Sehr geehrtes Trojanerboardteam,

seit geraumer Zeit habe ich ein vermutetes Problem mit meinem Rechner. In unregelmäßigen Abständen ertönen immer wieder die für Windows üblichen Konnektionssignale, welche bei der Einstöpselung/Ausstöpselung von zB USB Sticks auftreten. Hinzu kommt eine unübliche Auslastung der CPU, was jedoch nicht im Process-Explorer angezeigt wird. Man kann sie dennoch an einer deutlichen Lärmsteigerung des Rechners und einer Verlangsamung von ausgeführten Prozessen beobachten. Bei diesem Ein-/Ausstöpselungs-Geräusch ändert sich teilweise die Anzahl der Ordner im Explorer. Im Process-Explorer finden sich immer wieder koreanische und chinesische Prozesse [erkennbar an der Beschriftung], welche nur kurzzeitig auftauchen und dann wieder verschwinden. All diese Probleme treten, mit Linux gebootet, nicht auf.


Defogger:

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 14:24 on 10/02/2015 (**********)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-


FRST:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-02-2015
Ran by ********** (administrator) on **********-PC on 10-02-2015 14:47:02
Running from D:\AV Software
Loaded Profiles: ********** (Available profiles: ********** & Standart)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(CyberGhost S.R.L) C:\Program Files\CyberGhost 5\Service.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Jumping Bytes) D:\Programm Downloads\Daten Synchronisator\PureSync\PureSyncTray.exe
(Valve Corporation) D:\Programm Downloads\Steam\Steam.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(Valve Corporation) D:\Programm Downloads\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [VX3000] => C:\Windows\vVX3000.exe
HKLM-x32\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2439072 2010-05-24] (VIA)
HKLM-x32\...\Run: [AVP] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe [356128 2013-10-09] (Kaspersky Lab ZAO)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-07-23] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [KidKey] => E:\Programme\KidKey\kidkey.exe
HKLM-x32\...\Run: [SunJavaUpdateSched] => "D:\Programm Downloads\Java\bin\jusched.exe"
HKU\S-1-5-21-3638779592-2612922094-3528985903-1000\...\Run: [RGSC] => E:\Programme\Rockstar Games Social Club\RGSCLauncher.exe /silent
HKU\S-1-5-21-3638779592-2612922094-3528985903-1000\...\Run: [Corel Photo Downloader] => "c:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
HKU\S-1-5-21-3638779592-2612922094-3528985903-1000\...\Run: [PureSync] => D:\Programm Downloads\Daten Synchronisator\PureSync\PureSyncTray.exe [906928 2013-12-20] (Jumping Bytes)
HKU\S-1-5-21-3638779592-2612922094-3528985903-1000\...\Run: [CyberGhost] => C:\Program Files\CyberGhost 5\CyberGhost.EXE [410216 2014-11-03] (CyberGhost S.R.L.)
HKU\S-1-5-21-3638779592-2612922094-3528985903-1000\...\Run: [Steam] => D:\Programm Downloads\Steam\steam.exe [1942720 2015-01-23] (Valve Corporation)
HKU\S-1-5-21-3638779592-2612922094-3528985903-1000\...\RunOnce: [Uninstall C:\Users\**********\AppData\Local\Microsoft\SkyDrive\17.0.4023.1211\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\**********\AppData\Local\Microsoft\SkyDrive\17.0.4023.1211\amd64"
HKU\S-1-5-21-3638779592-2612922094-3528985903-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-3638779592-2612922094-3528985903-1000\...\Policies\system: [DisableClock] 0
HKU\S-1-5-21-3638779592-2612922094-3528985903-1000\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-3638779592-2612922094-3528985903-1000\...\Policies\Explorer: [NoFind] 0
HKU\S-1-5-21-3638779592-2612922094-3528985903-1000\...\MountPoints2: {93e62f1f-6b26-11e0-9191-806e6f6e6963} - F:\TBG_Setup.exe
HKU\S-1-5-21-3638779592-2612922094-3528985903-1000\...\MountPoints2: {b997ff12-a7ff-11e0-8f20-20cf30e83341} - K:\LaunchU3.exe -a
HKU\S-1-5-18\...\Run: [Skype] => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
IFEO: [Debugger] logonui.exe
IFEO\taskmgr.exe: [Debugger] "D:\PROGRAMM DOWNLOADS\PROCESSEXPLORER\PROCEXP.EXE"
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk
ShortcutTarget: vpngui.exe.lnk -> C:\Windows\Installer\{467D5E81-8349-4892-9E81-C3674ED8E451}\Icon09DB8A851.exe ()
Startup: C:\Users\**********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Digitaluhr.exe.lnk
ShortcutTarget: Digitaluhr.exe.lnk -> E:\4. Programme\Digital Uhr\Digitaluhr\Digitaluhr.exe ()
Startup: C:\Users\**********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3638779592-2612922094-3528985903-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3638779592-2612922094-3528985903-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKU\S-1-5-21-3638779592-2612922094-3528985903-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> D:\Programm Downloads\Java\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\**********\AppData\Roaming\Mozilla\Firefox\Profiles\sla7vx9a.default
FF DefaultSearchEngine: Wikipedia (de)
FF Homepage: https://search.disconnect.me/
FF NetworkProxy: "autoconfig_url", "data:text/javascript,function%20FindProxyForURL(url%2C%20host)%20%7Bif%20(shExpMatch(url%2C%20'http%3A%2F%2Fwww.rdio.com*')%20%7C%7C%20shExpMatch(url%2C%20'http %3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.iheart.com*')%20%7C%7C%2 0(url.indexOf('proxmate%3Dactive')%20!%3D%20-1%20%26%26%20url.indexOf('amazonaws.com')%20%3D%3D%20-1)%20%7C%7C%20(url.indexOf('proxmate%3Dus')%20!%3D%20-1)%20%7C%7C%20url.indexOf('southparkstudios.com')%20!%3D%20-1%20%7C%7C%20url.indexOf('vevo.com')%20!%3D%20-1%20%7C%7C%20host%20%3D%3D%20'www.pandora.com'%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F% 2Fext.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Faccount.beatsmusic.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.beatsmusic.c om*')%20%7C%7C%20url.indexOf('discoverymedia.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fdsc.discovery.com%2F*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.mtv.com*')%20%7C%7C%20shExpMat ch(url%2C%20'http%3A%2F%2Fmedia.mtvnservices.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20 'https%3A%2F%2Fsecure.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fgrooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fr etro.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fhtml5.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Flisten.groo veshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpreview.grooveshark.co m*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shE xpMatch(url%2C%20'https%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20host%20%3D%3D%20's.hulu. com'%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fsongza.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fnew.songza.com*')%20%7C%7C%20shExpMatch(u rl%2C%20'https%3A%2F%2Fwww.daisuki.net*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.crunchyroll.com*')%20%7C%7C%20url.indexOf('play.google.com' )%20!%3D%20-1%20%7C%7C%20(url.indexOf('youtube.com%2Fvideoplayback')%20!%3D%20-1%20%26%26%20url.indexOf('%26gcr%3Dus')%20!%3D%20-1%20%26%26%20url.indexOf('%26ptchn')%20!%3D%20-1))%20%7B%20return%20'PROXY%20us06.sq.proxmate.me%3A8000%3B%20PROXY%20us05.sq.proxmate.me%3A8000%3B%20PROXY%20us07.sq.proxmate.me%3A8000%3B%20PROXY%20 us01.sq.proxmate.me%3A8000%3B%20PROXY%20us02.sq.proxmate.me%3A8000%3B%20PROXY%20us11.sq.proxmate.me%3A8000%3B%20PROXY%20us03.sq.proxmate.me%3A8000%3B% 20PROXY%20us04.sq.proxmate.me%3A8000%3B%20PROXY%20us10.sq.proxmate.me%3A8000%3B%20PROXY%20us09.sq.proxmate.me%3A8000%3B%20PROXY%20us08.sq.proxmate.me% 3A8000'%3B%7D%20%20else%20%7B%20return%20'DIRECT'%3B%20%7D%7D"
FF NetworkProxy: "backup.ftp", "202.171.253.74"
FF NetworkProxy: "backup.ftp_port", 85
FF NetworkProxy: "backup.socks", "202.171.253.74"
FF NetworkProxy: "backup.socks_port", 85
FF NetworkProxy: "backup.ssl", "202.171.253.74"
FF NetworkProxy: "backup.ssl_port", 85
FF NetworkProxy: "ftp", "218.204.77.132"
FF NetworkProxy: "ftp_port", 8123
FF NetworkProxy: "http", "218.204.77.132"
FF NetworkProxy: "http_port", 8123
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "218.204.77.132"
FF NetworkProxy: "socks_port", 8123
FF NetworkProxy: "socks_remote_dns", true
FF NetworkProxy: "ssl", "218.204.77.132"
FF NetworkProxy: "ssl_port", 8123
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.2.0-rc2 -> D:\Programm Downloads\VLC Player\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> D:\Programm Downloads\Java\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> D:\Programm Downloads\Java\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKU\S-1-5-21-3638779592-2612922094-3528985903-1000: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Extension: StumbleUpon - C:\Users\**********\AppData\Roaming\Mozilla\Firefox\Profiles\sla7vx9a.default\Extensions\toolbar@stumbleupon.com [2011-12-02]
FF Extension: DownloadHelper - C:\Users\**********\AppData\Roaming\Mozilla\Firefox\Profiles\sla7vx9a.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-09-05]
FF Extension: Block site - C:\Users\**********\AppData\Roaming\Mozilla\Firefox\Profiles\sla7vx9a.default\Extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc} [2013-12-16]
FF Extension: Cryptocat - C:\Users\**********\AppData\Roaming\Mozilla\Firefox\Profiles\sla7vx9a.default\Extensions\cryptocat@crypto.cat.xpi [2014-01-05]
FF Extension: Firebug - C:\Users\**********\AppData\Roaming\Mozilla\Firefox\Profiles\sla7vx9a.default\Extensions\firebug@software.joehewitt.com.xpi [2014-09-25]
FF Extension: RequestPolicy - C:\Users\**********\AppData\Roaming\Mozilla\Firefox\Profiles\sla7vx9a.default\Extensions\requestpolicy@requestpolicy.com.xpi [2014-11-25]
FF Extension: Quick Translator - C:\Users\**********\AppData\Roaming\Mozilla\Firefox\Profiles\sla7vx9a.default\Extensions\{5C655500-E712-41e7-9349-CE462F844B19}.xpi [2014-11-25]
FF Extension: NoScript - C:\Users\**********\AppData\Roaming\Mozilla\Firefox\Profiles\sla7vx9a.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-10-24]
FF Extension: LeechBlock - C:\Users\**********\AppData\Roaming\Mozilla\Firefox\Profiles\sla7vx9a.default\Extensions\{a95d8332-e4b4-6e7f-98ac-20b733364387}.xpi [2013-12-16]
FF Extension: Adblock Edge - C:\Users\**********\AppData\Roaming\Mozilla\Firefox\Profiles\sla7vx9a.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2014-10-21]
FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\FFExt\url_advisor@kaspersky.com [2013-06-12]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\FFExt\virtual_keyboard@kaspersky.com [2013-06-12]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\FFExt\content_blocker@kaspersky.com [2013-06-12]
StartMenuInternet: FIREFOX.EXE - E:\4. Programme\Firefox\firefox.exe

Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\ChromeExt\urladvisor.crx [2012-08-17]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\ChromeExt\content_blocker_chrome.crx [2012-08-17]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\ChromeExt\virtkbd.crx [2012-08-17]
CHR HKLM-x32\...\Chrome\Extension: [lpoimibckejjdjcfbdnajaicnklhfplh] - https://chrome.google.com/webstore/detail/lpoimibckejjdjcfbdnajaicnklhfplh [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [pgifblbjgdjhcelbanblbhkhmbnnmhfg] - C:\Users\**********\AppData\LocalLow\StumbleUpon\CHROME\StumbleUpon.crx [2011-11-22]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe [356128 2013-10-09] (Kaspersky Lab ZAO)
R2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64616 2014-11-03] (CyberGhost S.R.L)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2449592 2014-11-12] (Microsoft Corporation)
S4 hasplms; C:\Windows\system32\hasplms.exe [3750400 2009-12-16] (SafeNet Inc.)
S3 StumbleUponUpdater; C:\Users\**********\AppData\LocalLow\StumbleUpon\IE\StumbleUponUpdater.exe [18432 2011-11-22] () [File not signed]
S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)
S2 CVPND; "E:\4 Programme\VPN Client - FSU Jena\VPN Client 64 Bit\cvpnd.exe" [X]
S2 MSCamSvc; "C:\Program Files\Microsoft LifeCam\MSCamS64.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2009-08-04] ()
R1 cdrblock; C:\Windows\System32\DRIVERS\cdrblock.sys [34360 2008-05-30] (Canopus Co,. Ltd.)
S3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [304784 2010-03-23] ()
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2013-12-10] (Kaspersky Lab ZAO)
U5 klflt; C:\Windows\System32\Drivers\klflt.sys [91008 2014-05-19] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [628320 2014-05-19] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2013-12-10] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2013-10-09] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-10-09] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-06-18] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-06-12] (Kaspersky Lab ZAO)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
S3 NvnUsbAudio; C:\Windows\System32\DRIVERS\nvnusbaudio.sys [53080 2011-07-07] (Novation DMS Ltd.)
S3 MSICDSetup; \??\D:\CDriver64.sys [X]
S3 WN111v2; system32\DRIVERS\WN111v2w7x.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-10 14:27 - 2015-02-10 14:47 - 00000000 ____D () C:\FRST
2015-02-10 14:24 - 2015-02-10 14:24 - 00000000 _____ () C:\Users\**********\defogger_reenable
2015-02-10 11:25 - 2015-02-10 11:30 - 00000000 ____D () C:\Users\**********\AppData\Roaming\vlc
2015-02-10 11:25 - 2015-02-10 11:25 - 00000778 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2015-02-10 11:25 - 2015-02-10 11:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2015-02-10 11:19 - 2015-02-10 14:18 - 00000000 ____D () C:\Users\**********\.mediathek3
2015-02-06 21:27 - 2015-02-06 21:27 - 00000221 _____ () C:\Users\**********\Desktop\Destination Sol.url
2015-02-02 14:48 - 2015-02-02 14:48 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2015-02-02 14:48 - 2015-02-02 14:48 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2015-02-02 10:26 - 2015-02-02 10:26 - 00000221 _____ () C:\Users\**********\Desktop\Life Is Strange.url
2015-02-01 20:28 - 2015-02-01 20:28 - 00000675 _____ () C:\Users\Public\Desktop\Steam.lnk
2015-02-01 20:28 - 2015-02-01 20:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2015-01-30 02:26 - 2015-01-30 02:27 - 00000000 ____D () C:\Users\**********\Downloads\Übergang

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-10 14:46 - 2011-04-20 09:57 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-02-10 14:45 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-10 14:45 - 2009-07-14 05:51 - 00168186 _____ () C:\Windows\setupact.log
2015-02-10 14:44 - 2011-04-20 09:23 - 01369651 _____ () C:\Windows\WindowsUpdate.log
2015-02-10 14:24 - 2011-04-20 09:23 - 00000000 ____D () C:\Users\**********
2015-02-10 14:05 - 2013-04-01 17:43 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-10 11:24 - 2009-07-14 05:45 - 00021856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-10 11:24 - 2009-07-14 05:45 - 00021856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-10 11:23 - 2010-11-21 07:50 - 00713040 _____ () C:\Windows\system32\perfh007.dat
2015-02-10 11:23 - 2010-11-21 07:50 - 00154976 _____ () C:\Windows\system32\perfc007.dat
2015-02-10 11:23 - 2009-07-14 06:13 - 01656656 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-06 21:27 - 2012-07-29 11:06 - 00000000 ____D () C:\Users\**********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2015-02-05 19:05 - 2013-04-01 17:43 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-05 19:05 - 2013-04-01 17:43 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-02-05 19:05 - 2011-12-14 17:59 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-02 14:48 - 2012-10-27 10:15 - 00000000 ____D () C:\Users\**********\Documents\My Games
2015-02-02 14:48 - 2011-05-07 09:05 - 00529621 _____ () C:\Windows\DirectX.log
2015-02-02 14:47 - 2013-08-19 00:54 - 00000000 ____D () C:\ProgramData\Package Cache
2015-01-26 18:56 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-22 22:03 - 2014-08-02 07:10 - 00000000 ____D () C:\Users\**********\AppData\Local\CyberGhost
2015-01-14 10:04 - 2014-07-05 08:52 - 00000000 ____D () C:\Users\**********\Downloads\Sticker
2015-01-14 08:48 - 2014-09-29 12:34 - 00000000 ____D () C:\Users\**********\Downloads\Bilder

==================== Files in the root of some directories =======

2011-08-24 11:14 - 2011-08-24 11:14 - 0004608 _____ () C:\Users\**********\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-07-31 11:49 - 2012-07-31 11:49 - 0000098 _____ () C:\Users\**********\AppData\Local\fusioncache.dat
2013-07-22 17:33 - 2013-07-22 17:33 - 0001339 _____ () C:\Users\**********\AppData\Local\recently-used.xbel
2013-09-14 00:32 - 2014-05-04 19:06 - 0007597 _____ () C:\Users\**********\AppData\Local\Resmon.ResmonCfg
2013-10-03 17:39 - 2013-10-03 17:40 - 2411694 _____ () C:\Users\**********\AppData\Local\[j0002]-[p02].bmp
2013-10-03 17:40 - 2013-10-03 17:40 - 2411694 _____ () C:\Users\**********\AppData\Local\[j0002]-[p03].bmp
2013-10-03 17:40 - 2013-10-03 17:41 - 2411694 _____ () C:\Users\**********\AppData\Local\[j0002]-[p04].bmp
2013-10-03 17:41 - 2013-10-03 17:41 - 2411694 _____ () C:\Users\**********\AppData\Local\[j0002]-[p05].bmp
2013-10-03 17:41 - 2013-10-03 17:42 - 2411694 _____ () C:\Users\**********\AppData\Local\[j0002]-[p06].bmp
2013-10-03 17:42 - 2013-10-03 17:42 - 2411694 _____ () C:\Users\**********\AppData\Local\[j0002]-[p07].bmp
2013-10-03 17:42 - 2013-10-03 17:43 - 2411694 _____ () C:\Users\**********\AppData\Local\[j0002]-[p08].bmp
2013-10-03 17:43 - 2013-10-03 17:43 - 2411694 _____ () C:\Users\**********\AppData\Local\[j0002]-[p09].bmp
2013-10-03 17:43 - 2013-10-03 17:44 - 2411694 _____ () C:\Users\**********\AppData\Local\[j0002]-[p10].bmp
2013-10-03 17:44 - 2013-10-03 17:44 - 2411694 _____ () C:\Users\**********\AppData\Local\[j0002]-[p11].bmp
2013-10-03 17:44 - 2013-10-03 17:44 - 2411694 _____ () C:\Users\**********\AppData\Local\[j0002]-[p12].bmp
2013-10-03 17:45 - 2013-10-03 17:45 - 0040446 _____ () C:\Users\**********\AppData\Local\[j0002]-[p13].bmp
2011-08-24 11:14 - 2011-09-27 23:59 - 0000088 __RSH () C:\ProgramData\34FED14DE8.sys
2011-08-24 11:14 - 2011-09-27 23:59 - 0003140 ___SH () C:\ProgramData\KGyGaAvL.sys

Some content of TEMP:
====================
C:\Users\**********\AppData\Local\Temp\13-4_win7_win8_64_dd_ccc_whql.exe
C:\Users\**********\AppData\Local\Temp\drm_dialogs.dll
C:\Users\**********\AppData\Local\Temp\drm_dyndata_7370007.dll
C:\Users\**********\AppData\Local\Temp\drm_dyndata_7380014.dll
C:\Users\**********\AppData\Local\Temp\MSIAFTERBURNERSETUP.EXE
C:\Users\**********\AppData\Local\Temp\ose00000.exe
C:\Users\**********\AppData\Local\Temp\ose00001.exe
C:\Users\**********\AppData\Local\Temp\pyl58EA.tmp.exe
C:\Users\**********\AppData\Local\Temp\pylC467.tmp.exe
C:\Users\**********\AppData\Local\Temp\pylD4FA.tmp.exe
C:\Users\**********\AppData\Local\Temp\raptrpatch.exe
C:\Users\**********\AppData\Local\Temp\SETUP_AFTERBURNER.EXE
C:\Users\**********\AppData\Local\Temp\Stp853E_TMP.EXE
C:\Users\**********\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\**********\AppData\Local\Temp\vcredist_x64.exe
C:\Users\**********\AppData\Local\Temp\vcredist_x86.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-28 10:34

==================== End Of Log ============================


Addition:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-02-2015
Ran by ********** at 2015-02-10 14:50:20
Running from D:\AV Software
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Kaspersky Anti-Virus (Enabled - Out of date) {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}
AS: Kaspersky Anti-Virus (Enabled - Up to date) {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - )
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.3.633 - Adobe Systems, Inc.)
AMD Catalyst Install Manager (HKLM\...\{E9897E08-46FA-A07E-B332-1515AAB356F4}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
Anki (HKLM-x32\...\Anki) (Version: - )
Any Video Converter 5.6.3 (HKLM-x32\...\Any Video Converter_is1) (Version: - Any-Video-Converter.com)
ATI AVIVO64 Codecs (Version: 11.6.0.51118 - ATI Technologies Inc.) Hidden
ATI Problem Report Wizard (Version: 3.0.800.0 - ATI Technologies) Hidden
Canopus Codec Option 6.02 (HKLM-x32\...\{28C515CC-489B-4c02-898E-FE5B790E52FF}) (Version: 6.02 - Thomson Canopus Co., Ltd.)
Cisco Systems VPN Client 5.0.07.0290 (HKLM\...\{467D5E81-8349-4892-9E81-C3674ED8E451}) (Version: 5.0.7 - Cisco Systems, Inc.)
ConvertHelper 2.2 (HKLM-x32\...\{27CC6AB1-E72B-4179-AF1A-EAE507EBAF51}_is1) (Version: - DownloadHelper)
CyberGhost 5 (HKLM\...\CyberGhost 5_is1) (Version: - CyberGhost S.R.L.)
Destination Sol (HKLM-x32\...\Steam App 342980) (Version: - Milosh Petrov)
DigiTech JamManager (HKLM-x32\...\DigiTech JamManager) (Version: 1.1.1.3 - DigiTech)
DigiTech JamManager (x32 Version: 1.1.1.3 - DigiTech) Hidden
EDIUS 6.02 (HKLM-x32\...\{B91A1230-C199-421e-8F63-7235731D925E}) (Version: 6.02 - Thomson Canopus Co., Ltd.)
EDIUS Hardware Drivers (HKLM-x32\...\{5A1FCDE3-7B05-4821-AD83-B58117E6D0DF}) (Version: 6.02.0000 - Thomson Canopus Co., Ltd.)
Empire Earth (HKLM-x32\...\{2447500B-22D7-47BD-9B13-1A927F43A267}) (Version: - )
EPU-4 Engine (HKLM-x32\...\{8F66047B-1AF3-40D9-80D7-106E2EDC2C2A}) (Version: 1.02.01 - )
Free YouTube Download version 3.2.29.303 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.29.303 - DVDVideoSoft Ltd.)
Freenet version 0.7.5 build 1467 (HKU\S-1-5-21-3638779592-2612922094-3528985903-1000\...\{3196C62F-9C7B-4392-88B4-05C037D05518}_is1) (Version: 0.7.5 build 1467 - freenetproject.org)
HydraVision (x32 Version: 4.2.184.0 - ATI Technologies Inc.) Hidden
Inkscape 0.48.4 (HKLM-x32\...\Inkscape) (Version: 0.48.4 - )
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Kaspersky Anti-Virus 2013 (HKLM-x32\...\InstallWIX_{560985FB-4B76-4121-9189-7A2CDC7886D6}) (Version: 13.0.1.4190 - Kaspersky Lab)
Kaspersky Anti-Virus 2013 (x32 Version: 13.0.1.4190 - Kaspersky Lab) Hidden
Life Is Strange™ (HKLM-x32\...\Steam App 319630) (Version: - DONTNOD Entertainment)
Live 8.2.1 (HKLM-x32\...\Live 8.2.1) (Version: - )
MAGIX Screenshare (HKLM-x32\...\{A7B517E2-07EB-47BA-877B-3F174FB7760B}) (Version: 4.3.6.1987 - MAGIX AG)
MAGIX Speed burnR (MSI) (HKLM-x32\...\{9D5B0618-2EFA-4DAA-9B53-A546992824EA}) (Version: 7.0.2.6 - MAGIX AG)
Microsoft .NET Framework 1.1 (HKLM-x32\...\Microsoft .NET Framework 1.1 (1033)) (Version: - )
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4.5 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft Office 2010 Service Pack 1 (SP1) (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}) (Version: - Microsoft)
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4675.1003 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-0081-0407-0000-0000000FF1CE}) (Version: 14.0.6123.5001 - Microsoft Corporation)
Microsoft Office Professional 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.6029.1000 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3638779592-2612922094-3528985903-1000\...\OneDriveSetup.exe) (Version: 17.0.4029.0217 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{A96702F7-EFC8-3EED-BE46-22C809D4EBE5}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{402ED4A1-8F5B-387A-8688-997ABF58B8F2}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Mozilla Firefox 32.0.3 (x86 de) (HKU\S-1-5-21-3638779592-2612922094-3528985903-1000\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)
Mozilla Firefox 35.0.1 (x86 de) (HKU\S-1-5-21-3638779592-2612922094-3528985903-1000\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Native Instruments AC Box Combo (HKLM-x32\...\Native Instruments AC Box Combo) (Version: - )
Novation USB Audio Driver 2.2 (HKLM\...\Novation USB Audio Driver_is1) (Version: 2.2 - Novation DMS Ltd.)
NVIDIA PhysX (HKLM-x32\...\{80407BA7-7763-4395-AB98-5233F1B34E65}) (Version: 9.13.1220 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.8 - Pando Networks Inc.)
PhotoScape (HKLM-x32\...\PhotoScape) (Version: - )
Platform (x32 Version: 1.34 - VIA Technologies, Inc.) Hidden
Police Quest: SWAT2 (HKLM-x32\...\SWAT2) (Version: - )
PureSync (x32 Version: 3.7.9 - Jumping Bytes) Hidden
PureSync 3.7.9 (HKLM-x32\...\PureSync) (Version: 3.7.9 - Jumping Bytes)
R for Windows 3.0.3 (HKLM\...\R for Windows 3.0.3_is1) (Version: 3.0.3 - R Core Team)
Realtek Ethernet Controller Driver For Windows Vista and Later (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0009 - Realtek)
Rockefeller - Das schwarze Gold (HKLM-x32\...\{ADD18AB6-8F37-4BED-9AC4-5ED77B055B3E}_is1) (Version: - UIG GmbH)
Samplitude Music Studio MX (HKLM-x32\...\MAGIX_MSI_ms18dlx) (Version: 18.0.0.42 - MAGIX AG)
Samplitude Music Studio MX (x32 Version: 18.0.0.42 - MAGIX AG) Hidden
Security Task Manager 1.8g (HKLM-x32\...\Security Task Manager) (Version: 1.8g - Neuber Software)
Sid Meier's Civilization V (HKLM-x32\...\Civilization V) (Version: - 2K Games, Inc.)
Sierra Utilities (HKLM-x32\...\Sierra Utilities) (Version: - )
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TAP-Windows 9.9.2 (HKLM\...\TAP-Windows) (Version: 9.9.2 - )
TrueCrypt (HKLM-x32\...\TrueCrypt) (Version: 7.1a - TrueCrypt Foundation)
VIA Plattform-Geräte-Manager (HKLM-x32\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.34 - VIA Technologies, Inc.)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.0-rc2 - VideoLAN)
VoiceSupport 1.2.01 (HKLM-x32\...\TC-Helicon VoiceSupport_is1) (Version: 1.2.01 build 38 - TC-Helicon Vocal Technologies Inc.)
XMedia Recode 3.0.4.9 (HKLM-x32\...\XMedia Recode) (Version: 3.0.4.9 - Sebastian Dörfler)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3638779592-2612922094-3528985903-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\**********\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay No File
CustomCLSID: HKU\S-1-5-21-3638779592-2612922094-3528985903-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\**********\AppData\Local\Microsoft\SkyDrive\17.0.4029.0217\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3638779592-2612922094-3528985903-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\**********\AppData\Local\Microsoft\SkyDrive\17.0.4029.0217\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3638779592-2612922094-3528985903-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\**********\AppData\Local\Microsoft\SkyDrive\17.0.4029.0217\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3638779592-2612922094-3528985903-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\**********\AppData\Local\Microsoft\SkyDrive\17.0.4029.0217\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3638779592-2612922094-3528985903-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\**********\AppData\Local\Microsoft\SkyDrive\17.0.4029.0217\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points =========================

14-01-2015 08:52:37 Windows-Sicherung
18-01-2015 19:00:38 Windows-Sicherung
25-01-2015 21:42:37 Windows-Sicherung
01-02-2015 19:58:27 Windows-Sicherung
02-02-2015 14:46:26 Microsoft Visual C++ 2005 Redistributable (x64) wird installiert
02-02-2015 14:46:47 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610
02-02-2015 14:46:56 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727
02-02-2015 14:47:09 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610
02-02-2015 14:47:33 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727
02-02-2015 14:47:50 DirectX wurde installiert
10-02-2015 11:27:52 Windows-Sicherung

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {003755AF-E259-4BFC-8711-EA3357B904A0} - System32\Tasks\{A0371F9B-2D17-4ECC-B457-9B1794F2C11C} => pcalua.exe -a F:\ASIO_Driver\Setup.exe -d F:\ASIO_Driver
Task: {004CA8C6-0E96-4D00-8695-75DA1F60C866} - System32\Tasks\{CBC7E987-5AEF-4510-8BB7-DD68E4D1120E} => C:\Program Files (x86)\sixteen tons entertainment\Emergency4\Em4.exe
Task: {0063104D-D3FB-4A10-ADFB-0B65110F3120} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-11-12] (Microsoft Corporation)
Task: {01709E05-FD0A-4FF1-9CCB-CD2492F12591} - System32\Tasks\{09F870D4-4C9C-495F-8B7E-1A1222F6A544} => F:\ASIO_Driver\Setup.exe
Task: {07AACEFE-00FA-4F7F-8FC0-D57F15D885A7} - System32\Tasks\Microsoft\Internet Explorer\IE9 Install DelayedReboot_OnTimer => C:\Program Files\Internet Explorer\ienrcore.exe
Task: {08C0F3DF-F4FF-4948-ACF5-A0867CEC695A} - System32\Tasks\{791D0679-D57E-4723-8743-5502D135779C} => E:\Programme\Grand Theft Auto IV\LaunchGTAIV.exe
Task: {2B9DAF47-3CED-4A08-811D-6334D7D0BAA7} - System32\Tasks\Microsoft\Internet Explorer\IE9 Install DelayedReboot_OnReboot => C:\Program Files\Internet Explorer\ienrcore.exe
Task: {30B47D2C-60F0-4E7D-A4E7-B3A05130F05B} - System32\Tasks\{0823175B-BA01-48D1-AD3D-5B30C4A7F5D0} => C:\SIERRA\SWAT2\SWAT.EXE [1998-10-28] ()
Task: {37285ABC-72E1-4A6C-A30B-FE45D77E34E0} - System32\Tasks\ASUS\ASUS SIX Engine => C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe [2010-02-03] (ASUSTeK Computer Inc.)
Task: {383D0AC7-C71D-43C6-8C90-517213A1B9AB} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-11-04] (Microsoft Corporation)
Task: {3F4AF30A-986E-4C00-8880-177C85297826} - System32\Tasks\{0E7CE9F6-7B2A-43D5-A536-94026ED6AE5A} => E:\Programme\Grand Theft Auto IV\LaunchGTAIV.exe
Task: {4332914D-7F54-454E-AF20-1D654A935F8C} - System32\Tasks\{9A6D09E0-208A-48CE-98B3-A51997E3B1CB} => E:\Programme\KidKey\kidkey.exe
Task: {494B422C-8F77-4D82-A4CC-55AE7D733BF3} - System32\Tasks\Microsoft\Internet Explorer\IE9 Install DelayedReboot_OnLogon => C:\Program Files\Internet Explorer\ienrcore.exe
Task: {5C78513E-1808-4975-9A91-D5DD10EC2BBC} - System32\Tasks\{F22D6333-48BA-4A29-AF79-D2ED7CCEEB94} => C:\Program Files (x86)\Skype\Phone\Skype.exe
Task: {71F8F683-56FB-49AD-AAB7-5D9EADCDFE19} - System32\Tasks\{D2D2BF49-9EA8-4293-B7D4-CC01B044D08A} => pcalua.exe -a E:\Programme\Steam\steam.exe -c steam://uninstall/10500
Task: {8DC7FCFB-07AF-49BF-B7EA-A4A3EDE646A4} - System32\Tasks\{C41961C2-1272-4718-A755-AD02B692682B} => D:\Programm Downloads\Fenster im Vordergrund\OnTop.exe
Task: {9E9FB36A-42C8-43A1-BB03-C9ACE90606CA} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {BBD214D0-B938-46DB-BCDA-95E8BF1936C3} - System32\Tasks\{FDA1AA0C-1262-4836-B089-829894571EF2} => E:\Programme\Grand Theft Auto IV\LaunchGTAIV.exe
Task: {BF04F89E-4C61-402B-A150-6DC4F2D130F6} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-05] (Adobe Systems Incorporated)
Task: {D1DCAA77-AEAE-4976-B568-D9989B885C47} - System32\Tasks\{CAE71FCC-7AC7-4EDF-B696-2134FF1108A0} => pcalua.exe -a F:\SetupLauncher.exe -d F:\
Task: {E27B8D44-6689-4649-9CE8-FD90170ADF71} - System32\Tasks\{EEA706AA-AC6C-441B-A797-8922899461CD} => F:\ASIO_Driver\Setup98.exe <==== ATTENTION
Task: {E96C8FFA-5D81-4E06-B4A1-6E6985CD9A6B} - System32\Tasks\{07192476-75E3-4CF0-A16C-C234D148E696} => F:\ASIO_Driver\Setup.exe
Task: {F05BA773-AA08-4698-8FB2-AC66DAD273B9} - System32\Tasks\{678C5045-770D-4778-A8B2-3D6869BA3CC6} => pcalua.exe -a E:\PROGRA~1\Ableton\LIVE82~1.1\Install\UNWISE.EXE -c E:\PROGRA~1\Ableton\LIVE82~1.1\Install\INSTALL.LOG
Task: {F411EC1C-2B87-41D1-9661-398EFDC90E70} - System32\Tasks\{9E8214EA-CC19-4A04-A3C1-674BB30A2625} => pcalua.exe -a F:\SetupLauncher.exe -d F:\
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) ==============

2014-05-29 13:22 - 2014-05-20 08:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2011-04-20 09:30 - 2010-05-24 10:10 - 00076192 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll
2011-04-20 09:30 - 2010-05-24 10:10 - 00383904 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll
2011-04-20 09:30 - 2010-05-24 10:10 - 00103328 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\VMicApi.dll
2011-04-20 09:30 - 2010-05-24 10:10 - 64641440 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Skin.dll
2012-08-17 20:39 - 2013-06-12 14:36 - 01310136 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\kpcengine.2.2.dll
2011-04-20 09:33 - 2009-03-19 21:35 - 00208896 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\AiNap.dll
2011-04-20 09:33 - 2009-03-19 21:35 - 00008704 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\vvc.dll
2011-04-20 09:33 - 2009-01-15 13:55 - 00565248 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\pngio.dll
2011-04-20 09:33 - 2009-03-25 15:53 - 00053248 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\AsSpindownTimeout.dll
2015-02-01 21:20 - 2014-12-01 22:31 - 02396672 _____ () D:\Programm Downloads\Steam\libavcodec-56.dll
2015-02-01 21:20 - 2014-12-01 22:31 - 00442880 _____ () D:\Programm Downloads\Steam\libavutil-54.dll
2015-02-01 21:20 - 2014-12-01 22:31 - 00479744 _____ () D:\Programm Downloads\Steam\libavformat-56.dll
2015-02-01 21:20 - 2014-12-01 22:31 - 00332800 _____ () D:\Programm Downloads\Steam\libavresample-2.dll
2015-02-01 21:20 - 2014-11-11 19:47 - 00774656 _____ () D:\Programm Downloads\Steam\SDL2.dll
2015-02-01 21:20 - 2014-12-02 01:29 - 05002752 _____ () D:\Programm Downloads\Steam\v8.dll
2015-02-01 21:20 - 2014-12-02 01:29 - 01612800 _____ () D:\Programm Downloads\Steam\icui18n.dll
2015-02-01 21:20 - 2014-12-02 01:29 - 01210368 _____ () D:\Programm Downloads\Steam\icuuc.dll
2015-02-01 21:20 - 2015-01-23 23:34 - 02227904 _____ () D:\Programm Downloads\Steam\video.dll
2015-02-01 21:20 - 2014-12-01 22:31 - 00485888 _____ () D:\Programm Downloads\Steam\libswscale-3.dll
2015-02-01 21:20 - 2015-01-23 23:33 - 00696512 _____ () D:\Programm Downloads\Steam\bin\chromehtml.DLL
2012-08-17 20:38 - 2012-08-17 20:38 - 00479160 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\dblite.dll
2012-08-17 20:40 - 2012-08-17 20:40 - 00068024 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\QtWebKit\qmlwebkitplugin4.dll
2015-02-01 21:20 - 2015-01-16 00:42 - 34641288 _____ () D:\Programm Downloads\Steam\bin\libcef.dll
2011-03-16 23:11 - 2011-03-16 23:11 - 04297568 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\office14\Cultures\office.odf

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ksupmgr => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ksupmgr => ""="Service"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Registry Areas =====================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3638779592-2612922094-3528985903-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\**********\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-3638779592-2612922094-3528985903-500 - Administrator - Disabled)
ASPNET (S-1-5-21-3638779592-2612922094-3528985903-1003 - Limited - Enabled)
Gast (S-1-5-21-3638779592-2612922094-3528985903-501 - Limited - Disabled)
********** (S-1-5-21-3638779592-2612922094-3528985903-1000 - Administrator - Enabled) => C:\Users\**********
Standart (S-1-5-21-3638779592-2612922094-3528985903-1001 - Limited - Enabled) => C:\Users\Standart

==================== Faulty Device Manager Devices =============

Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/10/2015 02:47:30 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/10/2015 02:46:13 PM) (Source: MsiInstaller) (EventID: 11706) (User: **********-PC)
Description: Product: Cisco Systems VPN Client 5.0.07.0290 -- Error 1706. No valid source could be found for product Cisco Systems VPN Client 5.0.07.0290. Windows Installer cannot continue.

Error: (02/10/2015 02:12:32 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm EDIUS.exe, Version 6.0.0.18 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: e8c

Startzeit: 01d0452d0095973f

Endzeit: 4655

Anwendungspfad: E:\4. Programme\EDIUS 6\EDIUS.exe

Berichts-ID: 4e5a26dc-b126-11e4-8f1e-20cf30e83341

Error: (02/10/2015 11:49:29 AM) (Source: MsiInstaller) (EventID: 11706) (User: NT-AUTORITÄT)
Description: Product: Cisco Systems VPN Client 5.0.07.0290 -- Error 1706. No valid source could be found for product Cisco Systems VPN Client 5.0.07.0290. Windows Installer cannot continue.

Error: (02/10/2015 11:49:28 AM) (Source: MsiInstaller) (EventID: 11706) (User: NT-AUTORITÄT)
Description: Product: Cisco Systems VPN Client 5.0.07.0290 -- Error 1706. No valid source could be found for product Cisco Systems VPN Client 5.0.07.0290. Windows Installer cannot continue.

Error: (02/10/2015 11:49:28 AM) (Source: MsiInstaller) (EventID: 11706) (User: NT-AUTORITÄT)
Description: Product: Cisco Systems VPN Client 5.0.07.0290 -- Error 1706. No valid source could be found for product Cisco Systems VPN Client 5.0.07.0290. Windows Installer cannot continue.

Error: (02/10/2015 11:49:27 AM) (Source: MsiInstaller) (EventID: 11706) (User: NT-AUTORITÄT)
Description: Product: Cisco Systems VPN Client 5.0.07.0290 -- Error 1706. No valid source could be found for product Cisco Systems VPN Client 5.0.07.0290. Windows Installer cannot continue.

Error: (02/10/2015 11:29:17 AM) (Source: Windows Backup) (EventID: 4104) (User: )
Description: Die Sicherung war nicht erfolgreich. Fehler: "Der Sicherungsspeicherort ist ungültig. Ein in die Sicherung einbezogenes Volume kann nicht als Speicherort verwendet werden. (0x80780040)"

Error: (02/10/2015 11:18:34 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/10/2015 11:17:44 AM) (Source: MsiInstaller) (EventID: 11706) (User: **********-PC)
Description: Product: Cisco Systems VPN Client 5.0.07.0290 -- Error 1706. No valid source could be found for product Cisco Systems VPN Client 5.0.07.0290. Windows Installer cannot continue.


System errors:
=============
Error: (02/10/2015 02:50:26 PM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy117" den Befehl "chkdsk" aus.

Error: (02/10/2015 02:45:48 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "MSCamSvc" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (02/10/2015 02:45:46 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "UAC-Dateivirtualisierung" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (02/10/2015 02:15:28 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "CyberGhost 5 Client Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (02/10/2015 00:48:02 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \...\DR76 gefunden.

Error: (02/10/2015 11:27:19 AM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy118" den Befehl "chkdsk" aus.

Error: (02/10/2015 11:16:52 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "MSCamSvc" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (02/10/2015 11:16:50 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "UAC-Dateivirtualisierung" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (02/07/2015 07:12:17 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "MSCamSvc" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (02/07/2015 07:12:15 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "UAC-Dateivirtualisierung" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2


Microsoft Office Sessions:
=========================
Error: (02/10/2015 02:47:30 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/10/2015 02:46:13 PM) (Source: MsiInstaller) (EventID: 11706) (User: **********-PC)
Description: Product: Cisco Systems VPN Client 5.0.07.0290 -- Error 1706. No valid source could be found for product Cisco Systems VPN Client 5.0.07.0290. Windows Installer cannot continue.(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (02/10/2015 02:12:32 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: EDIUS.exe6.0.0.18e8c01d0452d0095973f4655E:\4. Programme\EDIUS 6\EDIUS.exe4e5a26dc-b126-11e4-8f1e-20cf30e83341

Error: (02/10/2015 11:49:29 AM) (Source: MsiInstaller) (EventID: 11706) (User: NT-AUTORITÄT)
Description: Product: Cisco Systems VPN Client 5.0.07.0290 -- Error 1706. No valid source could be found for product Cisco Systems VPN Client 5.0.07.0290. Windows Installer cannot continue.(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (02/10/2015 11:49:28 AM) (Source: MsiInstaller) (EventID: 11706) (User: NT-AUTORITÄT)
Description: Product: Cisco Systems VPN Client 5.0.07.0290 -- Error 1706. No valid source could be found for product Cisco Systems VPN Client 5.0.07.0290. Windows Installer cannot continue.(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (02/10/2015 11:49:28 AM) (Source: MsiInstaller) (EventID: 11706) (User: NT-AUTORITÄT)
Description: Product: Cisco Systems VPN Client 5.0.07.0290 -- Error 1706. No valid source could be found for product Cisco Systems VPN Client 5.0.07.0290. Windows Installer cannot continue.(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (02/10/2015 11:49:27 AM) (Source: MsiInstaller) (EventID: 11706) (User: NT-AUTORITÄT)
Description: Product: Cisco Systems VPN Client 5.0.07.0290 -- Error 1706. No valid source could be found for product Cisco Systems VPN Client 5.0.07.0290. Windows Installer cannot continue.(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (02/10/2015 11:29:17 AM) (Source: Windows Backup) (EventID: 4104) (User: )
Description: Der Sicherungsspeicherort ist ungültig. Ein in die Sicherung einbezogenes Volume kann nicht als Speicherort verwendet werden. (0x80780040)

Error: (02/10/2015 11:18:34 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/10/2015 11:17:44 AM) (Source: MsiInstaller) (EventID: 11706) (User: **********-PC)
Description: Product: Cisco Systems VPN Client 5.0.07.0290 -- Error 1706. No valid source could be found for product Cisco Systems VPN Client 5.0.07.0290. Windows Installer cannot continue.(NULL)(NULL)(NULL)(NULL)(NULL)


CodeIntegrity Errors:
===================================
Date: 2014-10-28 10:34:30.478
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2014-10-28 10:34:30.478
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2014-10-28 10:34:30.478
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2014-10-28 10:34:30.463
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2014-10-28 10:34:30.463
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2014-10-28 10:34:30.463
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2014-10-12 15:47:48.290
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2014-10-12 15:47:48.290
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2014-10-12 15:47:48.275
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2014-10-12 15:47:48.275
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i7 CPU 860 @ 2.80GHz
Percentage of memory in use: 49%
Total physical RAM: 4087.05 MB
Available physical RAM: 2076.48 MB
Total Pagefile: 8172.31 MB
Available Pagefile: 6397.94 MB
Total Virtual: 8192 MB
Available Virtual: 8191.58 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:111.69 GB) (Free:40.79 GB) NTFS
Drive d: () (Fixed) (Total:650.67 GB) (Free:647.33 GB) NTFS
Drive e: () (Fixed) (Total:1862.89 GB) (Free:1264.45 GB) NTFS
Drive f: (<Ghostwriter>) (CDROM) (Total:7.92 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

========================================================
Disk: 1 (Size: 111.8 GB) (Disk ID: EDADDE40)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=111.7 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 1863 GB) (Disk ID: DDE97DE7)

Partition: GPT Partition Type.

==================== End Of Log ============================


GMER:

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-02-10 15:12:14
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP2T0L0-3 Corsair_CSSD-F120GB2 rev.2.0 111,79GB
Running: ip54dcqg.exe; Driver: C:\Users\******~1\AppData\Local\Temp\kwdyyuod.sys


---- User code sections - GMER 2.1 ----

.text D:\Programm Downloads\Daten Synchronisator\PureSync\PureSyncTray.exe[2968] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000074fc1465 2 bytes [FC, 74]
.text D:\Programm Downloads\Daten Synchronisator\PureSync\PureSyncTray.exe[2968] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 0000000074fc14bb 2 bytes [FC, 74]
.text ... * 2
.text D:\Programm Downloads\Steam\Steam.exe[2300] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000074fc1465 2 bytes [FC, 74]
.text D:\Programm Downloads\Steam\Steam.exe[2300] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 0000000074fc14bb 2 bytes [FC, 74]
.text ... * 2
.text D:\Programm Downloads\Steam\bin\steamwebhelper.exe[1124] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074fc1465 2 bytes [FC, 74]
.text D:\Programm Downloads\Steam\bin\steamwebhelper.exe[1124] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074fc14bb 2 bytes [FC, 74]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3772] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000074fc1465 2 bytes [FC, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3772] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 0000000074fc14bb 2 bytes [FC, 74]
.text ... * 2

---- Threads - GMER 2.1 ----

Thread C:\Windows\System32\svchost.exe [1452:440] 000007fef32a9688

---- Disk sectors - GMER 2.1 ----

Disk \Device\Harddisk1\DR1 unknown MBR code

---- EOF - GMER 2.1 ----

Hallo und

Zukünftig bitte beachten:

Running from D:\AV Software

Leider hast du unsere Anleitung nicht richtig befolgt:
Bitte alle Tools direkt auf den Desktop downloaden bzw. dorthin verschieben und vom Desktop starten, da unsere Anleitungen daraufhin ausgelegt sind.
Zudem lassen sich dann am Ende der Bereinigung alle verwendeten Tools sehr einfach entfernen.
Alle Tools bis zum Ende der Bereinigung auf dem Desktop lassen, evtl. benötigen wir manche öfter.




Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

• Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
• Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
• Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
• Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.