Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   F11 Hänger bei Windows 7 Neustart (https://www.trojaner-board.de/159868-f11-haenger-windows-7-neustart.html)

Ello 18.10.2014 10:49
F11 Hänger bei Windows 7 Neustart
 
Moin,
Wenn ich meinen PC anstatt herunterzufahren Neustarte, hängt er sich bei der Stelle:
Press F11 to Run Recovery
auf. Er fährt nicht Standesgemäß weiter hoch, sondern unter der ersten Meldung, Listen sich immer weitere auf. Durch diesen Fehler kann ich ein Update bei Avira nicht durchführen.

Ist das überhaupt ein Fehler? Oder gehört das so?
Kann mir da jemand helfen?

Lg. Ello

schrauber 18.10.2014 10:56
HI,

kannste davon mal ein Bild machen? Ich weiß auch nit was das mit nem Update bei Avira zu tun haben soll.

Ello 18.10.2014 17:04
Liste der Anhänge anzeigen (Anzahl: 1)
Mit Avira hat das insofern zu tun, dasss es am 1.10 ein Update gab, welches besagt:
Führe einen Neustart durch.
Da dieser eben nicht funktioniert, kann ich auch nicht die aktuellsten Updates laden.
Das Bild habe ich hinzugefügt.
Lg. Ello

schrauber 19.10.2014 08:49
hi,

Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)
Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)
  • Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST Download FRST 32-Bit | FRST 64-Bit
  • Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.
  • Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:
Über den Boot Manager:
  • Starte den Rechner neu.
  • Während dem Hochfahren drücke mehrmals die F8 Taste
  • Wähle nun Computer reparieren.
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Mit Windows CD/DVD (auch bei Windows 8 möglich):
  • Lege die Windows CD in dein Laufwerk.
  • Starte den Rechner neu und starte von der CD.
  • Wähle die Spracheinstellungen und klicke "Weiter".
  • Klicke auf Computerreparaturoptionen !
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Wähle in den Reparaturoptionen: Eingabeaufforderung
  • Gib nun bitte notepad ein und drücke Enter.
  • Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
    Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.
  • Schließe Notepad wieder
  • Gib nun bitte folgenden Befehl ein.
    e:\frst.exe bzw. e:\frst64.exe
    Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.
  • Akzeptiere den Disclaimer mit Ja und klicke Untersuchen
Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).


Ello 19.10.2014 09:36
Danke für die Antwort Schrauber,
Jedoch gibt es 1 Problem, ich habe keinen USB Stick (verloren gegangen) tut es stattdesses auch eine CD-Rom? Noch habe ich eine CD mit dem Betriebssystem. Kannst mir trotzdem weiterhelfen?
Außerdem: Würde ich bei den Schritten, die du mir genannt hast, Gefahr laufen meine Daten zu verlieren?
Würde es auch reichen, wenn ich Avira de-und Neuinstalliere? Dazu müsste ich aber wissen, wie man Viren in Quarantäne löscht.
Und: Ist mein PC wirklich infiziert? Denn der Virenscanner findet nichts.
Das Problem mit dem Neustart existiert auch schon recht lange, bisher hatte ich aber noch nicht diese Situation mit Avira.
Lg. Ello

schrauber 19.10.2014 14:23
Dann lass FRST mal aus dem normalen MOdus lafen.

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


Ello 20.10.2014 09:09
Hier sind die Dateien, hoffe sie können dir weiterhelfen.
Lg. Ello

FRST.txt :

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-10-2014
Ran by Wahls (administrator) on WAHLS-PC on 20-10-2014 10:03:16
Running from C:\Users\Wahls\Desktop
Loaded Profile: Wahls (Available profiles: Wahls)
Platform: Windows 7 Home Premium (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Fuyu LIMITED) C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(G Data Software AG) C:\Program Files\G Data\AntiVirus\AVK\AVKService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(MAGIX AG) C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.24.15\GoogleCrashHandler.exe
(CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Valve Corporation) C:\Program Files\Steam\Steam.exe
() C:\Program Files\Pando Networks\Media Booster\PMB.exe
(Electronic Arts) C:\Program Files\Origin\Origin.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Dropbox, Inc.) C:\Users\Wahls\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files\Evernote\Evernote\EvernoteClipper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Valve Corporation) C:\Program Files\Steam\bin\steamwebhelper.exe
() C:\Windows\System32\PnkBstrA.exe
(Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Apple Inc.) C:\AirPrint\airprint.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(LogMeIn, Inc.) C:\Program Files\LogMeIn Hamachi\LMIGuardianSvc.exe
(Valve Corporation) C:\Program Files\Common Files\Steam\SteamService.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX86\integratedoffice.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [CLMLServer] => C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-06-03] (CyberLink)
HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-01-08] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8120864 2009-12-03] (Realtek Semiconductor)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [ApnUpdater] => "C:\Program Files\Ask.com\Updater\Updater.exe"
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-01] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [3806544 2013-11-29] (LogMeIn Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM\...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [718688 2009-10-01] (Microsoft Corporation)
HKLM\...\Run: [amd_dc_opt] => C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD)
HKU\S-1-5-21-4102999685-4175981624-726481352-1000\...\Run: [Steam] => C:\Program Files\Steam\steam.exe [1938112 2014-09-23] (Valve Corporation)
HKU\S-1-5-21-4102999685-4175981624-726481352-1000\...\Run: [Pando Media Booster] => C:\Program Files\Pando Networks\Media Booster\PMB.exe [4270640 2013-03-21] ()
HKU\S-1-5-21-4102999685-4175981624-726481352-1000\...\Run: [EADM] => C:\Program Files\Origin\Origin.exe [3600216 2014-09-16] (Electronic Arts)
HKU\S-1-5-21-4102999685-4175981624-726481352-1000\...\Run: [Browser Infrastructure Helper] => C:\Users\Wahls\AppData\Local\Smartbar\Application\SnapDo.exe [28192 2014-04-08] (Smartbar)
HKU\S-1-5-21-4102999685-4175981624-726481352-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
HKU\S-1-5-21-4102999685-4175981624-726481352-1000\...\MountPoints2: {64030811-c9f9-11e2-930f-406186932137} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\Start.hta
HKU\S-1-5-21-4102999685-4175981624-726481352-1000\...\MountPoints2: {9a151fce-c5dd-11e2-ab52-406186932137} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\Start.hta
HKU\S-1-5-21-4102999685-4175981624-726481352-1000\...\MountPoints2: {ce7f44e5-e032-11e3-ac37-406186932137} - F:\l2s.exe
AppInit_DLLs: C:\PROGRA~1\SupTab\SEARCH~1.DLL => C:\PROGRA~1\SupTab\SEARCH~1.DLL File Not Found
Startup: C:\Users\Wahls\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Wahls\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Wahls\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtHbLr1kkpuju3s1kW2osF1movHEdZtV2Yd3eZcSHBadZ-8fbrEGrP9jV9Kr3VPV1ZUdtJUDN-ixHaa-IKEAU2u_Al9cyNnwkPTKerxYC4uhn4prWia-y9zx7WZJINE4nfaO-XLqwWPzkn1E_kTG57HBw,&q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.sweet-page.com/?type=hp&ts=1404498084&from=wld&uid=ST1500DL003-9VT16L_5YD80E76XXXX5YD80E76
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://medion.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtHbLr1kkpuju3s1kW2osF1movHEdZtV2Yd3eZcSHBadZ-8fbrEGrP9jV9Kr3VPV1ZUdtJUDN-ixHaa-IKEAU2u_Al9cyNnwkPTKerxYC4uhn4prWia-y9zx7WZJINE4nfaO-XLqwWPzkn1E_kTG57HBw,&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
URLSearchHook: HKLM - (No Name) - {707db484-2428-402d-afb5-d85b387544c7} -  No File
SearchScopes: HKLM - DefaultScope {8F877BB3-0D94-40AC-A76C-EE564C597AC3} URL = hxxp://www.startseite24.net/?q={searchTerms}
SearchScopes: HKLM - {8F877BB3-0D94-40AC-A76C-EE564C597AC3} URL = hxxp://www.startseite24.net/?q={searchTerms}
SearchScopes: HKCU - DefaultScope {8F877BB3-0D94-40AC-A76C-EE564C597AC3} URL = hxxp://www.startseite24.net/?q={searchTerms}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtHbLr1kkpuju3s1kW2osF1movHEdZtV2Yd3eZcSHBadZ-8fbrEGrP9jV9Kr3VPV1ZUdtJUDN-ixHaa-IKEAU2u_Al9cyNnwkPTKerxYC4uhn4prWia-y9zx7WZJINE4nfaO-XLqwWPzkn1E_kTG57HBw,&q={searchTerms}
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1404498084&from=wld&uid=ST1500DL003-9VT16L_5YD80E76XXXX5YD80E76&q={searchTerms}
SearchScopes: HKCU - {8F877BB3-0D94-40AC-A76C-EE564C597AC3} URL = hxxp://www.startseite24.net/?q={searchTerms}
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Snap.DoEngine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: No Name -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} ->  No File
BHO: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} ->  No File
BHO: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
BHO: No Name -> {707db484-2428-402d-afb5-d85b387544c7} ->  No File
BHO: ArcPluginIEBHO Class -> {84BFE29A-8139-402a-B2A4-C23AE9E1A75F} -> C:\Program Files\Perfect World Entertainment\Arc\Plugins\ArcPluginIE.dll (Perfect World Entertainment Inc)
BHO: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: G Data BankGuard -> {BA3295CF-17ED-4F49-9E95-D999A0ADBFDC} -> C:\Program Files\Common Files\G DATA\AVKProxy\BanksafeBHO.dll No File
BHO: Avira SearchFree Toolbar plus Web Protection -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> C:\Program Files\Ask.com\GenericAskToolbar.dll No File
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live Toolbar Helper -> {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} -> C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKLM - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKLM - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll No File
Toolbar: HKLM - @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\Windows\system32\Msdxm6.ocx (Microsoft Corporation)
Toolbar: HKLM - Snap.Do - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKCU - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {707DB484-2428-402D-AFB5-D85B387544C7} -  No File
Toolbar: HKCU - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll No File
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} hxxp://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab
DPF: {1E3F1348-4370-4BBE-A67A-CC7ED824CA85} hxxp://download.microsoft.com/download/7/4/9/749b0dc5-2175-4d5b-a6dd-9c4bc923683e/Selfhelpcontrol.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\Windows\system32\Msdxm6.ocx (Microsoft Corporation)
Winsock: Catalog5 09 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 19 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Wahls\AppData\Roaming\Mozilla\Firefox\Profiles\phj280ou.default
FF NewTab: hxxp://www.sweet-page.com/newtab/?type=nt&ts=1404498084&from=wld&uid=ST1500DL003-9VT16L_5YD80E76XXXX5YD80E76
FF DefaultSearchEngine: sweet-page
FF SelectedSearchEngine: sweet-page
FF Homepage: hxxp://www.startseite24.net
FF Keyword.URL: hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtHbLr1kkpuju3s1kW2osF1movHEdZtV2Yd3eZcSHBadZ-8fbrEGrP9jV9Kr3VPV1ZUdtJUDN-ixHaa-IKEAU2u_Al9cyNnwkPTKerxYC4uhn4prWia-y9zx7WZJINE4nfaO-XLqwWPzkn1E_kTG57HBw,&q=
FF Keyword.URL: hxxp://www.startseite24.net/?q=
FF SearchEngineOrder.1: Websuche
FF SelectedSearchEngine: Websuche
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @esn.me/esnsonar,version=0.70.4 -> C:\Program Files\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin: @esn/esnlaunch,version=2.3.0 -> C:\Program Files\Battlelog Web Plugins\2.3.0\npesnlaunch.dll (ESN Social Software AB)
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @pandonetworks.com/PandoWebPlugin -> C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: @perfectworld.com/npArcPlayNowPlugin -> C:\Program Files\Perfect World Entertainment\Arc\Plugins\npArcPluginFF.dll (Perfect World Entertainment Inc)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin -> C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: ubisoft.com/uplaypc -> C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF SearchPlugin: C:\Users\Wahls\AppData\Roaming\Mozilla\Firefox\Profiles\phj280ou.default\searchplugins\search_engine_trovi.xml
FF SearchPlugin: C:\Users\Wahls\AppData\Roaming\Mozilla\Firefox\Profiles\phj280ou.default\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Fast Start - C:\Users\Wahls\AppData\Roaming\Mozilla\Firefox\Profiles\phj280ou.default\Extensions\faststartff@gmail.com [2014-07-05]
FF Extension: Snap.Do  - C:\Users\Wahls\AppData\Roaming\Mozilla\Firefox\Profiles\phj280ou.default\Extensions\{55e0f1f5-dfed-4288-910b-8cd1d033acbd} [2014-04-25]
FF HKLM\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Users\Wahls\AppData\Roaming\Mozilla\Firefox\Profiles\phj280ou.default\extensions\faststartff@gmail.com

Chrome:
=======

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AirPrint; C:\AirPrint\airprint.exe [234784 2012-10-20] (Apple Inc.)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [431920 2014-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [431920 2014-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [994552 2014-10-01] (Avira Operations GmbH & Co. KG)
S3 ArcService; C:\Program Files\Perfect World Entertainment\Arc\ArcService.exe [88400 2014-04-11] (Perfect World Entertainment Inc)
R2 AVKService; C:\Program Files\G Data\AntiVirus\AVK\AVKService.exe [469016 2012-11-29] (G Data Software AG)
S3 DAUpdaterSvc; C:\Program Files\Steam\steamapps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe [25832 2014-05-09] (BioWare)
R2 Fabs; C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe [1155072 2009-02-03] (MAGIX AG) [File not signed]
S3 FirebirdServerMAGIXInstance; C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2008-08-07] (MAGIX®) [File not signed]
S2 Hamachi2Svc; C:\Program Files\LogMeIn Hamachi\hamachi-2.exe [1664336 2013-11-29] (LogMeIn Inc.)
S2 HiPatchService; C:\Program Files\Hi-Rez Studios\HiPatchService.exe [8704 2013-02-12] (Hi-Rez Studios) [File not signed]
R2 LMIGuardianSvc; C:\Program Files\LogMeIn Hamachi\LMIGuardianSvc.exe [375056 2013-10-11] (LogMeIn, Inc.)
R2 OfficeSvc; C:\Program Files\Microsoft Office 15\ClientX86\integratedoffice.exe [1320120 2013-10-31] (Microsoft Corporation)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76888 2014-08-12] ()
R2 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)
R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [535936 2014-07-04] (Fuyu LIMITED)
S4 AVKWCtl; "C:\Program Files\G Data\AntiVirus\AVK\AVKWCtl.exe" [X]
S4 GDScan; "C:\Program Files\Common Files\G Data\GDScan\GDScan.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 amdide; C:\Windows\System32\DRIVERS\amdide.sys [11832 2009-07-07] (Advanced Micro Devices Inc.)
R3 amdkmdag; C:\Windows\System32\DRIVERS\atipmdag.sys [5191168 2010-01-09] (ATI Technologies Inc.)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [281504 2014-06-01] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98160 2014-10-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-10-01] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG)
S3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [51616 2013-01-20] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [30416 2013-01-20] (G Data Software)
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [50080 2013-01-20] (G Data Software AG)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2014-06-01] ()
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-03-20] (Avira GmbH)
S0 GDBehave; system32\drivers\GDBehave.sys [X]
S1 GDMnIcpt; \??\C:\Windows\system32\drivers\MiniIcpt.sys [X]
S1 gdwfpcd; system32\drivers\gdwfpcd32.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-20 10:03 - 2014-10-20 10:04 - 00022837 _____ () C:\Users\Wahls\Desktop\FRST.txt
2014-10-20 10:03 - 2014-10-20 10:03 - 00000000 ____D () C:\FRST
2014-10-20 09:58 - 2014-10-20 09:58 - 01102848 _____ (Farbar) C:\Users\Wahls\Desktop\FRST.exe
2014-10-18 17:59 - 2014-10-10 03:39 - 00394752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-18 17:59 - 2014-10-10 03:39 - 00230912 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-18 17:59 - 2014-10-10 03:34 - 00303104 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-18 17:58 - 2014-09-15 02:42 - 02377216 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-04 17:54 - 2014-10-04 17:54 - 00000040 _____ () C:\Windows\RUNAWAY.INI
2014-10-04 17:52 - 2014-10-04 17:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pendulo Studios
2014-10-04 17:52 - 2014-10-04 17:52 - 00000000 ____D () C:\Program Files\Pendulo Studios
2014-10-03 19:56 - 2014-10-03 19:56 - 00004096 _____ () C:\Users\Public\Documents\00000A4E.LCS
2014-10-03 19:56 - 2014-10-03 19:56 - 00000000 ____D () C:\Users\Wahls\AppData\Roaming\The Games Company
2014-10-03 19:55 - 2014-10-03 19:55 - 00000000 ____D () C:\splash
2014-10-03 19:55 - 2014-10-03 19:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\The Games Company
2014-10-03 19:54 - 2014-10-03 19:54 - 00000000 ____D () C:\Program Files\The Games Company
2014-10-03 18:21 - 2014-10-03 18:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Big Time Monkey
2014-10-03 18:21 - 2014-10-03 18:21 - 00000000 ____D () C:\Users\Wahls\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Big Time Monkey
2014-10-03 18:20 - 2014-10-05 16:22 - 00000000 ____D () C:\Users\Wahls\BigTimeMonkey
2014-10-02 16:20 - 2014-10-02 16:20 - 00000000 ____D () C:\ProgramData\Pendulo Studios
2014-09-30 18:59 - 2014-09-30 18:59 - 00002174 _____ () C:\Users\Public\Desktop\Google Earth.lnk
2014-09-30 18:59 - 2014-09-30 18:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
2014-09-30 18:58 - 2014-10-20 10:03 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-30 18:57 - 2014-10-20 09:31 - 00001092 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-30 18:57 - 2014-09-30 18:58 - 00000000 ____D () C:\Users\Wahls\AppData\Local\Google
2014-09-30 18:57 - 2014-09-30 18:58 - 00000000 ____D () C:\Program Files\Google
2014-09-28 17:18 - 2014-09-28 17:18 - 00444952 _____ (Creative Labs) C:\Windows\system32\wrap_oal.dll
2014-09-28 17:18 - 2014-09-28 17:18 - 00109080 _____ (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\Windows\system32\OpenAL32.dll
2014-09-28 17:18 - 2014-09-28 17:18 - 00000000 ____D () C:\Users\Wahls\Documents\Book of Unwritten Tales - Demo
2014-09-28 17:18 - 2014-09-28 17:18 - 00000000 ____D () C:\Program Files\OpenAL
2014-09-25 14:35 - 2014-09-25 14:35 - 00002505 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-09-25 14:35 - 2014-09-25 14:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-09-25 14:35 - 2014-09-25 14:35 - 00000000 ____D () C:\Program Files\Common Files\Skype

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-20 10:03 - 2013-03-21 10:43 - 00000000 ____D () C:\Users\Wahls\AppData\Local\PMB Files
2014-10-20 10:01 - 2012-10-21 18:18 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-20 09:59 - 2012-06-23 22:47 - 01734529 _____ () C:\Windows\WindowsUpdate.log
2014-10-20 09:52 - 2009-07-14 06:39 - 00119786 _____ () C:\Windows\setupact.log
2014-10-20 09:39 - 2009-07-14 06:34 - 00009888 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-20 09:39 - 2009-07-14 06:34 - 00009888 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-20 09:34 - 2013-12-20 13:53 - 00000000 ____D () C:\ProgramData\Origin
2014-10-20 09:34 - 2013-12-16 17:50 - 00000000 ____D () C:\Users\Wahls\AppData\Local\LogMeIn Hamachi
2014-10-20 09:32 - 2013-04-06 20:36 - 00000000 ___RD () C:\Users\Wahls\Dropbox
2014-10-20 09:32 - 2013-04-06 20:31 - 00000000 ____D () C:\Users\Wahls\AppData\Roaming\Dropbox
2014-10-20 09:32 - 2012-12-01 17:46 - 00000000 ____D () C:\Users\Wahls\AppData\Roaming\Skype
2014-10-20 09:31 - 2013-12-20 13:53 - 00000000 ____D () C:\Program Files\Origin
2014-10-20 09:31 - 2013-01-31 13:30 - 00000000 ____D () C:\Program Files\Steam
2014-10-20 09:30 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-19 12:12 - 2009-07-14 06:33 - 00519176 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-19 12:11 - 2014-07-09 22:48 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-08 13:54 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\tracing
2014-10-05 16:48 - 2012-11-03 19:35 - 00000000 ____D () C:\Users\Wahls\AppData\Roaming\.minecraft
2014-10-05 16:38 - 2014-01-09 18:31 - 00000000 ____D () C:\Users\Wahls\AppData\Roaming\Visionaire Editor
2014-10-04 19:52 - 2013-01-10 19:53 - 00000000 ____D () C:\Users\Wahls\AppData\Local\CrashDumps
2014-10-04 17:53 - 2014-04-16 15:21 - 00000000 ____D () C:\Users\Wahls\Desktop\Spiele
2014-10-04 17:52 - 2010-01-29 11:53 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2014-10-03 19:56 - 2014-03-17 16:55 - 00000000 ____D () C:\Users\Wahls\AppData\Roaming\ProtectDISC
2014-10-03 18:20 - 2012-06-23 22:00 - 00000000 ____D () C:\Users\Wahls
2014-10-01 13:58 - 2013-05-06 13:16 - 00037384 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-10-01 13:58 - 2013-03-20 11:44 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-10-01 13:58 - 2013-03-20 11:44 - 00098160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-09-25 14:45 - 2012-11-14 18:11 - 00000000 ____D () C:\Program Files\Common Files\Steam
2014-09-25 14:35 - 2012-12-01 17:45 - 00000000 ___RD () C:\Program Files\Skype
2014-09-25 14:35 - 2012-12-01 17:45 - 00000000 ____D () C:\ProgramData\Skype
2014-09-24 16:01 - 2012-10-21 18:18 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-09-24 16:01 - 2012-10-21 18:18 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

Files to move or delete:
====================
C:\ProgramData\4443798.pad
C:\ProgramData\dsgsdgdsgdsgw.pad


Some content of TEMP:
====================
C:\Users\Wahls\AppData\Local\Temp\ApnStub.exe
C:\Users\Wahls\AppData\Local\Temp\avgnt.exe
C:\Users\Wahls\AppData\Local\Temp\bdfilters.dll
C:\Users\Wahls\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpjdysyi.dll
C:\Users\Wahls\AppData\Local\Temp\DseShExt-x86.dll
C:\Users\Wahls\AppData\Local\Temp\npp.6.6.3.Installer.exe
C:\Users\Wahls\AppData\Local\Temp\OfficeSetup.exe
C:\Users\Wahls\AppData\Local\Temp\OpenOffice_4.1.1_Win_x86_install_de.exe
C:\Users\Wahls\AppData\Local\Temp\PrefJsonCpp.exe
C:\Users\Wahls\AppData\Local\Temp\sdanircmdc.exe
C:\Users\Wahls\AppData\Local\Temp\sdapskill.exe
C:\Users\Wahls\AppData\Local\Temp\sdaspwn.exe
C:\Users\Wahls\AppData\Local\Temp\SDShelEx-win32.dll
C:\Users\Wahls\AppData\Local\Temp\Setup.X86.de-DE_O365HomePremRetail_6987388b-3e0b-4897-874b-6e0c4d4d1822_TX_DB_.exe
C:\Users\Wahls\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Wahls\AppData\Local\Temp\sonarinst.exe
C:\Users\Wahls\AppData\Local\Temp\sqlite3.exe
C:\Users\Wahls\AppData\Local\Temp\stub.exe
C:\Users\Wahls\AppData\Local\Temp\sweetpage294wld_n2.exe
C:\Users\Wahls\AppData\Local\Temp\swt-win32-3740.dll
C:\Users\Wahls\AppData\Local\Temp\TB_9C9C.exe
C:\Users\Wahls\AppData\Local\Temp\tmp_minecraft.exe
C:\Users\Wahls\AppData\Local\Temp\vcredist_x86.exe
C:\Users\Wahls\AppData\Local\Temp\xmlUpdater.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-06 09:53

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---


Addition.txt :
Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 20-10-2014
Ran by Wahls at 2014-10-20 10:04:46
Running from C:\Users\Wahls\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)


==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader 9.3 - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-A93000000001}) (Version: 9.3.0 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.5 (HKLM\...\Adobe Shockwave Player) (Version: 11.5.6.606 - Adobe Systems, Inc.)
Adventure Maker v4.7.1 (build1) (HKLM\...\Adventure Maker v4.7.1_is1) (Version:  - )
ALDI Foto Service (HKLM\...\ALDI Foto Service D) (Version: 4.5.9.141 - MAGIX AG)
ALDI Nord Foto Manager Free (HKLM\...\ALDI Nord Foto Manager Free D) (Version: 6.0.1.491 - MAGIX AG)
Aldi Nord Fotoservice (HKLM\...\Aldi Nord Fotoservice_is1) (Version:  - )
ALDI Nord Online Druck Service (HKLM\...\ALDI Nord Online Druck Service D) (Version: 4.5.1.0 - MAGIX AG)
AMD USB Filter Driver (Version: 1.0.13.88 - Advanced Micro Devices, Inc.) Hidden
Apple Application Support (HKLM\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{0592EF96-69D8-4E4B-9CC9-88F58EA86F01}) (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Arc (HKLM\...\{CED8E25B-122A-4E80-B612-7F99B93284B3}) (Version: 1.0.0.5510 - Perfect World Entertainment)
Ask Toolbar (HKLM\...\{86D4B82A-ABED-442A-BE86-96357B70F4FE}) (Version: 1.15.20.0 - Ask.com) <==== ATTENTION
Assassin's Creed II (HKLM\...\Steam App 33230) (Version:  - Ubisoft Montreal)
Assassin's Creed® III (HKLM\...\Steam App 208480) (Version:  - Ubisoft Montreal)
ATI Catalyst Install Manager (HKLM\...\{88A34D88-1A75-8C9D-A26E-F283436AC0A6}) (Version: 3.0.758.0 - ATI Technologies, Inc.)
aTube Catcher (HKLM\...\aTube Catcher) (Version: 2.9.1341 - DsNET Corp)
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.7.306 - Avira)
Avira SearchFree Toolbar plus Web Protection Updater (HKCU\...\{79A765E1-C399-405B-85AF-466F52E918B0}) (Version: 1.2.4.37949 - Ask.com) <==== ATTENTION
AVS Audio Editor 7.2 (HKLM\...\AVS Audio Editor_is1) (Version: 7.2.2.488 - Online Media Technologies Ltd.)
AVS Audio Recorder 4.0 (HKLM\...\AVS Audio Recorder_is1) (Version: 4.0.2.22 - Online Media Technologies Ltd.)
AVS Video Converter 8.5 (HKLM\...\AVS4YOU Video Converter 7_is1) (Version: 8.5.1.551 - Online Media Technologies Ltd.)
AVS Video Editor 6.5 (HKLM\...\AVS Video Editor_is1) (Version: 6.5.1.246 - Online Media Technologies Ltd.)
AVS Video Recorder 2.6 (HKLM\...\AVS Video Recorder_is1) (Version: 2.6.1.94 - Online Media Technologies Ltd.)
Bandicam (HKLM\...\Bandicam) (Version: 1.8.4.283 - Bandisoft.com)
Bandisoft MPEG-1 Decoder (HKLM\...\BandiMPEG1) (Version:  - )
Bastion - Demo (HKLM\...\Steam App 107110) (Version:  - Supergiant Games)
Batman: Arkham City GOTY (HKLM\...\Steam App 200260) (Version:  - Rocksteady Studios)
Battle.net (HKLM\...\Battle.net) (Version:  - Blizzard Entertainment)
Battlefield 4™ (HKLM\...\{ABADE36E-EC37-413B-8179-B432AD3FACE7}) (Version: 1.3.2.15221 - Electronic Arts)
Battlelog Web Plugins (HKLM\...\Battlelog Web Plugins) (Version: 2.3.0 - EA Digital Illusions CE AB)
Beyond Good & Evil (HKLM\...\Steam App 15130) (Version:  - Ubisoft)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
Botanicula (HKLM\...\Botanicula) (Version: 1.0 - Daedalic Entertainment)
Camtasia Studio 8 (HKLM\...\{F5C9BE9A-04C3-4A72-8CD0-BB67C722D608}) (Version: 8.1.2.1344 - TechSmith Corporation)
Catalyst Control Center Core Implementation (Version: 2010.0108.1837.33337 - ATI) Hidden
Catalyst Control Center Graphics Full Existing (Version: 2010.0108.1837.33337 - ATI) Hidden
Catalyst Control Center Graphics Full New (Version: 2010.0108.1837.33337 - ATI) Hidden
Catalyst Control Center Graphics Light (Version: 2010.0108.1837.33337 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (Version: 2010.0108.1837.33337 - ATI) Hidden
Catalyst Control Center InstallProxy (Version: 2010.0108.1837.33337 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (Version: 2010.0108.1837.33337 - ATI) Hidden
CCC Help Danish (Version: 2010.0108.1836.33337 - ATI) Hidden
CCC Help Dutch (Version: 2010.0108.1836.33337 - ATI) Hidden
CCC Help English (Version: 2010.0108.1836.33337 - ATI) Hidden
CCC Help Finnish (Version: 2010.0108.1836.33337 - ATI) Hidden
CCC Help French (Version: 2010.0108.1836.33337 - ATI) Hidden
CCC Help German (Version: 2010.0108.1836.33337 - ATI) Hidden
CCC Help Italian (Version: 2010.0108.1836.33337 - ATI) Hidden
CCC Help Japanese (Version: 2010.0108.1836.33337 - ATI) Hidden
CCC Help Norwegian (Version: 2010.0108.1836.33337 - ATI) Hidden
CCC Help Spanish (Version: 2010.0108.1836.33337 - ATI) Hidden
CCC Help Swedish (Version: 2010.0108.1836.33337 - ATI) Hidden
ccc-core-static (Version: 2010.0108.1837.33337 - Ihr Firmenname) Hidden
ccc-utility (Version: 2010.0108.1837.33337 - ATI) Hidden
Chaos auf Deponia (HKLM\...\Deponia 2) (Version: 1.0 - Daedalic Entertainment)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6425.1000 - Microsoft Corporation)
CorelDRAW Essentials 4 - Content (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Draw (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Extra Content (HKLM\...\_{806422F8-8E0A-494A-A369-0F34F1B89160}) (Version:  - Corel Corporation)
CorelDRAW Essentials 4 - Extra Content (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Filters (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - ICA (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - IPM - No VBA (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang BR (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang DE (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang EN (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang ES (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang FR (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang IT (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang NL (Version: 4.0 - Uw bedrijfsnaam) Hidden
CorelDRAW Essentials 4 - PHOTO-PAINT (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 (HKLM\...\_{C0237AA4-1BFB-46EA-860D-7B0EB365CA13}) (Version:  - Corel Corporation)
CorelDRAW Essentials 4 (Version: 4.0 - Corel Corporation) Hidden
CPUID CPU-Z 1.65.1 (HKLM\...\CPUID CPU-Z_is1) (Version:  - )
CyberLink LabelPrint (HKLM\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.1916 - CyberLink Corp.)
CyberLink LabelPrint (Version: 2.5.1916 - CyberLink Corp.) Hidden
CyberLink Power2Go (HKLM\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.3213 - CyberLink Corp.)
CyberLink Power2Go (Version: 6.1.3213 - CyberLink Corp.) Hidden
CyberLink PowerDVD Copy (HKLM\...\{E3D04529-6EDB-11D8-A372-0050BAE317E1}) (Version: 1.0.6720 - CyberLink Corp.)
Dark Souls: Prepare to Die Edition (HKLM\...\Steam App 211420) (Version:  - FromSoftware)
Dead Space (HKLM\...\{025A585C-0C66-413D-80D2-4C05CB699771}) (Version: 1.0.0.222 - Electronic Arts)
Dragon Age: Origins - Ultimate Edition (HKLM\...\Steam App 47810) (Version:  - BioWare)
Drakensang (HKLM\...\Drakensang_is1) (Version:  - dtp)
Dropbox (HKCU\...\Dropbox) (Version: 2.10.30 - Dropbox, Inc.)
Dual-Core Optimizer (HKLM\...\{9FD6F1A8-5550-46AF-8509-271DF0E768B5}) (Version: 1.1.4.0169 - AMD)
Edna & Harvey: Harvey's New Eyes (HKLM\...\Steam App 219910) (Version:  - Daedalic Entertainment)
Electronic Super Joy (HKLM\...\Steam App 244870) (Version:  - Michael Todd Games)
ESN Sonar (HKLM\...\ESN Sonar-0.70.4) (Version: 0.70.4 - ESN Social Software AB)
Evernote v. 4.6.4 (HKLM\...\{DDAFC46A-90E2-11E2-B700-984BE15F174E}) (Version: 4.6.4.8136 - Evernote Corp.)
FIFA 14 Demo (HKLM\...\{7A6577E7-F341-430F-9173-91E14E2DE270}) (Version: 1.0.0.0 - Electronic Arts)
Firebird SQL Server - MAGIX Edition (HKLM\...\{3E6F0CAD-EE38-42A5-9EEA-AE17A55BF2D4}) (Version: 2.1.23.0 - MAGIX AG)
Fraps (remove only) (HKLM\...\Fraps) (Version:  - )
Free to Play (HKLM\...\Steam App 245550) (Version:  - Valve)
Free YouTube to MP3 Converter version 3.12.39.604 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.39.604 - DVDVideoSoft Ltd.)
FXAA Post Process Injector (HKLM\...\FXAA Post Process Injector) (Version:  - )
G Data AntiVirus 2013 (HKLM\...\{B0F08ACB-6BBA-49A8-8BE9-BBB4C2D8B574}) (Version: 23.1.0.0 - G Data Software AG)
Goin Downtown Demo (HKLM\...\{9E3F532B-824B-4A92-8ABF-CFF5BEAE289D}) (Version: 1.00.0000 - The Games Company)
Goodbye Deponia (HKLM\...\Deponia 3) (Version: 1.0 - Daedalic Entertainment)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden
Half-Life 2: Demo (HKLM\...\Steam App 219) (Version:  - Valve)
Hearthstone (HKLM\...\Hearthstone) (Version:  - Blizzard Entertainment)
Hi-Rez Studios Authenticate and Update Service (HKLM\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}) (Version: 3.0.0.0 - Hi-Rez Studios)
iTunes (HKLM\...\{C197BC08-3D82-4651-8886-E68C21578A38}) (Version: 11.1.3.8 - Apple Inc.)
Java Auto Updater (Version: 2.0.1.2 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 18 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216018FF}) (Version: 6.0.180 - Sun Microsystems, Inc.)
Junk Mail filter update (Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Kingdoms of Amalur: Reckoning (HKLM\...\{6A9D1594-7791-48f5-9CAA-DE9BCB968320}) (Version: 1.0.0.0 - Electronic Arts)
League of Legends (HKLM\...\{92606477-9366-4D3B-8AE3-6BE4B29727AB}) (Version: 1.3 - Riot Games)
LogMeIn Hamachi (HKLM\...\LogMeIn Hamachi) (Version: 2.2.0.109 - LogMeIn, Inc.)
LogMeIn Hamachi (Version: 2.2.0.109 - LogMeIn, Inc.) Hidden
Machinarium (HKLM\...\{4D96D2F0-8FB4-45C2-9B80-2DCB88016316}_is1) (Version:  - Daedalic Entertainment)
ManiaPlanet (HKLM\...\ManiaPlanet_is1) (Version:  - Nadeo)
Mario Forever Toolbar (HKLM\...\Mario_Forever Toolbar) (Version: 6.9.0.16 - Mario Forever)
Mass Effect (HKLM\...\Steam App 17460) (Version:  - BioWare)
Mass Effect 2 (HKLM\...\Steam App 24980) (Version:  - BioWare)
Mass Effect™ 3 Demo (HKLM\...\{A1683CA7-4850-4A21-982B-C6D853C79AF7}) (Version: 1.0.0.0 - Electronic Arts)
MEDION Fotos auf CD & DVD SE Nord (HKLM\...\MEDION Fotos auf CD & DVD SE Nord D) (Version: 8.0.3.4 - MAGIX AG)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office 365 Home Premium - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4551.1512 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Microsoft Xbox 360 Accessories 1.2 (HKLM\...\{AC4C38FD-A54C-4CA5-92EE-D983CD81293E}) (Version: 1.20.146.0 - Microsoft)
Microsoft XNA Framework Redistributable 3.1 (HKLM\...\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation)
Mirror's Edge (HKLM\...\Steam App 17410) (Version:  - DICE)
Mozilla Firefox 27.0.1 (x86 de) (HKLM\...\Mozilla Firefox 27.0.1 (x86 de)) (Version: 27.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 27.0.1 - Mozilla)
MSVCRT (Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MuseScore 1.3 (HKLM\...\MuseScore) (Version: 1.3.0 - Werner Schweer and Others)
Need For Speed™ World (HKLM\...\{3AF1B16A-7DC9-4C80-BAEC-70B088A7C5B8}) (Version: 1.0.0.0 - Electronic Arts)
Neverwinter (HKLM\...\Steam App 109600) (Version:  - Cryptic Studios)
Nexus Mod Manager (HKLM\...\6af12c54-643b-4752-87d0-8335503010de_is1) (Version: 0.47.3 - Black Tree Gaming)
Notepad++ (HKLM\...\Notepad++) (Version: 6.5.3 - Notepad++ Team)
NovaBench 3.0.4 (HKLM\...\{88603FC0-6B3C-442D-981E-E3D49F083548}_is1) (Version:  - Novawave Inc.)
NVIDIA PhysX (HKLM\...\{9530AE42-DAE1-4619-9594-B23487285D17}) (Version: 9.11.1107 - NVIDIA Corporation)
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0 - Microsoft Corporation) Hidden
OpenAL (HKLM\...\OpenAL) (Version:  - )
OpenOffice 4.1.1 (HKLM\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
Origin (HKLM\...\Origin) (Version: 9.3.11.2762 - Electronic Arts, Inc.)
PAC-MAN Championship Edition DX+ (HKLM\...\Steam App 236450) (Version:  - Mine Loader Software Co., Ltd.)
Pando Media Booster (HKLM\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.9 - Pando Networks Inc.)
Peggle (HKLM\...\{715AD72D-887A-459E-988B-D4F3E87FA24B}) (Version: 1.04.0.0 - PopCap Games)
Pflanzen gegen Zombies™ (HKLM\...\{5E6536C2-E79A-49CF-83EA-817AD81F9FC8}) (Version: 1.2.0.1093 - Electronic Arts, Inc.)
Pokémon Trading Card Game Online (HKLM\...\{496D7B7E-EBDC-4E2B-B021-4FF03B188B69}) (Version: 1.0.0 - The Pokémon Company International)
Pokemon World Online version 1.83 (HKLM\...\{30C01299-554C-4B62-BD0F-849F43E01C91}_is1) (Version: 1.83 - CCE & PWO Team.)
Portal (HKLM\...\Steam App 400) (Version:  - Valve)
Portal 2 (HKLM\...\Steam App 620) (Version:  - Valve)
Portal: First Slice (HKLM\...\Steam App 410) (Version:  - Valve)
PunkBuster Services (HKLM\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
QuickTime (HKLM\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5995 - Realtek Semiconductor Corp.)
Risen (HKLM\...\{155F4A0E-76ED-45A2-91FB-FF2A2133C31A}) (Version: 1.00.0000 - Deep Silver)
RollerCoaster Tycoon 3 Demo (HKLM\...\{990036E7-D647-45A4-8F7F-1CB277EF0ABD}) (Version: 1.00.000 - )
Runaway DEMO (HKLM\...\{9A50CAAA-B7A7-4AB5-810E-D43C199C35AE}) (Version:  - )
Runaway: A Twist of Fate (HKLM\...\Steam App 58560) (Version:  - Pendulo Studios)
Safari (HKLM\...\{C779648B-410E-4BBA-B75B-5815BCEFE71D}) (Version: 5.34.57.2 - Apple Inc.)
ScummVM 1.6.0 (HKLM\...\ScummVM_is1) (Version:  - The ScummVM Team)
Skype Click to Call (HKLM\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 6.3.11079 - Skype Technologies S.A.)
Skype™ 6.20 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
Snap.Do (HKLM\...\{923521CE-BCFD-4EDC-B755-798350C984DF}) (Version: 11.62.1.16545 - ReSoft Ltd.) <==== ATTENTION
Snap.Do Engine (HKCU\...\{e38060f4-cd35-4b13-b07b-44b82b26765c}) (Version: 11.62.1.16545 - ReSoft Ltd.) <==== ATTENTION
Spelling Dictionaries Support For Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
Steam (HKLM\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
The Book of Unwritten Tales Demo (HKLM\...\Steam App 215180) (Version:  - KING Art)
The Dark Eye: Chains of Satinav (HKLM\...\Steam App 203830) (Version:  - Daedalic Entertainment)
The Elder Scrolls V: Skyrim (HKLM\...\Steam App 72850) (Version:  - Bethesda Game Studios)
The Night of the Rabbit (HKLM\...\The Night of the Rabbit) (Version: 1.2 - Daedalic Entertainment)
The Stanley Parable (HKLM\...\Steam App 221910) (Version:  - Galactic Cafe)
The Whispered World (HKLM\...\Steam App 18490) (Version:  - Daedalic Entertainment)
The Whispered World Special Edition (HKLM\...\Steam App 268540) (Version:  - Daedalic Entertainment)
The Witcher 2: Assassins of Kings Enhanced Edition (HKLM\...\Steam App 20920) (Version:  - CD Projekt RED)
Tiny and Big: Grandpa's Leftovers (HKLM\...\Steam App 205910) (Version:  - Black Pants Game Studio)
TrackMania Nations ESWC 0.1.7.5 (HKLM\...\TmNations_is1) (Version:  - Nadeo)
Trine 2 (HKLM\...\Steam App 35720) (Version:  - Frozenbyte)
Ubisoft Game Launcher (HKLM\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
Uplay (HKLM\...\Uplay) (Version: 4.6 - Ubisoft)
Visionaire 3.7.1 (HKLM\...\Visionaire_is1) (Version: v3.7.1 - Visionaire Team)
VLC media player 2.1.2 (HKLM\...\VLC media player) (Version: 2.1.2 - VideoLAN)
Windows Live Call (Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
Windows Live Communications Platform (Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Essentials (Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 14.0.8081.709 - Microsoft Corporation) Hidden
Windows Live ID-Anmelde-Assistent (HKLM\...\{10A44844-4465-456E-8C97-80BDD4F68845}) (Version: 6.500.3146.0 - Microsoft Corporation)
Windows Live Mail (Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Movie Maker (Version: 14.0.8091.0730 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live Toolbar (Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Writer (Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WindowsMangerProtect20.0.0.502 (HKLM\...\WindowsMangerProtect) (Version: 20.0.0.502 - WindowsProtect LIMITED) <==== ATTENTION
Wing Commander III (HKLM\...\{F96B9930-E22A-44D6-81B5-6C8E92C21B4B}) (Version: 2.0.0.2 - Electronic Arts)
WinRAR 5.01 (32-bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
Wizard101(DE) (HKCU\...\Wizard101(DE)_is1) (Version:  - Gameforge 4D GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-4102999685-4175981624-726481352-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Wahls\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4102999685-4175981624-726481352-1000_Classes\CLSID\{1c492e6a-2803-5ed7-83e1-1b1d4d41eb39}\InprocServer32 -> C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
CustomCLSID: HKU\S-1-5-21-4102999685-4175981624-726481352-1000_Classes\CLSID\{31261F21-2B16-45EE-BEAB-07C4CFA18B65}\InprocServer32 -> C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CustomCLSID: HKU\S-1-5-21-4102999685-4175981624-726481352-1000_Classes\CLSID\{80A95F12-94C2-4B1D-8AE3-F0CBE5E96E85}\InprocServer32 -> C:\Users\Wahls\AppData\Local\ASKTOO~1\DOWNLO~1\AVIRAW~1.DLL No File
CustomCLSID: HKU\S-1-5-21-4102999685-4175981624-726481352-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Wahls\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4102999685-4175981624-726481352-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Wahls\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4102999685-4175981624-726481352-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Wahls\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4102999685-4175981624-726481352-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Wahls\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4102999685-4175981624-726481352-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Wahls\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4102999685-4175981624-726481352-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Wahls\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4102999685-4175981624-726481352-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Wahls\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4102999685-4175981624-726481352-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Wahls\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

==================== Restore Points  =========================

Could not list Restore Points. Check "winmgmt" service or repair WMI.


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:04 - 2013-01-24 19:53 - 00000064 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 65.52.240.48
127.0.0.1 activation.cloud.techsmith.com


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0240258A-87AF-4A46-808A-377DD4C16D0E} - System32\Tasks\{9C54E723-AA30-4655-BEE2-40D1E53AB33A} => C:\Program Files\Daedalic Entertainment\The Night of the Rabbit\rabbit.exe [2014-10-02] (Daedalic Entertainment GmbH)
Task: {09AF8A14-695E-454C-BA23-FBD99A496BB3} - System32\Tasks\{C8137323-4BFA-4525-9CDD-B3D4FEAD5AC1} => C:\Program Files\Daedalic Entertainment\The Night of the Rabbit\rabbit.exe [2014-10-02] (Daedalic Entertainment GmbH)
Task: {20DB98F8-184A-4E15-81BD-3D8E4173D483} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-24] (Adobe Systems Incorporated)
Task: {262AD9C3-4845-41F4-91A2-2F438CC789A3} - System32\Tasks\{D36B49EF-A472-4CEA-9EA1-AFC5FD8F88E5} => C:\Program Files\Daedalic Entertainment\The Night of the Rabbit\rabbit.exe [2014-10-02] (Daedalic Entertainment GmbH)
Task: {3816C1C0-ACA1-4220-8656-B311EAB28F85} - System32\Tasks\Microsoft\Office\Office First Run Task => C:\Program Files\Microsoft Office 15\ClientX86\integratedoffice.exe [2013-10-31] (Microsoft Corporation)
Task: {3C7814C2-CC60-4D48-AF73-B12BB4B445D4} - System32\Tasks\{9D7E28C2-49FC-4BE8-93C7-3E4A3CDE162C} => C:\Program Files\Daedalic Entertainment\The Night of the Rabbit\rabbit.exe [2014-10-02] (Daedalic Entertainment GmbH)
Task: {42892C26-A294-486F-9558-CDA49C790133} - System32\Tasks\{03C1CAEF-F4DE-40C6-AA6D-9301891F4559} => C:\Program Files\Pendulo Studios\Runaway DEMO\Runaway_DEMO.exe [2002-11-06] ()
Task: {60E63F4A-0DB1-4FD4-97B5-FF2D6DB98627} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-09-30] (Google Inc.)
Task: {6FE83DE2-148C-4774-B538-ABC269F490A1} - System32\Tasks\{DFE68967-2E75-41B0-B755-BB506B8E4FD3} => C:\Program Files\AVS4YOU\AVSAudioEditor\AVSAudioEditor.exe [2013-12-18] (Online Media Technologies Ltd.)
Task: {85DB27E2-C646-4671-BE6C-9C2698CFC66A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-09-30] (Google Inc.)
Task: {86E50F6D-FE6F-4CF3-B3AE-74CFF1732DF3} - System32\Tasks\{9C1F0C52-8E1F-4DB0-B08C-F676499F44E6} => C:\Program Files\Daedalic Entertainment\The Night of the Rabbit\rabbit.exe [2014-10-02] (Daedalic Entertainment GmbH)
Task: {8AEE8853-59F2-4FA4-93DE-172B03DEB3DF} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files\Ask.com\UpdateTask.exe <==== ATTENTION
Task: {AE762D4C-99C7-4DEC-9E21-D1A57A933E1E} - System32\Tasks\{38B08837-989B-49B0-9364-E8D081A4BBEB} => C:\Program Files\Daedalic Entertainment\Chaos auf Deponia\deponia2.exe [2012-09-23] (Daedalic Entertainment)
Task: {C1CFF1A3-CF5F-4C7E-824A-A541AA9FA9A0} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {F0743D78-93AE-4451-8397-7AA7A7161D9D} - System32\Tasks\{AE201725-5527-49EB-8872-E6B1728DD8FA} => C:\Program Files\Daedalic Entertainment\The Night of the Rabbit\rabbit.exe [2014-10-02] (Daedalic Entertainment GmbH)
Task: {F65D6FBB-C94E-4D39-8920-863EF1AEC982} - System32\Tasks\{05914AB3-C7DA-4B57-BC37-C674FE4A51FB} => C:\Program Files\Pendulo Studios\Runaway DEMO\Runaway_DEMO.exe [2002-11-06] ()
Task: {F919860B-4375-46AB-833E-FFCA0502FD66} - System32\Tasks\{C1535C37-1F93-45DB-AF85-8A2D377023CA} => C:\Program Files\Daedalic Entertainment\The Night of the Rabbit\rabbit.exe [2014-10-02] (Daedalic Entertainment GmbH)
Task: {F9FA6E5B-D13C-4737-A63F-0400DC452964} - System32\Tasks\{204F2563-CAC3-4D4F-8BD7-F6528A5F063D} => C:\Program Files\Daedalic Entertainment\Chaos auf Deponia\deponia2.exe [2012-09-23] (Daedalic Entertainment)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-04-21 22:44 - 2013-04-21 22:44 - 00087952 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2013-04-21 22:44 - 2013-04-21 22:44 - 01242952 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2009-06-03 21:59 - 2009-06-03 21:59 - 00619816 ____N () C:\Program Files\CyberLink\Power2Go\CLMediaLibrary.dll
2009-06-03 21:59 - 2009-06-03 21:59 - 00013096 ____N () C:\Program Files\CyberLink\Power2Go\CLMLSvcPS.dll
2014-08-30 18:39 - 2014-08-21 20:15 - 01171456 _____ () C:\Program Files\Steam\libavcodec-56.dll
2014-08-30 18:39 - 2014-08-21 20:15 - 00442368 _____ () C:\Program Files\Steam\libavutil-54.dll
2014-08-30 18:39 - 2014-08-21 20:15 - 00332800 _____ () C:\Program Files\Steam\libavresample-2.dll
2013-03-12 18:10 - 2014-09-03 21:28 - 00774656 _____ () C:\Program Files\Steam\SDL2.dll
2014-05-22 07:59 - 2014-09-23 06:32 - 02226880 _____ () C:\Program Files\Steam\video.dll
2014-08-30 18:39 - 2014-08-21 20:15 - 00403968 _____ () C:\Program Files\Steam\libavformat-56.dll
2014-08-30 18:39 - 2014-08-21 20:15 - 00485888 _____ () C:\Program Files\Steam\libswscale-3.dll
2013-01-31 13:36 - 2014-09-23 06:32 - 00679616 _____ () C:\Program Files\Steam\bin\chromehtml.DLL
2013-03-21 10:43 - 2013-03-21 10:43 - 04270640 _____ () C:\Program Files\Pando Networks\Media Booster\PMB.exe
2014-01-31 11:42 - 2014-09-16 16:53 - 00962560 _____ () C:\Program Files\Origin\platforms\qwindows.dll
2014-01-31 11:42 - 2014-09-16 16:53 - 00024064 _____ () C:\Program Files\Origin\imageformats\qgif.dll
2014-01-31 11:42 - 2014-09-16 16:53 - 00025088 _____ () C:\Program Files\Origin\imageformats\qico.dll
2014-01-31 11:42 - 2014-09-16 16:53 - 00217088 _____ () C:\Program Files\Origin\imageformats\qjpeg.dll
2014-01-31 11:42 - 2014-09-16 16:53 - 00261632 _____ () C:\Program Files\Origin\imageformats\qmng.dll
2014-01-31 11:42 - 2014-09-16 16:53 - 00019968 _____ () C:\Program Files\Origin\imageformats\qtga.dll
2014-01-31 11:42 - 2014-09-16 16:53 - 00302592 _____ () C:\Program Files\Origin\imageformats\qtiff.dll
2014-01-31 11:42 - 2014-09-16 16:53 - 00018944 _____ () C:\Program Files\Origin\imageformats\qwbmp.dll
2014-10-20 09:32 - 2014-10-20 09:32 - 00043008 _____ () c:\users\wahls\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpjdysyi.dll
2013-08-23 21:01 - 2013-08-23 21:01 - 25100288 _____ () C:\Users\Wahls\AppData\Roaming\Dropbox\bin\libcef.dll
2012-09-08 14:16 - 2012-09-08 14:16 - 00433664 _____ () C:\Program Files\Evernote\Evernote\libxml2.dll
2012-09-08 14:16 - 2012-09-08 14:16 - 00315392 _____ () C:\Program Files\Evernote\Evernote\libtidy.dll
2013-01-31 13:36 - 2014-09-05 01:29 - 34589376 _____ () C:\Program Files\Steam\bin\libcef.dll
2013-02-27 20:04 - 2014-08-12 20:54 - 00076888 _____ () C:\Windows\system32\PnkBstrA.exe
2010-02-02 11:33 - 2010-02-02 11:33 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-02-23 12:16 - 2013-08-23 14:45 - 00317096 _____ () C:\Program Files\Microsoft Office 15\ClientX86\c2rui.dll
2014-02-23 12:16 - 2013-10-31 09:47 - 00359592 _____ () C:\Program Files\Microsoft Office 15\ClientX86\c2r32.dll
2014-02-23 12:16 - 2013-10-31 09:47 - 00410792 _____ () C:\Program Files\Microsoft Office 15\ClientX86\StreamServer.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-4102999685-4175981624-726481352-500 - Administrator - Disabled)
Gast (S-1-5-21-4102999685-4175981624-726481352-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-4102999685-4175981624-726481352-1002 - Limited - Enabled)
Wahls (S-1-5-21-4102999685-4175981624-726481352-1000 - Administrator - Enabled) => C:\Users\Wahls

==================== Faulty Device Manager Devices =============

Could not list Devices. Check "winmgmt" service or repair WMI.


==================== Event log errors: =========================

Application errors:
==================
Error: (10/18/2014 11:25:45 AM) (Source: MsiInstaller) (EventID: 11609) (User: NT-AUTORITÄT)
Description: Product: Skype Click to Call -- Error 1609. An error occurred while applying security settings. Users is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. Unable to locate the user's SID, system error 1332(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (10/07/2014 06:55:45 PM) (Source: MsiInstaller) (EventID: 11609) (User: NT-AUTORITÄT)
Description: Product: Skype Click to Call -- Error 1609. An error occurred while applying security settings. Users is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. Unable to locate the user's SID, system error 1332(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (10/07/2014 05:29:13 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.

Error: (10/06/2014 07:14:19 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm iexplore.exe, Version 9.0.8112.16446 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1548

Startzeit: 01cfe13bf89e43a4

Endzeit: 62

Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe

Berichts-ID:

Error: (10/06/2014 11:54:21 AM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.

Error: (10/05/2014 06:05:56 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Steam.exe, Version 2.41.35.41 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: cdc

Startzeit: 01cfe072e901ddd4

Endzeit: 20

Anwendungspfad: C:\Program Files\Steam\Steam.exe

Berichts-ID: 77a2dee0-4ca9-11e4-8293-406186932137

Error: (10/05/2014 00:00:09 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.

Error: (10/04/2014 07:52:30 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Runaway_DEMO.exe, Version: 0.0.0.0, Zeitstempel: 0x3dc9579b
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7600.16915, Zeitstempel: 0x4ec49caf
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00046850
ID des fehlerhaften Prozesses: 0x6ec
Startzeit der fehlerhaften Anwendung: 0xRunaway_DEMO.exe0
Pfad der fehlerhaften Anwendung: Runaway_DEMO.exe1
Pfad des fehlerhaften Moduls: Runaway_DEMO.exe2
Berichtskennung: Runaway_DEMO.exe3

Error: (10/04/2014 07:52:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Runaway_DEMO.exe, Version: 0.0.0.0, Zeitstempel: 0x3dc9579b
Name des fehlerhaften Moduls: Runaway_DEMO.exe, Version: 0.0.0.0, Zeitstempel: 0x3dc9579b
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00003499
ID des fehlerhaften Prozesses: 0x1b30
Startzeit der fehlerhaften Anwendung: 0xRunaway_DEMO.exe0
Pfad der fehlerhaften Anwendung: Runaway_DEMO.exe1
Pfad des fehlerhaften Moduls: Runaway_DEMO.exe2
Berichtskennung: Runaway_DEMO.exe3

Error: (10/04/2014 05:55:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Runaway_DEMO.exe, Version: 0.0.0.0, Zeitstempel: 0x3dc9579b
Name des fehlerhaften Moduls: Runaway_DEMO.exe, Version: 0.0.0.0, Zeitstempel: 0x3dc9579b
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00003499
ID des fehlerhaften Prozesses: 0x15e8
Startzeit der fehlerhaften Anwendung: 0xRunaway_DEMO.exe0
Pfad der fehlerhaften Anwendung: Runaway_DEMO.exe1
Pfad des fehlerhaften Moduls: Runaway_DEMO.exe2
Berichtskennung: Runaway_DEMO.exe3


System errors:
=============
Error: (10/20/2014 09:51:47 AM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk4\DR8 gefunden.

Error: (10/20/2014 09:35:05 AM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: winmgmt. Dieser Dienst ist eventuell nicht installiert.

Error: (10/20/2014 09:33:00 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
GDBehave
GDMnIcpt
gdwfpcd

Error: (10/20/2014 09:32:44 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Microsoft Office-Dienst" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (10/20/2014 09:32:44 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Microsoft Office-Dienst erreicht.

Error: (10/20/2014 09:31:54 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "LMIGuardianSvc" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (10/20/2014 09:31:54 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst LMIGuardianSvc erreicht.

Error: (10/20/2014 09:31:24 AM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "IP-Hilfsdienst" ist von folgendem Dienst abhängig: winmgmt. Dieser Dienst ist eventuell nicht installiert.

Error: (10/20/2014 09:31:24 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Hi-Rez Studios Authenticate and Update Service erreicht.

Error: (10/20/2014 09:30:52 AM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "LogMeIn Hamachi Tunneling Engine" ist von folgendem Dienst abhängig: winmgmt. Dieser Dienst ist eventuell nicht installiert.


Microsoft Office Sessions:
=========================
Error: (10/18/2014 11:25:45 AM) (Source: MsiInstaller) (EventID: 11609) (User: NT-AUTORITÄT)
Description: Product: Skype Click to Call -- Error 1609. An error occurred while applying security settings. Users is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. Unable to locate the user's SID, system error 1332(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (10/07/2014 06:55:45 PM) (Source: MsiInstaller) (EventID: 11609) (User: NT-AUTORITÄT)
Description: Product: Skype Click to Call -- Error 1609. An error occurred while applying security settings. Users is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. Unable to locate the user's SID, system error 1332(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (10/07/2014 05:29:13 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: c:\program files\microsoft\search enhancement pack\search helper\sepsearchhelperie.dllc:\program files\microsoft\search enhancement pack\search helper\sepsearchhelperie.dll2

Error: (10/06/2014 07:14:19 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: iexplore.exe9.0.8112.16446154801cfe13bf89e43a462C:\Program Files\Internet Explorer\iexplore.exe

Error: (10/06/2014 11:54:21 AM) (Source: SideBySide) (EventID: 59) (User: )
Description: c:\program files\microsoft\search enhancement pack\search helper\sepsearchhelperie.dllc:\program files\microsoft\search enhancement pack\search helper\sepsearchhelperie.dll2

Error: (10/05/2014 06:05:56 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Steam.exe2.41.35.41cdc01cfe072e901ddd420C:\Program Files\Steam\Steam.exe77a2dee0-4ca9-11e4-8293-406186932137

Error: (10/05/2014 00:00:09 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: c:\program files\microsoft\search enhancement pack\search helper\sepsearchhelperie.dllc:\program files\microsoft\search enhancement pack\search helper\sepsearchhelperie.dll2

Error: (10/04/2014 07:52:30 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Runaway_DEMO.exe0.0.0.03dc9579bntdll.dll6.1.7600.169154ec49cafc0000005000468506ec01cfdffbf590a38bC:\Program Files\Pendulo Studios\Runaway DEMO\Runaway_DEMO.exeC:\Windows\SYSTEM32\ntdll.dll3598c31b-4bef-11e4-bb02-406186932137

Error: (10/04/2014 07:52:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Runaway_DEMO.exe0.0.0.03dc9579bRunaway_DEMO.exe0.0.0.03dc9579bc0000005000034991b3001cfdffbe0548972C:\Program Files\Pendulo Studios\Runaway DEMO\Runaway_DEMO.exeC:\Program Files\Pendulo Studios\Runaway DEMO\Runaway_DEMO.exe23ae7883-4bef-11e4-bb02-406186932137

Error: (10/04/2014 05:55:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Runaway_DEMO.exe0.0.0.03dc9579bRunaway_DEMO.exe0.0.0.03dc9579bc00000050000349915e801cfdfeb8639360fC:\Program Files\Pendulo Studios\Runaway DEMO\Runaway_DEMO.exeC:\Program Files\Pendulo Studios\Runaway DEMO\Runaway_DEMO.execfc981c9-4bde-11e4-bb02-406186932137

schrauber 20.10.2014 19:44
Lade Dir bitte von hier Revo Uninstaller Download Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
  • Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
  • Klicke auf Optionen und wähle als Sprache Deutsch.
  • Suche im Uninstallerfeld nach den Programmen:

    Ask Toolbar

    Avira SearchFree Toolbar plus Web Protection Updater (HKCU\...\{79A765E1-C399-405B-85AF-466F52E918B0}) (Version: 1.2.4.37949 - Ask.com) <==== ATTENTION

    Snap.Do

    Snap.Do Engine

    WindowsMangerProtect20.0.0.502 (HKLM\...\WindowsMangerProtect) (Version: 20.0.0.502 - WindowsProtect LIMITED) <==== ATTENTION


  • Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
  • Wähle anschließend den Modus "Moderat" aus.
  • Reste löschen:
    Klicke auf dann auf und dann auf .

 





Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Ello 20.10.2014 20:01
Den angewiesenen Schritt werde ich erst nach einer Antwort ausführen
Ist dieses Combofix auch sicher? Ich habe nämlich kein Bock drauf, dass wen das ganze nicht funktioniert, ich mich wegen dem F11 Hänger nicht mehr anmelden kann. Auch möchte ich nicht, dass wenn ich an die Maus komme, alle Dateien futsch sind :( Ist auch der Link für Combofix 100% sicher?
Lg. Ello

schrauber 21.10.2014 17:53
Warum sollte der Link nicht sicher sein?

Da steht nit du sollst nit an die Maus kommen, da steht nur du sollst nit in dem Combofix Fenster rum klicken :).

Das Tool wird am Tag mehrere Tausend Mal benutzt. Aber nein, es ist nicht sicher. Genauso wenig wie dein AV PRogramm, oder Windows Updates. Oder die Installation eines Programmes.

All das kann in einem nicht mehr bootbaren PC enden.

Ello 21.10.2014 19:15
Sprich, die Aktion ist genauso gefährlich wie fast alles andere was ich auf dem PC tue.
Tschuldige meine Vorsicht, aber seit ich mir vor kurzem nen Virus eingefangen habe, bin ich übervorsichtig.
Spätestens übermorgen mach ich dann das Ganze.
Lg. Ello

schrauber 22.10.2014 17:28
Sowas in der Art, genau :)

Combofix ist nen starkes Tool, prozentual kann da schon ne Kleinigkeit mehr passieren. Aber wir wollen das Ding ja sauber haben :)

Ello 23.10.2014 10:44
Was kann da denn passieren? Ich habe nen Scan jetzt abgebrochen weil ich los musst, ist das schlimm? Ich dachte das wäre nur nen Scan Programm :(

So, habe ich gemacht. Bei dem Neustart während des Combofix Scans, trat erneut das F11 Problem auf. Darauf hin habe ich den Hauptschalter betätigt und den PC ganz normal hochgefahren, seltsamerweise dauert dies immer länger. Nach dem Neustart öffneten sich solche Programme wie Skype, Tastatur und Steam-Update automatisch, hoffe es ist nicht schlimm. Combofix hat keine Fehlermeldung angezeigt. Jedoch war nach dem Scan LogMeInHamchi auf dem Desktop zufinden, obwohl ich dieses schon vor längerer Zeit gelöscht hatte. Hoffe du kannst mir weiterhelfen.
Lg. Ello

Code:
ComboFix 14-10-21.01 - Wahls 23.10.2014  10:51:53.1.4 - x86
ausgeführt von:: c:\users\Wahls\Desktop\ComboFix.exe
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\END
c:\programdata\4443798.pad
c:\programdata\dsgsdgdsgdsgw.pad
.
.
(((((((((((((((((((((((  Dateien erstellt von 2014-09-23 bis 2014-10-23  ))))))))))))))))))))))))))))))
.
.
2014-10-23 09:28 . 2014-10-23 09:28        --------        d-----w-        c:\program files\LogMeIn Hamachi
2014-10-23 09:17 . 2014-10-23 09:17        --------        d-----w-        c:\users\Default\AppData\Local\temp
2014-10-22 07:20 . 2014-10-22 07:20        --------        d-----w-        c:\program files\VS Revo Group
2014-10-20 08:03 . 2014-10-20 08:05        --------        d-----w-        C:\FRST
2014-10-18 15:59 . 2014-10-10 01:39        230912        ----a-w-        c:\windows\system32\generaltel.dll
2014-10-18 15:59 . 2014-10-10 01:39        394752        ----a-w-        c:\windows\system32\aepdu.dll
2014-10-18 15:59 . 2014-10-10 01:34        303104        ----a-w-        c:\windows\system32\aeinv.dll
2014-10-18 15:58 . 2014-09-15 00:42        2377216        ----a-w-        c:\windows\system32\win32k.sys
2014-10-04 15:52 . 2014-10-04 15:52        --------        d-----w-        c:\program files\Pendulo Studios
2014-10-03 17:56 . 2014-10-03 17:56        --------        d-----w-        c:\users\Wahls\AppData\Roaming\The Games Company
2014-10-03 17:55 . 2014-10-03 17:55        --------        d-----w-        C:\splash
2014-10-03 17:54 . 2014-10-03 17:54        --------        d-----w-        c:\program files\The Games Company
2014-10-03 16:21 . 2014-10-03 16:21        --------        d-----w-        c:\users\Wahls\AppData\Local\Hochschule der Medien
2014-10-03 16:20 . 2014-10-05 14:22        --------        d-----w-        c:\users\Wahls\BigTimeMonkey
2014-10-02 14:20 . 2014-10-02 14:20        --------        d-----w-        c:\programdata\Pendulo Studios
2014-09-30 16:57 . 2014-09-30 16:58        --------        d-----w-        c:\program files\Google
2014-09-30 16:57 . 2014-09-30 16:58        --------        d-----w-        c:\users\Wahls\AppData\Local\Google
2014-09-28 15:18 . 2014-09-28 15:18        444952        ----a-w-        c:\windows\system32\wrap_oal.dll
2014-09-28 15:18 . 2014-09-28 15:18        109080        ----a-w-        c:\windows\system32\OpenAL32.dll
2014-09-28 15:18 . 2014-09-28 15:18        --------        d-----w-        c:\program files\OpenAL
2014-09-25 12:35 . 2014-09-25 12:35        --------        d-----w-        c:\program files\Common Files\Skype
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-10-01 11:58 . 2013-05-06 11:16        37384        ----a-w-        c:\windows\system32\drivers\avnetflt.sys
2014-10-01 11:58 . 2013-03-20 09:44        98160        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2014-10-01 11:58 . 2013-03-20 09:44        136216        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2014-09-24 14:01 . 2012-10-21 16:18        71344        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2014-09-24 14:01 . 2012-10-21 16:18        701104        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2014-08-12 18:55 . 2013-02-27 18:05        138904        ----a-w-        c:\windows\system32\drivers\PnkBstrK.sys
2014-08-12 18:55 . 2013-02-27 18:05        138904        ----a-w-        c:\users\Wahls\AppData\Roaming\PnkBstrK.sys
2014-08-12 18:54 . 2013-02-27 18:04        281872        ----a-w-        c:\windows\system32\PnkBstrB.exe
2014-08-12 18:54 . 2013-02-27 18:04        281872        ----a-w-        c:\windows\system32\PnkBstrB.ex0
2014-08-12 18:54 . 2013-02-27 18:04        76888        ----a-w-        c:\windows\system32\PnkBstrA.exe
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04        131480        ----a-w-        c:\users\Wahls\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04        131480        ----a-w-        c:\users\Wahls\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04        131480        ----a-w-        c:\users\Wahls\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
"Steam"="c:\program files\Steam\steam.exe" [2014-10-21 1938624]
"Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2013-03-21 4270640]
"EADM"="c:\program files\Origin\Origin.exe" [2014-09-16 3600216]
"Browser Infrastructure Helper"="c:\users\Wahls\AppData\Local\Smartbar\Application\SnapDo.exe" [2014-04-08 28192]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2014-08-27 22041192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2009-06-03 103720]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-01-08 98304]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-12-03 8120864]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2014-10-01 703736]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2013-05-01 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-11-01 152392]
"XboxStat"="c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2009-10-01 718688]
"amd_dc_opt"="c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]
"LogMeIn Hamachi Ui"="c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2014-10-18 3835728]
.
c:\users\Wahls\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Wahls\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-9-13 36414624]
EvernoteClipper.lnk - c:\program files\Evernote\Evernote\EvernoteClipper.exe [2013-3-19 1086816]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
R0 GDBehave;GDBehave;c:\windows\system32\drivers\GDBehave.sys [x]
R1 GDMnIcpt;GDMnIcpt;c:\windows\system32\drivers\MiniIcpt.sys [x]
R1 gdwfpcd;G Data WFP CD;c:\windows\system32\drivers\gdwfpcd32.sys [x]
R3 ArcService;Arc Service;c:\program files\Perfect World Entertainment\Arc\ArcService.exe [2014-04-11 88400]
R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files\Steam\steamapps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe [2014-05-09 25832]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-08-07 3276800]
R3 GDPkIcpt;GDPkIcpt;c:\windows\system32\drivers\PktIcpt.sys [2013-01-20 51616]
R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [2009-09-22 579072]
R4 AVKWCtl;G Data Dateisystem Wächter;c:\program files\G Data\AntiVirus\AVK\AVKWCtl.exe [x]
R4 GDScan;G Data Scanner;c:\program files\Common Files\G Data\GDScan\GDScan.exe [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2013-10-01 37352]
S1 GRD;G Data Rootkit Detector Driver;c:\windows\system32\drivers\GRD.sys [2013-01-20 30416]
S1 HookCentre;HookCentre;c:\windows\system32\drivers\HookCentre.sys [2013-01-20 50080]
S2 AirPrint;AirPrint;c:\airprint\airprint.exe [2012-10-20 234784]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-01-08 172032]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2014-10-01 431920]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files\Avira\AntiVir Desktop\AVWEBGRD.EXE [2014-10-01 994552]
S2 AVKService;G Data Scheduler;c:\program files\G Data\AntiVirus\AVK\AVKService.exe [2012-11-29 469016]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files\Common Files\MAGIX Services\Database\bin\FABS.exe [2009-02-03 1155072]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [2014-10-18 1893200]
S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn Hamachi\LMIGuardianSvc.exe [2014-10-18 411920]
S2 OfficeSvc;Microsoft Office-Dienst;c:\program files\Microsoft Office 15\ClientX86\integratedoffice.exe [2013-10-31 1320120]
S2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-10-02 3064000]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-11-05 230912]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-06-05 27320]
.
.
Inhalt des "geplante Tasks" Ordners
.
2014-10-23 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-21 14:01]
.
2014-10-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2014-09-30 16:57]
.
2014-10-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2014-09-30 16:57]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = https://www.google.de/
mStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtHbLr1kkpuju3s1kW2osF1movHEdZtV2Yd3eZcSHBadZ-8fbrEGrP9jV9Kr3VPV1ZUdtJUDN-ixHaa-IKEAU2u_Al9cyNnwkPTKerxYC4uhn4prWia-y9zx7WZJINE4nfaO-XLqwWPzkn1E_kTG57HBw,&q={searchTerms}
IE: Auswahl speichern - c:\program files\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=3
IE: Diese Seite ausschneiden - c:\program files\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=1
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MIF5BA~1\Office12\EXCEL.EXE/3000
IE: Neue Notiz - c:\program files\Evernote\Evernote\\EvernoteIERes\NewNote.html
IE: URL notieren - c:\program files\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=0
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: Interfaces\{A0A0565E-9D18-497D-B202-0EA892DF1FAB}: DhcpNameServer = 192.168.0.1
TCP: Interfaces\{A0A0565E-9D18-497D-B202-0EA892DF1FAB}\B4440275C414E40284F6473707F647B2: DhcpNameServer = 10.7.179.130 10.7.177.130
TCP: Interfaces\{ce822ebf-4220-462c-a3cb-656bd9dbc7e2}: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Wahls\AppData\Roaming\Mozilla\Firefox\Profiles\phj280ou.default\
FF - prefs.js: browser.search.selectedEngine - sweet-page
FF - prefs.js: browser.startup.homepage - hxxp://www.startseite24.net
FF - prefs.js: keyword.URL - hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtHbLr1kkpuju3s1kW2osF1movHEdZtV2Yd3eZcSHBadZ-8fbrEGrP9jV9Kr3VPV1ZUdtJUDN-ixHaa-IKEAU2u_Al9cyNnwkPTKerxYC4uhn4prWia-y9zx7WZJINE4nfaO-XLqwWPzkn1E_kTG57HBw,&q=
FF - prefs.js: keyword.URL - hxxp://www.startseite24.net/?q=
FF - prefs.js: browser.search.selectedEngine - Websuche
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{707db484-2428-402d-afb5-d85b387544c7} - (no file)
Toolbar-Locked - (no file)
WebBrowser-{707DB484-2428-402D-AFB5-D85B387544C7} - (no file)
AddRemove-6af12c54-643b-4752-87d0-8335503010de_is1 - c:\users\Wahls\Desktop\Nexus Mod\Nexus Mod Manager\uninstall\unins000.exe
AddRemove-FXAA Post Process Injector - c:\users\Wahls\Desktop\Uninstall.exe
AddRemove-Mario_Forever Toolbar - c:\program files\Mario_Forever\uninstall.exe
AddRemove-ScummVM_is1 - c:\program files\ScummVM\unins000.exe
AddRemove-{75D84EF7-0D8C-4e70-B3FA-7B42A5D4E0EB} - c:\program files\Common Files\BioWare\Uninstall Mass Effect 2.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-4102999685-4175981624-726481352-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.download\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariDownload"
.
[HKEY_USERS\S-1-5-21-4102999685-4175981624-726481352-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (S-1-5-21-4102999685-4175981624-726481352-1000)
@Denied: (2) (LocalSystem)
"Progid"="IE.AssocFile.HTM"
.
[HKEY_USERS\S-1-5-21-4102999685-4175981624-726481352-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (S-1-5-21-4102999685-4175981624-726481352-1000)
@Denied: (2) (LocalSystem)
"Progid"="IE.AssocFile.HTM"
.
[HKEY_USERS\S-1-5-21-4102999685-4175981624-726481352-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.safariextz\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariExtension"
.
[HKEY_USERS\S-1-5-21-4102999685-4175981624-726481352-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (S-1-5-21-4102999685-4175981624-726481352-1000)
@Denied: (2) (LocalSystem)
"Progid"="FirefoxHTML"
.
[HKEY_USERS\S-1-5-21-4102999685-4175981624-726481352-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\UserChoice]
@Denied: (2) (S-1-5-21-4102999685-4175981624-726481352-1000)
@Denied: (2) (LocalSystem)
"Progid"="IE.AssocFile.SVG"
.
[HKEY_USERS\S-1-5-21-4102999685-4175981624-726481352-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.webarchive\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariHTML"
.
[HKEY_USERS\S-1-5-21-4102999685-4175981624-726481352-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (S-1-5-21-4102999685-4175981624-726481352-1000)
@Denied: (2) (LocalSystem)
"Progid"="IE.AssocFile.XHT"
.
[HKEY_USERS\S-1-5-21-4102999685-4175981624-726481352-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (S-1-5-21-4102999685-4175981624-726481352-1000)
@Denied: (2) (LocalSystem)
"Progid"="IE.AssocFile.XHT"
.
[HKEY_USERS\S-1-5-21-4102999685-4175981624-726481352-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariHTML"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\atieclxx.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Hi-Rez Studios\HiPatchService.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Google\Update\1.3.24.15\GoogleCrashHandler.exe
c:\windows\system32\taskhost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\msiexec.exe
c:\windows\System32\WUDFHost.exe
c:\windows\system32\conhost.exe
c:\windows\System32\osk.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\users\Wahls\AppData\Roaming\Dropbox\bin\Dropbox.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Steam\bin\steamwebhelper.exe
c:\program files\Common Files\Steam\SteamService.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-10-23  11:36:13 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2014-10-23 09:36
.
Vor Suchlauf: 12 Verzeichnis(se), 993.954.373.632 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 997.134.929.920 Bytes frei
.
- - End Of File - - AAB7B1520B659E8CDF6399D384700260
4624822E540EC83CD0819525C65846BA

schrauber 24.10.2014 07:39
Zitat:
Ich habe nen Scan jetzt abgebrochen weil ich los musst, ist das schlimm?
Bist du in irgendeiner Form lebensmüde? Du fragst mich wie schlimm das Tool ist wegen Maus bewegen und so. Ich sage alles gut, nur nicht klicken, und du beendest das Programm während dem Scan? :wtf:

Jetzt kannste hoch offiziell froh sein dass die Kiste noch bootet.....



Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.


Alle Zeitangaben in WEZ +1. Es ist jetzt 09:29 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131