Trojaner-Board - Win 7: Rechner friert ein

Hi Schrauber,

danke, dass du mir hilfst.

Ich geh also mal davon aus, dass ich den Scan auch im abgesicherten Modus mache...

hier die FRST-Log:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 28-01-2015 01

Ran by Tomsk (administrator) on APPARAT on 29-01-2015 19:12:54

Running from C:\Users\Tomsk\Desktop

Loaded Profiles: Tomsk (Available profiles: Tomsk & Gast)

Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser: FF)

Boot Mode: Safe Mode (with Networking)

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

HKLM\...\Run: [NvMediaCenter] => RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

HKLM\...\Run: [PWMTRV] => rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWMTR32V.DLL,PwrMgrBkGndMonitor

HKLM\...\Run: [atchk] => C:\Program Files\Intel\AMT\atchk.exe [401408 2009-11-30] (Intel Corporation)

HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-08-07] (Intel Corporation)

HKLM\...\Run: [TpShocks] => C:\Windows\system32\TpShocks.exe [337256 2011-03-29] (Lenovo.)

HKLM\...\Run: [SoundMAXPnP] => C:\Program Files\Analog Devices\Core\smax4pnp.exe [1314816 2009-05-18] (Analog Devices, Inc.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2379504 2013-04-24] (Synaptics Incorporated)

HKLM\...\Run: [hpqSRMon] => C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)

HKLM\...\Run: [FreePDF Assistant] => C:\Program Files\FreePDF_XP\fpassist.exe [373760 2013-03-14] (shbox.de)

HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-26] (AVAST Software)

Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (UPEK Inc.)

Lsa: [Notification Packages] scecli C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk

ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk

ShortcutTarget: Bluetooth.lnk -> C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software)

ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll (Autodesk, Inc.)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\S-1-5-21-1575497497-273483109-2788137214-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

HKU\S-1-5-21-1575497497-273483109-2788137214-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: IePasswordManagerHelper Class -> {BF468356-BB7E-42D7-9F15-4F3B9BCFCED2} -> C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll (Lenovo Group Limited)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)

BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Tomsk\AppData\Roaming\Mozilla\Firefox\Profiles\7aw1kt3n.default

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_296.dll ()

FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin: @videolan.org/vlc,version=2.1.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Extension: Flashblock - C:\Users\Tomsk\AppData\Roaming\Mozilla\Firefox\Profiles\7aw1kt3n.default\Extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} [2014-12-10]

FF Extension: WOT - C:\Users\Tomsk\AppData\Roaming\Mozilla\Firefox\Profiles\7aw1kt3n.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-28]

FF Extension: DownloadHelper - C:\Users\Tomsk\AppData\Roaming\Mozilla\Firefox\Profiles\7aw1kt3n.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-09-06]

FF Extension: NoScript - C:\Users\Tomsk\AppData\Roaming\Mozilla\Firefox\Profiles\7aw1kt3n.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-05-10]

FF Extension: Adblock Plus - C:\Users\Tomsk\AppData\Roaming\Mozilla\Firefox\Profiles\7aw1kt3n.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-11-21]

FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-12-10]

FF HKU\S-1-5-21-1575497497-273483109-2788137214-1000\...\Firefox\Extensions: [{F74D5734-46F5-4B16-96F0-1E7FBF41B750}] - C:\Program Files\Lenovo\Client Security Solution\PWM Firefox Extension\2.0b12

FF Extension: ThinkVantage Password Manager - C:\Program Files\Lenovo\Client Security Solution\PWM Firefox Extension\2.0b12 [2012-08-24]

FF HKU\S-1-5-21-1575497497-273483109-2788137214-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
 

========================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S3 Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2014-01-25] (Adobe Systems) [File not signed]

S4 Adobe Version Cue CS2; c:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe [163840 2005-04-06] (Adobe Systems Incorporated) [File not signed]

S2 atchksrv; C:\Program Files\Intel\AMT\atchksrv.exe [176128 2009-11-30] (Intel Corporation) [File not signed]

S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-11-26] (AVAST Software)

S3 FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [1064752 2014-02-24] (Flexera Software LLC)

S3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed]

S4 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed]

S2 HPSLPSVC; C:\Program Files\HP\Digital Imaging\bin\HPSLPSVC32.DLL [694784 2009-09-20] (Hewlett-Packard Co.) [File not signed]

S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]

S2 LENOVO.MICMUTE; C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe [45496 2011-04-04] (Lenovo Group Limited)

S2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [93032 2010-04-07] (Lenovo Group Limited)

S2 LMS; C:\Program Files\Intel\AMT\LMS.exe [114688 2009-11-30] (Intel Corporation) [File not signed]

S2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]

S2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]

S3 PwmEWSvc; C:\Program Files\ThinkPad\Utilities\PWMEWSVC.EXE [1665120 2012-05-16] (Lenovo Group Limited)

S3 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)

S2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)

S3 SystemExplorerHelpService; C:\Program Files\System Explorer\service\SystemExplorerService.exe [567256 2012-11-25] (Mister Group)

S2 TPHKLOAD; C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe [130920 2011-04-20] (Lenovo Group Limited)

S2 TSSCoreService; C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe [988472 2011-12-13] (Lenovo)

S2 UNS; C:\Program Files\Intel\AMT\UNS.exe [1458176 2009-11-30] (Intel Corporation) [File not signed]

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-11-26] ()

S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [70384 2014-11-26] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81768 2014-11-26] (AVAST Software)

S0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-11-26] ()

S1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [787800 2014-11-26] (AVAST Software)

S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423784 2014-11-26] (AVAST Software)

S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [91496 2014-11-26] (AVAST Software)

S0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [206248 2014-11-26] ()

R3 NETwLv32; C:\Windows\System32\DRIVERS\NETwLv32.sys [6639616 2010-10-07] (Intel Corporation)

S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_x86.sys [16024 2013-12-06] (Secunia)

S2 smihlp; C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [12560 2009-03-13] (UPEK Inc.)

S3 swmx01; C:\Windows\system32\drivers\swmx01.sys [72576 2007-04-10] (Sierra Wireless Inc.)

S3 SWUMX01; C:\Windows\system32\drivers\swumx01.sys [70656 2007-01-12] (Sierra Wireless Inc.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)

S3 catchme; \??\C:\Users\Tomsk\AppData\Local\Temp\catchme.sys [X]

U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation)
 

==================== NetSvcs (Whitelisted) ===================
 
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-01-29 19:12 - 2015-01-29 19:13 - 00012784 _____ () C:\Users\Tomsk\Desktop\FRST.txt

2015-01-29 19:12 - 2015-01-29 19:12 - 00000000 ____D () C:\FRST

2015-01-29 18:58 - 2015-01-29 17:07 - 1412431872 _____ () C:\Users\Tomsk\Desktop\linuxmint-17.1-cinnamon-32bit.iso

2015-01-29 18:56 - 2015-01-29 18:57 - 01088905 _____ (pendrivelinux.com) C:\Users\Tomsk\Downloads\Universal-USB-Installer-1.9.5.9.exe

2015-01-29 18:18 - 2015-01-29 18:20 - 00000000 _____ () C:\Windows\Explorer.EXE.Z-missing.txt

2015-01-29 17:59 - 2015-01-29 17:59 - 00380416 _____ () C:\Users\Tomsk\Desktop\Gmer-19357.exe

2015-01-29 17:58 - 2015-01-29 17:58 - 01121792 _____ (Farbar) C:\Users\Tomsk\Desktop\FRST.exe

2015-01-29 17:58 - 2015-01-29 17:58 - 00050477 _____ () C:\Users\Tomsk\Desktop\Defogger.exe

2015-01-28 19:36 - 2015-01-28 19:36 - 01488384 _____ () C:\Users\Tomsk\Downloads\msxml6.msi

2015-01-26 21:31 - 2015-01-26 21:31 - 00000000 ____D () C:\Program Files\Mozilla Firefox

2015-01-26 21:05 - 2015-01-29 17:36 - 00001243 _____ () C:\Windows\setupact.log

2015-01-26 21:05 - 2015-01-26 21:05 - 00000000 _____ () C:\Windows\setuperr.log

2015-01-25 19:20 - 2015-01-25 19:21 - 02194432 _____ () C:\Users\Tomsk\Downloads\adwcleaner_4.109.exe

2015-01-21 22:26 - 2015-01-21 22:26 - 00000000 ____D () C:\Program Files\Common Files\Java

2015-01-15 22:43 - 2015-01-16 19:10 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird

2015-01-14 18:53 - 2014-12-19 03:43 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll

2015-01-14 18:53 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe

2015-01-14 18:53 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2015-01-14 18:53 - 2014-12-11 18:47 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe

2015-01-14 18:52 - 2014-12-19 02:34 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys

2015-01-14 18:52 - 2014-12-06 04:50 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll

2015-01-05 22:32 - 2015-01-05 22:33 - 02347384 _____ (ESET) C:\Users\Tomsk\Downloads\esetsmartinstaller_deu.exe
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-01-29 19:02 - 2010-11-20 22:01 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI

2015-01-29 18:33 - 2014-05-09 12:17 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-01-29 17:51 - 2013-11-21 16:59 - 01941399 _____ () C:\Windows\WindowsUpdate.log

2015-01-29 17:44 - 2009-07-14 05:34 - 00028720 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-01-29 17:44 - 2009-07-14 05:34 - 00028720 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-01-29 17:37 - 2014-01-05 12:37 - 00000000 ____D () C:\Users\Tomsk\AppData\Local\FreePDF_XP

2015-01-29 17:36 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-01-29 16:31 - 2014-06-29 19:31 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-01-29 09:03 - 2009-07-14 05:53 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2015-01-27 19:23 - 2014-12-20 18:06 - 00000000 ____D () C:\Users\Tomsk\Desktop\USB

2015-01-27 19:20 - 2013-12-06 16:20 - 00000000 ____D () C:\Users\Tomsk\Documents\5_AUTO

2015-01-27 19:19 - 2014-06-03 12:29 - 00000000 ____D () C:\Users\Tomsk\Documents\15_SOIERN

2015-01-27 19:18 - 2014-01-09 10:46 - 00000000 ____D () C:\Users\Tomsk\Documents\11_MISC

2015-01-27 19:05 - 2013-11-21 22:39 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service

2015-01-27 15:20 - 2014-07-06 18:06 - 00000000 ____D () C:\Users\Tomsk\Documents\16_HOCHZEIT

2015-01-26 21:51 - 2010-11-20 22:48 - 00215502 _____ () C:\Windows\PFRO.log

2015-01-26 21:50 - 2014-11-04 19:40 - 00000000 ____D () C:\AdwCleaner

2015-01-26 21:48 - 2014-06-29 13:52 - 00000000 ____D () C:\Users\Tomsk\Documents\1_DIPLOM

2015-01-25 10:57 - 2013-11-22 20:09 - 00000000 ____D () C:\Users\Tomsk\dwhelper

2015-01-25 10:32 - 2012-08-24 12:23 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2015-01-25 10:32 - 2012-08-24 12:23 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2015-01-21 22:27 - 2013-12-04 16:27 - 00000000 ____D () C:\Program Files\Java

2015-01-21 22:25 - 2014-12-20 08:58 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll

2015-01-14 23:43 - 2014-12-11 10:09 - 00000000 ____D () C:\Windows\system32\MRT

2015-01-14 23:40 - 2013-11-25 07:33 - 110348472 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2015-01-14 11:12 - 2013-12-09 11:25 - 00000000 ____D () C:\Users\Tomsk\Documents\3_ALPINER STUDIENPLATZ

2015-01-06 17:20 - 2014-02-12 14:40 - 00007600 _____ () C:\Users\Tomsk\AppData\Local\Resmon.ResmonCfg

2015-01-06 04:36 - 2012-08-24 12:39 - 00249488 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2015-01-05 21:02 - 2009-07-14 05:33 - 00367016 _____ () C:\Windows\system32\FNTCACHE.DAT

2015-01-05 19:52 - 2013-11-21 17:13 - 00097616 _____ () C:\Users\Tomsk\AppData\Local\GDIPFONTCACHEV1.DAT
 

==================== Files in the root of some directories =======
 

2013-09-20 13:02 - 2013-09-20 13:02 - 153313362 _____ () C:\Program Files\openoffice1.cab

2013-09-20 13:00 - 2013-09-20 13:00 - 2269184 _____ () C:\Program Files\openoffice401.msi

2013-09-20 13:00 - 2013-09-20 13:00 - 0475136 _____ () C:\Program Files\setup.exe

2013-09-20 13:00 - 2013-09-20 13:00 - 0000279 _____ () C:\Program Files\setup.ini

2013-11-25 14:25 - 2014-11-21 16:31 - 0017408 _____ () C:\Users\Tomsk\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2014-02-12 14:40 - 2015-01-06 17:20 - 0007600 _____ () C:\Users\Tomsk\AppData\Local\Resmon.ResmonCfg

2013-11-25 15:53 - 2014-10-10 06:22 - 0002115 _____ () C:\ProgramData\hpzinstall.log

2014-02-24 16:48 - 2014-02-24 16:48 - 0000147 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
 

Some content of TEMP:

====================

C:\Users\Tomsk\AppData\Local\Temp\jre-8u31-windows-au.exe

C:\Users\Tomsk\AppData\Local\Temp\Quarantine.exe

C:\Users\Tomsk\AppData\Local\Temp\sqlite3.dll
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2015-01-24 10:38
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

und hier Addition:

Code:

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 28-01-2015 01

Ran by Tomsk at 2015-01-29 19:13:45

Running from C:\Users\Tomsk\Desktop

Boot Mode: Safe Mode (with Networking)

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

32 Bit HP CIO Components Installer (Version: 7.1.8 - Hewlett-Packard) Hidden

7-Zip 9.20 (HKLM\...\7-Zip) (Version:  - )

Adobe Creative Suite 2 (HKLM\...\{0134A1A1-C283-4A47-91A1-92F19F960372}) (Version:  - )

Adobe Flash Player 16 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 16.0.0.296 - Adobe Systems Incorporated)

Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.10) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)

Adobe SVG Viewer 3.0 (HKLM\...\Adobe SVG Viewer) (Version:  3.0 - Adobe Systems, Inc.)

AIO_Scan (Version: 130.0.365.000 - Hewlett-Packard) Hidden

Any Video Converter 5.7.6 (HKLM\...\Any Video Converter_is1) (Version:  - Any-Video-Converter.com)

Anzeige am Bildschirm (HKLM\...\OnScreenDisplay) (Version: 6.42.00 - )

Apple Application Support (HKLM\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)

Audacity 2.0.5 (HKLM\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)

AutoCAD Map 3D 2011 Language Pack - Deutsch (Version: 14.0.045.0 - Autodesk) Hidden

Autodesk DWG TrueView 2015 - English (HKLM\...\DWG TrueView 2015 - English) (Version: 20.0.51.0 - Autodesk)

Avast Free Antivirus (HKLM\...\Avast) (Version: 10.0.2208 - AVAST Software)

BufferChm (Version: 130.0.331.000 - Hewlett-Packard) Hidden

C5200 (Version: 130.0.365.000 - Hewlett-Packard) Hidden

C5200_Help (Version: 100.0.206.000 - Hewlett-Packard) Hidden

Canon IJ Scan Utility (HKLM\...\Canon_IJ_Scan_Utility) (Version:  - ‪Canon Inc.‬)

Canon MG4200 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG4200_series) (Version: 1.02 - Canon Inc.)

CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.3.4643 - CDBurnerXP)

Client Security - Password Manager (HKLM\...\{18554B3F-46EA-40A9-B4EA-7EEE83C0559D}) (Version: 8.30.0052.00 - Lenovo Group Limited)

Copy (Version: 130.0.428.000 - Hewlett-Packard) Hidden

D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden

Defraggler (HKLM\...\Defraggler) (Version: 2.17 - Piriform)

Destinations (Version: 130.0.0.0 - Hewlett-Packard) Hidden

DeviceDiscovery (Version: 130.0.465.000 - Hewlett-Packard) Hidden

Dienstprogramm "ThinkPad UltraNav" (HKLM\...\{17CBC505-D1AE-459D-B445-3D2000A85842}) (Version: 2.13.0 - Lenovo)

DocProc (Version: 13.0.0.0 - Hewlett-Packard) Hidden

DWG TrueView 2015 - English (Version: 20.0.51.0 - Autodesk) Hidden

Energie-Manager (HKLM\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 6.32 - )

ESET Online Scanner v3 (HKLM\...\ESET Online Scanner) (Version:  - )

FARO LS 1.1.406.58 (HKLM\...\{951B0F30-9F1A-4BF6-B3DA-99EB0E917B1C}) (Version: 4.6.58.2 - FARO Scanner Production)

FARO LS 1.1.501.0 (HKLM\...\{8F196892-666A-4A40-8587-6AE38F78A5C2}) (Version: 5.1.0.30630 - FARO Scanner Production)

Fax (Version: 130.0.418.000 - Hewlett-Packard) Hidden

Fotogalerie (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

FreePDF (Remove only) (HKLM\...\FreePDF_XP) (Version:  - )

GPBaseService2 (Version: 130.0.371.000 - Hewlett-Packard) Hidden

GPL Ghostscript (HKLM\...\GPL Ghostscript 9.10) (Version: 9.10 - Artifex Software Inc.)

HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)

HP Photosmart All-In-One Driver Software 13.0 Rel. 2 (HKLM\...\{988329F4-A1A1-4D51-803C-EF2725A97627}) (Version: 13.0 - HP)

HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP)

HP Smart Web Printing 4.51 (HKLM\...\HP Smart Web Printing) (Version: 4.51 - HP)

HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)

HP Update (HKLM\...\{7059BDA7-E1DB-442C-B7A1-6144596720A4}) (Version: 4.000.011.006 - Hewlett-Packard)

HPPhotoGadget (Version: 130.0.282.000 - Hewlett-Packard) Hidden

HPPhotoSmartDiscLabel_PaperLabel (Version: 2.04.0000 - Hewlett-Packard) Hidden

HPPhotoSmartDiscLabel_PrintOnDisc (Version: 2.04.0000 - Hewlett-Packard) Hidden

HPPhotoSmartDiscLabelContent1 (Version: 2.04.0000 - Hewlett-Packard) Hidden

hpphotosmartdisclabelplugin (Version: 2.04.0000 - Hewlett-Packard) Hidden

HPPhotosmartEssential (Version: 2.04.0000 - Hewlett-Packard) Hidden

HPProductAssistant (Version: 130.0.371.000 - Hewlett-Packard) Hidden

Intel(R) Active Management Technology Device Software (HKLM\...\MESOL) (Version:  - )

Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1867 - Intel Corporation)

Intel(R) PROSet/Wireless WiFi-Software (HKLM\...\{D75AEB5B-FA18-4BD4-9EED-54CA46DB5AE8}) (Version: 13.04.0000 - Intel Corporation)

Intel(R) TV Wizard (HKLM\...\TVWiz) (Version:  - Intel Corporation)

Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)

IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.37 - Irfan Skiljan)

Java 8 Update 31 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)

Lenovo Auto Scroll Utility (HKLM\...\LenovoAutoScrollUtility) (Version: 1.00 - )

Lenovo Patch Utility (HKLM\...\{6E6E7725-C7BC-4C39-8B3F-14B67331A120}) (Version: 1.3.0.9 - Lenovo Group Limited)

Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.04.05 - )

Lenovo System Interface Driver (HKLM\...\LENOVO.SMIIF) (Version: 1.05 - )

Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)

Message Center (HKLM\...\{E7E836B8-4BDD-454F-82E6-5FEA17C83AD4}) (Version: 2.01g - )

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft SQL Server 2012 Native Client  (HKLM\...\{83C7F964-AC58-4104-B613-B4D0F61DA8CD}) (Version: 11.0.2100.60 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Movie Maker (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Mozilla Firefox 35.0.1 (x86 de) (HKLM\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)

Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)

Mozilla Thunderbird 31.4.0 (x86 de) (HKLM\...\Mozilla Thunderbird 31.4.0 (x86 de)) (Version: 31.4.0 - Mozilla)

MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (HKLM\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (KB2758694) (HKLM\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)

Network (Version: 130.0.572.000 - Hewlett-Packard) Hidden

NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version:  - NVIDIA Corporation)

OCR Software by I.R.I.S. 13.0 (HKLM\...\HPOCR) (Version: 13.0 - HP)

OpenOffice 4.1.1 (HKLM\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)

ORCA AVA (HKLM\...\{AB5D7FCD-BFE6-4DE2-92D6-7C2FB97E0F2F}) (Version: 20.0.2.115 - ORCA Software GmbH)

PS_AIO_02_ProductContext (Version: 130.0.365.000 - Hewlett-Packard) Hidden

PS_AIO_02_Software (Version: 130.0.365.000 - Hewlett-Packard) Hidden

PS_AIO_02_Software_Min (Version: 130.0.365.000 - Hewlett-Packard) Hidden

RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version:  - )

Scan (Version: 13.0.0.0 - Hewlett-Packard) Hidden

Secunia PSI (3.0.0.9016) (HKLM\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)

Sierra Wireless HSDPA MiniCard (HKLM\...\{D2A6CB42-8327-4167-AB04-F4A15658F2BF}) (Version: 7.0.2.1300 - Sierra Wireless Inc)

Sierra Wireless MC57xx Package for Access Connections (Version: 6.30.0.3 - Sierra Wireless) Hidden

SmartWebPrinting (Version: 130.0.457.000 - Hewlett-Packard) Hidden

SolutionCenter (Version: 130.0.373.000 - Hewlett-Packard) Hidden

SoundMAX (HKLM\...\{F0A37341-D692-11D4-A984-009027EC0A9C}) (Version: 6.10.1.7255 - Analog Devices)

Status (Version: 130.0.469.000 - Hewlett-Packard) Hidden

Suite Specific (Version: 2.0.0 - Adobe Systems, Incorporated) Hidden

System Explorer 4.6.0 (HKLM\...\{40F485F7-6478-4896-B0D5-F94BE677EB78}_is1) (Version:  - Mister Group)

ThinkPad Bluetooth with Enhanced Data Rate Software (HKLM\...\{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}) (Version: 6.2.1.3100 - Broadcom Corporation)

ThinkPad FullScreen Magnifier (HKLM\...\ThinkPad FullScreen Magnifier) (Version: 2.30 - )

ThinkPad Modem (HKLM\...\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_10140588) (Version: 7.62.00 - )

ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.19.7 - )

ThinkVantage Active Protection System (HKLM\...\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}) (Version: 1.75 - Lenovo)

ThinkVantage Fingerprint Software (HKLM\...\{502EE63C-9A62-4330-8F8B-1EAB51B7BB46}) (Version: 5.9.4.6882 - UPEK Inc.)

Toolbox (Version: 130.0.648.000 - Hewlett-Packard) Hidden

TrayApp (Version: 130.0.422.000 - Hewlett-Packard) Hidden

UnloadSupport (Version: 11.0.0 - Hewlett-Packard) Hidden

VBA (2627.01) (Version: 6.03.00.9402 - Microsoft Corporation) Hidden

Visual C++ 2008 x86 Runtime - v9.0.30729.01 (HKLM\...\{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01) (Version: 9.0.30729.01 - Microsoft Corporation)

VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)

WebReg (Version: 130.0.132.017 - Hewlett-Packard) Hidden

Winamp (HKLM\...\Winamp) (Version: 5.66  - Nullsoft, Inc)

Windows Driver Package - Broadcom (BTHUSB) Bluetooth  (04/08/2010 6.3.5.430) (HKLM\...\2004BB9EB6CEA02846881BEF1F51C11F7A90C9D6) (Version: 04/08/2010 6.3.5.430 - Broadcom)

Windows Driver Package - Broadcom HIDClass  (07/28/2009 6.2.0.9800) (HKLM\...\BF20603967CFDCB2BBF91950E8A56DFBC5C833FE) (Version: 07/28/2009 6.2.0.9800 - Broadcom)

Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 

CustomCLSID: HKU\S-1-5-21-1575497497-273483109-2788137214-1000_Classes\CLSID\{49E0BE0A-39E0-4932-B7BE-F249D56ACD31}\InprocServer32 -> csp16.dll No File

CustomCLSID: HKU\S-1-5-21-1575497497-273483109-2788137214-1000_Classes\CLSID\{6A221957-2D85-42A7-8E19-BE33950D1DEB}\localserver32 -> C:\Program Files\Autodesk\Autodesk AutoCAD Map 3D 2014\acad.exe No File

CustomCLSID: HKU\S-1-5-21-1575497497-273483109-2788137214-1000_Classes\CLSID\{6D7AE628-FF41-4CD3-91DD-34825BB1A251}\localserver32 -> C:\Program Files\AutoCAD Map 3D 2011\acad.exe /Automation No File

CustomCLSID: HKU\S-1-5-21-1575497497-273483109-2788137214-1000_Classes\CLSID\{7DE1BE5C-CEBA-4F1D-ACBC-9CE11EE9A2A1}\localserver32 -> C:\Program Files\Autodesk\Autodesk AutoCAD Map 3D 2014\acad.exe /Automation No File

CustomCLSID: HKU\S-1-5-21-1575497497-273483109-2788137214-1000_Classes\CLSID\{b2b568c8-3712-4a75-b806-4b3c2fdb06d5}\localserver32 -> C:\Users\Tomsk\AppData\Local\Temp\{e9513610-f218-4dda-b954-2c7e6ba7cabb}\IDriver.NonElevated.exe No  (the data entry has 4 more characters).

CustomCLSID: HKU\S-1-5-21-1575497497-273483109-2788137214-1000_Classes\CLSID\{BD0DEB94-63DB-4392-9420-6EEE05094B1F}\localserver32 -> C:\Program Files\Autodesk\Autodesk AutoCAD Map 3D 2014\acad.exe /Automation No File

CustomCLSID: HKU\S-1-5-21-1575497497-273483109-2788137214-1000_Classes\CLSID\{C92FB640-AD4D-498A-9979-A51A2540C977}\localserver32 -> C:\Program Files\AutoCAD Map 3D 2011\acad.exe /Automation No File

CustomCLSID: HKU\S-1-5-21-1575497497-273483109-2788137214-1000_Classes\CLSID\{D70E31AD-2614-49F2-B0FC-ACA781D81F3E}\localserver32 -> C:\Program Files\AutoCAD Map 3D 2011\acad.exe No File

CustomCLSID: HKU\S-1-5-21-1575497497-273483109-2788137214-1000_Classes\CLSID\{E2C40589-DE61-11ce-BAE0-0020AF6D7005}\InprocServer32 -> C:\Program Files\AutoCAD Map 3D 2011\acadficn.dll No File
 

==================== Restore Points  =========================
 

28-01-2015 20:08:57 Geplanter Prüfpunkt
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 03:04 - 2014-07-21 18:28 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {24176BD0-1659-4EF3-9E02-DAF2C2D63AD6} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-11-26] (AVAST Software)

Task: {267CDBAE-730F-4417-8101-56801CD7BA30} - System32\Tasks\PMTask => C:\Program Files\ThinkPad\Utilities\PWMIDTSV.EXE [2012-05-16] (Lenovo Group Limited)

Task: {47EB6B8A-56AA-4081-9125-290212DE6B02} - System32\Tasks\{2A8F1736-3476-4806-97A8-E203F6AE3CDB} => pcalua.exe -a C:\Users\Administrator\Desktop\T61\WIN7\7qwc02ww.exe -d C:\Users\Administrator\Desktop\T61\WIN7

Task: {6C79E00A-E4AC-4290-AA7A-643C7A8F2269} - System32\Tasks\{D7EEF3C0-8DF3-4E43-AD22-4ABB109DF6BA} => pcalua.exe -a C:\Users\Tomsk\Downloads\AutodeskDesignRevSetup.exe -d C:\Users\Tomsk\Downloads

Task: {76E50089-E7CE-4247-ACDD-D98F93A3B110} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-25] (Adobe Systems Incorporated)

Task: {8ED88C38-B411-49F0-956D-5EE0261375DC} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)

Task: {9A7B1FEE-57DE-479D-8C16-C1D52F27C701} - System32\Tasks\{438E5CAA-23DA-4B28-AE65-478AE9C8A4F0} => pcalua.exe -a C:\Users\Tomsk\AppData\Local\Temp\jre-8u31-windows-au.exe -d C:\Windows\system32 -c /installmethod=jau FAMILYUPGRADE=1

Task: {BD191D21-0441-4F32-AA93-08C6866D2C96} - System32\Tasks\{9B784AB5-0637-4871-811C-EF871A30A64D} => pcalua.exe -a "C:\Users\Tomsk\Downloads\CS 2\CS2_RetNon_Ger_3.exe" -d "C:\Users\Tomsk\Downloads\CS 2"

Task: {CB515E01-D37D-4757-8B4D-ACCFFAB295F0} - System32\Tasks\{F45CDC61-9FEA-48C7-A272-C6A98E05777A} => pcalua.exe -a C:\Users\Administrator\Desktop\T61\WIN7\7mwc03ww.exe -d C:\Users\Administrator\Desktop\T61\WIN7

Task: {CC234712-BEB7-4794-B7B9-62E35FD16905} - System32\Tasks\{ADB40A55-6EC8-4F9D-B6B9-12AA4EE8F4E4} => pcalua.exe -a "C:\Users\Tomsk\Downloads\CS 2\CS2_RetNon_Ger_2.exe" -d "C:\Users\Tomsk\Downloads\CS 2"

Task: {F0A4850A-4054-4A76-B41B-2CABF8698050} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => c:\Program Files\Microsoft Security Client\MpCmdRun.exe
 

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
 

==================== Loaded Modules (whitelisted) =============
 

2015-01-26 21:31 - 2015-01-26 21:31 - 03925104 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 

AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxldtlfudivq`qsp`26hfm
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="2"
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk => C:\Windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup

MSCONFIG\startupreg: Adobe Version Cue CS2 => "c:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe"

MSCONFIG\startupreg: HP Software Update => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
 

========================= Accounts: ==========================
 

Administrator (S-1-5-21-1575497497-273483109-2788137214-500 - Administrator - Disabled)

Gast (S-1-5-21-1575497497-273483109-2788137214-501 - Limited - Enabled) => C:\Users\Gast

HomeGroupUser$ (S-1-5-21-1575497497-273483109-2788137214-1002 - Limited - Enabled)

Tomsk (S-1-5-21-1575497497-273483109-2788137214-1000 - Administrator - Enabled) => C:\Users\Tomsk
 

==================== Faulty Device Manager Devices =============
 

Name: avast! VM Monitor

Description: avast! VM Monitor

Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}

Manufacturer: 

Service: aswVmm

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 

Name: Security Processor Loader Driver

Description: Security Processor Loader Driver

Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}

Manufacturer: 

Service: spldr

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 

Name: avast! Revert

Description: avast! Revert

Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}

Manufacturer: 

Service: aswRvrt

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (01/29/2015 05:55:16 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (01/29/2015 05:37:30 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (01/29/2015 05:37:06 PM) (Source: LMS) (EventID: 2) (User: NT-AUTORITÄT)

Description: LMS Service cannot connect to HECI driver
 

Error: (01/29/2015 05:26:23 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (01/29/2015 09:04:32 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (01/29/2015 09:04:10 AM) (Source: LMS) (EventID: 2) (User: NT-AUTORITÄT)

Description: LMS Service cannot connect to HECI driver
 

Error: (01/28/2015 08:34:51 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: PSIA.exe, Version: 3.0.0.9016, Zeitstempel: 0x52a1d50f

Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea91c

Ausnahmecode: 0xc0000005

Fehleroffset: 0x00056018

ID des fehlerhaften Prozesses: 0xb28

Startzeit der fehlerhaften Anwendung: 0xPSIA.exe0

Pfad der fehlerhaften Anwendung: PSIA.exe1

Pfad des fehlerhaften Moduls: PSIA.exe2

Berichtskennung: PSIA.exe3
 

Error: (01/28/2015 07:17:20 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (01/28/2015 07:16:48 PM) (Source: LMS) (EventID: 2) (User: NT-AUTORITÄT)

Description: LMS Service cannot connect to HECI driver
 

Error: (01/27/2015 09:51:33 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 

System errors:

=============

Error: (01/29/2015 07:12:20 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 

Error: (01/29/2015 07:12:20 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 

Error: (01/29/2015 07:12:20 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 

Error: (01/29/2015 07:12:15 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 

Error: (01/29/2015 07:12:15 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 

Error: (01/29/2015 07:12:15 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 

Error: (01/29/2015 07:12:15 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 

Error: (01/29/2015 07:12:15 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 

Error: (01/29/2015 07:12:15 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 

Error: (01/29/2015 07:07:19 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 
 

Microsoft Office Sessions:

=========================

Error: (01/29/2015 05:55:16 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (01/29/2015 05:37:30 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (01/29/2015 05:37:06 PM) (Source: LMS) (EventID: 2) (User: NT-AUTORITÄT)

Description: LMS Service cannot connect to HECI driver
 

Error: (01/29/2015 05:26:23 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (01/29/2015 09:04:32 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (01/29/2015 09:04:10 AM) (Source: LMS) (EventID: 2) (User: NT-AUTORITÄT)

Description: LMS Service cannot connect to HECI driver
 

Error: (01/28/2015 08:34:51 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: PSIA.exe3.0.0.901652a1d50fntdll.dll6.1.7601.18247521ea91cc000000500056018b2801d03b271174e932C:\Program Files\Secunia\PSI\PSIA.exeC:\Windows\SYSTEM32\ntdll.dllba05b4b6-a724-11e4-a427-001e37d0f414
 

Error: (01/28/2015 07:17:20 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (01/28/2015 07:16:48 PM) (Source: LMS) (EventID: 2) (User: NT-AUTORITÄT)

Description: LMS Service cannot connect to HECI driver
 

Error: (01/27/2015 09:51:33 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Core(TM)2 Duo CPU T7100 @ 1.80GHz

Percentage of memory in use: 22%

Total physical RAM: 3046.3 MB

Available physical RAM: 2346.13 MB

Total Pagefile: 6088.83 MB

Available Pagefile: 5472.19 MB

Total Virtual: 2047.88 MB

Available Virtual: 1886.13 MB
 

==================== Drives ================================
 

Drive c: (Windows) (Fixed) (Total:63.93 GB) (Free:14.95 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 74.5 GB) (Disk ID: 0A7034EB)

Partition 1: (Not Active) - (Size=10.6 GB) - (Type=27)

Partition 2: (Active) - (Size=63.9 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================