Win7 | Scheinbar unsichtbare, überlappende Fenster verhindern Eingabe

Lagavulin · 16.12.2014, 23:36

Guten Abend wünsche ich erst einmal und natürlich vielen Dank für Eure grandiosen und kostenlosen Dienstleistungen !

Vorweg: Ich bin selbst seit ca. 10 Jahren in der IT-Branche tätig, kümmer mich sowohl um Hardware als auch Software Probleme (sprich; Softwareprobleme jeglicher Art, Malware Beseitigung, Treiberprobleme, "Rechner läuft langsam trotz aktueller Hardware" usw.) bin daher nicht ganz unbedarft.

Nun zu meinem Problem:

Mir ist vor kurzem aufgefallen, dass ich meinen Rechner unmittelbar nach nach einem Neustart/Einschalten nicht vernünftig bedienen kann.
Es scheint, als wäre die komplette Taskleiste für Eingaben komplett deaktiviert. Ich habe meinen Browser, Explorer etc. auf der Taskleiste abgelegt, aber kann es/ihn nicht anklicken, gleiches gilt für den Infobereich, auch da ist keine Aktivierung möglich.
Sobald ich mittels Strg+Alt+Entf und einem Klick auf 'Taskmanager starten', den Taskmanager starte, läuft alles bestens und ich kann ohne Probleme arbeiten. Die Eingabeprobleme tauchen grundsätzlich nur in einem bestimmten Bereich auf. Desktopanwendungen kann ich ohne Probleme per Doppelklick starten...

Grundsätzlich eine vorübergehende Lösung, ja, aber wenn ich meinen VLC Player starte, habe ich am Anfang vollen Zugriff auf alle Buttons (Play, Stop etc.), aber nachdem ich ein Video/Song gestartet habe, geht plötzlich gar nichts mehr, es sind keine Eingaben via Maus möglich. Shortcuts via Tastatur funktionieren ohne Probleme, auch das Vorspulen via Mausrad haut hin.

- Updates sind selbstverständlich alle installiert
- Autostart ist auf das nötigste beschränkt
- Software ist mMn auszuschließen

Ich surfe generell nie ohne Adblock im WWW und habe auch als "Virenschutz", zusätzlich zu brain.exe, Norton Antivirus (nicht die IS oder 360 Version von T-Kom) in aktuellster Version installiert.(Ich weiß, es gibt immer ein vorübergehendes Programm, welches die derzeitige Referenz darstellt, aber ich bin grundsätzlich von dem aktuellen Norton durchaus überzeugt, was Ressourcenmanagement angeht).

Ich bin mir im Moment wirklich nicht sicher ob es Malware oder einfach nur irgendein Überrest einer Software ist, die mich in den Wahnsinn treibt, daher wäre ich durchaus dankbar wenn Ihr euch mein Problem mal anschauen würdet.

Von mir durchgeführte Scans hänge ich als Log mit Beschreibung an.

Von euch verlangte Logs:

FRST:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-12-2014 01
Ran by user (administrator) on USER-PC on 16-12-2014 22:19:21
Running from C:\Users\user\Desktop
Loaded Profiles: user & UpdatusUser (Available profiles: user & UpdatusUser)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsusFanControlService\1.01.08\AsusFanControlService.exe
(CrypKey (Canada) Ltd.) C:\Windows\System32\Crypserv.exe
(DTS) C:\Program Files\Realtek\Audio\HDA\DTSAudioService64.exe
(Symantec Corporation) C:\Program Files (x86)\Norton AntiVirus\Engine\21.6.0.32\nav.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.6.15\nst.exe
(DEVGURU Co., LTD.) C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Symantec Corporation) C:\Program Files (x86)\Norton AntiVirus\Engine\21.6.0.32\nav.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.6.15\nst.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winamp.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7204568 2013-11-04] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_DTS] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1361112 2013-11-05] (Realtek Semiconductor)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
HKU\S-1-5-21-2826055049-857224148-3662155922-1000\...\MountPoints2: J - J:\setup.exe
HKU\S-1-5-21-2826055049-857224148-3662155922-1000\...\MountPoints2: {179d96aa-8dd5-11e3-b8f1-f46d042c12dd} - J:\setup.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-2826055049-857224148-3662155922-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKU\S-1-5-21-2826055049-857224148-3662155922-1000\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.giga.de/androidnews/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2826055049-857224148-3662155922-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Norton Identity Protection -> {AB4C7833-A6EC-433f-B9FE-6B14B1A2F836} -> C:\Program Files (x86)\Norton Identity Safe\Engine64\2014.7.6.15\coIEPlg.dll (Symantec Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton AntiVirus\Engine\21.6.0.32\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Norton Identity Protection -> {AB4C7833-A6EC-433f-B9FE-6B14B1A2F836} -> C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.6.15\coIEPlg.dll (Symantec Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Norton Identity Safe Toolbar - {A13C2648-91D4-4bf3-BC6D-0079707C4389} - C:\Program Files (x86)\Norton Identity Safe\Engine64\2014.7.6.15\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Norton Identity Safe Toolbar - {A13C2648-91D4-4bf3-BC6D-0079707C4389} - C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.6.15\coIEPlg.dll (Symantec Corporation)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.44.2
Tcpip\..\Interfaces\{6515BC46-956B-438F-A5F1-C2B5DD4B811F}: [NameServer] 8.8.8.8,8.8.4.4

FireFox:
========
FF ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\vbqa0o53.default
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2826055049-857224148-3662155922-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\user\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_21.1.0.18\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_21.1.0.18\IPSFF [2014-01-27]
FF HKLM-x32\...\Firefox\Extensions: [{F04D2D30-776C-4d02-8627-8E4385ECA58D}] - C:\ProgramData\Norton\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST_2014.6.0.27\coFFPlgn
FF Extension: Norton Identity Safe Toolbar - C:\ProgramData\Norton\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST_2014.6.0.27\coFFPlgn [2014-12-16]
FF Extension: No Name - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\vbqa0o53.default\extensions\quick_start@gmail.com [Not Found]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR Profile: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (ProxFlow) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2014-02-04]
CHR Extension: (Google Docs) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-26]
CHR Extension: (Google Drive) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-26]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-04]
CHR Extension: (YouTube) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-26]
CHR Extension: (Adblock Plus) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-01-26]
CHR Extension: (Google-Suche) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-26]
CHR Extension: (AdBlock) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-01-26]
CHR Extension: (Google Wallet) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-26]
CHR Extension: (Google Mail) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-26]
CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe [920736 2012-06-01] ()
R2 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe [951936 2012-06-01] (ASUSTeK Computer Inc.)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe [149120 2012-02-17] (ASUSTeK Computer Inc.)
R2 AsusFanControlService; C:\Program Files (x86)\ASUS\AsusFanControlService\1.01.08\AsusFanControlService.exe [324608 2012-05-18] (ASUSTeK Computer Inc.) [File not signed]
R2 Crypkey License; C:\Windows\system32\crypserv.exe [122880 2008-05-08] (CrypKey (Canada) Ltd.) [File not signed]
R2 DTSAudioService; C:\Program Files\Realtek\Audio\HDA\DTSAudioService64.exe [210024 2011-05-31] (DTS)
R2 NAV; C:\Program Files (x86)\Norton AntiVirus\Engine\21.6.0.32\NAV.exe [262968 2014-09-21] (Symantec Corporation)
R2 NCO; C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.6.15\NST.exe [130104 2014-07-31] (Symantec Corporation)
R2 ss_conn_service; C:\Program Files\SAMSUNG\USB Drivers\25_escape\conn\ss_conn_service.exe [728328 2014-04-11] (DEVGURU Co., LTD.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2012-08-22] ()
R1 BHDrvx64; C:\Program Files (x86)\Norton AntiVirus\NortonData\21.1.0.18\Definitions\BASHDefs\20141209.001\BHDrvx64.sys [1587416 2014-10-03] (Symantec Corporation)
R1 ccSet_NAV; C:\Windows\system32\drivers\NAVx64\1506000.020\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)
R1 ccSet_NST; C:\Windows\system32\drivers\NSTx64\7DE07060.00F\ccSetx64.sys [162392 2013-09-27] (Symantec Corporation)
S3 CEDRIVER60; C:\Program Files (x86)\Cheat Engine 6.3\dbk64.sys [64480 2013-06-02] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-02-12] (Disc Soft Ltd)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [487216 2014-12-11] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142640 2014-12-11] (Symantec Corporation)
R1 IDSVia64; C:\Program Files (x86)\Norton AntiVirus\NortonData\21.1.0.18\Definitions\IPSDefs\20141212.002\IDSvia64.sys [637656 2014-11-18] (Symantec Corporation)
R3 NAVENG; C:\Program Files (x86)\Norton AntiVirus\NortonData\21.1.0.18\Definitions\VirusDefs\20141215.016\ENG64.SYS [129752 2014-08-21] (Symantec Corporation)
R3 NAVEX15; C:\Program Files (x86)\Norton AntiVirus\NortonData\21.1.0.18\Definitions\VirusDefs\20141215.016\EX64.SYS [2137304 2014-08-21] (Symantec Corporation)
R1 NetworkX; C:\Windows\system32\ckldrv.sys [28664 2008-03-17] ()
S3 RTCore64; C:\Program Files (x86)\MSI Afterburner\RTCore64.sys [13368 2013-01-23] ()
R1 SRTSP; C:\Windows\System32\Drivers\NAVx64\1506000.020\SRTSP64.SYS [876248 2014-08-26] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NAVx64\1506000.020\SRTSPX64.SYS [37592 2014-08-26] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NAVx64\1506000.020\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NAVx64\1506000.020\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-01-27] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NAVx64\1506000.020\Ironx64.SYS [266968 2014-08-06] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NAVx64\1506000.020\SYMNETS.SYS [593112 2014-02-18] (Symantec Corporation)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 WinRing0_1_2_0; \??\E:\AppData\Local\Temp\tmpEF4D.tmp [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-16 22:19 - 2014-12-16 22:19 - 00015861 _____ () C:\Users\user\Desktop\FRST.txt
2014-12-16 22:18 - 2014-12-16 22:19 - 00000000 ____D () C:\FRST
2014-12-16 22:18 - 2014-12-16 22:18 - 02119168 _____ (Farbar) C:\Users\user\Desktop\FRST64.exe
2014-12-16 22:17 - 2014-12-16 22:17 - 00000000 _____ () C:\Users\user\defogger_reenable
2014-12-12 03:15 - 2014-12-12 03:15 - 00000000 ____D () C:\Windows\system32\appraiser
2014-12-12 03:00 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-12-12 03:00 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2014-12-11 03:42 - 2014-12-04 03:50 - 00830976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2014-12-11 03:42 - 2014-12-04 03:50 - 00741376 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2014-12-11 03:42 - 2014-12-04 03:50 - 00413184 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-12-11 03:42 - 2014-12-04 03:50 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2014-12-11 03:42 - 2014-12-04 03:50 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-12-11 03:42 - 2014-12-04 03:50 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2014-12-11 03:42 - 2014-12-04 03:44 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-12-11 03:42 - 2014-12-02 00:28 - 01232040 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2014-12-11 03:42 - 2014-11-27 02:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-12-11 03:42 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-12-11 03:42 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-12-11 03:42 - 2014-11-22 04:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-12-11 03:42 - 2014-11-22 04:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-12-11 03:42 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-12-11 03:42 - 2014-11-22 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-12-11 03:42 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-12-11 03:42 - 2014-11-22 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-12-11 03:42 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-12-11 03:42 - 2014-11-22 03:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-12-11 03:42 - 2014-11-22 03:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-12-11 03:42 - 2014-11-22 03:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-12-11 03:42 - 2014-11-22 03:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-11 03:42 - 2014-11-22 03:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-12-11 03:42 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-12-11 03:42 - 2014-11-22 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-12-11 03:42 - 2014-11-22 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-11 03:42 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-12-11 03:42 - 2014-11-22 03:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-12-11 03:42 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-12-11 03:42 - 2014-11-22 03:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-11 03:42 - 2014-11-22 03:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-12-11 03:42 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-12-11 03:42 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-12-11 03:42 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-12-11 03:42 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-12-11 03:42 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-12-11 03:42 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-12-11 03:42 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-12-11 03:42 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-12-11 03:42 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-12-11 03:42 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-12-11 03:42 - 2014-11-22 02:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-12-11 03:42 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-12-11 03:42 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-12-11 03:42 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-12-11 03:42 - 2014-11-22 02:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-12-11 03:42 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-12-11 03:42 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-12-11 03:42 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-12-11 03:42 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-12-11 03:42 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-12-11 03:42 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-12-11 03:42 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-12-11 03:42 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-12-11 03:42 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-12-11 03:42 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-12-11 03:42 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-12-11 03:42 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-12-11 03:42 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-12-11 03:42 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-12-11 03:42 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-12-11 03:42 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-12-11 03:42 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-12-11 03:42 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-12-11 03:42 - 2014-11-11 04:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-12-11 03:42 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-12-11 03:42 - 2014-11-11 02:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2014-12-11 03:41 - 2014-11-08 04:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-12-11 03:41 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-12-11 03:41 - 2014-10-30 03:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2014-12-11 03:41 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe
2014-12-11 03:41 - 2014-10-03 03:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-12-11 03:41 - 2014-10-03 03:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2014-12-11 03:41 - 2014-10-03 03:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2014-12-11 03:41 - 2014-10-03 03:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2014-12-11 03:41 - 2014-10-03 03:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2014-12-11 03:41 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2014-12-11 03:41 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll
2014-12-11 03:41 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2014-12-11 03:41 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll
2014-12-11 03:41 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe
2014-12-08 19:46 - 2014-12-08 19:46 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-08 19:46 - 2014-12-08 19:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-12-08 19:46 - 2014-12-08 19:46 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-08 19:46 - 2014-12-08 19:46 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-12-08 19:46 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-08 19:46 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-12-08 19:46 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-12-08 19:41 - 2014-12-08 19:41 - 00000112 _____ () C:\Windows\system32\snetcfg.log
2014-12-08 19:40 - 2014-12-08 19:41 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-12-03 19:09 - 2014-12-03 19:20 - 00000825 _____ () C:\Users\Public\Desktop\South Park - The Stick of Truth.lnk
2014-12-03 19:09 - 2014-12-03 19:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\South Park - The Stick of Truth
2014-11-19 11:58 - 2014-11-19 11:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III Public Test
2014-11-19 08:40 - 2014-11-11 04:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-11-19 08:40 - 2014-11-11 04:08 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2014-11-19 08:40 - 2014-11-11 03:44 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-11-19 08:40 - 2014-11-11 03:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-16 22:19 - 2009-07-14 05:45 - 00032080 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-16 22:19 - 2009-07-14 05:45 - 00032080 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-16 22:18 - 2011-04-12 08:43 - 00699092 _____ () C:\Windows\system32\perfh007.dat
2014-12-16 22:18 - 2011-04-12 08:43 - 00149232 _____ () C:\Windows\system32\perfc007.dat
2014-12-16 22:18 - 2009-07-14 06:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-16 22:15 - 2014-01-26 13:24 - 01187886 _____ () C:\Windows\WindowsUpdate.log
2014-12-16 22:12 - 2014-06-26 18:37 - 00006944 _____ () C:\Windows\error.log
2014-12-16 22:12 - 2014-01-26 23:51 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-12-16 22:12 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-16 22:12 - 2009-07-14 05:51 - 00208840 _____ () C:\Windows\setupact.log
2014-12-16 22:11 - 2014-06-26 18:37 - 00002969 _____ () C:\Windows\errord.log
2014-12-16 22:11 - 2014-01-27 00:29 - 00000000 ____D () C:\AdwCleaner
2014-12-16 22:11 - 2010-11-21 04:47 - 00198490 _____ () C:\Windows\PFRO.log
2014-12-16 22:10 - 2014-01-27 00:02 - 00000000 ____D () C:\Users\user\AppData\Roaming\Skype
2014-12-16 22:02 - 2014-01-30 20:25 - 00000000 ____D () C:\Users\user\AppData\Roaming\vlc
2014-12-16 22:01 - 2014-01-27 20:58 - 00000000 ____D () C:\Users\user\Desktop\Neuer Ordner
2014-12-16 21:38 - 2014-01-26 23:51 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-12-12 03:41 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-12-12 03:15 - 2014-05-07 02:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-12-12 03:15 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-12-12 03:15 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2014-12-08 19:52 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\Offline Web Pages
2014-12-08 19:43 - 2014-07-29 10:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Takatis - A Tribute To Manfred Trenz
2014-12-08 19:43 - 2014-07-29 10:58 - 00000000 ____D () C:\Program Files\Takatis - A Tribute To Manfred Trenz
2014-12-08 19:42 - 2014-08-23 08:22 - 00000000 ____D () C:\Program Files (x86)\Rockstar Games
2014-12-08 19:42 - 2014-06-26 18:37 - 00000127 _____ () C:\Windows\Crypkey.ini
2014-12-08 19:41 - 2014-11-05 21:52 - 00000000 ____D () C:\Program Files\FRITZ!Fernzugang
2014-12-08 19:40 - 2014-07-12 17:06 - 00000000 ____D () C:\Program Files (x86)\ASUS
2014-12-08 19:40 - 2014-01-26 13:46 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-12-08 19:40 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Public\Libraries
2014-12-03 19:21 - 2014-01-26 15:10 - 00000000 ____D () C:\Users\user\Documents\My Games
2014-12-03 19:10 - 2014-02-15 12:13 - 00000000 ____D () C:\Windows\SysWOW64\directx
2014-12-03 19:10 - 2014-01-26 14:55 - 00000000 ____D () C:\TEMP
2014-11-23 15:09 - 2014-03-01 15:12 - 00000898 _____ () C:\Users\user\Desktop\Diablo III.lnk

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-15 03:29

==================== End Of Log ============================

Addition:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 14-12-2014 01
Ran by user at 2014-12-16 22:19:35
Running from C:\Users\user\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Norton AntiVirus (Enabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}
AS: Norton AntiVirus (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-2826055049-857224148-3662155922-1000\...\uTorrent) (Version: 3.4.2.32239 - BitTorrent Inc.)
Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.176 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
AIMP3 (HKLM-x32\...\AIMP3) (Version: v3.55.1338, 31.01.2014 - AIMP DevTeam)
Archeage (HKLM-x32\...\Glyph Archeage) (Version:  - Trion Worlds, Inc.)
Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.4.5.0 - Asmedia Technology)
Audiosurf (HKLM-x32\...\Steam App 12900) (Version:  - Dylan Fitterer)
calibre (HKLM-x32\...\{3FABD0E8-EEEF-4BB9-BA19-2D73F5D8D3FA}) (Version: 1.46.0 - Kovid Goyal)
calibre 64bit (HKLM\...\{50A398DA-4562-40AA-9535-0A14C4AB1DD9}) (Version: 1.21.0 - Kovid Goyal)
Cheat Engine 6.3 (HKLM-x32\...\Cheat Engine 6.3_is1) (Version:  - Cheat Engine)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.48.1.0347 - Disc Soft Ltd)
Diablo III Public Test (HKLM-x32\...\Diablo III Public Test) (Version:  - Blizzard Entertainment)
Dir-It! (HKLM-x32\...\{E3ED49BB-0544-4844-B296-6A0CB28E7BE3}) (Version: 4.02.0000 - Wirth IT Design)
Empire Earth III (HKLM-x32\...\{B17E235C-7A3B-4482-B650-21FFDE1D452E}) (Version: 1.00.0000 - Sierra Entertainment)
Glyph (HKLM-x32\...\Glyph) (Version:  - Trion Worlds, Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.95 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
GPU Temp version 1.0 (HKLM-x32\...\{8C8711FD-0FC8-4801-B33E-ED19BB0350B1}_is1) (Version: 1.0 - gputemp.com)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217055FF}) (Version: 7.0.710 - Oracle)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
JDownloader 2 (HKLM\...\jdownloader2-1) (Version: 2.0 - AppWork GmbH)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
marvell 91xx driver (HKLM-x32\...\MagniDriver) (Version: 1.0.0.1051 - Marvell)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022.218 (HKLM\...\{BBBE35B2-9349-3C48-BD3D-F574B17C7924}) (Version: 9.0.21022.218 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)
Mozilla Firefox 27.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 27.0 (x86 de)) (Version: 27.0 - Mozilla)
MSI Afterburner 2.3.1 (HKLM-x32\...\Afterburner) (Version: 2.3.1 - MSI Co., LTD)
Norton AntiVirus (HKLM-x32\...\NAV) (Version: 21.6.0.32 - Symantec Corporation)
Norton Identity Safe (HKLM-x32\...\NST) (Version: 2014.7.6.15 - Symantec Corporation)
NVIDIA 3D Vision Controller-Treiber 285.62 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 285.62 - NVIDIA Corporation)
NVIDIA Grafiktreiber 285.62 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 285.62 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.2.24.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.2.24.0 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
QIP 2012 4.0.9354 (HKU\S-1-5-21-2826055049-857224148-3662155922-1000\...\QIP 2012) (Version: 4.0.9354 - )
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.37.1229.2010 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7083 - Realtek Semiconductor Corp.)
Recuva (HKLM\...\Recuva) (Version: 1.51 - Piriform)
SAMSUNG Android USB Modem Software (HKLM\...\SAMSUNG Android USB Modem) (Version: V5.28.2.1 - )
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.43.0 - SAMSUNG Electronics Co., Ltd.)
Skype™ 6.21 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.21.104 - Skype Technologies S.A.)
South Park - The Stick of Truth Version 1.0 u3 (HKLM-x32\...\South Park - The Stick of Truth_is1) (Version: 1.0 u3 - Ubisoft)
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.32494 - TeamViewer)
The Elder Scrolls V Skyrim - Legendary Edition (Game of the Year) Deutsche Version 1.9.32.0.8 (HKLM-x32\...\The Elder Scrolls V Skyrim - Legendary Edition (Game of the Year) Deutsche Version 1.9.32.0.8) (Version: 1.9.32.0.8 - .x.X.RIDDICK.X.x.)
Unity Web Player (HKU\S-1-5-21-2826055049-857224148-3662155922-1000\...\UnityWebPlayer) (Version: 4.5.2f1 - Unity Technologies ApS)
VideoPad Video Editor (HKLM-x32\...\VideoPad) (Version: 3.29 - NCH Software)
VLC media player 2.1.2 (HKLM-x32\...\VLC media player) (Version: 2.1.2 - VideoLAN)
Winamp (HKLM-x32\...\Winamp) (Version: 5.666  - Nullsoft, Inc)
Windows Phone app for desktop (HKLM-x32\...\{19773614-FC22-4ACC-AAA3-E6BDA81ACF92}) (Version: 1.1.2726.0 - Microsoft Corporation)
WinRAR 4.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.01.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

28-11-2014 06:28:53 Geplanter Prüfpunkt
08-12-2014 18:39:54 Removed FAN Xpert 2
08-12-2014 18:40:02 Removed AI Suite II
08-12-2014 18:40:26 Removed BlueStacks Notification Center
08-12-2014 18:41:29 FRITZ!Fernzugang wird entfernt
08-12-2014 18:42:35 Entfernt RollerCoaster Tycoon 2
12-12-2014 02:00:10 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0591BF04-56AE-41BA-B454-C64118CEE3C9} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-01-26] (Google Inc.)
Task: {146BF5CB-7D5F-4A10-9447-7EE8511569A9} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2014-03-19] (Microsoft)
Task: {2C218483-DF01-4BD1-9C2F-687081D6F24E} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {414792B2-1207-4BAD-873E-45690B7E92E4} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton AntiVirus\Engine\21.6.0.32\WSCStub.exe [2014-09-21] (Symantec Corporation)
Task: {5BF95CA4-A360-4965-9603-BE16D7E16997} - System32\Tasks\Norton AntiVirus\Norton Error Processor => C:\Program Files (x86)\Norton AntiVirus\Engine\21.6.0.32\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {7DDEE4E6-5C01-4AAD-B815-EA44C8983C62} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {832CD1D4-4085-4B5D-A280-5C6BABD2C736} - System32\Tasks\Norton Identity Safe\Norton Error Processor => C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.6.15\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {958B8A46-3C26-4BA4-B271-5DE6BF786A6F} - System32\Tasks\{75FBD970-E89D-4BDC-9795-D9FF709E9EFC} => Chrome.exe hxxp://ui.skype.com/ui/0/6.16.0.105/de/go/help.faq.installer?LastError=1603
Task: {B5675848-D8B6-4678-B14F-1DAEA9E2086C} - System32\Tasks\Norton AntiVirus\Norton Error Analyzer => C:\Program Files (x86)\Norton AntiVirus\Engine\21.6.0.32\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {C52B02EC-7388-4069-A7F8-28197F9C3BA1} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {C7F4FAD7-E1CC-4BC4-9CF8-5F31FA5585B1} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {D075492B-56A4-41EF-B54D-E952C74845D2} - System32\Tasks\Norton Identity Safe\Norton Error Analyzer => C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.6.15\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {D6ECF808-3298-4816-9937-01FEAAC93A07} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-01-26] (Google Inc.)
Task: {E6A2F764-3AC1-404F-8223-0AAC174699E0} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-07-12 17:06 - 2012-06-01 16:42 - 00920736 _____ () C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe
2014-01-26 14:58 - 2011-05-28 22:05 - 00164864 _____ () C:\Program Files\WinRAR\rarext.dll
2014-07-12 17:06 - 2014-12-16 22:12 - 00023552 _____ () C:\Program Files (x86)\ASUS\AXSP\1.00.19\PEbiosinterface32.dll
2014-07-12 17:06 - 2010-06-29 09:58 - 00104448 _____ () C:\Program Files (x86)\ASUS\AXSP\1.00.19\ATKEX.dll
2014-12-16 22:13 - 2014-12-16 22:13 - 00014336 _____ () E:\AppData\Local\Temp\WDE77FC.tmp\ml_online.lng
2014-12-16 22:13 - 2014-12-16 22:13 - 00036352 _____ () E:\AppData\Local\Temp\WDE77FC.tmp\ombrowser.lng
2014-12-11 22:40 - 2014-12-06 02:50 - 01077064 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\libglesv2.dll
2014-12-11 22:40 - 2014-12-06 02:50 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\libegl.dll
2014-12-11 22:40 - 2014-12-06 02:50 - 09009480 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\pdf.dll
2014-12-11 22:40 - 2014-12-06 02:50 - 01677128 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\ffmpegsumo.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: BDESVC => 3
MSCONFIG\Services: bthserv => 3
MSCONFIG\Services: defragsvc => 3
MSCONFIG\Services: ehRecvr => 3
MSCONFIG\Services: ehSched => 3
MSCONFIG\Services: Fax => 3
MSCONFIG\Services: SDRSVC => 3
MSCONFIG\Services: SysMain => 2
MSCONFIG\Services: TabletInputService => 3
MSCONFIG\Services: WbioSrvc => 3
MSCONFIG\Services: Wlansvc => 3
MSCONFIG\Services: WMPNetworkSvc => 3
MSCONFIG\Services: WPCSvc => 3
MSCONFIG\Services: WPDBusEnum => 3
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: BCSSync => "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
MSCONFIG\startupreg: BlueStacks Agent => C:\Program Files (x86)\BlueStacks\HD-Agent.exe
MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: MurGee.com Auto Keyboard => C:\ProgramData\Auto Keyboard\AutoKeyboard.exe :silent
MSCONFIG\startupreg: NoIPDUCv4 => "C:\Program Files (x86)\No-IP\DUC40.exe" /minimize
MSCONFIG\startupreg: QIP Internet Guardian => C:\Users\user\AppData\Roaming\QipGuard\QipGuard.exe /p

========================= Accounts: ==========================

Administrator (S-1-5-21-2826055049-857224148-3662155922-500 - Administrator - Disabled)
Gast (S-1-5-21-2826055049-857224148-3662155922-501 - Limited - Disabled)
UpdatusUser (S-1-5-21-2826055049-857224148-3662155922-1001 - Limited - Enabled) => C:\Users\UpdatusUser
user (S-1-5-21-2826055049-857224148-3662155922-1000 - Administrator - Enabled) => C:\Users\user

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (12/16/2014 10:13:50 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/12/2014 03:18:21 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/08/2014 07:54:10 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/08/2014 07:45:58 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/08/2014 07:37:14 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/08/2014 07:35:35 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.IO.FileNotFoundException: Die Datei "F:\Archive\BlueStacks\Android\Root.fs" konnte nicht gefunden werden.
Dateiname: "F:\Archive\BlueStacks\Android\Root.fs"
   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Error: (12/03/2014 07:10:57 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: South Park - The Stick of Truth.exe, Version: 1.0.0.0, Zeitstempel: 0x533903ee
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x53159a86
Ausnahmecode: 0xc06d007e
Fehleroffset: 0x0000c42d
ID des fehlerhaften Prozesses: 0x16d0
Startzeit der fehlerhaften Anwendung: 0xSouth Park - The Stick of Truth.exe0
Pfad der fehlerhaften Anwendung: South Park - The Stick of Truth.exe1
Pfad des fehlerhaften Moduls: South Park - The Stick of Truth.exe2
Berichtskennung: South Park - The Stick of Truth.exe3

Error: (11/23/2014 02:47:18 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Diablo III.exe, Version 2.1.1.27255 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1420

Startzeit: 01d007235768baa7

Endzeit: 20

Anwendungspfad: G:\Diablo III\Diablo III.exe

Berichts-ID: 3b425a15-7317-11e4-bdfa-f46d042c12dd

Error: (11/20/2014 03:17:50 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/20/2014 03:16:14 AM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.IO.FileNotFoundException: Die Datei "F:\Archive\BlueStacks\Android\Root.fs" konnte nicht gefunden werden.
Dateiname: "F:\Archive\BlueStacks\Android\Root.fs"
   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)


System errors:
=============
Error: (12/16/2014 10:11:54 PM) (Source: volmgr) (EventID: 46) (User: )
Description: Die Initialisierung des Speicherabbildes ist fehlgeschlagen.

Error: (12/16/2014 10:05:08 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "TeamViewer 9" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 2000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (12/16/2014 10:04:59 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "SAMSUNG Mobile Connectivity Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (12/16/2014 10:04:48 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Crypkey License" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (12/16/2014 10:04:39 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "AsusFanControlService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (12/12/2014 03:16:25 AM) (Source: volmgr) (EventID: 46) (User: )
Description: Die Initialisierung des Speicherabbildes ist fehlgeschlagen.

Error: (12/08/2014 07:52:14 PM) (Source: volmgr) (EventID: 46) (User: )
Description: Die Initialisierung des Speicherabbildes ist fehlgeschlagen.

Error: (12/08/2014 07:49:24 PM) (Source: atapi) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort4 gefunden.

Error: (12/08/2014 07:49:10 PM) (Source: atapi) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort4 gefunden.

Error: (12/08/2014 07:44:02 PM) (Source: volmgr) (EventID: 46) (User: )
Description: Die Initialisierung des Speicherabbildes ist fehlgeschlagen.


Microsoft Office Sessions:
=========================
Error: (12/16/2014 10:13:50 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/12/2014 03:18:21 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/08/2014 07:54:10 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/08/2014 07:45:58 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/08/2014 07:37:14 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/08/2014 07:35:35 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.IO.FileNotFoundException: Die Datei "F:\Archive\BlueStacks\Android\Root.fs" konnte nicht gefunden werden.
Dateiname: "F:\Archive\BlueStacks\Android\Root.fs"
   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Error: (12/03/2014 07:10:57 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: South Park - The Stick of Truth.exe1.0.0.0533903eeKERNELBASE.dll6.1.7601.1840953159a86c06d007e0000c42d16d001d00f247b1abe56G:\South Park - The Stick of Truth\South Park - The Stick of Truth.exeC:\Windows\syswow64\KERNELBASE.dllba151373-7b17-11e4-bdfa-f46d042c12dd

Error: (11/23/2014 02:47:18 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Diablo III.exe2.1.1.27255142001d007235768baa720G:\Diablo III\Diablo III.exe3b425a15-7317-11e4-bdfa-f46d042c12dd

Error: (11/20/2014 03:17:50 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/20/2014 03:16:14 AM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.IO.FileNotFoundException: Die Datei "F:\Archive\BlueStacks\Android\Root.fs" konnte nicht gefunden werden.
Dateiname: "F:\Archive\BlueStacks\Android\Root.fs"
   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)


CodeIntegrity Errors:
===================================
  Date: 2014-05-24 20:26:48.597
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\sxs.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-17 17:31:45.496
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\sxs.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-16 15:38:50.450
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\sxs.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-12 23:00:21.231
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\sxs.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-12 22:59:16.527
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\sxs.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-12 22:57:13.861
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\sxs.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-12 18:33:20.133
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\sxs.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-12 12:44:28.231
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\sxs.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-12 07:48:00.936
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\sxs.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-07 22:36:49.194
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\sxs.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-2500K CPU @ 3.30GHz
Percentage of memory in use: 19%
Total physical RAM: 12264.87 MB
Available physical RAM: 9888.72 MB
Total Pagefile: 12263.05 MB
Available Pagefile: 9547.45 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:111.69 GB) (Free:24.34 GB) NTFS
Drive e: (Maxtor) (Fixed) (Total:465.76 GB) (Free:176.88 GB) NTFS
Drive f: (HD204UJ) (Fixed) (Total:1863.01 GB) (Free:0.26 GB) NTFS
Drive g: (HD103SJ) (Fixed) (Total:540.88 GB) (Free:211.99 GB) NTFS
Drive h: (HD103SJ) (Fixed) (Total:390.53 GB) (Free:290.68 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: C79FB1BE)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=111.7 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 8E44D164)
Partition 1: (Not Active) - (Size=540.9 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=390.5 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 432DFCD7)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=42)

========================================================
Disk: 3 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: E9C03D2C)
Partition 1: (Not Active) - (Size=1863 GB) - (Type=07 NTFS)

==================== End Of Log ============================

GMER:

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-12-16 22:25:35
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Samsung_SSD_840_EVO_120GB rev.EXT0BB0Q 111,79GB
Running: Gmer-19357.exe; Driver: E:\AppData\Local\Temp\kxldapob.sys


---- User code sections - GMER 2.1 ----

?      C:\Windows\system32\mssprxy.dll [1992] entry point in ".rdata" section                                                                  000000006f8171e6
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17      00000000769a1401 2 bytes JMP 76adb21b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4952] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17        00000000769a1419 2 bytes JMP 76adb346 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17      00000000769a1431 2 bytes JMP 76b58ea9 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42      00000000769a144a 2 bytes CALL 76ab48ad C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                     * 9
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4952] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17         00000000769a14dd 2 bytes JMP 76b587a2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17  00000000769a14f5 2 bytes JMP 76b58978 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4952] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17         00000000769a150d 2 bytes JMP 76b58698 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17  00000000769a1525 2 bytes JMP 76b58a62 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17        00000000769a153d 2 bytes JMP 76acfca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4952] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17             00000000769a1555 2 bytes JMP 76ad68ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17      00000000769a156d 2 bytes JMP 76b58f61 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17        00000000769a1585 2 bytes JMP 76b58ac2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4952] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17           00000000769a159d 2 bytes JMP 76b5865c C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17        00000000769a15b5 2 bytes JMP 76acfd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17      00000000769a15cd 2 bytes JMP 76adb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20  00000000769a16b2 2 bytes JMP 76b58e24 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31  00000000769a16bd 2 bytes JMP 76b585f1 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\user\Desktop\Gmer-19357.exe[1536] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection                                           000000007710fc80 5 bytes JMP 000000010023012a
.text  C:\Users\user\Desktop\Gmer-19357.exe[1536] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                             000000007710fcb0 5 bytes JMP 0000000100230bc2
.text  C:\Users\user\Desktop\Gmer-19357.exe[1536] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory                                           000000007710fe14 5 bytes JMP 0000000100230048
.text  C:\Users\user\Desktop\Gmer-19357.exe[1536] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent                                                    000000007710fea8 5 bytes JMP 0000000100230594
.text  C:\Users\user\Desktop\Gmer-19357.exe[1536] C:\Windows\SysWOW64\ntdll.dll!NtQueueApcThread                                               000000007710ff24 5 bytes JMP 0000000100230e68
.text  C:\Users\user\Desktop\Gmer-19357.exe[1536] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread                                                 0000000077110004 5 bytes JMP 0000000100230758
.text  C:\Users\user\Desktop\Gmer-19357.exe[1536] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                         0000000077110038 5 bytes JMP 0000000100230ca4
.text  C:\Users\user\Desktop\Gmer-19357.exe[1536] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread                                                 0000000077110068 5 bytes JMP 0000000100230d86
.text  C:\Users\user\Desktop\Gmer-19357.exe[1536] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread                                              0000000077110084 5 bytes JMP 0000000100020050
.text  C:\Users\user\Desktop\Gmer-19357.exe[1536] C:\Windows\SysWOW64\ntdll.dll!NtAlertResumeThread                                            00000000771102e8 5 bytes JMP 000000010023020c
.text  C:\Users\user\Desktop\Gmer-19357.exe[1536] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant                                                 000000007711079c 5 bytes JMP 00000001002303d0
.text  C:\Users\user\Desktop\Gmer-19357.exe[1536] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject                                     000000007711088c 5 bytes JMP 00000001002309fe
.text  C:\Users\user\Desktop\Gmer-19357.exe[1536] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx                                               00000000771108a4 2 bytes JMP 000000010023091c
.text  C:\Users\user\Desktop\Gmer-19357.exe[1536] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx + 3                                           00000000771108a7 2 bytes [12, 89]
.text  C:\Users\user\Desktop\Gmer-19357.exe[1536] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver                                                   0000000077110df4 5 bytes JMP 0000000100230676
.text  C:\Users\user\Desktop\Gmer-19357.exe[1536] C:\Windows\SysWOW64\ntdll.dll!NtQueueApcThreadEx                                             00000000771115d4 5 bytes JMP 00000001002302ee
.text  C:\Users\user\Desktop\Gmer-19357.exe[1536] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                             0000000077111920 5 bytes JMP 000000010023083a
.text  C:\Users\user\Desktop\Gmer-19357.exe[1536] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation                                         0000000077111be4 5 bytes JMP 0000000100230ae0
.text  C:\Users\user\Desktop\Gmer-19357.exe[1536] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread                                                0000000077111d70 5 bytes JMP 00000001002304b2
.text  C:\Users\user\Desktop\Gmer-19357.exe[1536] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity + 206                               000000007548524f 7 bytes JMP 00000001003302f4
.text  C:\Users\user\Desktop\Gmer-19357.exe[1536] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA + 380                                   00000000754853d0 7 bytes JMP 00000001003305a0
.text  C:\Users\user\Desktop\Gmer-19357.exe[1536] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 149                                  0000000075485677 7 bytes JMP 00000001003303d8
.text  C:\Users\user\Desktop\Gmer-19357.exe[1536] C:\Windows\SysWOW64\sechost.dll!CreateServiceA + 542                                         000000007548589a 7 bytes JMP 0000000100330048
.text  C:\Users\user\Desktop\Gmer-19357.exe[1536] C:\Windows\SysWOW64\sechost.dll!CreateServiceW + 382                                         0000000075485a1d 7 bytes JMP 0000000100330768
.text  C:\Users\user\Desktop\Gmer-19357.exe[1536] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigW + 370                                    0000000075485c9b 7 bytes JMP 00000001003304bc
.text  C:\Users\user\Desktop\Gmer-19357.exe[1536] C:\Windows\SysWOW64\sechost.dll!ControlServiceExA + 231                                      0000000075485d87 7 bytes JMP 0000000100330684
.text  C:\Users\user\Desktop\Gmer-19357.exe[1536] C:\Windows\SysWOW64\sechost.dll!I_ScBroadcastServiceControlMessage + 123                     0000000075487240 7 bytes JMP 0000000100330210
.text  C:\Users\user\Desktop\Gmer-19357.exe[1536] C:\Windows\syswow64\USER32.dll!RecordShutdownReason + 882                                    0000000076561492 7 bytes JMP 000000010033084c

---- EOF - GMER 2.1 ----

Hier meine Logs:

ADWcleaner:

Code:

ATTFilter

# AdwCleaner v4.105 - Bericht erstellt am 16/12/2014 um 22:09:27
# Aktualisiert 08/12/2014 von Xplode
# Database : 2014-12-13.4 [Live]
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : user - USER-PC
# Gestartet von : F:\AdwCleaner.exe
# Option : Suchen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Datei Gefunden : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.azlyrics.com_0.localstorage
Datei Gefunden : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.azlyrics.com_0.localstorage-journal
Ordner Gefunden : C:\Program Files (x86)\NCH Software
Ordner Gefunden : C:\ProgramData\NCH Software
Ordner Gefunden : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nppllibpnmahfaklnpggkibhkapjkeob
Ordner Gefunden : C:\users\user\AppData\Roaming\NCH Software

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}
Schlüssel Gefunden : HKCU\Software\Mozilla\Extends
Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\nppllibpnmahfaklnpggkibhkapjkeob
Schlüssel Gefunden : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Wpm

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17496


-\\ Mozilla Firefox v27.0 (de)

[vbqa0o53.default] - Zeile gefunden : user_pref("extensions.enabledAddons", "quick_start%40gmail.com:3.2.6,%7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:27.0");

-\\ Google Chrome v39.0.2171.95


-\\ Chromium v


*************************

AdwCleaner[R0].txt - [6365 octets] - [27/01/2014 00:29:23]
AdwCleaner[R1].txt - [7193 octets] - [07/06/2014 08:58:11]
AdwCleaner[R2].txt - [1846 octets] - [16/12/2014 22:09:27]
AdwCleaner[S0].txt - [4137 octets] - [27/01/2014 00:29:48]
AdwCleaner[S1].txt - [5932 octets] - [07/06/2014 08:58:34]

########## EOF - C:\AdwCleaner\AdwCleaner[R2].txt - [2026 octets] ##########

MBAM vom 08.12:

Code:

ATTFilter

<?xml version="1.0" encoding="UTF-16" ?>
<mbam-log>
<header>
<date>2014/12/08 19:46:41 +0100</date>
<logfile>mbam-log-2014-12-08 (19-46-40).xml</logfile>
<isadmin>yes</isadmin>
</header>
<engine>
<version>2.00.4.1028</version>
<malware-database>v2014.12.08.07</malware-database>
<rootkit-database>v2014.12.08.01</rootkit-database>
<license>free</license>
<file-protection>disabled</file-protection>
<web-protection>disabled</web-protection>
<self-protection>disabled</self-protection>
</engine>
<system>
<osversion>Windows 7 Service Pack 1</osversion>
<arch>x64</arch>
<username>user</username>
<filesys>NTFS</filesys>
</system>
<summary>
<type>threat</type>
<result>completed</result>
<objects>366215</objects>
<time>281</time>
<processes>0</processes>
<modules>0</modules>
<keys>2</keys>
<values>1</values>
<datas>1</datas>
<folders>0</folders>
<files>0</files>
<sectors>0</sectors>
</summary>
<options>
<memory>enabled</memory>
<startup>enabled</startup>
<filesystem>enabled</filesystem>
<archives>enabled</archives>
<rootkits>disabled</rootkits>
<deeprootkit>disabled</deeprootkit>
<heuristics>enabled</heuristics>
<pup>enabled</pup>
<pum>enabled</pum>
</options>
<items>
<key><path>HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\IePluginService</path><vendor>PUP.Optional.IEPluginServices.A</vendor><action>success</action><hash>c3a4c799413bca6c7c8c99b38f74e21e</hash></key>
<key><path>HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\IePluginServices</path><vendor>PUP.Optional.IEPluginServices.A</vendor><action>success</action><hash>8adddc84c6b6d85ec3b76ee152b1bf41</hash></key>
<value><path>HKU\S-1-5-21-2826055049-857224148-3662155922-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS</path><valuename>appid</valuename><vendor>PUP.Optional.QuickStart.A</vendor><action>success</action><valuedata>quick_start@gmail.com</valuedata><hash>45227de39fdd3afc265297d143c0e020</hash></value>
<data><path>HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES</path><valuename>DefaultScope</valuename><vendor>PUP.Optional.Qone8</vendor><action>replaced</action><valuedata>{33BB0A4E-99AF-4226-BDF6-49120163DE86}</valuedata><baddata>{33BB0A4E-99AF-4226-BDF6-49120163DE86}</baddata><gooddata>{0633EE93-D776-472f-A0FF-E1416B8B2E3A}</gooddata><hash>fd6a342c0775ec4af4a6bbaac04524dc</hash></data>
</items>
</mbam-log>

Ich hoffe Ihr könnt mir damit schonmal ein wenig weiterhelfen.

Vielen Dank im Voraus !

Laga

schrauber · 16.12.2014, 23:46

hi,

Zitat:

aber ich bin grundsätzlich von dem aktuellen Norton durchaus überzeugt, was Ressourcenmanagement angeht

echt jetzt?

Schon mal Norton in ner Google Suche eingegeben? Wieviele abermillionen von Usern Problem damit haben dass das System lahm gelegt wird?

Hast Du die Funde von AdwCleaner auch löschen lassen? AdwCleaner und MBAM haben nur etwas PUP aufgegriffen. Aber das ist nicht dein Problem. Logs sind unauffällig.

Ich würde jetzt ernsthaft Norton deaktivieren, auch Autostart, rebooten und testen.
Nächster Test wäre ein Clean Boot.

Lagavulin · 17.12.2014, 09:42

Die Funde von ADW und MBAM hab ich gelöscht, war ja "nur" PUP, welche ich auch in einem gewissen Rahmen nachvollziehen konnte, ich bin ein sehr aufmerksamer User und wähle grundsätzlich alles ab, was nicht sein muss, aber gegen alles kann man sich nicht schützen...

Da wäre durchaus das Datum interessant, denn ich habe seit der 2011er Version absolut null Probleme was Geschwindigkeit und Ressourcennutzung angeht. Ich habe auch Kaspersky, G-DATA und Bitdefender getestet (jeweils in der AV Variante) und die wenigste Auslastung hat das Norton erzeugt. G-Data war ziemlich "krass" was den Ressourcenbedarf anging und Kaspersky war auch nur minimal sparsamer. Bitdefender kam "übern Daumen" an Norton ran was Systembelastung angeht, aber von der Bedienung her finde ich das Norton AV wesentlich angenehmer.

Norton hat halt seinen Ruf von "unmöglich deinstallierbarer Softwareballast", aber das liegt mittlerweile viele Jahre zurück und ein erneutes testen der aktuellsten Norton Version sollte wohl drin sein bevor man solche Aussagen trifft:

Zitat:

echt jetzt?
Schon mal Norton in ner Google Suche eingegeben? Wieviele abermillionen von Usern Problem damit haben dass das System lahm gelegt wird?

So, ich habe Norton komplett deinstalliert -> Problem besteht weiterhin.
Autostart komplett deaktiviert -> Problem besteht weiterhin.
Alle Nicht-Microsoft-Dienste beim Systemstart deaktiviert -> Problem besteht weiterhin.

Mir ist auch noch aufgefallen, dass ich im Browser keine Mouse over Anzeige mehr bekomme.

Sehr komisch das Ganze...

schrauber · 17.12.2014, 20:54

Wenn bei nem kompletten Clean Boot das Problem immer noch besteht bleibt ja eigentlich fast nur Windows ansich.

Hast Du mal die Erkennungsraten von Norton verglichen?

Win7 | Scheinbar unsichtbare, überlappende Fenster verhindern Eingabe

Log-Analyse und Auswertung: Win7 | Scheinbar unsichtbare, überlappende Fenster verhindern Eingabe