-in (HKLM\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)

Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden

Google Update Helper (Version: 1.3.28.1 - Google Inc.) Hidden

Greenshot 1.1.6.2779 (HKLM\...\Greenshot_is1) (Version: 1.1.6.2779 - Greenshot)

HD Writer AE 4.0 (HKLM\...\{DAC69A3A-89E6-4B70-B486-B974C2C95BE9}) (Version: 4.00.022.1031 - Panasonic Corporation)

ITECIR (HKLM\...\{40580068-9B10-40B5-9548-536CE88AB23C}) (Version: 1.00.0000 - ITE)

iTunes (HKLM\...\{0718A90E-93AA-49AF-A4FE-0165ACD91DF0}) (Version: 11.2.2.3 - Apple Inc.)

KhalInstallWrapper (Version: 4.00.121 - Logitech) Hidden

LEGO MINDSTORMS EV3 (HKLM\...\LEGO_SW.{5B0CB826-E499-4E6B-94F0-75B6327ED934}) (Version: 1.0.0 - The LEGO Group)

LEGO MINDSTORMS EV3 Home Content (Version: 1.1.41 - The LEGO Group) Hidden

LEGO MINDSTORMS EV3 Home deutscher Support (Version: 1.1.41 - The LEGO Group) Hidden

LEGO MINDSTORMS EV3 Home Edition (Version: 1.1.41 - The LEGO Group) Hidden

LEGO MINDSTORMS EV3 Uninstaller (Version: 1.0.11 - The LEGO Group) Hidden

LEGO MINDSTORMS NXT Driver (HKLM\...\{FA2B75F7-6037-4C34-9F3B-3E4320C4CC61}) (Version: 1.20.111.0 - LEGO)

LightScribe System Software  1.14.17.1 (HKLM\...\{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}) (Version: 1.14.17.1 - LightScribe)

MAGIX Filme auf DVD 8 8.0.0.11 (D) (HKLM\...\MAGIX Filme auf DVD 8 D) (Version: 8.0.0.11 - MAGIX AG)

MAGIX Online Druck Service 3.4.3.0 (D) (HKLM\...\MAGIX Online Druck Service D) (Version: 3.4.3.0 - MAGIX AG)

MAGIX Screenshare 4.3.6.1987 (D) (HKLM\...\MAGIX Screenshare D) (Version: 4.3.6.1987 - MAGIX AG)

MAGIX USB-Videowandler 2 (HKLM\...\InstallShield_{91065458-A5CF-474C-9160-B44B974B3C25}) (Version: 1.00.0000 - MAGIX)

MAGIX USB-Videowandler 2 (Version: 1.00.0000 - MAGIX) Hidden

MAGIXUSB-Videowandler 2 Device Driver (HKLM\...\TVEpaDrv) (Version:  - )

Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)

MediaManager (HKLM\...\MediaManager) (Version: 3.0.3 (60) - PacketVideo)

Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)

Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)

Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)

Microsoft Office Professional Edition 2003 (HKLM\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)

Microsoft redistributable runtime DLLs VS2005(x86) (HKLM\...\{C0DB380B-97B5-4BB8-AC8D-1835E61439B6}) (Version: 1.0.0.0 - SAP)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)

Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4048 (HKLM\...\{5B1F2843-B379-3FF2-B0D3-64DD143ED53A}) (Version: 9.0.30729.4048 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Mozilla Firefox 37.0.1 (x86 de) (HKLM\...\Mozilla Firefox 37.0.1 (x86 de)) (Version: 37.0.1 - Mozilla)

Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)

MSVC80_x86_v2 (Version: 1.0.3.0 - Nokia) Hidden

MSVC90_x86 (Version: 1.0.1.2 - Nokia) Hidden

MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

MSXML4.0 redistributable (HKLM\...\{44D66AD9-AE19-4AFD-BE7E-A1B44C856697}) (Version: 4.0.0.0 - SAP)

MyDriveConnect 3.3.0.1756 (HKLM\...\MyDriveConnect) (Version: 3.3.0.1756 - TomTom)

NB Probe (HKLM\...\{6324A1EF-CEF4-43E3-8BCD-9EF3F67317FD}) (Version:  - )

Nero 6 Demo (HKLM\...\Nero - Burning Rom!UninstallKey) (Version:  - )

NI .NET Framework 4 (Version: 4.00.49152 - National Instruments) Hidden

NI EulaDepot (Version: 3.20.363 - National Instruments) Hidden

NI MDF Support (Version: 3.20.363 - National Instruments) Hidden

NI Security Update (KB 67L8LCQW) (Version: 1.0.29.0 - National Instruments) Hidden

NI Uninstaller (Version: 3.20.363 - National Instruments) Hidden

NI VC2008MSMs x86 (Version: 9.0.401 - National Instruments) Hidden

Nokia Connectivity Cable Driver (HKLM\...\{A57025CC-5F2E-4D01-B387-06DB10500D43}) (Version: 7.1.78.0 - Nokia)

Nokia PC Suite (HKLM\...\{531317A5-586A-4E36-87C1-CA823447B375}) (Version: 6.81.13.0 - Nokia)

Nokia Suite (HKLM\...\Nokia Suite) (Version: 3.4.49.0 - Nokia)

Nokia Suite (Version: 3.4.49.0 - Nokia) Hidden

Nuance PaperPort 14 (HKLM\...\{08BCE67B-6305-4D8A-B749-F381E7E3DDA2}) (Version: 14.5.0000 - Nuance Communications, Inc.)

Nuance PDF Viewer Plus (HKLM\...\{FC984E39-43D0-4AB2-ACC7-A7B87977B009}) (Version: 7.20.3274 - Nuance Communications, Inc.)

NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.4 - NVIDIA Corporation)

NVIDIA HD-Audiotreiber 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation)

OMPM v2.0 (HKLM\...\InstallShield_{0A7245F9-B454-4FAA-9A94-61617B6039A1}) (Version: 2.7.4.7 - Ihr Firmenname)

OMPM v2.0 (Version: 2.7.4.7 - Ihr Firmenname) Hidden

P4P (HKLM\...\{FC3D290D-79BE-44B7-ABF9-FDD110925930}) (Version: 1.0.0.17 - P4P)

PaperPort Image Printer (HKLM\...\{6EF2FDAB-7FBF-4AB9-92CD-594BDDB6A56B}) (Version: 14.00.0000 - Nuance Communications, Inc.)

PC Connectivity Solution (HKLM\...\{DA5B2BDC-F654-4A88-A669-4D34BC7846A1}) (Version: 12.0.17.0 - Nokia)

PhotoFrame  (HKLM\...\PhotoFrame) (Version:  - )

PostgreSQL 8.4 (HKLM\...\PostgreSQL 8.4) (Version: 8.4 - PostgreSQL Global Development Group)

QuickTime 7 (HKLM\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)

Ravensburger tiptoi (HKLM\...\Ravensburger tiptoi) (Version:  - )

Realtek 8169 8168 8101E 8102E Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0000 - Realtek)

Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5683 - Realtek Semiconductor Corp.)

RICOH R5C83x/84x Flash Media Controller Driver Ver.3.55.03 (HKLM\...\{59F6A514-9813-47A3-948C-8A155460CC2A}) (Version: 3.55.03 - RICOH)

Scansoft PDF Professional (Version:  - ) Hidden

SetPoint (HKLM\...\{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}) (Version: 4.00 - Logitech)

Skype™ 7.0 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 10.1.8.0 - Synaptics)

USB 2.0 2.0M UVC WebCam (HKLM\...\USB 2.0 2.0M UVC WebCam) (Version:  - )

vcredist_x86 (HKLM\...\{CEC7A786-A9C8-4EF7-BB59-6518E3B3C878}) (Version: 1.0.0 - SAP)

Visual Studio C++ 10.0 Runtime (HKLM\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)

Web Companion (HKLM\...\{cb9e3725-16cf-4074-9773-48ed63531d12}) (Version: 2.0.1025.2130 - Lavasoft)

WIDCOMM Bluetooth Software (HKLM\...\{03D1988F-469F-4843-8E6E-E5FE9D17889D}) (Version: 5.2.0.800 - Broadcom Corporation)

Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0) (HKLM\...\504244733D18C8F63FF584AEB290E3904E791693) (Version: 08/22/2008 7.0.0.0 - Nokia)

WinFlash (HKLM\...\{DE10AB76-4756-4913-BE25-55D1C1051F9A}) (Version:  - )

WinRAR Archivierer (HKLM\...\WinRAR archiver) (Version:  - )

WinZip (HKLM\...\WinZip) (Version:  8.1 SR-1  (5266) - WinZip Computing, Inc.)

Wireless Console 2 (HKLM\...\{83F73CB1-7705-49D1-9852-84D839CA2A45}) (Version: 2.0.10 - ATK)

WISO Steuer 2012 (HKLM\...\{0CC1DAFB-40C8-4903-953D-471E541477C7}) (Version: 19.00.7304 - Buhl Data Service GmbH)

WISO Steuer 2013 (HKLM\...\{D6CC2FAF-F827-4091-96A1-D32CC9B69C79}) (Version: 20.00.8137 - Buhl Data Service GmbH)

WISO Steuer 2014 (HKLM\...\{3C5C5344-25D3-4013-BCA1-A0711FE7B3AD}) (Version: 21.00.8480 - Buhl Data Service GmbH)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1619064115-466689268-4177747022-1000_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File

CustomCLSID: HKU\S-1-5-21-1619064115-466689268-4177747022-1000_Classes\CLSID\{3f04dadf-6ea4-44d1-a507-03cad176f443}\InprocServer32 -> C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin1017325.dll (Amazon.com, Inc.)

CustomCLSID: HKU\S-1-5-21-1619064115-466689268-4177747022-1000_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File

CustomCLSID: HKU\S-1-5-21-1619064115-466689268-4177747022-1000_Classes\CLSID\{BB6410D8-F879-4184-9C5C-6A02D16AE0B3}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File

CustomCLSID: HKU\S-1-5-21-1619064115-466689268-4177747022-1000_Classes\CLSID\{CA1073A2-5F3F-4445-8E5E-7109BDCEDDBE}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File

CustomCLSID: HKU\S-1-5-21-1619064115-466689268-4177747022-1000_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File

CustomCLSID: HKU\S-1-5-21-1619064115-466689268-4177747022-1000_Classes\CLSID\{D5A55D2D-C59D-42C3-A5BF-4C08EEE74339}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File

==================== Restore Points =========================

17-07-2015 08:39:11 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 12:23 - 2015-07-16 16:20 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {19411A74-991C-4A16-BF7C-166E4E49D856} - System32\Tasks\ASUS Live Update => C:\Program Files\ASUS\ASUS Live Update\ALU.exe [2007-11-30] ()

Task: {1941507E-9998-4627-89DD-A82A69E7ADA2} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)

Task: {414841C6-91CC-4966-933A-D71E285DCD6D} - System32\Tasks\{ED30B319-CC19-424F-846E-0F8ECB82F999} => pcalua.exe -a E:\Setup.exe -d E:\

Task: {4776059D-376A-4ACD-B3A9-3778FFDE026E} - System32\Tasks\ASUS SmartLogon Console Sensor => C:\Program Files\ASUS\SmartLogon\sensorsrv.exe [2008-06-18] (ASUS)

Task: {518721D2-0013-4B19-A46B-4B51B04559C6} - System32\Tasks\{663C24D5-10FA-4FAA-84B9-CD94B89A69AB} => pcalua.exe -a D:\Downloads\3gp\3GP_Converter034\Setup.exe -d D:\Downloads\3gp\3GP_Converter034

Task: {69C4819B-7EFB-4390-A2B5-1390D59AAB13} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)

Task: {819AAF3C-60E3-448E-BFF7-D5CD780E3594} - System32\Tasks\{F7BB27B9-C40B-43A9-95C2-530FBC73558A} => pcalua.exe -a E:\Software\Bluetooth\Setup.exe -d E:\Software\Bluetooth

Task: {98F3527B-8354-4119-8577-E0DA25B224E0} - System32\Tasks\{89C29468-C381-4F13-8FA7-ABDD6BF2A3DA} => C:\Program Files\Skype\\Phone\Skype.exe [2014-12-11] (Skype Technologies S.A.)

Task: {C26BC1A5-691B-414B-BF54-1E492181F57F} - System32\Tasks\Direct Console 2.0 => C:\Program Files\ASUS\Direct Console\DCHelper.exe [2008-03-25] (ASUSTek.)

Task: {C51BD195-A428-4355-AC9F-8097D6A0BC5B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-20] (Google Inc.)

Task: {C8F76C46-2FC5-4E64-91D7-5124505E2CEB} - System32\Tasks\{C6C7E2A8-77AA-4E25-958E-511E0167322E} => pcalua.exe -a D:\Downloads\directx_nov2008_redist.exe -d D:\Downloads

Task: {D5E3E87C-0880-453A-A1C5-529B75FD0756} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-20] (Google Inc.)

Task: {E725020D-5EE0-40D0-8EE4-98F9EF122DE0} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-07-17] (Adobe Systems Incorporated)

Task: {FA7B7F3A-545E-4E08-AA17-43391A52A2F3} - System32\Tasks\ASPG => C:\Program Files\ASUS\ASUS CopyProtect\aspg.exe [2008-06-19] (ASUS)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2008-12-04 23:53 - 2007-05-18 12:31 - 00073728 _____ () C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe

2008-08-14 06:59 - 2008-08-14 06:59 - 00100920 _____ () C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe

2008-12-04 23:14 - 2007-08-08 10:08 - 00094208 _____ () C:\Program Files\ATKGFNEX\GFNEXSrv.exe

2014-07-17 10:37 - 2012-06-07 17:48 - 00019968 _____ () C:\Windows\system32\spool\PRTPROCS\W32X86\dltfm1zPP.dll

2008-12-04 23:53 - 2007-06-15 20:28 - 00147456 _____ () C:\Program Files\ASUS\ASUS Data Security Manager\OverlayIconShlExt.dll

2008-12-04 23:53 - 2007-06-02 03:08 - 00143360 _____ () C:\Program Files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll

2008-12-04 23:53 - 2007-08-08 12:52 - 00331776 _____ () C:\Program Files\ASUS\ASUS Data Security Manager\AdsmendecExt.dll

2009-02-21 01:23 - 2003-05-19 22:16 - 00120320 _____ () C:\Program Files\WinRAR\rarext.dll

2004-05-28 04:13 - 2004-05-28 04:13 - 00057344 _____ () C:\Program Files\ASUS\ATK Hotkey\CMSSC.dll

2008-12-04 23:27 - 2007-07-06 02:53 - 01040384 _____ () C:\Program Files\Wireless Console 2\wcourier.exe

2008-12-04 23:53 - 2007-11-30 21:20 - 00051768 _____ () C:\Program Files\ASUS\ASUS Live Update\ALU.exe

2008-05-29 07:39 - 2008-05-29 07:39 - 00053248 _____ () C:\Program Files\ASUS\Direct Console\SysInfo.dll

2008-12-04 23:14 - 2007-03-10 02:16 - 00106496 _____ () C:\Program Files\ATKGFNEX\AGFNEX.dll

2007-11-13 01:41 - 2007-11-13 01:41 - 00106496 _____ () C:\Program Files\ASUS\ATK Hotkey\MsgTran.dll

2008-12-04 23:57 - 2008-01-26 04:32 - 00778240 _____ () C:\Program Files\P4P\P4P.exe

2008-05-29 07:40 - 2008-05-29 07:40 - 00049152 _____ () C:\Program Files\ASUS\Direct Console\OLED.dll

2007-12-28 02:04 - 2007-12-28 02:04 - 00032768 _____ () C:\Program Files\ASUS\Direct Console\LED.dll

2008-02-19 08:32 - 2008-02-19 08:32 - 00012288 _____ () C:\Program Files\ASUS\Direct Console\OvrClk.dll

2007-12-12 02:07 - 2007-12-12 02:07 - 00090112 _____ () C:\Program Files\ASUS\Direct Console\OUTLOOK.dll

2007-12-08 01:32 - 2007-12-08 01:32 - 00061440 _____ () C:\Program Files\ASUS\Direct Console\MSN.dll

2014-04-23 16:05 - 2014-04-23 16:05 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

2014-04-23 16:04 - 2014-04-23 16:04 - 01044808 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

2013-02-06 17:37 - 2013-02-06 17:37 - 00191464 _____ () C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1db.exe

2012-05-16 15:45 - 2012-05-16 15:45 - 08506280 _____ () C:\Program Files\Nokia\Nokia Suite\QtGui4.dll

2012-05-16 15:45 - 2012-05-16 15:45 - 02353576 _____ () C:\Program Files\Nokia\Nokia Suite\QtCore4.dll

2012-05-16 15:45 - 2012-05-16 15:45 - 01013672 _____ () C:\Program Files\Nokia\Nokia Suite\QtNetwork4.dll

2012-05-16 15:45 - 2012-05-16 15:45 - 00363944 _____ () C:\Program Files\Nokia\Nokia Suite\QtXml4.dll

2012-05-16 15:45 - 2012-05-16 15:45 - 02480552 _____ () C:\Program Files\Nokia\Nokia Suite\QtDeclarative4.dll

2012-05-16 15:45 - 2012-05-16 15:45 - 01346472 _____ () C:\Program Files\Nokia\Nokia Suite\QtScript4.dll

2012-05-16 15:45 - 2012-05-16 15:45 - 00205736 _____ () C:\Program Files\Nokia\Nokia Suite\QtSql4.dll

2012-05-16 15:45 - 2012-05-16 15:45 - 02652584 _____ () C:\Program Files\Nokia\Nokia Suite\QtXmlPatterns4.dll

2012-05-16 15:45 - 2012-05-16 15:45 - 00032680 _____ () C:\Program Files\Nokia\Nokia Suite\imageformats\qgif4.dll

2012-05-16 15:45 - 2012-05-16 15:45 - 00035240 _____ () C:\Program Files\Nokia\Nokia Suite\imageformats\qico4.dll

2012-05-16 15:45 - 2012-05-16 15:45 - 00206760 _____ () C:\Program Files\Nokia\Nokia Suite\imageformats\qjpeg4.dll

2012-05-16 15:45 - 2012-05-16 15:45 - 11166120 _____ () C:\Program Files\Nokia\Nokia Suite\QtWebKit4.dll

2012-05-16 15:45 - 2012-05-16 15:45 - 00276392 _____ () C:\Program Files\Nokia\Nokia Suite\phonon4.dll

2012-05-16 13:46 - 2012-05-16 13:46 - 00391056 _____ () C:\Program Files\Nokia\Nokia Suite\ssoengine.dll

2012-05-16 13:46 - 2012-05-16 13:46 - 00059280 _____ () C:\Program Files\Nokia\Nokia Suite\securestorage.dll

2012-05-16 15:45 - 2012-05-16 15:45 - 00445864 _____ () C:\Program Files\Nokia\Nokia Suite\sqldrivers\qsqlite4.dll

2012-05-16 15:45 - 2012-05-16 15:45 - 00520104 _____ () C:\Program Files\Nokia\Nokia Suite\QtMultimediaKit1.dll

2012-05-16 15:45 - 2012-05-16 15:45 - 00720296 _____ () C:\Program Files\Nokia\Nokia Suite\QtOpenGL4.dll

2012-05-16 15:44 - 2012-05-16 15:44 - 00604072 _____ () C:\Program Files\Nokia\Nokia Suite\CommonUpdateChecker.dll

2012-05-16 15:44 - 2012-05-16 15:44 - 00437672 _____ () C:\Program Files\Nokia\Nokia Suite\NService.dll

2012-05-16 13:45 - 2012-05-16 13:45 - 00110080 _____ () C:\Program Files\Nokia\Nokia Suite\mediaservice\dsengine.dll

2014-08-22 10:38 - 2014-08-22 10:38 - 00026488 _____ () C:\Program Files\MyDrive Connect\DeviceDetection.dll

2014-08-22 10:38 - 2014-08-22 10:38 - 00087416 _____ () C:\Program Files\MyDrive Connect\TomTomSupporterBase.dll

2014-08-22 10:38 - 2014-08-22 10:38 - 00398712 _____ () C:\Program Files\MyDrive Connect\TomTomSupporterProxy.dll

2015-07-17 07:48 - 2015-07-17 07:48 - 00072192 _____ () C:\Program Files\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll

2015-07-17 07:48 - 2015-07-17 07:48 - 00178176 _____ () C:\Program Files\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll

2015-07-17 07:48 - 2015-07-17 07:48 - 00040448 _____ () C:\Program Files\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dll

2015-07-17 07:48 - 2015-07-17 07:48 - 00026624 _____ () C:\Program Files\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Repositories.dll

2015-07-17 07:48 - 2015-07-17 07:48 - 00009216 _____ () C:\Program Files\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll

2015-07-17 07:48 - 2015-07-17 07:48 - 00117248 _____ () C:\Program Files\Lavasoft\Web Companion\Application\Lavasoft.PUP.Management.dll

2015-07-17 07:48 - 2015-07-17 07:48 - 00032768 _____ () C:\Program Files\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll

2014-03-18 18:20 - 2014-03-18 18:20 - 00199633 _____ () C:\Program Files\Dell Printers\OpenManage\OMPMv2.0\client\OMPMWatchdogService.exe

2014-06-27 23:22 - 2012-08-16 12:25 - 00172032 _____ () C:\Program Files\PostgreSQL\8.4\bin\LIBPQ.dll

2015-07-17 07:48 - 2015-07-17 07:48 - 00013312 _____ () C:\Program Files\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WinService.exe

2015-07-17 07:48 - 2015-07-17 07:48 - 00005632 _____ () C:\Program Files\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Service.Logger.dll

2015-07-17 07:48 - 2015-07-17 07:48 - 00028160 _____ () C:\Program Files\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WcfService.dll

2014-06-27 23:24 - 2012-08-14 15:19 - 00999424 _____ () C:\Program Files\PostgreSQL\8.4\bin\libxml2.dll

2008-12-04 23:55 - 2007-08-03 22:24 - 00125496 _____ () C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

2008-12-04 23:55 - 2007-09-14 20:00 - 00147456 _____ () C:\Program Files\ASUS\NB Probe\SPM\spdiskex.dll

2008-12-04 23:55 - 2003-11-28 12:11 - 00135168 _____ () C:\Program Files\ASUS\NB Probe\SPM\spos.dll

2008-12-04 23:55 - 2005-08-30 01:24 - 00081920 _____ () C:\Program Files\ASUS\NB Probe\SPM\spnbacpi.dll

2008-12-04 23:55 - 2003-09-10 02:08 - 00049152 _____ () C:\Program Files\ASUS\NB Probe\SPM\spdmi.dll

2008-12-04 23:55 - 2006-04-04 20:24 - 00036864 _____ () C:\Program Files\ASUS\NB Probe\SPM\ghadmi.dll

2008-12-04 23:55 - 2005-04-08 05:25 - 00077824 _____ () C:\Program Files\ASUS\NB Probe\SPM\spmemory.dll

2014-07-17 10:32 - 2012-08-16 19:33 - 00041984 _____ () C:\Windows\system32\dltsm1zwia.dll

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\.DEFAULT\...\localhost -> localhost

IE trusted site: HKU\.DEFAULT\...\webcompanion.com -> hxxp://webcompanion.com

IE trusted site: HKU\S-1-5-21-1619064115-466689268-4177747022-1000\...\webcompanion.com -> hxxp://webcompanion.com
 

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1619064115-466689268-4177747022-1000\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\img24.jpg

HKU\S-1-5-21-1619064115-466689268-4177747022-1001\Control Panel\Desktop\\Wallpaper -> C:\windows\Web\Wallpaper\img24.jpg

DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)
 

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [WinCollab-Out-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe

FirewallRules: [WinCollab-In-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe

FirewallRules: [WinCollab-Out-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe

FirewallRules: [WinCollab-In-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe

FirewallRules: [WinCollab-DFSR-Out-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe

FirewallRules: [WinCollab-DFSR-In-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe

FirewallRules: [TCP Query User{28AA2FEE-D481-4D84-913E-1CF0E59B80CA}C:\program files\internet explorer\iexplore.exe] => (Block) C:\program files\internet explorer\iexplore.exe

FirewallRules: [UDP Query User{832088FB-DCA6-4627-AA07-BF2CF73BCB70}C:\program files\internet explorer\iexplore.exe] => (Block) C:\program files\internet explorer\iexplore.exe

FirewallRules: [TCP Query User{C831918A-6B6B-423E-9978-475C8A4BF60E}C:\program files\openvpn\bin\openvpn.exe] => (Block) C:\program files\openvpn\bin\openvpn.exe

FirewallRules: [UDP Query User{8C46CC16-25BB-4736-8AC9-ED1E19731AC4}C:\program files\openvpn\bin\openvpn.exe] => (Block) C:\program files\openvpn\bin\openvpn.exe

FirewallRules: [TCP Query User{1C164927-BB8D-478C-9964-F8D6BC59A2A9}C:\program files\openvpn\bin\openvpn.exe] => (Allow) C:\program files\openvpn\bin\openvpn.exe

FirewallRules: [UDP Query User{5F013047-4D01-4CAA-9A45-F35743BCCDA2}C:\program files\openvpn\bin\openvpn.exe] => (Allow) C:\program files\openvpn\bin\openvpn.exe

FirewallRules: [TCP Query User{84EB3341-6966-4163-BF72-289A70024253}C:\windows\system32\taskeng.exe] => (Block) C:\windows\system32\taskeng.exe

FirewallRules: [UDP Query User{471DE340-B595-4E19-8032-A6C916BA3AC9}C:\windows\system32\taskeng.exe] => (Block) C:\windows\system32\taskeng.exe

FirewallRules: [TCP Query User{D7A3CCF0-0385-44BF-A902-715B7FACC26E}C:\windows\explorer.exe] => (Block) C:\windows\explorer.exe

FirewallRules: [UDP Query User{14B1B00C-0309-41A0-BDE9-77AF78337780}C:\windows\explorer.exe] => (Block) C:\windows\explorer.exe

FirewallRules: [TCP Query User{750408C6-979C-4A2E-8C08-EBD76DD2A813}C:\windows\explorer.exe] => (Block) C:\windows\explorer.exe

FirewallRules: [UDP Query User{01DBCC36-310E-4CF7-BAF6-C766E0CEC184}C:\windows\explorer.exe] => (Block) C:\windows\explorer.exe

FirewallRules: [{C304B180-0E0B-4081-AC0E-42E22FE45F78}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe

FirewallRules: [{1AB83C35-B101-4B79-BF6B-191A0C947D48}] => (Allow) LPort=80

FirewallRules: [{7DA1E521-4A3A-4461-8445-F8F4905E0A18}] => (Allow) LPort=80

FirewallRules: [{F863D41D-BFE3-4F1D-8B11-D8781843CE57}] => (Allow) LPort=80

FirewallRules: [TCP Query User{AAB4ED21-1406-4629-9AC3-44B3404EC5B3}C:\program files\nokia\nokia ovi suite\nokiaovisuite.exe] => (Allow) C:\program files\nokia\nokia ovi suite\nokiaovisuite.exe

FirewallRules: [UDP Query User{19CC29C9-60AA-4BA3-9D86-6F983DE52361}C:\program files\nokia\nokia ovi suite\nokiaovisuite.exe] => (Allow) C:\program files\nokia\nokia ovi suite\nokiaovisuite.exe

FirewallRules: [TCP Query User{5BF834D1-FC3F-45F4-9C69-40DFD0EAEBB1}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe] => (Allow) C:\program files\common files\nokia\service layer\a\nsl_host_process.exe

FirewallRules: [UDP Query User{5719C01C-2E21-4EE4-B1EB-6AFFC59CAE1B}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe] => (Allow) C:\program files\common files\nokia\service layer\a\nsl_host_process.exe

FirewallRules: [{47725C01-D394-4560-BBA2-D84DF721F3AA}] => (Allow) C:\Program Files\Nakido\nakido.exe

FirewallRules: [{B59BB5F2-B4F0-48A9-A43E-EB884E336BB6}] => (Allow) C:\Program Files\Nakido\nakido.exe

FirewallRules: [{C9B20076-4909-431E-A146-617230B20DA3}] => (Allow) C:\Program Files\Twonky\TwonkyServer\twonkystarter.exe

FirewallRules: [{69869431-6331-4CC0-BD48-C94BE8C22F37}] => (Allow) C:\Program Files\Twonky\TwonkyServer\twonkystarter.exe

FirewallRules: [{5354F5F7-6EC2-4C1D-B108-2EFB0B616032}] => (Allow) C:\Program Files\Twonky\TwonkyServer\twonkyserver.exe

FirewallRules: [{D6768DFC-208E-42A3-8C26-51709369EE04}] => (Allow) C:\Program Files\Twonky\TwonkyServer\twonkyserver.exe

FirewallRules: [TCP Query User{5078F6E3-CE57-4B62-9F40-96204765B386}C:\program files\philips\mediamanager\twonkyrenderer.exe] => (Allow) C:\program files\philips\mediamanager\twonkyrenderer.exe

FirewallRules: [UDP Query User{23AB7648-7C1B-43B9-93C3-B2C2E4B2E69F}C:\program files\philips\mediamanager\twonkyrenderer.exe] => (Allow) C:\program files\philips\mediamanager\twonkyrenderer.exe

FirewallRules: [TCP Query User{8203D92A-BC7A-458B-B873-72EDDEE13569}C:\program files\philips\mediamanager\twonkymanager.exe] => (Allow) C:\program files\philips\mediamanager\twonkymanager.exe

FirewallRules: [UDP Query User{06C64734-4B88-4416-B7CD-D71712E5F646}C:\program files\philips\mediamanager\twonkymanager.exe] => (Allow) C:\program files\philips\mediamanager\twonkymanager.exe

FirewallRules: [{00ADE940-2B0D-48A6-8C9B-03C51A49CE12}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe

FirewallRules: [{EE2A595D-30AA-48F0-A82D-9460A22625AC}] => (Allow) C:\Program Files\iTunes\iTunes.exe

FirewallRules: [UDP Query User{68E46633-8DC3-499C-A590-8A85F5FE92AD}C:\Program Files\LEGO Software\LEGO MINDSTORMS EV3 Home Edition\MindstormsEV3.exe] => (Allow) C:\Program Files\LEGO Software\LEGO MINDSTORMS EV3 Home Edition\MindstormsEV3.exe

FirewallRules: [TCP Query User{F468232A-782C-4386-AF14-03CFA72EB0FB}C:\Program Files\LEGO Software\LEGO MINDSTORMS EV3 Home Edition\MindstormsEV3.exe] => (Allow) C:\Program Files\LEGO Software\LEGO MINDSTORMS EV3 Home Edition\MindstormsEV3.exe

FirewallRules: [{B309BC33-1C71-4BF2-94C6-904F3873BA5C}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe

FirewallRules: [{63E9A5E2-7F26-4E64-ACB3-D673BBA32FF3}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe

==================== Faulty Device Manager Devices =============
 

==================== Event log errors: =========================

Application errors:

==================

Error: (07/17/2015 04:32:52 PM) (Source: Perflib) (EventID: 1008) (User: )

Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4

Error: (07/17/2015 04:32:49 PM) (Source: Perflib) (EventID: 1008) (User: )

Description: BITSC:\Windows\system32\bitsperf.dll4

Error: (07/17/2015 04:32:37 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/17/2015 08:43:25 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/17/2015 07:57:43 AM) (Source: ESENT) (EventID: 447) (User: )

Description: Windows (616) Windows: Ungültige Seitenverknüpfung (Fehler -327) in B-Struktur (Objekt-Id: 52, PgnoRoot: 491) von Datenbank C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb (19534 => 4874, Windows0).

Error: (07/17/2015 07:57:38 AM) (Source: ESENT) (EventID: 447) (User: )

Description: Windows (616) Windows: Ungültige Seitenverknüpfung (Fehler -327) in B-Struktur (Objekt-Id: 52, PgnoRoot: 491) von Datenbank C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb (19534 => 4874, Windows0).

Error: (07/17/2015 07:12:54 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/17/2015 12:25:05 AM) (Source: VSS) (EventID: 12293) (User: )

Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen einer Routine auf einem Volumeschattenkopieanbieter "{b5946137-7b9f-4925-af80-51abd60b20d5}" ist ein Fehler aufgetreten. Routinedetails PostFinalCommitSnapshots({a6761f65-59d4-4d0b-81e1-b860c7755aba}, 1) [hr = 0x80042308].
 

Vorgang:

   Asynchroner Vorgang wird ausgeführt

Kontext:

   Aktueller Status: DoSnapshotSet

Error: (07/17/2015 12:25:05 AM) (Source: VSS) (EventID: 12305) (User: )

Description: Volumeschattenkopie-Dienstfehler: Volume bzw. Datenträger ist nicht richtig angeschlossen oder wurde nicht gefunden.

Fehlerkontext: DeviceIoControl(\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2 - 0000013C,0x00560038,000DAF10,0,000D9F08,4096,[0]).
 

Vorgang:

   PostFinalCommitSnapshots wird verarbeitet

Kontext:

   Ausführungskontext: System Provider

Error: (07/17/2015 12:16:06 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Fehlerhafte Anwendung iexplore.exe, Version 9.0.8112.16669, Zeitstempel 0x5580c8aa, fehlerhaftes Modul nvd3dum.dll, Version 8.15.11.8631, Zeitstempel 0x4a4c6b3e, Ausnahmecode 0xc0000005, Fehleroffset 0x0027bcd2,

Prozess-ID 0x1638, Anwendungsstartzeit iexplore.exe0.
 

System errors:

=============

Error: (07/17/2015 05:32:29 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: OMPM Service%%1053

Error: (07/17/2015 05:32:29 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: 30000OMPM Service

Error: (07/17/2015 05:27:29 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: OMPM Service%%1053

Error: (07/17/2015 05:27:29 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: 30000OMPM Service

Error: (07/17/2015 05:22:29 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: OMPM Service%%1053

Error: (07/17/2015 05:22:29 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: 30000OMPM Service

Error: (07/17/2015 05:17:29 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: OMPM Service%%1053

Error: (07/17/2015 05:17:29 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: 30000OMPM Service

Error: (07/17/2015 05:12:29 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: OMPM Service%%1053

Error: (07/17/2015 05:12:29 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: 30000OMPM Service
 

Microsoft Office:

=========================

Error: (07/17/2015 04:32:52 PM) (Source: Perflib) (EventID: 1008) (User: )

Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4

Error: (07/17/2015 04:32:49 PM) (Source: Perflib) (EventID: 1008) (User: )

Description: BITSC:\Windows\system32\bitsperf.dll4

Error: (07/17/2015 04:32:37 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/17/2015 08:43:25 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/17/2015 07:57:43 AM) (Source: ESENT) (EventID: 447) (User: )

Description: Windows616Windows: -32752491C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb19534487412788

Error: (07/17/2015 07:57:38 AM) (Source: ESENT) (EventID: 447) (User: )

Description: Windows616Windows: -32752491C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb19534487412788

Error: (07/17/2015 07:12:54 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/17/2015 12:25:05 AM) (Source: VSS) (EventID: 12293) (User: )

Description: {b5946137-7b9f-4925-af80-51abd60b20d5}PostFinalCommitSnapshots({a6761f65-59d4-4d0b-81e1-b860c7755aba}, 1)0x80042308

Vorgang:

   Asynchroner Vorgang wird ausgeführt

Kontext:

   Aktueller Status: DoSnapshotSet

Error: (07/17/2015 12:25:05 AM) (Source: VSS) (EventID: 12305) (User: )

Description: DeviceIoControl(\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2 - 0000013C,0x00560038,000DAF10,0,000D9F08,4096,[0])

Vorgang:

   PostFinalCommitSnapshots wird verarbeitet

Kontext:

   Ausführungskontext: System Provider

Error: (07/17/2015 12:16:06 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: iexplore.exe9.0.8112.166695580c8aanvd3dum.dll8.15.11.86314a4c6b3ec00000050027bcd2163801d0c014b4d254f3
 

CodeIntegrity Errors:

===================================

  Date: 2015-07-17 17:35:01.874

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-07-17 17:35:01.582

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-07-17 17:35:01.290

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-07-17 17:35:00.996

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-07-17 17:35:00.574

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-07-17 17:35:00.283

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-07-17 17:34:59.983

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-07-17 17:34:59.678

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-07-17 17:34:36.975

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-07-17 17:34:36.649

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Duo CPU T9400 @ 2.53GHz

Percentage of memory in use: 49%

Total physical RAM: 3070.17 MB

Available physical RAM: 1560.71 MB

Total Virtual: 6347.35 MB

Available Virtual: 4268.33 MB

==================== Drives ================================

Drive c: (VistaOS) (Fixed) (Total:232.88 GB) (Free:103.1 GB) NTFS ==>[drive with boot components (obtained from BCD)]

Drive d: (DATA) (Fixed) (Total:223.12 GB) (Free:37.61 GB) NTFS

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (Size: 465.8 GB) (Disk ID: 97646C29)

Partition 1: (Not Active) - (Size=9.8 GB) - (Type=1C)

Partition 2: (Active) - (Size=232.9 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=223.1 GB) - (Type=OF Extended)

==================== End of log ============================

--- --- ---

--- --- ---

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

EmptyTemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Fix result of Farbar Recovery Scan Tool (x86) Version: 18-07-2015
Ran by noki at 2015-07-18 12:14:11 Run:1
Running from D:\
Loaded Profiles: noki & postgres (Available Profiles: noki & postgres)
Boot Mode: Normal
==============================================
fixlist content:
*****************
EmptyTemp:
*****************
EmptyTemp: => 2.2 GB temporary data Removed.

The system needed a reboot.
==== End of Fixlog 12:15:33 ====

Nach dem fixen hat der Neustart des Laptop ca. 1-2 Minuten länger gedauert als sonst.

Weiterhin ist das Surfen und der normale Umgang mit dem Laptop einwandfrei. Nur bei den Deinstallationen hängt sich der Laptop spätestens bei der zweiten Deinstallation aus. Auch die automatischen Windows-Updates funktionieren kaum. Ich habe diese jetzt deaktiviert.

Ach ja, von Anfang an habe ich auch immer diese Fehler-Meldung nach dem Neustart gehabt (jetzt auch noch): GDI+ Window : avgnt.exe - Ungültiges Bild ; Probleme mit der Datei c:/program files/setpoint/lgscroll.dll

Ich habe eben ein manuelles Windows-Update durchgeführt. Das hat auch geklappt, System forderte dann Neustart, habe ich gemacht und sofort startete wieder CHKDSK. Dabei wurden 35 verwaiste Dateien wieder hergestell (u.a dmusic.dll, midimap.dll, mmci.dll, msacm32.drv, winload.exe, winresume.exe, wscapi.dll, wscsvc.dll). Vielleicht ist das ja auch noch wichtig.

Zitat:

Auch die automatischen Windows-Updates funktionieren kaum. Ich habe diese jetzt deaktiviert.

Das ist nicht Sinn und Zweck des ganzen...um die Updates muss man sich immer kümmern, das ist sicherheitsrelevant!

Aber erstmal bitte Kontrollscans mit MBAM und ESET:

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

DEr Pre-Scan startet nicht. Programm ist installiert, habe es als Administrator ausgeführt, bei Avira alle Überwachungen ausgeschaltet, aber der Scan startet nicht. Läuft schon 1 Std. und keine Objekte wurden untersucht.

Was nun?

Nach 1:46 war der Scan dann doch beendet. Er hatte den Dateifortschritt nicht fortlaufend angezeigt. Hier die Ergebnisse:

ES wurden 2 Ordner und 2 Dateien in die Quarantäne verschoben (OpenCandy, trojan.agent: e-n83601.zip)

Malwarebytes Anti-Malware
www.malwarebytes.org

Error, 19.07.2015 17:54:31, SYSTEM, NOKI-PC, Protection, IsLicensed, 13,
Protection, 19.07.2015 17:54:31, SYSTEM, NOKI-PC, Protection, Malware Protection, Stopping,
Protection, 19.07.2015 17:54:31, SYSTEM, NOKI-PC, Protection, Malware Protection, Stopped,
Update, 19.07.2015 18:15:50, SYSTEM, NOKI-PC, Manual, Domain Database, 0.0.0.0, 2015.6.12.1,
Update, 19.07.2015 18:15:50, SYSTEM, NOKI-PC, Manual, IP Database, 0.0.0.0, 2015.6.12.1,
Update, 19.07.2015 18:15:50, SYSTEM, NOKI-PC, Manual, Remediation Database, 2015.3.9.1, 2015.7.15.2,
Update, 19.07.2015 18:15:50, SYSTEM, NOKI-PC, Manual, Rootkit Database, 2015.2.25.1, 2015.7.17.1,
Update, 19.07.2015 18:16:05, SYSTEM, NOKI-PC, Manual, Malware Database, 2015.3.9.5, 2015.7.19.2,
Error, 19.07.2015 19:30:35, SYSTEM, NOKI-PC, Protection, IsLicensed, 13,
Protection, 19.07.2015 19:30:35, SYSTEM, NOKI-PC, Protection, Malware Protection, Stopping,
Protection, 19.07.2015 19:30:35, SYSTEM, NOKI-PC, Protection, Malware Protection, Stopped,
Update, 19.07.2015 19:37:01, SYSTEM, NOKI-PC, Manual, Domain Database, 0.0.0.0, 2015.6.12.1,
Update, 19.07.2015 19:37:01, SYSTEM, NOKI-PC, Manual, Rootkit Database, 2015.2.25.1, 2015.7.17.1,
Update, 19.07.2015 19:37:02, SYSTEM, NOKI-PC, Manual, IP Database, 0.0.0.0, 2015.6.12.1,
Update, 19.07.2015 19:37:02, SYSTEM, NOKI-PC, Manual, Remediation Database, 2015.3.9.1, 2015.7.15.2,
Update, 19.07.2015 19:37:19, SYSTEM, NOKI-PC, Manual, Malware Database, 2015.3.9.5, 2015.7.19.2,
Error, 19.07.2015 21:28:35, SYSTEM, NOKI-PC, Protection, IsLicensed, 13,
Protection, 19.07.2015 21:28:35, SYSTEM, NOKI-PC, Protection, Malware Protection, Stopping,
Protection, 19.07.2015 21:28:35, SYSTEM, NOKI-PC, Protection, Malware Protection, Stopped,
(end)

Nun kommt ESET

Bitte das richtige Log von MBAM posten...

Alle Logs!

MBAM1:
Malwarebytes Anti-Malware
www.malwarebytes.org
Suchlauf Datum: 19.07.2015
Suchlauf-Zeit: 19:37:40
Logdatei: mbam1.txt
Administrator: Ja
Version: 2.01.6.1022
Malware Datenbank: v2015.07.19.02
Rootkit Datenbank: v2015.07.17.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert
Betriebssystem: Windows Vista Service Pack 2
CPU: x86
Dateisystem: NTFS
Benutzer: noki
Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 374141
Verstrichene Zeit: 1 Std, 36 Min, 44 Sek
Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert
Prozesse: 0
(Keine schädliche Elemente gefunden)
Module: 0
(Keine schädliche Elemente gefunden)
Registrierungsschlüssel: 0
(Keine schädliche Elemente gefunden)
Registrierungswerte: 0
(Keine schädliche Elemente gefunden)
Registrierungsdaten: 0
(Keine schädliche Elemente gefunden)
Ordner: 0
(Keine schädliche Elemente gefunden)
Dateien: 0
(Keine schädliche Elemente gefunden)
Physische Sektoren: 0
(Keine schädliche Elemente gefunden)

(end)

MBAM2:

Malwarebytes Anti-Malware
www.malwarebytes.org

Error, 19.07.2015 17:54:31, SYSTEM, NOKI-PC, Protection, IsLicensed, 13,
Protection, 19.07.2015 17:54:31, SYSTEM, NOKI-PC, Protection, Malware Protection, Stopping,
Protection, 19.07.2015 17:54:31, SYSTEM, NOKI-PC, Protection, Malware Protection, Stopped,
Update, 19.07.2015 18:15:50, SYSTEM, NOKI-PC, Manual, Domain Database, 0.0.0.0, 2015.6.12.1,
Update, 19.07.2015 18:15:50, SYSTEM, NOKI-PC, Manual, IP Database, 0.0.0.0, 2015.6.12.1,
Update, 19.07.2015 18:15:50, SYSTEM, NOKI-PC, Manual, Remediation Database, 2015.3.9.1, 2015.7.15.2,
Update, 19.07.2015 18:15:50, SYSTEM, NOKI-PC, Manual, Rootkit Database, 2015.2.25.1, 2015.7.17.1,
Update, 19.07.2015 18:16:05, SYSTEM, NOKI-PC, Manual, Malware Database, 2015.3.9.5, 2015.7.19.2,
Error, 19.07.2015 19:30:35, SYSTEM, NOKI-PC, Protection, IsLicensed, 13,
Protection, 19.07.2015 19:30:35, SYSTEM, NOKI-PC, Protection, Malware Protection, Stopping,
Protection, 19.07.2015 19:30:35, SYSTEM, NOKI-PC, Protection, Malware Protection, Stopped,
Update, 19.07.2015 19:37:01, SYSTEM, NOKI-PC, Manual, Domain Database, 0.0.0.0, 2015.6.12.1,
Update, 19.07.2015 19:37:01, SYSTEM, NOKI-PC, Manual, Rootkit Database, 2015.2.25.1, 2015.7.17.1,
Update, 19.07.2015 19:37:02, SYSTEM, NOKI-PC, Manual, IP Database, 0.0.0.0, 2015.6.12.1,
Update, 19.07.2015 19:37:02, SYSTEM, NOKI-PC, Manual, Remediation Database, 2015.3.9.1, 2015.7.15.2,
Update, 19.07.2015 19:37:19, SYSTEM, NOKI-PC, Manual, Malware Database, 2015.3.9.5, 2015.7.19.2,
Error, 19.07.2015 21:28:35, SYSTEM, NOKI-PC, Protection, IsLicensed, 13,
Protection, 19.07.2015 21:28:35, SYSTEM, NOKI-PC, Protection, Malware Protection, Stopping,
Protection, 19.07.2015 21:28:35, SYSTEM, NOKI-PC, Protection, Malware Protection, Stopped,
(end)

Andere Logs gibt es unter "Verlauf" nicht!

ESET:

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=0f9f745258f05f48a6f3df169773a5f7
# end=init
# utc_time=2015-07-19 07:45:21
# local_time=2015-07-19 09:45:21 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.0.6002 NT Service Pack 2
Update Init
Update Download
Update Finalize
Updated modules version: 24878
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=0f9f745258f05f48a6f3df169773a5f7
# end=updated
# utc_time=2015-07-19 07:49:37
# local_time=2015-07-19 09:49:37 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.0.6002 NT Service Pack 2
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=0f9f745258f05f48a6f3df169773a5f7
# engine=24878
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-07-19 09:49:37
# local_time=2015-07-19 11:49:37 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode_1=''
# compatibility_mode=5892 16776574 100 100 197314 274875305 0 0
# scanned=279083
# found=1
# cleaned=0
# scan_time=7200
sh=DE68CECF035638C21CD9EC0F79C443C5E36FABD8 ft=1 fh=2b40ef9402fb7ae4 vn="Win32/Somoto.E evtl. unerwÃ¼nschte Anwendung" ac=I fn="D:\Downloads\m4a-to-mp3-converter.exe"

FRST-Fix

Virenscanner jetzt bitte komplett deaktivieren, damit sichergestellt ist, dass der Fix sauber durchläuft!

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

D:\Downloads\m4a-to-mp3-converter.exe

EmptyTemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Fix result of Farbar Recovery Scan Tool (x86) Version: 20-07-2015
Ran by noki at 2015-07-20 19:02:58 Run:2
Running from D:\
Loaded Profiles: noki & postgres (Available Profiles: noki & postgres)
Boot Mode: Normal
==============================================
fixlist content:
*****************
D:\Downloads\m4a-to-mp3-converter.exe
EmptyTemp:
*****************
D:\Downloads\m4a-to-mp3-converter.exe => moved successfully.
EmptyTemp: => 132.2 MB temporary data Removed.

The system needed a reboot.
==== End of Fixlog 19:03:08 ====

Noch ein kleiner Hinweis. Als gestern noch Avira aktiv war, kam folgende Diagnose:

Sicherheitshinsweis - Typ: Fund
Der Zugriff auf die Datei frst.exe mit dem Virus oder unerwünschten Programm TR/Graftor.1637376 wurde blockiert.

Kann ich das ignorieren?

Weitere Frage: was passiert mit den 2 Ordnern und 2 Dateien, die Malware in Quarantäne gesteckt hat. Kann ich die jetzt löschen?

FRST.exe ist unser Analyse- und Bereinigungstool, natürlich ist da kein Schädling drin

Zitat:

die Malware in Quarantäne gesteckt hat. Kann ich die jetzt löschen?

Was habt ihr alle immer nur mit der Quarantäne? :wtf:
Überleg doch mal was eine Quarantäne ist. Ob da die schädliche Datei drinbleibt oder nicht, das hat keine Auswirkungen. Schädlinge in der Quarantäne können nichts mehr anrichten, sie sind dort isoliert. Du solltest grundsätzlich mit der Quarantäne arbeiten, denn falls der Virenscanner durch einen Fehlalarm was wichtiges löscht, kannst Du notfalls noch über die Quarantäne an die Datei ran.

Ok, danke für die Belehrung. ��

Letzte Log war ok, oder? Laptop läuft ja nun auch deutlich besser, auch chkdsk hatte er 2 Tage nicht gemacht. Komischerweise heute Abend noch mal, obwohl Laptop davor ganz normal runter gefahren.

Ich wunder mich immer nur über solche Fragen mit Elemente aus der Q löschen, eigentlich ist es ja selbst erklärend, was eine Q ist und das Elemente darin keinen Schaden anrichten können.

Zitat:

Komischerweise heute Abend noch mal

Wir hatten doch erst neulich darüber gesprochen, dass deine Festplatte Alterserscheinungen aufweist bzw ausstehende Sektoren hat.

Ja das stimmt. Also, dann echt 1000 Dank für die vielen Tipps. Hat ne Menge gebracht. Werde mir mittelfristig einen neuen Laptop zulegen.

Denkst du, dass von heute auf morgen Schluss sein kann ?

Werde mich in den nächsten Tagen erkenntlich zeigen!

Ja, ist bei Platten so. Die Ausfallwahrscheinlichkeit wird höher, je älter die sind. V.a. aber wenn da schon ausstehende Sektoren angezeigt werden.

Sieht soweit ok aus :daumenhoc

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) empfehle ich die Erweiterung Ghostery, diese verhindert weitgehend Usertracking bzw. das Anzeigen von Werbebannern.

Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?