Trojaner-Board - Exe-Dateien starten nicht, bekomme Fehlermeldung

Ich konnte nur mit der Aussage "boote das System in die Repartur - Option" nichts anfangen. Die Reparatur -Option ist ein Menüpunkt der Rettungs CD. Ist jetzt schon klar.
Ich hab das Programm laufen lassen. Hier die Log-Datei.

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-12-2014

Ran by SYSTEM on MININT-VM8C0Q6 on 26-12-2014 19:49:57

Running from H:\

Platform: Windows 7 Home Premium (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 10

Boot Mode: Recovery
 

The current controlset is ControlSet001
 ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.
 

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [hpsysdrv] => c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard)

HKLM\...\Run: [SmartMenu] => C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe [568888 2010-01-18] ()

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-03-10] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2010-01-25] (EasyBits Software AS)

HKLM-x32\...\Run: [hpqSRMon] => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)

HKLM-x32\...\Run: [BtTray] => C:\Program Files (x86)\IVT Corporation\BlueSoleil\BtTray.exe [315478 2009-09-02] (IVT Corporation)

HKLM-x32\...\Run: [TkBellExe] => c:\program files (x86)\real\realplayer\Update\realsched.exe [273544 2011-05-29] (RealNetworks, Inc.)

HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-09] (Hewlett-Packard)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-16] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG)

HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1

HKU\Default\...\Run: [HPAdvisorDock] => C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe [1715768 2010-09-28] (Hewlett-Packard)

HKU\Default User\...\Run: [HPAdvisorDock] => C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe [1715768 2010-09-28] (Hewlett-Packard)

HKU\Gerhard\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2010-01-22] (Hewlett-Packard Company)

HKU\Gerhard\...\Run: [Kohirienz] => C:\Users\Gerhard\AppData\Roaming\Ceqe\iwyrz.exe

HKU\Gerhard\...\Policies\system: [DisableLockWorkstation] 0

HKU\Gerhard\...\Policies\system: [DisableChangePassword] 0

HKU\PC Chef\...\Run: [HPAdvisorDock] => C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe [1715768 2010-09-28] (Hewlett-Packard)

HKU\PC Chef\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [17707624 2013-02-07] (Skype Technologies S.A.)

HKU\PC Chef\...\Run: [] => [X]

HKU\PC Chef\...\Policies\system: [DisableLockWorkstation] 0

HKU\PC Chef\...\Policies\system: [DisableChangePassword] 0

HKU\TEMP\...\Run: [HPAdvisorDock] => C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe [1715768 2010-09-28] (Hewlett-Packard)

Startup: C:\Users\Gerhard\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\program\quickstart.exe ()
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)

S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)

S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)

S2 BlueSoleilCS; C:\Program Files (x86)\IVT Corporation\BlueSoleil\BlueSoleilCS.exe [1466476 2009-09-02] (IVT Corporation)

S3 BsHelpCS; C:\Program Files (x86)\IVT Corporation\BlueSoleil\BsHelpCS.exe [192000 2009-09-02] (IVT Corporation)

S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-14] (Avira Operations GmbH & Co. KG)

S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-14] (Avira Operations GmbH & Co. KG)

S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)

S5 BlueletAudio; C:\Windows\System32\Drivers\BlueletAudio.sys [36360 2009-06-17] (IVT Corporation.)

S3 BT; C:\Windows\System32\DRIVERS\btnetdrv.sys [20488 2009-06-17] (IVT Corporation.)

S3 Btcsrusb; C:\Windows\System32\Drivers\btcusb.sys [47880 2009-08-28] (IVT Corporation.)

S0 BtHidBus; C:\Windows\System32\Drivers\BtHidBus.sys [24840 2009-08-26] (IVT Corporation.)

S3 btnetBUs; C:\Windows\System32\Drivers\btnetBus.sys [34440 2009-08-26] ()

S3 IvtBtBUs; C:\Windows\System32\Drivers\IvtBtBus.sys [30344 2009-08-26] (IVT Corporation.)

S3 VComm; C:\Windows\System32\DRIVERS\VComm.sys [17032 2009-08-26] (IVT Corporation.)

S3 VcommMgr; C:\Windows\System32\Drivers\VcommMgr.sys [43912 2009-08-28] (IVT Corporation.)

S5 BlueletAudio; C:\Windows\SysWOW64\Drivers\BlueletAudio.sys [36360 2009-06-17] (IVT Corporation.)

S3 CrystalSysInfo; \??\C:\Program Files\MediaCoder Audio Edition x64\SysInfoX64.sys [X]

S3 PCDSRVC{F36B3A4C-F95654BD-06000000}_0; \??\c:\program files\pc-doctor for windows\pcdsrvc_x64.pkms [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-12-26 10:20 - 2014-12-26 10:20 - 00000000 ____D () C:\Users\Gerhard\Desktop\FRST-OlderVersion

2014-12-19 12:56 - 2014-12-19 12:56 - 05601641 _____ (Swearware) C:\Users\Gerhard\Desktop\ComboFix.exe

2014-12-19 12:55 - 2014-12-19 12:56 - 05601641 _____ (Swearware) C:\Users\Gerhard\Downloads\ComboFix.exe

2014-12-18 12:07 - 2014-12-18 12:06 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Gerhard\Desktop\revosetup95.exe

2014-12-18 12:06 - 2014-12-18 12:06 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Gerhard\Downloads\revosetup95.exe

2014-12-17 12:11 - 2014-12-17 12:14 - 00028466 _____ () C:\Users\Gerhard\Downloads\Addition.txt

2014-12-17 12:10 - 2014-12-26 19:49 - 00000000 ____D () C:\FRST

2014-12-17 12:10 - 2014-12-17 12:14 - 00031949 _____ () C:\Users\Gerhard\Downloads\FRST.txt

2014-12-17 12:09 - 2014-12-26 10:20 - 02122752 _____ (Farbar) C:\Users\Gerhard\Desktop\FRST64.exe

2014-12-17 12:08 - 2014-12-17 12:08 - 02121216 _____ (Farbar) C:\Users\Gerhard\Downloads\FRST64.exe

2014-12-17 11:01 - 2014-12-17 11:01 - 00000000 ____D () C:\Users\Gerhard\Desktop\Tor Browser

2014-12-15 12:03 - 2014-12-15 12:02 - 00050477 _____ () C:\Users\Gerhard\Desktop\Defogger.exe

2014-12-15 12:02 - 2014-12-15 12:02 - 00050477 _____ () C:\Users\Gerhard\Downloads\Defogger.exe

2014-12-13 13:03 - 2014-12-13 13:03 - 00000179 _____ () C:\Users\Gerhard\Desktop\Reg Alt.txt

2014-12-10 12:36 - 2014-12-10 12:52 - 196019032 _____ (Buhl Data Service GmbH) C:\Users\Gerhard\Downloads\WISOFinanz2015.exe

2014-12-09 13:55 - 2014-12-09 13:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-12-05 13:24 - 2014-12-07 01:48 - 00000000 ____D () C:\users\TEMP

2014-12-05 13:24 - 2014-08-23 10:21 - 00123152 _____ () C:\Users\TEMP\AppData\Local\GDIPFONTCACHEV1.DAT
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-12-26 19:00 - 2010-12-15 13:11 - 00000000 ____D () C:\ProgramData\Recovery

2014-12-26 10:23 - 2009-09-07 06:42 - 00001150 _____ () C:\Windows\SysWOW64\bscs.ini

2014-12-26 10:23 - 2009-07-13 21:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-12-26 10:23 - 2009-07-13 20:51 - 00181399 _____ () C:\Windows\setupact.log

2014-12-26 10:22 - 2010-11-29 20:07 - 02028080 _____ () C:\Windows\WindowsUpdate.log

2014-12-26 10:22 - 2009-07-13 20:45 - 00015568 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-12-26 10:22 - 2009-07-13 20:45 - 00015568 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-12-26 10:21 - 2011-03-21 13:37 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-12-26 10:21 - 2010-06-17 06:31 - 00654150 _____ () C:\Windows\System32\perfh007.dat

2014-12-26 10:21 - 2010-06-17 06:31 - 00130022 _____ () C:\Windows\System32\perfc007.dat

2014-12-26 10:21 - 2009-07-13 21:13 - 01498742 _____ () C:\Windows\System32\PerfStringBackup.INI

2014-12-26 10:16 - 2011-03-21 13:37 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-12-26 09:30 - 2012-04-30 08:38 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-12-26 09:01 - 2010-12-11 10:09 - 00003342 _____ () C:\Windows\System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-578626087-998674019-1617852334-1003

2014-12-26 09:01 - 2010-12-11 10:09 - 00003212 _____ () C:\Windows\System32\Tasks\RealUpgradeLogonTaskS-1-5-21-578626087-998674019-1617852334-1003

2014-12-24 04:38 - 2010-12-07 13:42 - 00000000 ____D () C:\Users\Gerhard\Documents\Mein Steuer-Sparbuch Heute

2014-12-22 12:58 - 2011-03-02 12:27 - 00000000 ____D () C:\Users\Gerhard\AppData\Local\CrashDumps

2014-12-17 12:24 - 2010-11-30 13:08 - 00000000 ____D () C:\Users\Gerhard\AppData\Roaming\Mozilla

2014-12-15 10:02 - 2014-08-14 10:46 - 00001139 _____ () C:\Users\Public\Desktop\Avira.lnk

2014-12-15 10:02 - 2014-08-14 10:45 - 00000000 ____D () C:\ProgramData\Package Cache

2014-12-15 10:02 - 2013-02-23 09:10 - 00000000 ____D () C:\Program Files (x86)\Avira

2014-12-14 06:25 - 2010-11-30 12:53 - 00000000 ____D () C:\users\Gerhard

2014-12-14 02:13 - 2012-10-31 23:41 - 00000000 ____D () C:\Users\Gerhard\Documents\Taxpool-Buchhalter

2014-12-11 00:25 - 2013-07-16 09:24 - 00002177 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-12-10 04:06 - 2012-08-29 12:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-12-09 13:30 - 2012-04-30 08:38 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-12-09 13:30 - 2012-04-30 08:38 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-12-09 13:30 - 2011-06-19 07:16 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-12-05 14:27 - 2011-01-14 12:10 - 00005063 _____ () C:\Windows\SysWOW64\LOCALSERVICE.INI

2014-12-05 13:37 - 2011-01-14 12:10 - 00000099 _____ () C:\Windows\SysWOW64\LOCALDEVICE.INI

2014-11-30 02:08 - 2010-11-29 11:14 - 00000544 _____ () C:\Windows\Tasks\PCDRScheduledMaintenance.job
 

Some content of TEMP:

====================

C:\Users\Gerhard\AppData\Local\Temp\2jfuweif.exe

C:\Users\Gerhard\AppData\Local\Temp\AskSLib.dll

C:\Users\Gerhard\AppData\Local\Temp\avgnt.exe

C:\Users\Gerhard\AppData\Local\Temp\hz4l8g_b.dll

C:\Users\Gerhard\AppData\Local\Temp\LOCK.EXE

C:\Users\Gerhard\AppData\Local\Temp\NOSEventMessages.dll

C:\Users\Gerhard\AppData\Local\Temp\quqm0tdz.dll

C:\Users\Gerhard\AppData\Local\Temp\udll.dll

C:\Users\Gerhard\AppData\Local\Temp\ufddll.dll

C:\Users\Gerhard\AppData\Local\Temp\unrar.dll

C:\Users\PC Chef\AppData\Local\Temp\AskSLib.dll

C:\Users\PC Chef\AppData\Local\Temp\avgnt.exe

C:\Users\PC Chef\AppData\Local\Temp\DseShExt-x64.dll

C:\Users\PC Chef\AppData\Local\Temp\DseShExt-x86.dll

C:\Users\PC Chef\AppData\Local\Temp\FORMAT.EXE

C:\Users\PC Chef\AppData\Local\Temp\gert0.dll

C:\Users\PC Chef\AppData\Local\Temp\GLFAF19.tmp.ConduitEngineSetup.exe

C:\Users\PC Chef\AppData\Local\Temp\GLFAF19.tmp.tbsoft.dll

C:\Users\PC Chef\AppData\Local\Temp\GLFB565.tmp.tbDVDV.dll

C:\Users\PC Chef\AppData\Local\Temp\GLFB7C0.tmp.ConduitEngine.dll

C:\Users\PC Chef\AppData\Local\Temp\LOCK.EXE

C:\Users\PC Chef\AppData\Local\Temp\LT2Update2010-11-25.exe

C:\Users\PC Chef\AppData\Local\Temp\LT2Update2011-11-17.exe

C:\Users\PC Chef\AppData\Local\Temp\NEventMessages.dll

C:\Users\PC Chef\AppData\Local\Temp\NOSEventMessages.dll

C:\Users\PC Chef\AppData\Local\Temp\nsaDE90.exe

C:\Users\PC Chef\AppData\Local\Temp\nsd20CD.exe

C:\Users\PC Chef\AppData\Local\Temp\nsj777C.exe

C:\Users\PC Chef\AppData\Local\Temp\nso7D18.exe

C:\Users\PC Chef\AppData\Local\Temp\nst2793.exe

C:\Users\PC Chef\AppData\Local\Temp\nst73C3.exe

C:\Users\PC Chef\AppData\Local\Temp\nsy2409.exe

C:\Users\PC Chef\AppData\Local\Temp\Resource.MG2010.dll

C:\Users\PC Chef\AppData\Local\Temp\SCC.dll

C:\Users\PC Chef\AppData\Local\Temp\SDShelEx-win32.dll

C:\Users\PC Chef\AppData\Local\Temp\SDShelEx-x64.dll

C:\Users\PC Chef\AppData\Local\Temp\Setup.exe

C:\Users\PC Chef\AppData\Local\Temp\shelper.dll

C:\Users\PC Chef\AppData\Local\Temp\softonic-de3.exe

C:\Users\PC Chef\AppData\Local\Temp\softonic_s_de3.exe

C:\Users\PC Chef\AppData\Local\Temp\tbsoft.dll

C:\Users\PC Chef\AppData\Local\Temp\tmp19DC.exe

C:\Users\PC Chef\AppData\Local\Temp\tmp30CC.exe

C:\Users\PC Chef\AppData\Local\Temp\tmp4DFA.exe

C:\Users\PC Chef\AppData\Local\Temp\tmpABCB.exe

C:\Users\PC Chef\AppData\Local\Temp\tmpDC81.exe

C:\Users\PC Chef\AppData\Local\Temp\udll.dll

C:\Users\PC Chef\AppData\Local\Temp\ufddll.dll

C:\Users\PC Chef\AppData\Local\Temp\unrar.dll

C:\Users\PC Chef\AppData\Local\Temp\WISOMeinGeld2011SP1.exe

C:\Users\PC Chef\AppData\Local\Temp\WISOMeinGeld2012HF1.exe
 
 

==================== Known DLLs (Whitelisted) ================
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 

==================== Restore Points  =========================
 

Restore point made on: 2014-12-01 12:03:50

Restore point made on: 2014-12-07 01:38:24

Restore point made on: 2014-12-14 04:28:28

Restore point made on: 2014-12-21 07:36:32

Restore point made on: 2014-12-25 11:03:03
 

==================== Memory info =========================== 
 

Percentage of memory in use: 20%

Total physical RAM: 4095.24 MB

Available physical RAM: 3265.52 MB

Total Pagefile: 4093.39 MB

Available Pagefile: 3238.38 MB

Total Virtual: 8192 MB

Available Virtual: 8191.89 MB
 

==================== Drives ================================
 

Drive c: (OS) (Fixed) (Total:686.24 GB) (Free:595.6 GB) NTFS

Drive e: (HP_RECOVERY) (Fixed) (Total:12.3 GB) (Free:1.43 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Drive f: (Reparaturdatenträger Windows 7 6) (CDROM) (Total:0.33 GB) (Free:0 GB) UDF

Drive h: () (Removable) (Total:0.94 GB) (Free:0.94 GB) FAT

Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Drive y: (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 698.6 GB) (Disk ID: E2D5374C)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=686.2 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=12.3 GB) - (Type=07 NTFS)
 

========================================================

Disk: 2 (Size: 961 MB) (Disk ID: BB8CB236)

Partition 1: (Not Active) - (Size=961 MB) - (Type=06)
 
 

LastRegBack: 2014-12-25 11:04
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---
In der Scan-voreinstellung war die Option "List BCD" und "Drivers MD5" nicht angeklickt. Ich hab das so gelassen. Ich hoffe das ist so in Ordnung.

Hier die Fixlog.txt

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 26-12-2014

Ran by SYSTEM at 2014-12-27 19:58:08 Run:1

Running from H:\

Boot Mode: Recovery

==============================================
 

Content of fixlist:

*****************

HKLM-x32\...\Run: [] => [X]

HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1

HKU\Gerhard\...\Run: [Kohirienz] => C:\Users\Gerhard\AppData\Roaming\Ceqe\iwyrz.exe

C:\Users\Gerhard\AppData\Roaming\Ceqe

HKU\PC Chef\...\Run: [] => [X]

Emptytemp:

*****************
 

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\EnableShellExecuteHooks => value deleted successfully.

HKU\Gerhard\Software\Microsoft\Windows\CurrentVersion\Run\\Kohirienz => value deleted successfully.

"C:\Users\Gerhard\AppData\Roaming\Ceqe" => File/Directory not found.

HKU\PC Chef\Software\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.

Emptytemp: => Error: This directive works only outside recovery mode.
 

==== End of Fixlog 19:58:09 ====

Frst hab ich im normalen Modus als normal User Gerhard gestartet. Als Admin geht nicht. Er findet die Datei nicht.
Hier auch gleich noch die Logdatei. Nennt sich Addition.txt

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-12-2014

Ran by Gerhard at 2014-12-27 20:08:38

Running from F:\

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

2007 Microsoft Office system (HKLM-x32\...\PROHYBRIDR) (Version: 12.0.4518.1014 - Microsoft Corporation)

6300 (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden

6300_Help (x32 Version: 82.0.242.000 - Hewlett-Packard) Hidden

6300Trb (x32 Version: 82.0.242.000 - Hewlett-Packard) Hidden

64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden

ActiveCheck component for HP Active Support Library (x32 Version: 3.0.0.1 - Hewlett-Packard) Hidden

Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.246 - Adobe Systems Incorporated)

Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.246 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)

Agatha Christie - Death on the Nile (x32 Version: 2.2.0.82 - WildTangent) Hidden

AIO_CDB_ProductContext (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden

AIO_CDB_Software (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden

AIO_Scan (x32 Version: 130.0.421.000 - Hewlett-Packard) Hidden

ATI Catalyst Install Manager (HKLM\...\{F9F4430E-80DE-EC0F-BF8E-476352C8F954}) (Version: 3.0.765.0 - ATI Technologies, Inc.)

Audacity 1.2.6 (HKLM-x32\...\Audacity_is1) (Version:  - )

Avira (HKLM-x32\...\{e7c7c227-b742-4878-9425-f09bbf9951db}) (Version: 1.1.27.25527 - Avira Operations & Co. KG)

Avira (x32 Version: 1.1.27.25527 - Avira Operations & Co. KG) Hidden

Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)

Bejeweled 2 Deluxe (x32 Version: 2.2.0.82 - WildTangent) Hidden

Bing Bar (HKLM-x32\...\{77F8A71E-3515-4832-B8B2-2F1EDBD2E0F1}) (Version: 7.0.609.0 - Microsoft Corporation)

Blasterball 3 (x32 Version: 2.2.0.82 - WildTangent) Hidden

Bluesoleil 5.4.277.0 (HKLM\...\{FBBAB883-0BEE-4744-8062-281B213ADC1E}) (Version: 5.4.277.0 - IVT Corporation)

BufferChm (x32 Version: 130.0.331.000 - Hewlett-Packard) Hidden

Bus Driver (x32 Version: 2.2.0.82 - WildTangent) Hidden

ccc-core-static (x32 Version: 2010.0310.1824.32984 - ATI) Hidden

Chuzzle Deluxe (x32 Version: 2.2.0.82 - WildTangent) Hidden

Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)

Conduit Engine (HKLM-x32\...\conduitEngine) (Version: 6.2.3.0 - Conduit Ltd.) <==== ATTENTION

Copy (x32 Version: 130.0.428.000 - Hewlett-Packard) Hidden

CyberLink DVD Suite Deluxe (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 7.0.2712 - CyberLink Corp.)

DesignPro 5 (HKLM-x32\...\InstallShield_{F82C6574-AD88-4B40-A432-970BC77F1BD2}) (Version: 5.5.708 - Avery Dennison)

DesignPro 5 (x32 Version: 5.5.708 - Avery Dennison) Hidden

Destinations (x32 Version: 130.0.0.0 - Hewlett-Packard) Hidden

DeviceDiscovery (x32 Version: 130.0.465.000 - Hewlett-Packard) Hidden

DHTML Editing Component (HKLM-x32\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation)

Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.82 - WildTangent) Hidden

DocProc (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden

Dream Chronicles (x32 Version: 2.2.0.82 - WildTangent) Hidden

DVD Menu Pack for HP MediaSmart Video (HKLM-x32\...\InstallShield_{FB4BB287-37F9-4E27-9C4D-2D3882E08EFF}) (Version: 4.0.3715 - Hewlett-Packard)

DVD Menu Pack for HP MediaSmart Video (x32 Version: 4.0.3715 - Hewlett-Packard) Hidden

DVDVideoSoftTB Toolbar (HKLM-x32\...\DVDVideoSoftTB Toolbar) (Version:  - )

EAGLE 5.11.0 (HKLM-x32\...\EAGLE 5.11.0) (Version: 5.11.0 - CadSoft Computer GmbH)

ElsterFormular (HKLM-x32\...\ElsterFormular 13.2.0.8623u) (Version: 14.4.12044 - Landesfinanzdirektion Thüringen)

FATE (x32 Version: 2.2.0.82 - WildTangent) Hidden

Fax (x32 Version: 130.0.418.000 - Hewlett-Packard) Hidden

Gem Shop (x32 Version: 2.2.0.82 - WildTangent) Hidden

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.95 - Google Inc.)

Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden

Hardware Diagnostic Tools (HKLM\...\PC-Doctor for Windows) (Version: 6.0.5418.39 - PC-Doctor, Inc.)

HP Advisor (HKLM-x32\...\{40FB8D7C-6FF8-4AF2-BC8B-0B1DB32AF04B}) (Version: 3.4.12850.3526 - Hewlett-Packard)

HP Customer Participation Program 13.0 (HKLM\...\HPExtendedCapabilities) (Version: 13.0 - HP)

HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.0.80 - WildTangent)

HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)

HP MediaSmart DVD (HKLM-x32\...\InstallShield_{DCCAD079-F92C-44DA-B258-624FC6517A5A}) (Version: 4.0.3902 - Hewlett-Packard)

HP MediaSmart Music (HKLM-x32\...\InstallShield_{91A34181-9FAD-43AB-A35F-E7A8945B7E1C}) (Version: 4.0.3910 - Hewlett-Packard)

HP MediaSmart Photo (HKLM-x32\...\InstallShield_{6DAF8CDC-9B04-413B-A0F2-BCC13CF8A5BF}) (Version: 4.0.3911 - Hewlett-Packard)

HP MediaSmart SmartMenu (HKLM\...\{5B08AF35-B699-4A44-BB89-3E51E70611E8}) (Version: 3.1.1.12 - Hewlett-Packard)

HP MediaSmart Video (HKLM-x32\...\InstallShield_{D12E3E7F-1B13-4933-A915-16C7DD37A095}) (Version: 4.0.3911 - Hewlett-Packard)

HP Odometer (HKLM-x32\...\{B8AC1A89-FFD1-4F97-8051-E505A160F562}) (Version: 2.10.0000 - Hewlett-Packard)

HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP)

HP Photosmart Officejet and Deskjet All-In-One Driver Software 13.0 Rel. B (HKLM\...\{B61ED343-0B14-4241-999C-490CB1A20DA4}) (Version: 13.0 - HP)

HP Setup (HKLM-x32\...\{F5C7FD70-2C0A-401E-95E9-916363567DDA}) (Version: 1.2.4048.3310 - Hewlett-Packard)

HP Smart Web Printing 4.51 (HKLM\...\HP Smart Web Printing) (Version: 4.51 - HP)

HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)

HP Support Assistant (HKLM-x32\...\{495A8A3C-8FD0-4C46-9979-95C26181A1AB}) (Version: 4.3.1.2 - Hewlett-Packard)

HP Support Information (HKLM-x32\...\{B9A03B7B-E0FF-4FB3-BA83-762E58A1B0AA}) (Version: 10.1.0002 - Hewlett-Packard)

HP Update (HKLM-x32\...\{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}) (Version: 5.003.001.001 - Hewlett-Packard)

HPAsset component for HP Active Support Library (x32 Version: 3.0.0.3 - Hewlett-Packard) Hidden

HPDiagnosticAlert (x32 Version: 1.00.0000 - Microsoft) Hidden

HPPhotoGadget (x32 Version: 130.0.282.000 - Hewlett-Packard) Hidden

HPPhotoSmartDiscLabelContent1 (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden

HPPhotosmartEssential (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden

HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden

HPSSupply (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden

HydraVision (x32 Version: 4.2.162.0 - ATI Technologies Inc.) Hidden

Insaniquarium Deluxe (x32 Version: 2.2.0.82 - WildTangent) Hidden

Java 7 Update 10 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217010FF}) (Version: 7.0.100 - Oracle)

Java(TM) 6 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216031FF}) (Version: 6.0.310 - Oracle)

JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)

Jewel Quest II (x32 Version: 2.2.0.82 - WildTangent) Hidden

Jewel Quest Solitaire (x32 Version: 2.2.0.82 - WildTangent) Hidden

Junk Mail filter update (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden

LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.2610 - CyberLink Corp.)

LabelPrint (x32 Version: 2.5.2610 - CyberLink Corp.) Hidden

LAME v3.98.3 for Audacity (HKLM-x32\...\LAME for Audacity_is1) (Version:  - )

LightScribe System Software (HKLM-x32\...\{FA8BFB25-BF48-4F8B-8859-B30810745190}) (Version: 1.18.11.1 - LightScribe)

Magic Desktop (HKLM-x32\...\EasyBits Magic Desktop) (Version:  - EasyBits Software AS)

Mahjongg Artifacts (x32 Version: 2.2.0.82 - WildTangent) Hidden

MarketResearch (x32 Version: 130.0.374.000 - Hewlett-Packard) Hidden

McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)

Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft Office PowerPoint Viewer 2007 (German) (HKLM-x32\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218 (HKLM-x32\...\{E503B4BF-F7BB-3D5F-8BC8-F694B1CFF942}) (Version: 9.0.21022.218 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Works (HKLM-x32\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)

Movie Theme Pack for HP MediaSmart Video (HKLM-x32\...\InstallShield_{3023EBDA-BF1B-4831-B347-E5018555F26E}) (Version: 4.0.3715 - Hewlett-Packard)

Movie Theme Pack for HP MediaSmart Video (x32 Version: 4.0.3715 - Hewlett-Packard) Hidden

Mozilla Firefox 34.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)

Mozilla Thunderbird (3.0.1) (HKLM-x32\...\Mozilla Thunderbird (3.0.1)) (Version: 3.0.1 (de) - Mozilla)

MSVC80_x64_v2 (Version: 1.0.3.0 - Nokia) Hidden

MSVC80_x86_v2 (x32 Version: 1.0.3.0 - Nokia) Hidden

MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden

MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

MusicStation (HKLM-x32\...\MusicStationNetstaller) (Version: 1.0.0.116 - Hewlett-Packard)

Mystery P.I. - The Vegas Heist (x32 Version: 2.2.0.82 - WildTangent) Hidden

Network64 (Version: 130.0.572.000 - Hewlett-Packard) Hidden

Network64 (Version: 140.0.221.000 - Hewlett-Packard) Hidden

Nokia Connectivity Cable Driver (HKLM-x32\...\{29373274-977E-413C-A4DE-DC0F8E80C429}) (Version: 7.1.172.0 - Nokia)

Nokia Suite (HKLM-x32\...\Nokia Suite) (Version: 3.8.48.0 - Nokia)

Nokia Suite (x32 Version: 3.8.48.0 - Nokia) Hidden

OCR Software by I.R.I.S. 13.0 (HKLM\...\HPOCR) (Version: 13.0 - HP)

OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)

PC Connectivity Solution (HKLM-x32\...\{6D01D1B1-17BD-4F10-BB11-F08F0C47D42B}) (Version: 12.0.109.0 - Nokia)

Penguins! (x32 Version: 2.2.0.82 - WildTangent) Hidden

PhotoNow! (HKLM-x32\...\InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.1.6904 - CyberLink Corp.)

PhotoNow! (x32 Version: 1.1.6904 - CyberLink Corp.) Hidden

PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)

Polar Bowler (x32 Version: 2.2.0.82 - WildTangent) Hidden

Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.3810 - CyberLink Corp.)

Power2Go (x32 Version: 6.1.3810 - CyberLink Corp.) Hidden

PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 8.0.2704 - CyberLink Corp.)

PowerDirector (x32 Version: 8.0.2704 - CyberLink Corp.) Hidden

RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden

RealPlayer (HKLM-x32\...\RealPlayer 12.0) (Version:  - RealNetworks)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6196 - Realtek Semiconductor Corp.)

RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden

Recovery Manager (x32 Version: 5.5.2719 - CyberLink Corp.) Hidden

Scan (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden

Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 13.0 - HP)

Skype™ 6.2 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.2.106 - Skype Technologies S.A.)

Slingo Deluxe (x32 Version: 2.2.0.82 - WildTangent) Hidden

SmartWebPrinting (x32 Version: 130.0.457.000 - Hewlett-Packard) Hidden

softonic-de3 Toolbar (HKLM-x32\...\softonic-de3 Toolbar) (Version: 6.2.3.0 - softonic-de3) <==== ATTENTION

SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden

Status (x32 Version: 130.0.469.000 - Hewlett-Packard) Hidden

Taxpool-Buchhalter 6.24 (HKLM-x32\...\Taxpool-Buchhalter) (Version: 6.24 - psynetic® Software)

Taxpool-Buchhalter EÜR 8.00 (HKLM-x32\...\Taxpool-Buchhalter EÜR) (Version: 8.00 - psynetic® Software)

Testversion von Microsoft Office Home and Student 2007 (HKLM-x32\...\OfficeTrial) (Version:  - )

Toolbox (x32 Version: 130.0.648.000 - Hewlett-Packard) Hidden

TrayApp (x32 Version: 130.0.422.000 - Hewlett-Packard) Hidden

Turbo Lister 2 (HKLM-x32\...\{8927E07C-97F7-4A54-88FB-D976F50DD46E}) (Version: 2.00.0000 - eBay Inc.)

UnloadSupport (x32 Version: 11.0.0 - Hewlett-Packard) Hidden

Virtual Villagers - The Secret City (x32 Version: 2.2.0.82 - WildTangent) Hidden

WebReg (x32 Version: 130.0.132.017 - Hewlett-Packard) Hidden

Wedding Dash (x32 Version: 2.2.0.82 - WildTangent) Hidden

Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)

Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)

Windows Live Sync (HKLM-x32\...\{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}) (Version: 14.0.8089.726 - Microsoft Corporation)

Windows Live Upload Tool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)

Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)

Windows-Treiberpaket - Nokia pccsmcfd LegacyDriver  (05/31/2012 7.1.2.0) (HKLM\...\62BBD193ADFDBB228C7E1ADB56463F5732FF7F6F) (Version: 05/31/2012 7.1.2.0 - Nokia)

WISO Mein Geld 2014 Professional (HKLM-x32\...\WISO Mein Geld 2014 Professional) (Version:  - Buhl Data Service GmbH)

WISO Mein Geld 2014 Professional (x32 Version: 16.0.1.0 - Buhl Data Service GmbH) Hidden

WISO Steuer-Sparbuch 2011 (HKLM-x32\...\{02F0B8AE-7501-4333-AFBE-6BAABFEC7637}) (Version: 18.00.6928 - Buhl Data Service GmbH)

WISO Steuer-Sparbuch 2012 (HKLM-x32\...\{0CC1DAFB-40C8-4903-953D-471E541477C7}) (Version: 19.03.7334 - Buhl Data Service GmbH)

WISO Steuer-Sparbuch 2013 (HKLM-x32\...\{D6CC2FAF-F827-4091-96A1-D32CC9B69C79}) (Version: 20.00.8137 - Buhl Data Service GmbH)

WISO Steuer-Sparbuch 2014 (HKLM-x32\...\{DA5646AC-91BC-4918-8ED0-7D8A88E221A5}) (Version: 21.00.8480 - Buhl Data Service GmbH)

Zuma Deluxe (x32 Version: 2.2.0.82 - WildTangent) Hidden
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
 

==================== Restore Points  =========================
 

Check "winmgmt" service or repair WMI.
 
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => ?

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => ?

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => ?

Task: C:\Windows\Tasks\PCDRScheduledMaintenance.job => ?
 

==================== Loaded Modules (whitelisted) =============
 

2009-09-02 09:46 - 2009-09-02 09:46 - 00022016 _____ () C:\Windows\system32\BsTrace.dll

2008-03-07 13:54 - 2008-03-07 13:54 - 17892352 _____ () C:\Windows\system32\BsLangInDepRes.dll

2010-01-18 18:21 - 2010-01-18 18:21 - 00568888 _____ () C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe

2014-01-09 21:18 - 2014-07-02 09:13 - 01427736 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe

2010-01-12 20:49 - 2010-01-12 20:49 - 00098304 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll

2010-06-17 14:52 - 2010-06-17 14:52 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 
 

========================= Accounts: ==========================
 

Administrator (S-1-5-21-578626087-998674019-1617852334-500 - Administrator - Disabled)

Gast (S-1-5-21-578626087-998674019-1617852334-501 - Limited - Enabled)

Gerhard (S-1-5-21-578626087-998674019-1617852334-1003 - Limited - Enabled) => C:\Users\Gerhard

HomeGroupUser$ (S-1-5-21-578626087-998674019-1617852334-1002 - Limited - Enabled)

PC Chef (S-1-5-21-578626087-998674019-1617852334-1000 - Administrator - Enabled) => C:\Users\TEMP
 

==================== Faulty Device Manager Devices =============
 

Name: Officejet 6300 series

Description: Officejet 6300 series

Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}

Manufacturer: HP

Service: 

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 

Name: Officejet 6300 series

Description: Officejet 6300 series

Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}

Manufacturer: HP

Service: StillCam

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (12/26/2014 07:20:49 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: Boweber)

Description: Das Profil konnte nicht erfolgreich geladen werden, aber Sie wurden mit dem standardmäßigen Profil für das System angemeldet. 
 

 Details - Zugriff verweigert
 

Error: (12/26/2014 07:19:44 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: Boweber)

Description: Das Profil konnte nicht erfolgreich geladen werden, aber Sie wurden mit dem standardmäßigen Profil für das System angemeldet. 
 

 Details - Zugriff verweigert
 

Error: (12/25/2014 08:02:51 PM) (Source: VSS) (EventID: 8193) (User: )

Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "ConvertStringSidToSid(S-1-5-21-578626087-998674019-1617852334-1000.bak)" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070539, Die Struktur der Sicherheitskennung ist unzulässig.

.
 
 

Vorgang:

   OnIdentify-Ereignis

   Generatordaten werden gesammelt
 

Kontext:

   Ausführungskontext: Shadow Copy Optimization Writer

   Generatorklassen-ID: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}

   Generatorname: Shadow Copy Optimization Writer

   Generatorinstanz-ID: {39767622-f17b-4e90-8ab0-da5e8f42bf9f}
 

Error: (12/25/2014 07:16:28 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: Boweber)

Description: Das Profil konnte nicht erfolgreich geladen werden, aber Sie wurden mit dem standardmäßigen Profil für das System angemeldet. 
 

 Details - Zugriff verweigert
 

Error: (12/24/2014 03:22:42 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: Boweber)

Description: Das Profil konnte nicht erfolgreich geladen werden, aber Sie wurden mit dem standardmäßigen Profil für das System angemeldet. 
 

 Details - Zugriff verweigert
 

Error: (12/24/2014 03:16:49 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1500) (User: Boweber)

Description: Sie konnten nicht angemeldet werden, da das lokal gespeicherte Profil nicht geladen werden konnte. Überprüfen Sie, ob eine Netzwerkverbindung besteht und das Netzwerk ordnungsgemäß funktioniert. 
 

 Details - Zugriff verweigert
 

Error: (12/24/2014 03:08:59 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: Boweber)

Description: Das Profil konnte nicht erfolgreich geladen werden, aber Sie wurden mit dem standardmäßigen Profil für das System angemeldet. 
 

 Details - Zugriff verweigert
 

Error: (12/24/2014 03:08:03 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: Boweber)

Description: Das Profil konnte nicht erfolgreich geladen werden, aber Sie wurden mit dem standardmäßigen Profil für das System angemeldet. 
 

 Details - Zugriff verweigert
 

Error: (12/24/2014 03:04:55 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: Boweber)

Description: Das Profil konnte nicht erfolgreich geladen werden, aber Sie wurden mit dem standardmäßigen Profil für das System angemeldet. 
 

 Details - Zugriff verweigert
 

Error: (12/24/2014 03:04:48 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: Boweber)

Description: Das Profil konnte nicht erfolgreich geladen werden, aber Sie wurden mit dem standardmäßigen Profil für das System angemeldet. 
 

 Details - Zugriff verweigert
 
 

System errors:

=============

Error: (12/26/2014 07:23:56 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet: 

%%1115
 

Error: (12/26/2014 07:23:56 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "BsHelpCS" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (12/26/2014 07:23:56 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst BsHelpCS erreicht.
 

Error: (12/26/2014 07:23:56 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "Diagnosediensthost" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1069
 

Error: (12/26/2014 07:23:56 PM) (Source: Service Control Manager) (EventID: 7038) (User: )

Description: Der Dienst "WdiServiceHost" konnte sich nicht als "NT AUTHORITY\LocalService" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 

%%50
 

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
 

Error: (12/26/2014 07:23:56 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "Anwendungserfahrung" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1115
 

Error: (12/26/2014 07:23:56 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "Netzwerklistendienst" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1069
 

Error: (12/26/2014 07:23:56 PM) (Source: Service Control Manager) (EventID: 7038) (User: )

Description: Der Dienst "netprofm" konnte sich nicht als "NT AUTHORITY\LocalService" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 

%%50
 

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
 

Error: (12/26/2014 07:23:56 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "Diagnosediensthost" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1069
 

Error: (12/26/2014 07:23:56 PM) (Source: Service Control Manager) (EventID: 7038) (User: )

Description: Der Dienst "WdiServiceHost" konnte sich nicht als "NT AUTHORITY\LocalService" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 

%%50
 

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
 
 

Microsoft Office Sessions:

=========================

Error: (07/21/2014 09:19:11 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.6612.1000. This session lasted 30346 seconds with 540 seconds of active time.  This session ended with a crash.
 
 

==================== Memory info =========================== 
 

Processor: Pentium(R) Dual-Core CPU E5400 @ 2.70GHz

Percentage of memory in use: 36%

Total physical RAM: 4095.24 MB

Available physical RAM: 2587.09 MB

Total Pagefile: 8188.66 MB

Available Pagefile: 6396.86 MB

Total Virtual: 8192 MB

Available Virtual: 8191.84 MB
 

==================== Drives ================================
 

Drive c: (OS) (Fixed) (Total:686.24 GB) (Free:594.89 GB) NTFS

Drive d: (HP_RECOVERY) (Fixed) (Total:12.3 GB) (Free:1.43 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Drive f: () (Removable) (Total:0.94 GB) (Free:0.94 GB) FAT
 

==================== MBR & Partition Table ==================
 

==================== End Of Log ============================