Trojaner-Board
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Laptop fährt hoch, CPU-Auslastung dauerhaft 100% und hängt sich dann auf; im abgesicherten Modus alles ok (https://www.trojaner-board.de/168743-laptop-faehrt-hoch-cpu-auslastung-dauerhaft-100-haengt-dann-abgesicherten-modus-alles-ok.html)

noki 16.07.2015 09:03
Laptop fährt hoch, CPU-Auslastung dauerhaft 100% und hängt sich dann auf; im abgesicherten Modus alles ok
 
Hi,

mein Laptop ist schon 7-8 Jahre alt und es ist auch ne Menge drauf, aber seit ein paar Tagen bekomme ich das Ding kaum noch zum Laufen.

Ich fahre ihn hoch, dann rattert das Ding ohne Ende bei dauerhafter 100% Auslastung der CPU. Laut Task Manager hauptsächlich mehrere svchost.exe - Prozesse. Irgendwann bleibt er dann einfach stehen oder es kommt Blue Screen.

Im Abgesicherten Modus ist alles ok. Anbei 2 Log-Files. GMER bekomme ich leider nicht zum Laufen.



Reicht euch das für die erste Diagnose?

cosinus 16.07.2015 09:07
Hi und :hallo:

Logs bitte nicht anhängen, notfalls splitten und über mehrere Postings verteilt posten

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

noki 16.07.2015 09:47
FRST.txt:
FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-07-2015
Ran by noki (administrator) on NOKI-PC on 16-07-2015 00:54:05
Running from D:\
Loaded Profiles: noki & postgres (Available Profiles: noki & postgres)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Geeks to Go Forum
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
() C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
() C:\Program Files\ASUS\ATK Hotkey\AsLdrSrv.exe
() C:\Program Files\ATKGFNEX\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\HControl.exe
() C:\Program Files\Wireless Console 2\wcourier.exe
(ATK) C:\Program Files\P4G\BatteryLife.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
() C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1db.exe
(MAGIX AG) C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
(ASUS) C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\KBFiltr.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\WDC.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files\P4P\P4P.exe
(ASUSTek.) C:\Program Files\ASUS\Direct Console\Direct Console.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
() C:\Program Files\Dell Printers\OpenManage\OMPMv2.0\client\OMPMWatchdogService.exe
(Dell Inc.) C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1pl.exe
(Nuance Communications, Inc.) C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe
(Nuance Communications, Inc.) C:\Program Files\Nuance\PaperPort\pptd40nt.exe
(Nuance Communications, Inc.) C:\Program Files\Nuance\PDFViewer\PdfPro7Hook.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(TomTom) C:\Program Files\MyDrive Connect\MyDriveConnect.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\8.4\bin\pg_ctl.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Panasonic Corporation) C:\Program Files\Common Files\Panasonic\HD Writer AutoStart\HDWriterAutoStart.exe
(Logitech Inc.) C:\Program Files\SetPoint\SetPoint.exe
() C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\8.4\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\8.4\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\8.4\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\8.4\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\8.4\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\8.4\bin\postgres.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Microsoft Corporation) C:\Windows\System32\iashost.exe
(Logitech Inc.) C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Nokia) C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
(Nokia) C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
(Nokia) C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Nokia) C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe

==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [HControlUser] => C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe [98304 2008-08-18] (ASUS)
HKLM\...\Run: [ATKOSD2] => C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe [8105984 2008-09-03] (ASUS)
HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [6265376 2008-08-12] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1029416 2007-12-06] (Synaptics, Inc.)
HKLM\...\Run: [PowerForPhone] => C:\Program Files\P4P\P4P.exe [778240 2008-01-26] ()
HKLM\...\Run: [DirectConsole2] => C:\Program Files\ASUS\Direct Console\Direct Console.exe [2705976 2008-08-21] (ASUSTek.)
HKLM\...\Run: [TrayServer] => C:\Program Files\MAGIX\Filme_auf_DVD_8\TrayServer.exe [90112 2008-01-17] (MAGIX AG)
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] => C:\Windows\KHALMNPR.EXE [56080 2007-04-12] (Logitech Inc.)
HKLM\...\Run: [ALDI_NORD_FotoSuite_Download] => C:\Program Files\ALDI Nord Foto Service\ALDI_Foto_Service\FotoSuite.exe [1257472 2008-11-13] (MAGIX AG)
HKLM\...\Run: [NeroFilterCheck] => C:\Windows\system32\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)
HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1833504 2008-08-12] (Realtek Semiconductor Corp.)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-04-23] (Apple Inc.)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [730416 2015-06-10] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Greenshot] => C:\Program Files\Greenshot\Greenshot.exe [495616 2013-10-27] (Greenshot)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-05-26] (Apple Inc.)
HKLM\...\Run: [LauncherC1765nf] => C:\Program Files\Dell Printers\Printer SSW\Launcher\dlm1launcher.exe [2471928 2013-08-13] (Dell Inc.)
HKLM\...\Run: [StatusAutoRunC1765nf] => C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1pl.exe [3024360 2013-02-06] (Dell Inc.)
HKLM\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\\isuspm.exe [2068856 2011-10-12] (Flexera Software LLC.)
HKLM\...\Run: [PaperPort PTD] => C:\Program Files\Nuance\PaperPort\pptd40nt.exe [36168 2013-05-29] (Nuance Communications, Inc.)
HKLM\...\Run: [IndexSearch] => C:\Program Files\Nuance\PaperPort\IndexSearch.exe [18248 2013-05-29] (Nuance Communications, Inc.)
HKLM\...\Run: [PPort14reminder] => C:\Program Files\Nuance\PaperPort\Ereg\Ereg.exe [330056 2013-03-14] (Nuance Communications, Inc.)
HKLM\...\Run: [PDFProHook] => C:\Program Files\Nuance\PDFViewer\pdfpro7hook.exe [641864 2013-03-20] (Nuance Communications, Inc.)
HKLM\...\Run: [InstallValidator.exe.FA87EC44_C38F_4148_93A1_FF4A64A2B707] => C:\Program Files\National Instruments\Shared\NIUninstaller\InstallValidator.exe [265608 2013-11-21] ()
HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
HKU\S-1-5-21-1619064115-466689268-4177747022-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-1619064115-466689268-4177747022-1000\...\Run: [] => [X]
HKU\S-1-5-21-1619064115-466689268-4177747022-1000\...\Run: [NokiaSuite.exe] => C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe [1084840 2012-05-16] (Nokia)
HKU\S-1-5-21-1619064115-466689268-4177747022-1000\...\Run: [MyDriveConnect.exe] => C:\Program Files\MyDrive Connect\MyDriveConnect.exe [1792376 2014-08-22] (TomTom)
HKU\S-1-5-21-1619064115-466689268-4177747022-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk [2009-03-25]
ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2008-12-04]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HD Writer.lnk [2013-03-29]
ShortcutTarget: HD Writer.lnk -> C:\Program Files\Common Files\Panasonic\HD Writer AutoStart\HDWriterAutoStart.exe (Panasonic Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SetPoint.lnk [2008-12-04]
ShortcutTarget: SetPoint.lnk -> C:\Program Files\SetPoint\SetPoint.exe (Logitech Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk [2014-12-21]
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files\WISO\Steuersoftware 2014\mshaktuell.exe ()
ShellIconOverlayIdentifiers: [ADSMOverlayIcon] -> {A825576B-0042-4F0F-8FB0-93CE0F054E69} => C:\Program Files\ASUS\ASUS Data Security Manager\OverlayIconShlExt.dll [2007-06-15] ()
ShellIconOverlayIdentifiers: [ADSMOverlayIcon1] -> {A8D448F4-0431-45AC-9F5E-E1B434AB2249} => C:\Program Files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll [2007-06-02] ()
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1619064115-466689268-4177747022-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Google
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = MSN Deutschland ? mit Hotmail Nachfolger Outlook und Messenger Skype
HKU\S-1-5-21-1619064115-466689268-4177747022-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1619064115-466689268-4177747022-1000\Software\Microsoft\Internet Explorer\Main,Start Page = Wetter aktuell, Wettervorhersage und Wetterbericht - WetterOnline
SearchScopes: HKLM -> DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = {searchTerms} - Google Search
SearchScopes: HKLM -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = {searchTerms} - Google Search
SearchScopes: HKU\S-1-5-21-1619064115-466689268-4177747022-1000 -> DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = {searchTerms} - Google Search
SearchScopes: HKU\S-1-5-21-1619064115-466689268-4177747022-1000 -> {42F85EF5-86CF-4D1F-B473-ACDA9AD99AC8} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=93c032c4-0bf8-430e-ad40-0dc3b271a391&apn_sauid=0A1FD2C1-4874-4C04-BADE-CB4863AF08D4
SearchScopes: HKU\S-1-5-21-1619064115-466689268-4177747022-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = {searchTerms} - Google Search
BHO: PlusIEEventHelper Class -> {551A852F-39A6-44A7-9C13-AFBEC9185A9D} -> C:\Program Files\Nuance\PDFViewer\Bin\PlusIEContextMenu.dll [2011-06-30] (Zeon Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-05-21] (Oracle Corporation)
BHO: Skype Plug-In -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-11-22] (Skype Technologies S.A.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-05-21] (Oracle Corporation)
Toolbar: HKU\S-1-5-21-1619064115-466689268-4177747022-1000 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
DPF: {22E5D91F-89E6-4405-AD9C-0AF27BA6F06B} file:///E:/components/hidinputmonitorx.ocx
DPF: {4F63D44B-6274-4D60-8AB1-CAA7116B8AF3} file:///E:/components/A9.ocx
DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1375990510233
DPF: {7030CC6C-1A88-4591-BB5A-651B9F7F0C30} file:///E:/components/wmvhdrating.ocx
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-11-22] (Skype Technologies S.A.)
ShellExecuteHooks:  - {AEB6717E-7E19-11d0-97EE-00C04FD91972} -  No File [ ]
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2012-12-02] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2012-12-02] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2012-12-02] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2012-12-02] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2012-12-02] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2012-12-02] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2012-12-02] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2012-12-02] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 20 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2012-12-02] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{FEA61DD9-6138-4BB7-83A2-5A1E647F7064}: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\noki\AppData\Roaming\Mozilla\Firefox\Profiles\p25m8g9e.default
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Ask.com
FF Homepage: hxxp://www.wetteronline.de
FF Keyword.URL:
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_191.dll [2015-07-09] ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2014-02-21] ()
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-21] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-21] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-30] (Microsoft Corporation)
FF Plugin: @nokia.com/EnablerPlugin -> C:\Program Files\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll [2012-05-16] ( )
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-04-30] (Adobe Systems Inc.)
FF Plugin: ZEON/PDF,version=2.0 -> C:\Program Files\Nuance\PDFViewer\bin\nppdf.dll [2011-07-15] (Zeon Corporation)
FF Plugin HKU\S-1-5-21-1619064115-466689268-4177747022-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin1017325.dll [2012-10-04] (Amazon.com, Inc.)
FF Extension: Avira Browser Safety - C:\Users\noki\AppData\Roaming\Mozilla\Firefox\Profiles\p25m8g9e.default\Extensions\abs@avira.com [2015-06-18]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-02-17]
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\itms.js [2015-05-03]
Chrome:
=======
CHR Profile: C:\Users\noki\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\noki\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-08-25]
CHR Extension: (Google Search) - C:\Users\noki\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-08-25]
CHR Extension: (Gmail) - C:\Users\noki\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-08-25]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [68096 2009-03-25] () [File not signed]
R2 ADSMService; C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe [73728 2007-05-18] () [File not signed]
R2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc.exe [825136 2015-06-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [450808 2015-06-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [450808 2015-06-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1187336 2015-06-10] (Avira Operations GmbH & Co. KG)
R2 ASLDRService; C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe [100920 2008-08-14] ()
R2 ATKGFNEXSrv; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [94208 2007-08-08] () [File not signed]
R2 DLNBDB; C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1db.exe [191464 2013-02-06] ()
R2 Fabs; C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe [1155072 2009-02-03] (MAGIX AG) [File not signed]
S3 FirebirdServerMAGIXInstance; C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2008-08-07] (MAGIX®) [File not signed]
R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728 2008-06-09] (Hewlett-Packard Company) [File not signed]
S2 OMPM Service; C:\Program Files\Dell Printers\OpenManage\OMPMv2.0\client\rdmf_clientd.exe [5738823 2014-03-06] () [File not signed]
S2 OMPMJBASSVC; C:\Program Files\Dell Printers\OpenManage\OMPMv2.0\server\jboss-as\bin\jbosssvc.exe [61440 2011-08-11] (Red Hat®, Inc.) [File not signed]
R2 OMPMWatchdogService; C:\Program Files\Dell Printers\OpenManage\OMPMv2.0\client\OMPMWatchdogService.exe [199633 2014-03-18] () [File not signed]
R2 PDFProFiltSrvPP; C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe [77640 2013-05-29] (Nuance Communications, Inc.)
R2 postgresql-8.4; C:\Program Files\PostgreSQL\8.4\bin\pg_ctl.exe [66048 2012-08-16] (PostgreSQL Global Development Group) [File not signed]
R2 spmgr; C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe [125496 2007-08-03] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-21] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 61883; C:\Windows\System32\DRIVERS\61883.sys [45696 2008-01-21] (Microsoft Corporation)
R0 AsDsm; C:\Windows\system32\Drivers\AsDsm.sys [29752 2007-08-11] (Windows (R) Codename Longhorn DDK provider)
R2 ASMMAP; C:\Program Files\ATKGFNEX\ASMMAP.sys [13880 2007-07-24] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108448 2015-06-10] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136728 2015-06-10] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37896 2015-05-07] (Avira Operations GmbH & Co. KG)
R2 ghaio; C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys [20936 2007-08-03] ()
S3 GigasetGenericUSB; C:\Windows\System32\DRIVERS\GigasetGenericUSB.sys [44032 2009-02-20] (Siemens Home and Office Communication Devices GmbH & Co. KG)
R3 itecir; C:\Windows\System32\DRIVERS\itecir.sys [54784 2007-12-19] (ITE Tech. Inc. )
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15928 2008-06-03] ( )
R0 lullaby; C:\Windows\System32\DRIVERS\lullaby.sys [15416 2008-05-29] (Windows (R) Codename Longhorn DDK provider)
R3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [28688 2007-04-12] (Logitech, Inc.)
R3 MTsensor; C:\Windows\System32\DRIVERS\ATKACPI.sys [7680 2006-12-14] (ATK0100)
S3 PhotoFrame; C:\Windows\System32\DRIVERS\PhotoFrame.sys [30464 2007-09-11] (ETC) [File not signed]
R0 PxHelp20; C:\Windows\System32\Drivers\PxHelp20.sys [45744 2011-10-04] (Rovi Corporation)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1748352 2008-06-09] ()
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [31848 2015-06-10] (Avira Operations GmbH & Co. KG)
S3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [25984 2009-12-12] (The OpenVPN Project)
S3 USB28xxBGA; C:\Windows\System32\DRIVERS\emBDA.sys [530944 2008-03-06] (eMPIA Technology, Inc.)
S3 USB28xxOEM; C:\Windows\System32\DRIVERS\emOEM.sys [45696 2007-04-25] (eMPIA Technology, Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\Users\noki\AppData\Local\Temp\catchme.sys [X]
S4 Eskgfroc; No ImagePath
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-15 23:56 - 2015-07-15 23:56 - 00004880 ____N C:\bootex.log
2015-07-15 23:52 - 2015-07-15 23:52 - 00000000 __SHD C:\found.002
2015-07-15 23:14 - 2015-07-15 23:14 - 00160408 _____ C:\Windows\Minidump\Mini071515-01.dmp
2015-07-15 23:09 - 2015-06-23 18:02 - 00501248 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-07-15 22:49 - 2015-07-15 22:49 - 00000000 ____D C:\Users\noki\Documents\SapWorkDir
2015-07-15 22:28 - 2015-05-31 10:11 - 00225792 _____ (Microsoft Corporation) C:\Windows\system32\cewmdm.dll
2015-07-15 22:27 - 2015-07-16 00:54 - 00000000 ____D C:\FRST
2015-07-15 22:24 - 2015-07-15 22:24 - 00000000 _____ C:\Users\noki\defogger_reenable
2015-07-11 09:40 - 2015-07-11 09:40 - 00160408 _____ C:\Windows\Minidump\Mini071115-01.dmp
2015-07-08 22:09 - 2015-07-08 22:09 - 00160408 _____ C:\Windows\Minidump\Mini070815-01.dmp
2015-06-29 13:15 - 2015-06-29 13:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-06-25 20:04 - 2015-06-25 20:04 - 00000000 __SHD C:\found.001
2015-06-25 07:37 - 2015-06-25 07:55 - 00000000 ___RD C:\Musik
2015-06-24 23:39 - 2015-06-24 23:39 - 00000000 __RSH C:\MSDOS.SYS
2015-06-24 23:39 - 2015-06-24 23:39 - 00000000 __RSH C:\IO.SYS
2015-06-19 20:35 - 2015-06-19 20:35 - 00160408 _____ C:\Windows\Minidump\Mini061915-01.dmp
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-16 00:50 - 2013-07-28 01:07 - 00000000 ____D C:\Windows\system32\MRT
2015-07-16 00:48 - 2010-11-19 14:55 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-07-16 00:48 - 2010-11-19 14:55 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-07-16 00:42 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-16 00:41 - 2006-11-02 15:01 - 00032606 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-07-16 00:35 - 2008-12-04 21:13 - 01517376 _____ C:\Windows\WindowsUpdate.log
2015-07-16 00:26 - 2012-04-06 09:10 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-07-16 00:01 - 2009-02-11 00:55 - 00151688 _____ C:\ProgramData\nvModes.001
2015-07-16 00:01 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-07-16 00:01 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-07-15 23:59 - 2009-02-11 00:54 - 00151688 _____ C:\ProgramData\nvModes.dat
2015-07-15 23:25 - 2014-07-28 13:45 - 00000000 _____ C:\sparkraw.log
2015-07-15 23:14 - 2010-01-16 01:49 - 00000000 ____D C:\Windows\Minidump
2015-07-15 23:13 - 2013-03-21 22:13 - 454217748 _____ C:\Windows\MEMORY.DMP
2015-07-15 22:56 - 2009-02-08 23:40 - 00114168 _____ C:\Users\noki\AppData\Local\GDIPFONTCACHEV1.DAT
2015-07-15 22:56 - 2006-11-02 14:47 - 00399544 _____ C:\Windows\system32\FNTCACHE.DAT
2015-07-15 22:50 - 2010-07-08 15:19 - 00000000 ____D C:\Program Files\OpenVPN
2015-07-15 22:49 - 2010-07-13 16:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Business Explorer
2015-07-15 22:49 - 2010-07-13 16:02 - 00000000 ____D C:\Users\noki\SapWorkDir
2015-07-15 22:27 - 2006-11-02 12:33 - 01567488 _____ C:\Windows\system32\PerfStringBackup.INI
2015-07-15 22:24 - 2009-02-08 23:39 - 00000000 ____D C:\Users\noki
2015-07-14 09:07 - 2008-12-04 21:14 - 00003613 _____ C:\Windows\bthservsdp.dat
2015-07-12 23:09 - 2009-02-12 00:34 - 00000000 ____D C:\Users\noki\AppData\Roaming\Adobe
2015-07-12 23:09 - 2009-02-08 23:43 - 00000000 ____D C:\ProgramData\Adobe
2015-07-09 07:23 - 2012-04-06 09:10 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-07-09 07:23 - 2011-05-16 08:44 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-07-07 08:08 - 2013-12-09 20:51 - 00000000 ____D C:\Users\noki\AppData\Local\Greenshot
2015-07-03 08:49 - 2006-11-02 12:24 - 127070192 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2015-07-01 07:02 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\LogFiles
2015-06-29 13:15 - 2015-05-07 19:11 - 00001856 _____ C:\Users\Public\Desktop\Avira Antivirus.lnk
2015-06-23 13:27 - 2009-10-02 22:08 - 00246952 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-06-20 20:03 - 2014-08-25 12:33 - 00000000 ____D C:\Users\noki\AppData\Local\Adobe
==================== Files in the root of some directories =======
2007-06-12 20:34 - 2007-06-12 20:34 - 0035822 _____ () C:\Program Files\Common Files\ASPG_icon.ico
2008-05-22 19:35 - 2008-05-22 19:35 - 0051962 _____ () C:\Program Files\Common Files\banner.jpg
2008-08-09 00:48 - 2008-08-09 00:48 - 0090112 _____ () C:\Program Files\Common Files\CPInstallAction.dll
2014-05-15 23:10 - 2014-05-15 23:10 - 0000008 _____ () C:\Users\noki\AppData\Roaming\NMM-MetaData.db
2011-07-20 22:28 - 2012-06-03 17:36 - 0001188 _____ () C:\Users\noki\AppData\Local\crc32list11.txt
2010-03-14 13:04 - 2010-03-14 13:04 - 0000552 _____ () C:\Users\noki\AppData\Local\d3d8caps.dat
2013-01-13 13:53 - 2015-06-15 13:57 - 0000680 _____ () C:\Users\noki\AppData\Local\d3d9caps.dat
2009-02-09 00:23 - 2015-04-12 23:33 - 0103936 _____ () C:\Users\noki\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-02-22 22:44 - 2013-05-10 12:11 - 0004096 ____H () C:\Users\noki\AppData\Local\keyfile3.drm
2013-08-27 22:12 - 2013-08-27 22:12 - 0000011 _____ () C:\ProgramData\.tv7
2010-12-22 13:54 - 2010-12-22 13:54 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2009-02-11 00:55 - 2015-07-16 00:01 - 0151688 _____ () C:\ProgramData\nvModes.001
2009-02-11 00:54 - 2015-07-15 23:59 - 0151688 _____ () C:\ProgramData\nvModes.dat
Some files in TEMP:
====================
C:\Users\noki\AppData\Local\temp\A12003E4-7CB1-49C0-BD80-700AF775A509.exe
C:\Users\noki\AppData\Local\temp\avgnt.exe
C:\Users\noki\AppData\Local\temp\BBDEBD21-36D1-47A6-B80E-22B5655A2521.exe
C:\Users\noki\AppData\Local\temp\jre-7u11-windows-i586-iftw.exe
C:\Users\noki\AppData\Local\temp\jre-7u21-windows-i586-iftw.exe
C:\Users\noki\AppData\Local\temp\jre-7u51-windows-i586-iftw.exe
C:\Users\noki\AppData\Local\temp\jre-7u55-windows-i586-iftw.exe
C:\Users\noki\AppData\Local\temp\jre-7u67-windows-i586-iftw.exe
C:\Users\noki\AppData\Local\temp\jre-7u71-windows-i586-iftw.exe
C:\Users\noki\AppData\Local\temp\jre-8u31-windows-au.exe
C:\Users\noki\AppData\Local\temp\NOSEventMessages.dll
C:\Users\noki\AppData\Local\temp\SapSmartDel.exe
C:\Users\noki\AppData\Local\temp\vcredist_x86.exe
C:\Users\noki\AppData\Local\temp\_isF1ED.exe

==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-07-16 00:04
==================== End of log ============================
--- --- ---


FRST Additions Logfile:
[CODE]Additional
FRST Logfile:
Code:
scan result of Farbar Recovery Scan Tool (x86) Version: 12-07-2015
Ran by noki at 2015-07-16 00:55:15
Running from D:\
Boot Mode: Normal
==========================================================
 
==================== Accounts: =============================
Administrator (S-1-5-21-1619064115-466689268-4177747022-500 - Administrator - Disabled)
Gast (S-1-5-21-1619064115-466689268-4177747022-501 - Limited - Disabled)
noki (S-1-5-21-1619064115-466689268-4177747022-1000 - Administrator - Enabled) => C:\Users\noki
postgres (S-1-5-21-1619064115-466689268-4177747022-1001 - Limited - Enabled) => C:\Users\postgres
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 17 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 17.0.0.191 - Adobe Systems Incorporated)
Adobe Flash Player 18 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 18.0.0.203 - Adobe Systems Incorporated)
Adobe Photoshop CS (HKLM\...\{EFB21DE7-8C19-4A88-BB28-A766E16493BC}) (Version: CS - Adobe Systems, Inc.)
Adobe Reader X (10.1.14) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.14 - Adobe Systems Incorporated)
Albelli Fotobücher (HKU\S-1-5-21-1619064115-466689268-4177747022-1000\...\{EE20E438-B675-4421-AB07-928F0EC9FB22}_is1) (Version: - Albelli)
ALDI NORD Bestellsoftware 4.13 (HKLM\...\ALDI NORD Bestellsoftware) (Version: 4.13 - ORWO Net)
ALDI Nord Foto Manager Free (HKLM\...\ALDI Nord Foto Manager Free D) (Version: 6.0.1.471 - MAGIX AG)
ALDI Nord Foto Service (HKLM\...\ALDI Nord Foto Service D) (Version: 1.13.0.111 - MAGIX AG)
ALDI Nord Online Druck Service (HKLM\...\ALDI Nord Online Druck Service D) (Version: 4.5.1.0 - MAGIX AG)
Amazon MP3-Downloader 1.0.17 (HKLM\...\Amazon MP3-Downloader) (Version: 1.0.17 - Amazon Services LLC)
Apple Application Support (HKLM\...\{D9DAD0FF-495A-472B-9F10-BAE430A26682}) (Version: 3.0.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{18D47FA1-0440-48D3-A7E0-DA09537FF471}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ASUS CopyProtect (HKLM\...\{6B77A7F6-DD63-4F13-A6FF-83137A5AC354}) (Version: 1.0.0008 - ASUS)
ASUS Data Security Manager (HKLM\...\{1C8521E5-5A7B-4A4E-A9CD-AD53116EAEE0}) (Version: 1.00.0006 - ASUS)
ASUS LifeFrame3 (HKLM\...\{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}) (Version: 3.0.13 - ASUS)
ASUS Live Update (HKLM\...\{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}) (Version: 2.5.6 - ASUS)
ASUS Power4Gear eXtreme (HKLM\...\{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}) (Version: 1.0.19 - ASUS)
ASUS SmartLogon (HKLM\...\{64452561-169F-4A36-A2FF-B5E118EC65F5}) (Version: 1.0.0005 - ASUS)
ASUS Virtual Camera (HKLM\...\{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}) (Version: 1.0.11 - ASUS)
ATK Generic Function Service (HKLM\...\{D3D54F3E-C5C3-443D-978F-87A72E5616E8}) (Version: 1.00.0008 - ATK)
ATK Hotkey (HKLM\...\{7C05592D-424B-46CB-B505-E0013E8E75C9}) (Version: 1.0.0042 - ASUS)
ATKOSD2 (HKLM\...\{3B05F2FB-745B-4012-ADF2-439F36B2E70B}) (Version: 7.0.0002 - ASUS)
Audacity 1.2.6 (HKLM\...\Audacity_is1) (Version: - )
AudibleManager (HKLM\...\AudibleManager) (Version: 49582374.-2.1996386486.1996385500 - Audible, Inc.)
Avira Antivirus (HKLM\...\Avira Antivirus) (Version: 15.0.11.579 - Avira Operations GmbH & Co. KG)
Bild Albelli Fotoservice (HKU\S-1-5-21-1619064115-466689268-4177747022-1000\...\{4E97552A-D0D2-47E3-B4A0-82E5A57A4198}_is1) (Version: - Bild Albelli)
CCleaner (HKLM\...\CCleaner) (Version: 3.01 - Piriform)
CDDRV_Installer (Version: 1.00.0000 - Logitech) Hidden
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Dell C1765 Color MFP (HKLM\...\InstallShield_{B03A2793-A8FF-4242-B23D-88D2D5FAE56A}) (Version: 1.039.0 - Dell Inc.)
Dell C1765 Color MFP (Version: 1.039.0 - Dell Inc.) Hidden
Direct Console 2.0 (HKLM\...\{E616A5EE-B7F4-4807-800B-79EB4EB2182B}) (Version: 2.0.5 - ASUS)
Dolby Control Center (HKLM\...\{A23E5590-6799-437B-9723-2627BA800B6F}) (Version: 2.0.0706 - Dolby)
Express Gate (HKLM\...\{2862A3C1-0CD9-4D8B-A28C-8C337D4DD5EB}) (Version: 0.8.6.0 - devicevm)
Firebird SQL Server - MAGIX Edition (HKLM\...\{3E6F0CAD-EE38-42A5-9EEA-AE17A55BF2D4}) (Version: 2.1.23.0 - MAGIX AG)
FormatFactory 2.20 (HKLM\...\FormatFactory) (Version: 2.20 - Free Time)
Free M4a to MP3 Converter 8.2 (HKLM\...\Free M4a to MP3 Converter_is1) (Version: - ManiacTools.com)
Gigaset QuickSync (HKLM\...\{7b7e564b-0c70-4506-9ab6-b7a2044425ab}) (Version: 5.1.0001.14719 - Gigaset Communications GmbH)
Google Earth Plug-in (HKLM\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.28.1 - Google Inc.) Hidden
Greenshot 1.1.6.2779 (HKLM\...\Greenshot_is1) (Version: 1.1.6.2779 - Greenshot)
HD Writer AE 4.0 (HKLM\...\{DAC69A3A-89E6-4B70-B486-B974C2C95BE9}) (Version: 4.00.022.1031 - Panasonic Corporation)
HijackThis 2.0.2 (HKLM\...\HijackThis) (Version: 2.0.2 - TrendMicro)
ITECIR (HKLM\...\{40580068-9B10-40B5-9548-536CE88AB23C}) (Version: 1.00.0000 - ITE)
iTunes (HKLM\...\{0718A90E-93AA-49AF-A4FE-0165ACD91DF0}) (Version: 11.2.2.3 - Apple Inc.)
Java 7 Update 67 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.670 - Oracle)
Java 8 Update 45 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
KhalInstallWrapper (Version: 4.00.121 - Logitech) Hidden
LEGO MINDSTORMS EV3 (HKLM\...\LEGO_SW.{5B0CB826-E499-4E6B-94F0-75B6327ED934}) (Version: 1.0.0 - The LEGO Group)
LEGO MINDSTORMS EV3 Home Content (Version: 1.1.41 - The LEGO Group) Hidden
LEGO MINDSTORMS EV3 Home deutscher Support (Version: 1.1.41 - The LEGO Group) Hidden
LEGO MINDSTORMS EV3 Home Edition (Version: 1.1.41 - The LEGO Group) Hidden
LEGO MINDSTORMS EV3 Uninstaller (Version: 1.0.11 - The LEGO Group) Hidden
LEGO MINDSTORMS NXT Driver (HKLM\...\{FA2B75F7-6037-4C34-9F3B-3E4320C4CC61}) (Version: 1.20.111.0 - LEGO)
LightScribe System Software 1.14.17.1 (HKLM\...\{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}) (Version: 1.14.17.1 - LightScribe)
MAGIX Filme auf DVD 8 8.0.0.11 (D) (HKLM\...\MAGIX Filme auf DVD 8 D) (Version: 8.0.0.11 - MAGIX AG)
MAGIX Online Druck Service 3.4.3.0 (D) (HKLM\...\MAGIX Online Druck Service D) (Version: 3.4.3.0 - MAGIX AG)
MAGIX Screenshare 4.3.6.1987 (D) (HKLM\...\MAGIX Screenshare D) (Version: 4.3.6.1987 - MAGIX AG)
MAGIX USB-Videowandler 2 (HKLM\...\InstallShield_{91065458-A5CF-474C-9160-B44B974B3C25}) (Version: 1.00.0000 - MAGIX)
MAGIX USB-Videowandler 2 (Version: 1.00.0000 - MAGIX) Hidden
MAGIXUSB-Videowandler 2 Device Driver (HKLM\...\TVEpaDrv) (Version: - )
MediaManager (HKLM\...\MediaManager) (Version: 3.0.3 (60) - PacketVideo)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft redistributable runtime DLLs VS2005(x86) (HKLM\...\{C0DB380B-97B5-4BB8-AC8D-1835E61439B6}) (Version: 1.0.0.0 - SAP)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4048 (HKLM\...\{5B1F2843-B379-3FF2-B0D3-64DD143ED53A}) (Version: 9.0.30729.4048 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 37.0.1 (x86 de) (HKLM\...\Mozilla Firefox 37.0.1 (x86 de)) (Version: 37.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSVC80_x86_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x86 (Version: 1.0.1.2 - Nokia) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML4.0 redistributable (HKLM\...\{44D66AD9-AE19-4AFD-BE7E-A1B44C856697}) (Version: 4.0.0.0 - SAP)
MyDriveConnect 3.3.0.1756 (HKLM\...\MyDriveConnect) (Version: 3.3.0.1756 - TomTom)
NB Probe (HKLM\...\{6324A1EF-CEF4-43E3-8BCD-9EF3F67317FD}) (Version: - )
Nero 6 Demo (HKLM\...\Nero - Burning Rom!UninstallKey) (Version: - )
NI .NET Framework 4 (Version: 4.00.49152 - National Instruments) Hidden
NI EulaDepot (Version: 3.20.363 - National Instruments) Hidden
NI MDF Support (Version: 3.20.363 - National Instruments) Hidden
NI Security Update (KB 67L8LCQW) (Version: 1.0.29.0 - National Instruments) Hidden
NI Uninstaller (Version: 3.20.363 - National Instruments) Hidden
NI VC2008MSMs x86 (Version: 9.0.401 - National Instruments) Hidden
Nokia Connectivity Cable Driver (HKLM\...\{A57025CC-5F2E-4D01-B387-06DB10500D43}) (Version: 7.1.78.0 - Nokia)
Nokia PC Suite (HKLM\...\{531317A5-586A-4E36-87C1-CA823447B375}) (Version: 6.81.13.0 - Nokia)
Nokia Suite (HKLM\...\Nokia Suite) (Version: 3.4.49.0 - Nokia)
Nokia Suite (Version: 3.4.49.0 - Nokia) Hidden
Nuance PaperPort 14 (HKLM\...\{08BCE67B-6305-4D8A-B749-F381E7E3DDA2}) (Version: 14.5.0000 - Nuance Communications, Inc.)
Nuance PDF Viewer Plus (HKLM\...\{FC984E39-43D0-4AB2-ACC7-A7B87977B009}) (Version: 7.20.3274 - Nuance Communications, Inc.)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.4 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation)
OMPM v2.0 (HKLM\...\InstallShield_{0A7245F9-B454-4FAA-9A94-61617B6039A1}) (Version: 2.7.4.7 - Ihr Firmenname)
OMPM v2.0 (Version: 2.7.4.7 - Ihr Firmenname) Hidden
P4P (HKLM\...\{FC3D290D-79BE-44B7-ABF9-FDD110925930}) (Version: 1.0.0.17 - P4P)
PaperPort Image Printer (HKLM\...\{6EF2FDAB-7FBF-4AB9-92CD-594BDDB6A56B}) (Version: 14.00.0000 - Nuance Communications, Inc.)
PC Connectivity Solution (HKLM\...\{DA5B2BDC-F654-4A88-A669-4D34BC7846A1}) (Version: 12.0.17.0 - Nokia)
PhotoFrame (HKLM\...\PhotoFrame) (Version: - )
PostgreSQL 8.4 (HKLM\...\PostgreSQL 8.4) (Version: 8.4 - PostgreSQL Global Development Group)
QuickTime 7 (HKLM\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Ravensburger tiptoi (HKLM\...\Ravensburger tiptoi) (Version: - )
Realtek 8169 8168 8101E 8102E Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0000 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5683 - Realtek Semiconductor Corp.)
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.55.03 (HKLM\...\{59F6A514-9813-47A3-948C-8A155460CC2A}) (Version: 3.55.03 - RICOH)
Scansoft PDF Professional (Version: - ) Hidden
SetPoint (HKLM\...\{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}) (Version: 4.00 - Logitech)
Skype Toolbars (HKLM\...\{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}) (Version: 5.0.4137 - Skype Technologies S.A.)
Skype™ 7.0 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 10.1.8.0 - Synaptics)
USB 2.0 2.0M UVC WebCam (HKLM\...\USB 2.0 2.0M UVC WebCam) (Version: - )
vcredist_x86 (HKLM\...\{CEC7A786-A9C8-4EF7-BB59-6518E3B3C878}) (Version: 1.0.0 - SAP)
Visual Studio C++ 10.0 Runtime (HKLM\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
WIDCOMM Bluetooth Software (HKLM\...\{03D1988F-469F-4843-8E6E-E5FE9D17889D}) (Version: 5.2.0.800 - Broadcom Corporation)
Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0) (HKLM\...\504244733D18C8F63FF584AEB290E3904E791693) (Version: 08/22/2008 7.0.0.0 - Nokia)
WinFlash (HKLM\...\{DE10AB76-4756-4913-BE25-55D1C1051F9A}) (Version: - )
WinRAR Archivierer (HKLM\...\WinRAR archiver) (Version: - )
WinZip (HKLM\...\WinZip) (Version: 8.1 SR-1 (5266) - WinZip Computing, Inc.)
Wireless Console 2 (HKLM\...\{83F73CB1-7705-49D1-9852-84D839CA2A45}) (Version: 2.0.10 - ATK)
WISO Steuer 2012 (HKLM\...\{0CC1DAFB-40C8-4903-953D-471E541477C7}) (Version: 19.00.7304 - Buhl Data Service GmbH)
WISO Steuer 2013 (HKLM\...\{D6CC2FAF-F827-4091-96A1-D32CC9B69C79}) (Version: 20.00.8137 - Buhl Data Service GmbH)
WISO Steuer 2014 (HKLM\...\{3C5C5344-25D3-4013-BCA1-A0711FE7B3AD}) (Version: 21.00.8480 - Buhl Data Service GmbH)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-1619064115-466689268-4177747022-1000_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-1619064115-466689268-4177747022-1000_Classes\CLSID\{3f04dadf-6ea4-44d1-a507-03cad176f443}\InprocServer32 -> C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin1017325.dll (Amazon.com, Inc.)
CustomCLSID: HKU\S-1-5-21-1619064115-466689268-4177747022-1000_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-1619064115-466689268-4177747022-1000_Classes\CLSID\{BB6410D8-F879-4184-9C5C-6A02D16AE0B3}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-1619064115-466689268-4177747022-1000_Classes\CLSID\{CA1073A2-5F3F-4445-8E5E-7109BDCEDDBE}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-1619064115-466689268-4177747022-1000_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-1619064115-466689268-4177747022-1000_Classes\CLSID\{D5A55D2D-C59D-42C3-A5BF-4C08EEE74339}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
==================== Restore Points =========================
 
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2006-11-02 12:23 - 2010-12-12 22:24 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {19411A74-991C-4A16-BF7C-166E4E49D856} - System32\Tasks\ASUS Live Update => C:\Program Files\ASUS\ASUS Live Update\ALU.exe [2007-11-30] ()
Task: {29ABCCCA-1A0B-4415-A3E1-FDE7BDDECDBB} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {414841C6-91CC-4966-933A-D71E285DCD6D} - System32\Tasks\{ED30B319-CC19-424F-846E-0F8ECB82F999} => pcalua.exe -a E:\Setup.exe -d E:\
Task: {4776059D-376A-4ACD-B3A9-3778FFDE026E} - System32\Tasks\ASUS SmartLogon Console Sensor => C:\Program Files\ASUS\SmartLogon\sensorsrv.exe [2008-06-18] (ASUS)
Task: {518721D2-0013-4B19-A46B-4B51B04559C6} - System32\Tasks\{663C24D5-10FA-4FAA-84B9-CD94B89A69AB} => pcalua.exe -a D:\Downloads\3gp\3GP_Converter034\Setup.exe -d D:\Downloads\3gp\3GP_Converter034
Task: {819AAF3C-60E3-448E-BFF7-D5CD780E3594} - System32\Tasks\{F7BB27B9-C40B-43A9-95C2-530FBC73558A} => pcalua.exe -a E:\Software\Bluetooth\Setup.exe -d E:\Software\Bluetooth
Task: {98F3527B-8354-4119-8577-E0DA25B224E0} - System32\Tasks\{89C29468-C381-4F13-8FA7-ABDD6BF2A3DA} => C:\Program Files\Skype\\Phone\Skype.exe [2014-12-11] (Skype Technologies S.A.)
Task: {C26BC1A5-691B-414B-BF54-1E492181F57F} - System32\Tasks\Direct Console 2.0 => C:\Program Files\ASUS\Direct Console\DCHelper.exe [2008-03-25] (ASUSTek.)
Task: {C51BD195-A428-4355-AC9F-8097D6A0BC5B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-20] (Google Inc.)
Task: {C8F76C46-2FC5-4E64-91D7-5124505E2CEB} - System32\Tasks\{C6C7E2A8-77AA-4E25-958E-511E0167322E} => pcalua.exe -a D:\Downloads\directx_nov2008_redist.exe -d D:\Downloads
Task: {D5E3E87C-0880-453A-A1C5-529B75FD0756} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-20] (Google Inc.)
Task: {E725020D-5EE0-40D0-8EE4-98F9EF122DE0} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-07-09] (Adobe Systems Incorporated)
Task: {F0E726A4-0AA3-413F-B6B4-517E315170AC} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)
Task: {FA7B7F3A-545E-4E08-AA17-43391A52A2F3} - System32\Tasks\ASPG => C:\Program Files\ASUS\ASUS CopyProtect\aspg.exe [2008-06-19] (ASUS)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (Whitelisted) ==============
2008-12-04 23:53 - 2007-05-18 12:31 - 00073728 _____ () C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
2008-08-14 06:59 - 2008-08-14 06:59 - 00100920 _____ () C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe
2008-12-04 23:14 - 2007-08-08 10:08 - 00094208 _____ () C:\Program Files\ATKGFNEX\GFNEXSrv.exe
2014-07-17 10:37 - 2012-06-07 17:48 - 00019968 _____ () C:\Windows\system32\spool\PRTPROCS\W32X86\dltfm1zPP.dll
2014-04-23 16:05 - 2014-04-23 16:05 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2014-04-23 16:04 - 2014-04-23 16:04 - 01044808 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2008-12-04 23:53 - 2007-06-15 20:28 - 00147456 _____ () C:\Program Files\ASUS\ASUS Data Security Manager\OverlayIconShlExt.dll
2008-12-04 23:53 - 2007-06-02 03:08 - 00143360 _____ () C:\Program Files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll
2008-12-04 23:53 - 2007-08-08 12:52 - 00331776 _____ () C:\Program Files\ASUS\ASUS Data Security Manager\AdsmendecExt.dll
2009-02-21 01:23 - 2003-05-19 22:16 - 00120320 _____ () C:\Program Files\WinRAR\rarext.dll
2004-05-28 04:13 - 2004-05-28 04:13 - 00057344 _____ () C:\Program Files\ASUS\ATK Hotkey\CMSSC.dll
2008-12-04 23:27 - 2007-07-06 02:53 - 01040384 _____ () C:\Program Files\Wireless Console 2\wcourier.exe
2013-02-06 17:37 - 2013-02-06 17:37 - 00191464 _____ () C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1db.exe
2007-11-13 01:41 - 2007-11-13 01:41 - 00106496 _____ () C:\Program Files\ASUS\ATK Hotkey\MsgTran.dll
2008-12-04 23:57 - 2008-01-26 04:32 - 00778240 _____ () C:\Program Files\P4P\P4P.exe
2008-05-29 07:40 - 2008-05-29 07:40 - 00049152 _____ () C:\Program Files\ASUS\Direct Console\OLED.dll
2008-05-29 07:39 - 2008-05-29 07:39 - 00053248 _____ () C:\Program Files\ASUS\Direct Console\SysInfo.dll
2007-12-28 02:04 - 2007-12-28 02:04 - 00032768 _____ () C:\Program Files\ASUS\Direct Console\LED.dll
2008-02-19 08:32 - 2008-02-19 08:32 - 00012288 _____ () C:\Program Files\ASUS\Direct Console\OvrClk.dll
2008-12-04 23:14 - 2007-03-10 02:16 - 00106496 _____ () C:\Program Files\ATKGFNEX\AGFNEX.dll
2007-12-12 02:07 - 2007-12-12 02:07 - 00090112 _____ () C:\Program Files\ASUS\Direct Console\OUTLOOK.dll
2007-12-08 01:32 - 2007-12-08 01:32 - 00061440 _____ () C:\Program Files\ASUS\Direct Console\MSN.dll
2014-03-18 18:20 - 2014-03-18 18:20 - 00199633 _____ () C:\Program Files\Dell Printers\OpenManage\OMPMv2.0\client\OMPMWatchdogService.exe
2014-08-22 10:38 - 2014-08-22 10:38 - 00026488 _____ () C:\Program Files\MyDrive Connect\DeviceDetection.dll
2014-08-22 10:38 - 2014-08-22 10:38 - 00087416 _____ () C:\Program Files\MyDrive Connect\TomTomSupporterBase.dll
2014-08-22 10:38 - 2014-08-22 10:38 - 00398712 _____ () C:\Program Files\MyDrive Connect\TomTomSupporterProxy.dll
2014-06-27 23:22 - 2012-08-16 12:25 - 00172032 _____ () C:\Program Files\PostgreSQL\8.4\bin\LIBPQ.dll
2008-12-04 23:55 - 2007-08-03 22:24 - 00125496 _____ () C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
2008-12-04 23:55 - 2007-09-14 20:00 - 00147456 _____ () C:\Program Files\ASUS\NB Probe\SPM\spdiskex.dll
2008-12-04 23:55 - 2003-11-28 12:11 - 00135168 _____ () C:\Program Files\ASUS\NB Probe\SPM\spos.dll
2008-12-04 23:55 - 2005-08-30 01:24 - 00081920 _____ () C:\Program Files\ASUS\NB Probe\SPM\spnbacpi.dll
2008-12-04 23:55 - 2003-09-10 02:08 - 00049152 _____ () C:\Program Files\ASUS\NB Probe\SPM\spdmi.dll
2008-12-04 23:55 - 2006-04-04 20:24 - 00036864 _____ () C:\Program Files\ASUS\NB Probe\SPM\ghadmi.dll
2008-12-04 23:55 - 2005-04-08 05:25 - 00077824 _____ () C:\Program Files\ASUS\NB Probe\SPM\spmemory.dll
2014-06-27 23:24 - 2012-08-14 15:19 - 00999424 _____ () C:\Program Files\PostgreSQL\8.4\bin\libxml2.dll
2014-07-17 10:32 - 2012-08-16 19:33 - 00041984 _____ () C:\Windows\system32\dltsm1zwia.dll
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
 
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1619064115-466689268-4177747022-1000\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\img24.jpg
HKU\S-1-5-21-1619064115-466689268-4177747022-1001\Control Panel\Desktop\\Wallpaper -> C:\windows\Web\Wallpaper\img24.jpg
DNS Servers: 192.168.178.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
 
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [WinCollab-Out-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-In-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-Out-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-In-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-DFSR-Out-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [WinCollab-DFSR-In-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [TCP Query User{28AA2FEE-D481-4D84-913E-1CF0E59B80CA}C:\program files\internet explorer\iexplore.exe] => (Block) C:\program files\internet explorer\iexplore.exe
FirewallRules: [UDP Query User{832088FB-DCA6-4627-AA07-BF2CF73BCB70}C:\program files\internet explorer\iexplore.exe] => (Block) C:\program files\internet explorer\iexplore.exe
FirewallRules: [TCP Query User{C831918A-6B6B-423E-9978-475C8A4BF60E}C:\program files\openvpn\bin\openvpn.exe] => (Block) C:\program files\openvpn\bin\openvpn.exe
FirewallRules: [UDP Query User{8C46CC16-25BB-4736-8AC9-ED1E19731AC4}C:\program files\openvpn\bin\openvpn.exe] => (Block) C:\program files\openvpn\bin\openvpn.exe
FirewallRules: [TCP Query User{1C164927-BB8D-478C-9964-F8D6BC59A2A9}C:\program files\openvpn\bin\openvpn.exe] => (Allow) C:\program files\openvpn\bin\openvpn.exe
FirewallRules: [UDP Query User{5F013047-4D01-4CAA-9A45-F35743BCCDA2}C:\program files\openvpn\bin\openvpn.exe] => (Allow) C:\program files\openvpn\bin\openvpn.exe
FirewallRules: [TCP Query User{84EB3341-6966-4163-BF72-289A70024253}C:\windows\system32\taskeng.exe] => (Block) C:\windows\system32\taskeng.exe
FirewallRules: [UDP Query User{471DE340-B595-4E19-8032-A6C916BA3AC9}C:\windows\system32\taskeng.exe] => (Block) C:\windows\system32\taskeng.exe
FirewallRules: [TCP Query User{D7A3CCF0-0385-44BF-A902-715B7FACC26E}C:\windows\explorer.exe] => (Block) C:\windows\explorer.exe
FirewallRules: [UDP Query User{14B1B00C-0309-41A0-BDE9-77AF78337780}C:\windows\explorer.exe] => (Block) C:\windows\explorer.exe
FirewallRules: [TCP Query User{750408C6-979C-4A2E-8C08-EBD76DD2A813}C:\windows\explorer.exe] => (Block) C:\windows\explorer.exe
FirewallRules: [UDP Query User{01DBCC36-310E-4CF7-BAF6-C766E0CEC184}C:\windows\explorer.exe] => (Block) C:\windows\explorer.exe
FirewallRules: [{C304B180-0E0B-4081-AC0E-42E22FE45F78}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe
FirewallRules: [{1AB83C35-B101-4B79-BF6B-191A0C947D48}] => (Allow) LPort=80
FirewallRules: [{7DA1E521-4A3A-4461-8445-F8F4905E0A18}] => (Allow) LPort=80
FirewallRules: [{F863D41D-BFE3-4F1D-8B11-D8781843CE57}] => (Allow) LPort=80
FirewallRules: [TCP Query User{AAB4ED21-1406-4629-9AC3-44B3404EC5B3}C:\program files\nokia\nokia ovi suite\nokiaovisuite.exe] => (Allow) C:\program files\nokia\nokia ovi suite\nokiaovisuite.exe
FirewallRules: [UDP Query User{19CC29C9-60AA-4BA3-9D86-6F983DE52361}C:\program files\nokia\nokia ovi suite\nokiaovisuite.exe] => (Allow) C:\program files\nokia\nokia ovi suite\nokiaovisuite.exe
FirewallRules: [TCP Query User{5BF834D1-FC3F-45F4-9C69-40DFD0EAEBB1}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe] => (Allow) C:\program files\common files\nokia\service layer\a\nsl_host_process.exe
FirewallRules: [UDP Query User{5719C01C-2E21-4EE4-B1EB-6AFFC59CAE1B}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe] => (Allow) C:\program files\common files\nokia\service layer\a\nsl_host_process.exe
FirewallRules: [{47725C01-D394-4560-BBA2-D84DF721F3AA}] => (Allow) C:\Program Files\Nakido\nakido.exe
FirewallRules: [{B59BB5F2-B4F0-48A9-A43E-EB884E336BB6}] => (Allow) C:\Program Files\Nakido\nakido.exe
FirewallRules: [{C9B20076-4909-431E-A146-617230B20DA3}] => (Allow) C:\Program Files\Twonky\TwonkyServer\twonkystarter.exe
FirewallRules: [{69869431-6331-4CC0-BD48-C94BE8C22F37}] => (Allow) C:\Program Files\Twonky\TwonkyServer\twonkystarter.exe
FirewallRules: [{5354F5F7-6EC2-4C1D-B108-2EFB0B616032}] => (Allow) C:\Program Files\Twonky\TwonkyServer\twonkyserver.exe
FirewallRules: [{D6768DFC-208E-42A3-8C26-51709369EE04}] => (Allow) C:\Program Files\Twonky\TwonkyServer\twonkyserver.exe
FirewallRules: [TCP Query User{5078F6E3-CE57-4B62-9F40-96204765B386}C:\program files\philips\mediamanager\twonkyrenderer.exe] => (Allow) C:\program files\philips\mediamanager\twonkyrenderer.exe
FirewallRules: [UDP Query User{23AB7648-7C1B-43B9-93C3-B2C2E4B2E69F}C:\program files\philips\mediamanager\twonkyrenderer.exe] => (Allow) C:\program files\philips\mediamanager\twonkyrenderer.exe
FirewallRules: [TCP Query User{8203D92A-BC7A-458B-B873-72EDDEE13569}C:\program files\philips\mediamanager\twonkymanager.exe] => (Allow) C:\program files\philips\mediamanager\twonkymanager.exe
FirewallRules: [UDP Query User{06C64734-4B88-4416-B7CD-D71712E5F646}C:\program files\philips\mediamanager\twonkymanager.exe] => (Allow) C:\program files\philips\mediamanager\twonkymanager.exe
FirewallRules: [{00ADE940-2B0D-48A6-8C9B-03C51A49CE12}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{EE2A595D-30AA-48F0-A82D-9460A22625AC}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [UDP Query User{68E46633-8DC3-499C-A590-8A85F5FE92AD}C:\Program Files\LEGO Software\LEGO MINDSTORMS EV3 Home Edition\MindstormsEV3.exe] => (Allow) C:\Program Files\LEGO Software\LEGO MINDSTORMS EV3 Home Edition\MindstormsEV3.exe
FirewallRules: [TCP Query User{F468232A-782C-4386-AF14-03CFA72EB0FB}C:\Program Files\LEGO Software\LEGO MINDSTORMS EV3 Home Edition\MindstormsEV3.exe] => (Allow) C:\Program Files\LEGO Software\LEGO MINDSTORMS EV3 Home Edition\MindstormsEV3.exe
FirewallRules: [{B309BC33-1C71-4BF2-94C6-904F3873BA5C}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{63E9A5E2-7F26-4E64-ACB3-D673BBA32FF3}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
==================== Faulty Device Manager Devices =============
 
==================== Event log errors: =========================
Application errors:
==================
Error: (07/16/2015 12:43:25 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/16/2015 12:26:32 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung svchost.exe_EMDMgmt, Version 6.0.6001.18000, Zeitstempel 0x47918b89, fehlerhaftes Modul kernel32.dll, Version 6.0.6002.19381, Zeitstempel 0x554d42a0, Ausnahmecode 0xc0000005, Fehleroffset 0x000be6ca,
Prozess-ID 0x450, Anwendungsstartzeit svchost.exe_EMDMgmt0.
Error: (07/16/2015 12:26:17 AM) (Source: VSS) (EventID: 12293) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen einer Routine auf einem Volumeschattenkopieanbieter "{b5946137-7b9f-4925-af80-51abd60b20d5}" ist ein Fehler aufgetreten. Routinedetails GetSnapshotProperties({638939ab-055f-4165-b266-f4894e5c201a}) [hr = 0x80042308].
 
Vorgang:
Asynchroner Vorgang wird ausgeführt
Kontext:
Aktueller Status: DoSnapshotSet
Error: (07/16/2015 12:20:56 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung wmpnscfg.exe, Version 11.0.6001.7000, Zeitstempel 0x47919371, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode 0xc0000005, Fehleroffset 0x00620022,
Prozess-ID 0xf88, Anwendungsstartzeit wmpnscfg.exe0.
Error: (07/16/2015 12:01:46 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/15/2015 11:42:24 PM) (Source: ESENT) (EventID: 474) (User: )
Description: avguard (316) GaviDB_0: Bei Überprüfung der aus Datei "C:\ProgramData\Avira\Antivirus\EVENTDB\gavi3.db" bei Offset 147456 (0x0000000000024000) (Datenbankseite avguard0) für 4096 (0x00001000) Bytes gelesenen Datenbankseite ist durch eine Inkonsistenz der Seitenprüfsumme ein Fehler aufgetreten. Die erwartete Prüfsumme war 6975619314087216752 (0x60ce60cec885c670), die tatsächliche Prüfsumme 8046824586773644825 (0x6fac1053e885c619). Fehler -1018 (0xfffffc06) bei Leseoperation. Wenn dieser Zustand andauert, stellen Sie die Datenbank aus einer vorherigen Sicherung wieder her. Dieses Problem ist vermutlich durch fehlerhafte Hardware bedingt. Wenden Sie sich für weitere Unterstützung bei der Diagnose des Problems an Ihren Hardwarehersteller.
Error: (07/15/2015 11:42:17 PM) (Source: ESENT) (EventID: 474) (User: )
Description: Windows (3448) Windows: Bei Überprüfung der aus Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb" bei Offset 91275264 (0x000000000570c000) (Datenbankseite Windows0) für 8192 (0x00002000) Bytes gelesenen Datenbankseite ist durch eine Inkonsistenz der Seitenprüfsumme ein Fehler aufgetreten. Die erwartete Prüfsumme war -157623583016329501 (0xfdd0022fb6165ee3), die tatsächliche Prüfsumme -166630644832115416 (0xfdb0024fb6166528). Fehler -1018 (0xfffffc06) bei Leseoperation. Wenn dieser Zustand andauert, stellen Sie die Datenbank aus einer vorherigen Sicherung wieder her. Dieses Problem ist vermutlich durch fehlerhafte Hardware bedingt. Wenden Sie sich für weitere Unterstützung bei der Diagnose des Problems an Ihren Hardwarehersteller.
Error: (07/15/2015 11:35:33 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: WmiApRplC:\Windows\system32\wbem\wmiaprpl.dll4
Error: (07/15/2015 11:35:01 PM) (Source: Perflib) (EventID: 1010) (User: )
Description: EmdCacheC:\Windows\system32\emdmgmt.dll4
Error: (07/15/2015 11:34:29 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
System errors:
=============
Error: (07/16/2015 12:51:22 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: OMPM Service%%1053
Error: (07/16/2015 12:51:22 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000OMPM Service
Error: (07/16/2015 12:46:22 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: OMPM Service%%1053
Error: (07/16/2015 12:46:22 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000OMPM Service
Error: (07/16/2015 12:45:51 AM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT)
Description: 0x80070032
Error: (07/16/2015 12:44:49 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {9B1F122C-2982-4E91-AA8B-E071D54F2A4D}
Error: (07/16/2015 12:36:22 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: OMPM Service%%1053
Error: (07/16/2015 12:36:22 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000OMPM Service
Error: (07/16/2015 12:32:59 AM) (Source: Microsoft-Windows-Servicing) (EventID: 4375) (User: NT-AUTORITÄT)
Description: Windows-Wartung konnte das Paket KB3067505 (Security Update) nicht in den Status Aufgelöst(Resolved) setzen.
Error: (07/16/2015 12:32:59 AM) (Source: Microsoft-Windows-Servicing) (EventID: 4375) (User: NT-AUTORITÄT)
Description: Windows-Wartung konnte das Paket KB3067505 (Security Update) nicht in den Status Aufgelöst(Resolved) setzen.
 
Microsoft Office:
=========================
Error: (07/16/2015 12:43:25 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/16/2015 12:26:32 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: svchost.exe_EMDMgmt6.0.6001.1800047918b89kernel32.dll6.0.6002.19381554d42a0c0000005000be6ca45001d0bf497afca015
Error: (07/16/2015 12:26:17 AM) (Source: VSS) (EventID: 12293) (User: )
Description: {b5946137-7b9f-4925-af80-51abd60b20d5}GetSnapshotProperties({638939ab-055f-4165-b266-f4894e5c201a})0x80042308
Vorgang:
Asynchroner Vorgang wird ausgeführt
Kontext:
Aktueller Status: DoSnapshotSet
Error: (07/16/2015 12:20:56 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: wmpnscfg.exe11.0.6001.700047919371unknown0.0.0.000000000c000000500620022f8801d0bf49b1851d45
Error: (07/16/2015 12:01:46 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/15/2015 11:42:24 PM) (Source: ESENT) (EventID: 474) (User: )
Description: avguard316GaviDB_0: C:\ProgramData\Avira\Antivirus\EVENTDB\gavi3.db147456 (0x0000000000024000)4096 (0x00001000)-1018 (0xfffffc06)6975619314087216752 (0x60ce60cec885c670)8046824586773644825 (0x6fac1053e885c619)35 (0x23)
Error: (07/15/2015 11:42:17 PM) (Source: ESENT) (EventID: 474) (User: )
Description: Windows3448Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb91275264 (0x000000000570c000)8192 (0x00002000)-1018 (0xfffffc06)-157623583016329501 (0xfdd0022fb6165ee3)-166630644832115416 (0xfdb0024fb6166528)11141 (0x2B85)
Error: (07/15/2015 11:35:33 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: WmiApRplC:\Windows\system32\wbem\wmiaprpl.dll4
Error: (07/15/2015 11:35:01 PM) (Source: Perflib) (EventID: 1010) (User: )
Description: EmdCacheC:\Windows\system32\emdmgmt.dll4
Error: (07/15/2015 11:34:29 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
CodeIntegrity Errors:
===================================
Date: 2013-12-20 16:12:14.138
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\SetPoint\lgscroll.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-20 16:12:13.264
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\SetPoint\lgscroll.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-20 16:12:09.195
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\SetPoint\lgscroll.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-20 16:12:08.386
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\SetPoint\lgscroll.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-20 16:12:02.587
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\SetPoint\lgscroll.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-20 16:12:01.676
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\SetPoint\lgscroll.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-20 16:11:55.557
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\SetPoint\lgscroll.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-20 16:11:54.462
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\SetPoint\lgscroll.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-20 16:11:47.923
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\SetPoint\lgscroll.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-20 16:11:46.685
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\SetPoint\lgscroll.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 Duo CPU T9400 @ 2.53GHz
Percentage of memory in use: 45%
Total physical RAM: 3070.17 MB
Available physical RAM: 1666.24 MB
Total Virtual: 6343.35 MB
Available Virtual: 4832.77 MB
==================== Drives ================================
Drive c: (VistaOS) (Fixed) (Total:232.88 GB) (Free:101.56 GB) NTFS ==>[drive with boot components (obtained from BCD)]
Drive d: (DATA) (Fixed) (Total:223.12 GB) (Free:37.63 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 97646C29)
Partition 1: (Not Active) - (Size=9.8 GB) - (Type=1C)
Partition 2: (Active) - (Size=232.9 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=223.1 GB) - (Type=OF Extended)
==================== End of log ============================
--- --- ---

--- --- ---

cosinus 16.07.2015 09:57
Adware/Junkware/Toolbars entfernen

1. Schritt: Malwarebytes

Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.




(alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!)

2. Schritt: adwCleaner

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).



3. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.




4. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


noki 16.07.2015 11:20
Der Malwarebytes-Scan startet nicht. Verstrichene Zeit über 15 Minuten und noch nicht 1 Datei gescannt. Soll ich mal im Abgesicherten Modus probieren?

cosinus 16.07.2015 11:21
Dann überspringen wir MBAM, mach mit dem nächsten Schritt weiter

noki 16.07.2015 11:36
adw cleaner:AdwCleaner Logfile:
Code:
# AdwCleaner v4.208 - Bericht erstellt 16/07/2015 um 12:31:40
# Aktualisiert 09/07/2015 von Xplode
# Datenbank : 2015-07-09.2 [Lokal]
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (x86)
# Benutzername : noki - NOKI-PC
# Gestarted von : D:\AdwCleaner_4.208.exe
# Option : Löschen
***** [ Dienste ] *****
 
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\DownloadManager
Ordner Gelöscht : C:\Users\noki\AppData\Local\Temp\AskSearch
Datei Gelöscht : C:\Program Files\Mozilla Firefox\defaults\pref\itms.js
***** [ Geplante Tasks ] *****
 
***** [ Verknüpfungen ] *****
 
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{38122A36-83B2-46B8-B39A-EC72A4614A07}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{42F85EF5-86CF-4D1F-B473-ACDA9AD99AC8}
Schlüssel Gelöscht : HKLM\SOFTWARE\DeviceVM
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}
***** [ Internetbrowser ] *****
-\\ Internet Explorer v9.0.8112.16659
 
-\\ Mozilla Firefox v37.0.1 (x86 de)
[p25m8g9e.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.order.1", "Ask.com");
[p25m8g9e.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.selectedEngine", "Ask.com");
-\\ Google Chrome v
 
*************************
AdwCleaner[R0].txt - [2142 Bytes] - [16/07/2015 12:27:50]
AdwCleaner[S0].txt - [2080 Bytes] - [16/07/2015 12:31:40]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2139  Bytes] ##########
--- --- ---


Weiter mit JRT?

cosinus 16.07.2015 11:53
Ja weiter mit dem nächsten Schritt

noki 16.07.2015 12:43
Habe es jetzt 2x probiert. Während JRT läuft, bleibt der Laptop einfach stehen und sagt keinen Mucks mehr. Beim letzten Mal zeigte er noch an:

Create restore Point: Success
Checking Startup
Checking Processes
Checking Services

Tippe so langsam auf Hardware-Schaden, oder? :-(

Beim 3. Versuch lief das Programm ziemlich schnell und kam genau so weit wie oben aufgeführt. Dann kam allerdings ein Bluescreen mit Hinweis auf Datei "msrpc.sys".

cosinus 16.07.2015 13:34
Hm...mach mal bitte mit CF weiter:
Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

noki 16.07.2015 15:27
Bevor ich die combofix.txt einstelle, weitere Erkenntnisse. Ich habe ein Windows Update gemacht bzw. finalisiert, da aufgrund der ständigen Abbrüche einige Updates nicht endgültig durchgeführt wurden. Zudem habe ich JAVA deinstalliert.

Seitdem läuft der Laptop zumindest nun deutlich ruhiger und der Prozess-Overflow ist vorbei. Nichtsdestotrotz bleibt der Laptop immer noch relativ oft einfach stehen, v.a. wenn nach einer Deinstallation eine weitere Deinstallation durchgeführt werden soll.

Combofix lief aber ganz gut durch, Dauer: ca. 20 Minuten!

Hier das Logfile:
Combofix Logfile:
Code:
ComboFix 15-07-16.01 - noki 16.07.2015  16:07:32.2.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.49.1031.18.3070.1763 [GMT 2:00]
ausgeführt von:: c:\users\noki\Desktop\ComboFix.exe
AV: Avira Antivirus *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Antivirus *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Common Files\ASPG_icon.ico
c:\windows\system32\CddbCdda.dll
.
.
(((((((((((((((((((((((  Dateien erstellt von 2015-06-16 bis 2015-07-16  ))))))))))))))))))))))))))))))
.
.
2015-07-16 14:19 . 2015-07-16 14:19 -------- d-----w- c:\users\Public\AppData\Local\temp
2015-07-16 14:19 . 2015-07-16 14:19 -------- d-----w- c:\users\postgres\AppData\Local\temp
2015-07-16 14:19 . 2015-07-16 14:19 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-07-16 12:33 . 2015-06-17 16:50 2264576 ----a-w- c:\windows\system32\msi.dll
2015-07-16 12:33 . 2015-06-17 15:09 73216 ----a-w- c:\windows\system32\msiexec.exe
2015-07-16 10:27 . 2015-07-16 10:31 -------- d-----w- C:\AdwCleaner
2015-07-16 09:57 . 2015-07-16 10:14 119512 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-07-16 09:56 . 2015-04-14 07:37 51928 ----a-w- c:\windows\system32\drivers\mwac.sys
2015-07-16 09:56 . 2015-04-14 07:37 92888 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-07-16 09:56 . 2015-04-14 07:37 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2015-07-16 09:56 . 2015-07-16 09:56 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
2015-07-16 09:56 . 2015-07-16 09:56 -------- d-----w- c:\programdata\Malwarebytes
2015-07-16 09:00 . 2015-06-25 02:57 2066432 ----a-w- c:\windows\system32\win32k.sys
2015-07-16 09:00 . 2015-07-03 16:04 1316864 ----a-w- c:\windows\system32\ole32.dll
2015-07-16 08:23 . 2015-06-12 16:01 298496 ----a-w- c:\windows\system32\gdi32.dll
2015-07-15 22:34 . 2015-07-07 15:58 34304 ----a-w- c:\windows\system32\atmlib.dll
2015-07-15 22:34 . 2015-07-07 14:22 296960 ----a-w- c:\windows\system32\atmfd.dll
2015-07-15 21:52 . 2015-07-15 21:52 -------- d-----w- C:\found.002
2015-07-15 21:09 . 2015-06-23 16:02 501248 ----a-w- c:\windows\system32\kerberos.dll
2015-07-15 20:28 . 2015-05-31 08:11 225792 ----a-w- c:\windows\system32\cewmdm.dll
2015-07-15 20:27 . 2015-07-15 22:55 -------- d-----w- C:\FRST
2015-07-14 20:10 . 2015-07-03 05:19 474624 ----a-w- c:\program files\Internet Explorer\ieinstal.exe
2015-07-14 20:10 . 2015-07-03 05:18 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2015-07-14 18:32 . 2015-06-12 07:54 9252600 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{AEAD43C9-A9D5-4575-BF07-43A3A4B7E307}\mpengine.dll
2015-06-25 18:04 . 2015-06-25 18:04 -------- d-----w- C:\found.001
2015-06-25 05:37 . 2015-06-25 05:55 -------- d-----r- C:\Musik
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-07-09 05:23 . 2012-04-06 07:10 778416 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2015-07-09 05:23 . 2011-05-16 06:44 142512 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2015-06-23 11:27 . 2009-10-02 20:08 246952 ------w- c:\windows\system32\MpSigStub.exe
2015-06-10 09:50 . 2012-12-02 20:44 136728 ----a-w- c:\windows\system32\drivers\avipbb.sys
2015-06-10 09:50 . 2012-12-02 20:44 108448 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2015-05-27 20:05 . 2015-05-27 20:48 6292119151 ----a-w- C:\P51_N60S3MIBS2_EU_NT_Q3.14.zip
2015-05-07 17:09 . 2012-12-02 20:44 37896 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2015-05-04 22:50 . 2015-06-10 07:09 4096 ----a-w- c:\windows\system32\msdxm.ocx
2015-05-04 22:50 . 2015-06-10 07:09 4096 ----a-w- c:\windows\system32\dxmasf.dll
2015-05-04 22:50 . 2015-06-10 07:09 7680 ----a-w- c:\windows\system32\spwmp.dll
2015-05-04 21:21 . 2015-06-10 07:09 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2015-04-30 16:03 . 2015-05-13 07:13 279040 ----a-w- c:\windows\system32\schannel.dll
2015-04-30 13:14 . 2015-05-13 07:11 102608 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-04-24 15:54 . 2015-06-10 07:20 532480 ----a-w- c:\windows\system32\comctl32.dll
2015-04-19 21:24 . 2015-05-13 07:12 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
2015-04-19 21:24 . 2015-05-13 07:12 189952 ----a-w- c:\windows\system32\d3d10core.dll
2015-04-19 21:24 . 2015-05-13 07:12 160768 ----a-w- c:\windows\system32\d3d10_1.dll
2015-04-19 21:24 . 2015-05-13 07:12 1029120 ----a-w- c:\windows\system32\d3d10.dll
2015-04-19 20:19 . 2015-05-13 07:12 1172480 ----a-w- c:\windows\system32\d3d10warp.dll
2015-04-19 20:18 . 2015-05-13 07:12 486400 ----a-w- c:\windows\system32\d3d10level9.dll
2015-04-19 20:13 . 2015-05-13 07:12 682496 ----a-w- c:\windows\system32\d2d1.dll
2015-04-19 20:12 . 2015-05-13 07:12 1072640 ----a-w- c:\windows\system32\DWrite.dll
2015-04-19 20:12 . 2015-05-13 07:12 801792 ----a-w- c:\windows\system32\FntCache.dll
2008-08-08 22:48 . 2008-08-08 22:48 90112 ----a-w- c:\program files\Common Files\CPInstallAction.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1]
@="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}"
[HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}]
2007-06-02 01:08 143360 ----a-w- c:\program files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"NokiaSuite.exe"="c:\program files\Nokia\Nokia Suite\NokiaSuite.exe" [2012-05-16 1084840]
"MyDriveConnect.exe"="c:\program files\MyDrive Connect\MyDriveConnect.exe" [2014-08-22 1792376]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControlUser"="c:\program files\ASUS\ATK Hotkey\HControlUser.exe" [2008-08-18 98304]
"ATKOSD2"="c:\program files\ASUS\ATKOSD2\ATKOSD2.exe" [2008-09-03 8105984]
"RtHDVCpl"="RtHDVCpl.exe" [2008-08-12 6265376]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416]
"PowerForPhone"="c:\program files\P4P\P4P.exe" [2008-01-26 778240]
"DirectConsole2"="c:\program files\ASUS\Direct Console\Direct Console.exe" [2008-08-21 2705976]
"TrayServer"="c:\progra~1\MAGIX\FILME_~1\TrayServer.exe" [2008-01-17 90112]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 56080]
"ALDI_NORD_FotoSuite_Download"="c:\program files\ALDI Nord Foto Service\ALDI_Foto_Service\FotoSuite.exe" [2008-11-13 1257472]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Skytel"="Skytel.exe" [2008-08-12 1833504]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-04-23 43848]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2015-06-10 730416]
"Greenshot"="c:\program files\Greenshot\Greenshot.exe" [2013-10-27 495616]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2014-01-17 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2014-05-26 152392]
"LauncherC1765nf"="c:\program files\Dell Printers\Printer SSW\Launcher\dlm1launcher.exe" [2013-08-13 2471928]
"StatusAutoRunC1765nf"="c:\program files\Dell Printers\Printer SSW\Status Monitor\dlm1pl.exe" [2013-02-06 3024360]
"ISUSPM"="c:\programdata\FLEXnet\Connect\11\\isuspm.exe" [2011-10-12 2068856]
"PaperPort PTD"="c:\program files\Nuance\PaperPort\pptd40nt.exe" [2013-05-29 36168]
"IndexSearch"="c:\program files\Nuance\PaperPort\IndexSearch.exe" [2013-05-29 18248]
"PPort14reminder"="c:\program files\Nuance\PaperPort\Ereg\Ereg.exe" [2013-03-14 330056]
"PDFProHook"="c:\program files\Nuance\PDFViewer\pdfpro7hook.exe" [2013-03-20 641864]
"InstallValidator.exe.FA87EC44_C38F_4148_93A1_FF4A64A2B707"="c:\program files\National Instruments\Shared\NIUninstaller\InstallValidator.exe" [2013-11-21 265608]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-02 13789728]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-12-19 1022152]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-3-25 113664]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-7-30 752168]
HD Writer.lnk - c:\program files\Common Files\Panasonic\HD Writer AutoStart\HDWriterAutoStart.exe [2013-3-29 292736]
SetPoint.lnk - c:\program files\SetPoint\SetPoint.exe [2008-12-4 692224]
WISO Mein Steuer-Sparbuch heute.lnk - c:\program files\WISO\Steuersoftware 2014\mshaktuell.exe [2014-2-12 1428760]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ    BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ    FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 09:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2015-07-16 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-06 05:23]
.
2015-07-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-19 05:42]
.
2015-07-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-19 05:42]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.wetteronline.de/
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\noki\AppData\Roaming\Mozilla\Firefox\Profiles\p25m8g9e.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.wetteronline.de
FF - prefs.js: keyword.URL -
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
SafeBoot-WudfPf
SafeBoot-WudfRd
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2015-07-16 16:20
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\postgresql-8.4]
"ImagePath"="C:/Program Files/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N \"postgresql-8.4\" -D \"C:/Program Files/PostgreSQL/8.4/data\" -w"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\postgresql-8.4]
"ImagePath"="C:/Program Files/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N \"postgresql-8.4\" -D \"C:/Program Files/PostgreSQL/8.4/data\" -w"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(2112)
c:\program files\SetPoint\lgscroll.dll
c:\program files\ASUS\ASUS Data Security Manager\OverlayIconShlExt.dll
c:\program files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll
c:\windows\system32\btmmhook.dll
.
Zeit der Fertigstellung: 2015-07-16  16:22:47
ComboFix-quarantined-files.txt  2015-07-16 14:22
.
Vor Suchlauf: 19 Verzeichnis(se), 110.385.999.872 Bytes frei
Nach Suchlauf: 23 Verzeichnis(se), 112.939.659.264 Bytes frei
.
- - End Of File - - CDB9E1E1A36AF618C9F51FCE76C1D063
--- --- ---
64B1E91C5C6C2157642651010728F90F

cosinus 16.07.2015 15:31
Ok, dann mach jetzt wieder mit JRT und FRST weiter...

noki 16.07.2015 16:23
Geschafft! Aber kleine Info noch. Nach Combofix gab es erst mal wieder einen Absturz. Vista hat dann Chkdsk durchgeführt und ca. 30 verwaiste Dateien (sehr kryptische Dateinamen) wieder hergestellt.

JRT:JRT Logfile:
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.5.0 (07.15.2015:1)
OS: Windows Vista (TM) Home Premium x86
Ran by noki on 16.07.2015 at 17:10:01,29
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

~~~ Services
 
~~~ Tasks
 
~~~ Registry Values
 
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer
 
~~~ Files
 
~~~ Folders
 
~~~ FireFox
Emptied folder: C:\Users\noki\AppData\Roaming\mozilla\firefox\profiles\p25m8g9e.default\minidumps [7 files]
 
~~~ Chrome

[C:\Users\noki\appdata\local\Google\Chrome\User Data\Default\Preferences] - default search provider reset
[C:\Users\noki\appdata\local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:
[C:\Users\noki\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset
[C:\Users\noki\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
[]
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 16.07.2015 at 17:16:12,60
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
--- --- ---
FRST:
FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-07-2015
Ran by noki (administrator) on NOKI-PC on 16-07-2015 17:18:10
Running from D:\
Loaded Profiles: noki (Available Profiles: noki & postgres)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Geeks to Go Forum
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Microsoft Corporation) C:\Windows\System32\wermgr.exe

==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [HControlUser] => C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe [98304 2008-08-18] (ASUS)
HKLM\...\Run: [ATKOSD2] => C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe [8105984 2008-09-03] (ASUS)
HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [6265376 2008-08-12] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1029416 2007-12-06] (Synaptics, Inc.)
HKLM\...\Run: [PowerForPhone] => C:\Program Files\P4P\P4P.exe [778240 2008-01-26] ()
HKLM\...\Run: [DirectConsole2] => C:\Program Files\ASUS\Direct Console\Direct Console.exe [2705976 2008-08-21] (ASUSTek.)
HKLM\...\Run: [TrayServer] => C:\Program Files\MAGIX\Filme_auf_DVD_8\TrayServer.exe [90112 2008-01-17] (MAGIX AG)
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] => C:\Windows\KHALMNPR.EXE [56080 2007-04-12] (Logitech Inc.)
HKLM\...\Run: [ALDI_NORD_FotoSuite_Download] => C:\Program Files\ALDI Nord Foto Service\ALDI_Foto_Service\FotoSuite.exe [1257472 2008-11-13] (MAGIX AG)
HKLM\...\Run: [NeroFilterCheck] => C:\Windows\system32\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)
HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1833504 2008-08-12] (Realtek Semiconductor Corp.)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-04-23] (Apple Inc.)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [730416 2015-06-10] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Greenshot] => C:\Program Files\Greenshot\Greenshot.exe [495616 2013-10-27] (Greenshot)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-05-26] (Apple Inc.)
HKLM\...\Run: [LauncherC1765nf] => C:\Program Files\Dell Printers\Printer SSW\Launcher\dlm1launcher.exe [2471928 2013-08-13] (Dell Inc.)
HKLM\...\Run: [StatusAutoRunC1765nf] => C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1pl.exe [3024360 2013-02-06] (Dell Inc.)
HKLM\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\\isuspm.exe [2068856 2011-10-12] (Flexera Software LLC.)
HKLM\...\Run: [PaperPort PTD] => C:\Program Files\Nuance\PaperPort\pptd40nt.exe [36168 2013-05-29] (Nuance Communications, Inc.)
HKLM\...\Run: [IndexSearch] => C:\Program Files\Nuance\PaperPort\IndexSearch.exe [18248 2013-05-29] (Nuance Communications, Inc.)
HKLM\...\Run: [PPort14reminder] => C:\Program Files\Nuance\PaperPort\Ereg\Ereg.exe [330056 2013-03-14] (Nuance Communications, Inc.)
HKLM\...\Run: [PDFProHook] => C:\Program Files\Nuance\PDFViewer\pdfpro7hook.exe [641864 2013-03-20] (Nuance Communications, Inc.)
HKLM\...\Run: [InstallValidator.exe.FA87EC44_C38F_4148_93A1_FF4A64A2B707] => C:\Program Files\National Instruments\Shared\NIUninstaller\InstallValidator.exe [265608 2013-11-21] ()
HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKU\S-1-5-21-1619064115-466689268-4177747022-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-1619064115-466689268-4177747022-1000\...\Run: [NokiaSuite.exe] => C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe [1084840 2012-05-16] (Nokia)
HKU\S-1-5-21-1619064115-466689268-4177747022-1000\...\Run: [MyDriveConnect.exe] => C:\Program Files\MyDrive Connect\MyDriveConnect.exe [1792376 2014-08-22] (TomTom)
HKU\S-1-5-21-1619064115-466689268-4177747022-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk [2009-03-25]
ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2008-12-04]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HD Writer.lnk [2013-03-29]
ShortcutTarget: HD Writer.lnk -> C:\Program Files\Common Files\Panasonic\HD Writer AutoStart\HDWriterAutoStart.exe (Panasonic Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SetPoint.lnk [2008-12-04]
ShortcutTarget: SetPoint.lnk -> C:\Program Files\SetPoint\SetPoint.exe (Logitech Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk [2014-12-21]
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files\WISO\Steuersoftware 2014\mshaktuell.exe ()
ShellIconOverlayIdentifiers: [ADSMOverlayIcon] -> {A825576B-0042-4F0F-8FB0-93CE0F054E69} => C:\Program Files\ASUS\ASUS Data Security Manager\OverlayIconShlExt.dll [2007-06-15] ()
ShellIconOverlayIdentifiers: [ADSMOverlayIcon1] -> {A8D448F4-0431-45AC-9F5E-E1B434AB2249} => C:\Program Files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll [2007-06-02] ()
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Google
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = MSN Deutschland ? mit Hotmail Nachfolger Outlook und Messenger Skype
HKU\S-1-5-21-1619064115-466689268-4177747022-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1619064115-466689268-4177747022-1000\Software\Microsoft\Internet Explorer\Main,Start Page = Wetter aktuell, Wettervorhersage und Wetterbericht - WetterOnline
SearchScopes: HKLM -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = {searchTerms} - Google Search
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1619064115-466689268-4177747022-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = {searchTerms} - Google Search
BHO: PlusIEEventHelper Class -> {551A852F-39A6-44A7-9C13-AFBEC9185A9D} -> C:\Program Files\Nuance\PDFViewer\Bin\PlusIEContextMenu.dll [2011-06-30] (Zeon Corporation)
BHO: Skype Plug-In -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-11-22] (Skype Technologies S.A.)
DPF: {22E5D91F-89E6-4405-AD9C-0AF27BA6F06B} file:///E:/components/hidinputmonitorx.ocx
DPF: {4F63D44B-6274-4D60-8AB1-CAA7116B8AF3} file:///E:/components/A9.ocx
DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1375990510233
DPF: {7030CC6C-1A88-4591-BB5A-651B9F7F0C30} file:///E:/components/wmvhdrating.ocx
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-11-22] (Skype Technologies S.A.)
ShellExecuteHooks:  - {AEB6717E-7E19-11d0-97EE-00C04FD91972} -  No File [ ]
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{FEA61DD9-6138-4BB7-83A2-5A1E647F7064}: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\noki\AppData\Roaming\Mozilla\Firefox\Profiles\p25m8g9e.default
FF Homepage: hxxp://www.wetteronline.de
FF Keyword.URL:
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_191.dll [2015-07-09] ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2014-02-21] ()
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-30] (Microsoft Corporation)
FF Plugin: @nokia.com/EnablerPlugin -> C:\Program Files\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll [2012-05-16] ( )
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-04-30] (Adobe Systems Inc.)
FF Plugin: ZEON/PDF,version=2.0 -> C:\Program Files\Nuance\PDFViewer\bin\nppdf.dll [2011-07-15] (Zeon Corporation)
FF Plugin HKU\S-1-5-21-1619064115-466689268-4177747022-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin1017325.dll [2012-10-04] (Amazon.com, Inc.)
FF Extension: Avira Browser Safety - C:\Users\noki\AppData\Roaming\Mozilla\Firefox\Profiles\p25m8g9e.default\Extensions\abs@avira.com [2015-06-18]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-02-17]
Chrome:
=======
CHR RestoreOnStartup: Default -> "hxxp://www.google.com/"
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\20.0.1132.57\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\20.0.1132.57\pdf.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\20.0.1132.57\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin7.dll No File
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (Nokia Suite Enabler Plugin) - C:\Program Files\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Profile: C:\Users\noki\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\noki\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-08-25]
CHR Extension: (Google Search) - C:\Users\noki\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-08-25]
CHR Extension: (Gmail) - C:\Users\noki\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-08-25]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [68096 2009-03-25] () [File not signed]
S2 ADSMService; C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe [73728 2007-05-18] () [File not signed]
S2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc.exe [825136 2015-06-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [450808 2015-06-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [450808 2015-06-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1187336 2015-06-10] (Avira Operations GmbH & Co. KG)
S2 ASLDRService; C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe [100920 2008-08-14] ()
S2 ATKGFNEXSrv; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [94208 2007-08-08] () [File not signed]
S2 DLNBDB; C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1db.exe [191464 2013-02-06] ()
S2 Fabs; C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe [1155072 2009-02-03] (MAGIX AG) [File not signed]
S3 FirebirdServerMAGIXInstance; C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2008-08-07] (MAGIX®) [File not signed]
S2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728 2008-06-09] (Hewlett-Packard Company) [File not signed]
S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S2 OMPM Service; C:\Program Files\Dell Printers\OpenManage\OMPMv2.0\client\rdmf_clientd.exe [5738823 2014-03-06] () [File not signed]
S2 OMPMJBASSVC; C:\Program Files\Dell Printers\OpenManage\OMPMv2.0\server\jboss-as\bin\jbosssvc.exe [61440 2011-08-11] (Red Hat®, Inc.) [File not signed]
S2 OMPMWatchdogService; C:\Program Files\Dell Printers\OpenManage\OMPMv2.0\client\OMPMWatchdogService.exe [199633 2014-03-18] () [File not signed]
S2 PDFProFiltSrvPP; C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe [77640 2013-05-29] (Nuance Communications, Inc.)
S2 postgresql-8.4; C:\Program Files\PostgreSQL\8.4\bin\pg_ctl.exe [66048 2012-08-16] (PostgreSQL Global Development Group) [File not signed]
S2 spmgr; C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe [125496 2007-08-03] ()
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-21] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 61883; C:\Windows\System32\DRIVERS\61883.sys [45696 2008-01-21] (Microsoft Corporation)
R0 AsDsm; C:\Windows\system32\Drivers\AsDsm.sys [29752 2007-08-11] (Windows (R) Codename Longhorn DDK provider)
R2 ASMMAP; C:\Program Files\ATKGFNEX\ASMMAP.sys [13880 2007-07-24] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108448 2015-06-10] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136728 2015-06-10] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37896 2015-05-07] (Avira Operations GmbH & Co. KG)
R2 ghaio; C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys [20936 2007-08-03] ()
R3 itecir; C:\Windows\System32\DRIVERS\itecir.sys [54784 2007-12-19] (ITE Tech. Inc. )
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15928 2008-06-03] ( )
R0 lullaby; C:\Windows\System32\DRIVERS\lullaby.sys [15416 2008-05-29] (Windows (R) Codename Longhorn DDK provider)
R3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [28688 2007-04-12] (Logitech, Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-04-14] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2015-07-16] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-04-14] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ATKACPI.sys [7680 2006-12-14] (ATK0100)
S3 PhotoFrame; C:\Windows\System32\DRIVERS\PhotoFrame.sys [30464 2007-09-11] (ETC) [File not signed]
R0 PxHelp20; C:\Windows\System32\Drivers\PxHelp20.sys [45744 2011-10-04] (Rovi Corporation)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1748352 2008-06-09] ()
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [31848 2015-06-10] (Avira Operations GmbH & Co. KG)
S3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [25984 2009-12-12] (The OpenVPN Project)
S3 USB28xxBGA; C:\Windows\System32\DRIVERS\emBDA.sys [530944 2008-03-06] (eMPIA Technology, Inc.)
S3 USB28xxOEM; C:\Windows\System32\DRIVERS\emOEM.sys [45696 2007-04-25] (eMPIA Technology, Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\Users\noki\AppData\Local\Temp\catchme.sys [X]
S4 Eskgfroc; No ImagePath
S3 GigasetGenericUSB; system32\DRIVERS\GigasetGenericUSB.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-16 17:16 - 2015-07-16 17:16 - 00001301 _____ C:\Users\noki\Desktop\JRT.txt
2015-07-16 16:38 - 2015-07-16 16:38 - 00000000 __SHD C:\found.003
2015-07-16 16:22 - 2015-07-16 16:22 - 00013389 _____ C:\ComboFix.txt
2015-07-16 16:03 - 2015-07-16 16:22 - 00000000 ____D C:\ComboFix
2015-07-16 15:47 - 2015-07-16 14:38 - 05634275 ____R (Swearware) C:\Users\noki\Desktop\ComboFix.exe
2015-07-16 14:33 - 2015-06-17 18:50 - 02264576 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-07-16 14:33 - 2015-06-17 17:09 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2015-07-16 14:13 - 2015-07-16 14:13 - 00160408 _____ C:\Windows\Minidump\Mini071615-01.dmp
2015-07-16 12:27 - 2015-07-16 12:31 - 00000000 ____D C:\AdwCleaner
2015-07-16 11:57 - 2015-07-16 12:14 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-07-16 11:56 - 2015-07-16 11:56 - 00000866 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-07-16 11:56 - 2015-07-16 11:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-07-16 11:56 - 2015-07-16 11:56 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-07-16 11:56 - 2015-07-16 11:56 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
2015-07-16 11:56 - 2015-04-14 09:37 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-07-16 11:56 - 2015-04-14 09:37 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-07-16 11:56 - 2015-04-14 09:37 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-07-16 11:00 - 2015-07-03 18:04 - 01316864 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2015-07-16 11:00 - 2015-06-25 04:57 - 02066432 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-07-16 10:23 - 2015-06-12 18:01 - 00298496 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-07-16 00:34 - 2015-07-07 17:58 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-07-16 00:34 - 2015-07-07 16:22 - 00296960 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-07-15 23:52 - 2015-07-15 23:52 - 00000000 ____D C:\found.002
2015-07-15 23:14 - 2015-07-15 23:14 - 00160408 _____ C:\Windows\Minidump\Mini071515-01.dmp
2015-07-15 23:09 - 2015-06-23 18:02 - 00501248 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-07-15 22:49 - 2015-07-15 22:49 - 00000000 ____D C:\Users\noki\Documents\SapWorkDir
2015-07-15 22:28 - 2015-05-31 10:11 - 00225792 _____ (Microsoft Corporation) C:\Windows\system32\cewmdm.dll
2015-07-15 22:27 - 2015-07-16 17:18 - 00000000 ____D C:\FRST
2015-07-15 22:24 - 2015-07-15 22:24 - 00000000 _____ C:\Users\noki\defogger_reenable
2015-07-14 22:10 - 2015-07-03 07:31 - 12386304 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-07-14 22:10 - 2015-07-03 07:18 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-07-14 22:09 - 2015-06-17 03:14 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-07-14 22:09 - 2015-06-17 03:12 - 09750528 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-07-14 22:09 - 2015-06-17 03:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-07-14 22:09 - 2015-06-17 03:10 - 01139712 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-07-14 22:09 - 2015-06-17 03:09 - 01804288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-07-14 22:09 - 2015-06-17 03:09 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-07-14 22:09 - 2015-06-17 03:09 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-07-14 22:09 - 2015-06-17 03:09 - 00421888 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-07-14 22:09 - 2015-06-17 03:08 - 00718336 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-07-14 22:09 - 2015-06-17 03:08 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-07-14 22:09 - 2015-06-17 03:08 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-07-14 22:09 - 2015-06-17 03:08 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-07-14 22:09 - 2015-06-17 03:08 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-07-14 22:09 - 2015-06-17 03:08 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-07-14 22:09 - 2015-06-17 03:08 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-07-14 22:09 - 2015-06-17 03:08 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-07-14 22:09 - 2015-06-17 03:08 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-07-14 22:09 - 2015-06-17 03:08 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-07-14 22:09 - 2015-06-17 03:08 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-07-14 22:09 - 2015-06-17 03:08 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-07-11 09:40 - 2015-07-11 09:40 - 00160408 _____ C:\Windows\Minidump\Mini071115-01.dmp
2015-07-08 22:09 - 2015-07-08 22:09 - 00160408 _____ C:\Windows\Minidump\Mini070815-01.dmp
2015-06-29 13:15 - 2015-06-29 13:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-06-25 20:04 - 2015-06-25 20:04 - 00000000 ____D C:\found.001
2015-06-25 07:37 - 2015-06-25 07:55 - 00000000 ___RD C:\Musik
2015-06-24 23:39 - 2015-06-24 23:39 - 00000000 __RSH C:\MSDOS.SYS
2015-06-24 23:39 - 2015-06-24 23:39 - 00000000 __RSH C:\IO.SYS
2015-06-19 20:35 - 2015-06-19 20:35 - 00160408 _____ C:\Windows\Minidump\Mini061915-01.dmp
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-16 17:15 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-07-16 17:15 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-07-16 17:08 - 2008-12-04 21:13 - 01768890 _____ C:\Windows\WindowsUpdate.log
2015-07-16 17:03 - 2010-11-19 14:55 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-07-16 17:03 - 2009-02-11 00:55 - 00151688 _____ C:\ProgramData\nvModes.001
2015-07-16 17:03 - 2009-02-11 00:54 - 00151688 _____ C:\ProgramData\nvModes.dat
2015-07-16 17:03 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-16 16:48 - 2010-11-19 14:55 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-07-16 16:44 - 2012-12-02 21:08 - 00568532 _____ C:\Windows\PFRO.log
2015-07-16 16:23 - 2012-04-06 09:10 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-07-16 16:22 - 2010-12-12 21:46 - 00000000 ____D C:\Qoobox
2015-07-16 16:20 - 2006-11-02 12:23 - 00000215 _____ C:\Windows\system.ini
2015-07-16 15:21 - 2009-02-08 23:39 - 00000000 ____D C:\Users\noki
2015-07-16 15:00 - 2013-08-08 21:13 - 00000000 ____D C:\Program Files\Java
2015-07-16 14:36 - 2008-12-04 21:14 - 00003613 _____ C:\Windows\bthservsdp.dat
2015-07-16 14:36 - 2006-11-02 15:01 - 00032606 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-07-16 14:13 - 2013-03-21 22:13 - 401666068 _____ C:\Windows\MEMORY.DMP
2015-07-16 14:13 - 2010-01-16 01:49 - 00000000 ____D C:\Windows\Minidump
2015-07-16 11:06 - 2006-11-02 14:47 - 00399544 _____ C:\Windows\system32\FNTCACHE.DAT
2015-07-16 00:50 - 2013-07-28 01:07 - 00000000 ____D C:\Windows\system32\MRT
2015-07-15 22:56 - 2009-02-08 23:40 - 00114168 _____ C:\Users\noki\AppData\Local\GDIPFONTCACHEV1.DAT
2015-07-15 22:50 - 2010-07-08 15:19 - 00000000 ____D C:\Program Files\OpenVPN
2015-07-15 22:49 - 2010-07-13 16:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Business Explorer
2015-07-15 22:49 - 2010-07-13 16:02 - 00000000 ____D C:\Users\noki\SapWorkDir
2015-07-15 22:27 - 2006-11-02 12:33 - 01567488 _____ C:\Windows\system32\PerfStringBackup.INI
2015-07-12 23:09 - 2009-02-12 00:34 - 00000000 ____D C:\Users\noki\AppData\Roaming\Adobe
2015-07-12 23:09 - 2009-02-08 23:43 - 00000000 ____D C:\ProgramData\Adobe
2015-07-09 07:23 - 2012-04-06 09:10 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-07-09 07:23 - 2011-05-16 08:44 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-07-07 08:08 - 2013-12-09 20:51 - 00000000 ____D C:\Users\noki\AppData\Local\Greenshot
2015-07-03 08:49 - 2006-11-02 12:24 - 127070192 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2015-07-01 07:02 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\LogFiles
2015-06-29 13:15 - 2015-05-07 19:11 - 00001856 _____ C:\Users\Public\Desktop\Avira Antivirus.lnk
2015-06-23 13:27 - 2009-10-02 22:08 - 00246952 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-06-20 20:03 - 2014-08-25 12:33 - 00000000 ____D C:\Users\noki\AppData\Local\Adobe
==================== Files in the root of some directories =======
2008-05-22 19:35 - 2008-05-22 19:35 - 0051962 _____ () C:\Program Files\Common Files\banner.jpg
2008-08-09 00:48 - 2008-08-09 00:48 - 0090112 _____ () C:\Program Files\Common Files\CPInstallAction.dll
2014-05-15 23:10 - 2014-05-15 23:10 - 0000008 _____ () C:\Users\noki\AppData\Roaming\NMM-MetaData.db
2011-07-20 22:28 - 2012-06-03 17:36 - 0001188 _____ () C:\Users\noki\AppData\Local\crc32list11.txt
2010-03-14 13:04 - 2010-03-14 13:04 - 0000552 _____ () C:\Users\noki\AppData\Local\d3d8caps.dat
2013-01-13 13:53 - 2015-06-15 13:57 - 0000680 _____ () C:\Users\noki\AppData\Local\d3d9caps.dat
2009-02-09 00:23 - 2015-04-12 23:33 - 0103936 _____ () C:\Users\noki\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-02-22 22:44 - 2013-05-10 12:11 - 0004096 ____H () C:\Users\noki\AppData\Local\keyfile3.drm
2013-08-27 22:12 - 2013-08-27 22:12 - 0000011 _____ () C:\ProgramData\.tv7
2010-12-22 13:54 - 2010-12-22 13:54 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2009-02-11 00:55 - 2015-07-16 17:03 - 0151688 _____ () C:\ProgramData\nvModes.001
2009-02-11 00:54 - 2015-07-16 17:03 - 0151688 _____ () C:\ProgramData\nvModes.dat
Some files in TEMP:
====================
C:\Users\noki\AppData\Local\temp\avgnt.exe
C:\Users\noki\AppData\Local\temp\NOSEventMessages.dll

==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-07-16 17:15
==================== End of log ============================
--- --- ---

cosinus 16.07.2015 22:23
Also das mit deiner Festplatte gefällt mit so nicht - ständige Filesystemchecks sind ungewöhnlich. Bitte erstmal so fortfahren: Zustand der Festplatte herausfinden - so gehts - Anleitungen

Poste mir am besten ein komplettes Log von CDI :)

noki 17.07.2015 07:01
Status "Vorsicht"!

----------------------------------------------------------------------------
CrystalDiskInfo 6.5.2 (C) 2008-2015 hiyohiyo
Crystal Dew World : Crystal Dew World
----------------------------------------------------------------------------
OS : Windows Vista Home Premium SP2 [6.0 Build 6002] (x86)
Date : 2015/07/17 7:50:35
-- Controller Map ----------------------------------------------------------
- Ricoh SD/MMC Host Controller [ATA]
- Ricoh Memory Stick Controller [ATA]
- Ricoh xD-Picture Card Controller [ATA]
+ Intel(R) ICH9M-E/M SATA AHCI Controller [ATA]
- Hitachi HTS545050KTA300
- MATSHITA DVD-RAM UJ870BJ
- Microsoft iSCSI-Initiator [SCSI]
-- Disk List ---------------------------------------------------------------
(1) Hitachi HTS545050KTA300 : 500,1 GB [0/0/0, pd1]
----------------------------------------------------------------------------
(1) Hitachi HTS545050KTA300
----------------------------------------------------------------------------
Model : Hitachi HTS545050KTA300
Firmware : BKFOC60G
Serial Number : 081119BK0F00VEGDZ8PB
Disk Size : 500,1 GB (8,4/137,4/500,1/500,1)
Buffer Size : 7015 KB
Queue Depth : 32
# of Sectors : 976773168
Rotation Rate : Unbekannt
Interface : Serial ATA
Major Version : ATA8-ACS
Minor Version : ATA8-ACS version 3f
Transfer Mode : ---- | SATA/300
Power On Hours : 16368 Std.
Power On Count : 7565 mal
Temperature : 41 C (105 F)
Health Status : Vorsicht
Features : S.M.A.R.T., APM, AAM, 48bit LBA, NCQ
APM Level : 4080h [ON]
AAM Level : 80FEh [OFF]
-- S.M.A.R.T. --------------------------------------------------------------
ID Cur Wor Thr RawValues(6) Attribute Name
01 100 100 _62 000000000000 Lesefehlerrate
02 100 100 _40 000000000000 Datendurchsatz-Leistung
03 216 216 _33 001200000001 Mittlere Anlaufzeit
04 _93 _93 __0 000000002BA7 Start/Stopp-Zyklen der Spindel
05 100 100 __5 000000000000 Wiederzugewiesene Sektoren
07 100 100 _67 000000000000 Suchfehler
08 100 100 _40 000000000000 Güte der Suchoperationen
09 _63 _63 __0 000000003FF0 Betriebsstunden
0A 100 100 _60 000000000000 Misslungene Spindelanläufe
0C _96 _96 __0 000000001D8D Geräte-Einschaltvorgänge
BF 100 100 __0 000000000000 Beschleunigungssensor-Fehlerrate
C0 100 100 __0 00000000003D Ausschaltungsabbrüche
C1 _81 _81 __0 00000002EEB3 Laden/Entladen-Zyklen
C2 134 134 __0 003500120029 Temperatur
C4 100 100 __0 00000000000D Wiederzuweisungsereignisse
C5 100 100 __0 000000000005 Aktuell ausstehende Sektoren
C6 100 100 __0 000000000000 Nicht korrigierbare Sektoren
C7 200 200 __0 000000000000 UltraDMA-CRC-Fehler
DF 100 100 __0 000000000000 Laden/Entladen-Wiederholungen
-- IDENTIFY_DEVICE ---------------------------------------------------------
0 1 2 3 4 5 6 7 8 9
000: 045A 3FFF C837 0010 0000 0000 003F 0000 0000 0000
010: 3038 3131 3139 424B 3046 3030 5645 4744 5A38 5042
020: 0003 36CE 0004 424B 464F 4336 3047 4869 7461 6368
030: 6920 4854 5335 3435 3035 304B 5441 3330 3020 2020
040: 2020 2020 2020 2020 2020 2020 2020 8010 4000 0F00
050: 4000 0200 0200 0007 3FFF 0010 003F FC10 00FB 0110
060: FFFF 0FFF 0000 0007 0003 0078 0078 0078 0078 0000
070: 0000 0000 0000 0000 0000 001F 1706 0000 005E 0044
080: 01FC 0042 746B 7F69 6163 7469 BC49 6163 407F 006C
090: 006C 4080 FFFE 0000 80FE 0000 0000 0000 0000 0000
100: 6030 3A38 0000 0000 0000 0000 0000 8848 5000 CCA5
110: 56C5 E61F 0000 0000 0000 0000 0000 0000 0000 4014
120: 4014 0000 0000 0000 0000 0000 0000 0000 0029 000B
130: 000D 0000 0000 0000 0000 0000 0000 0000 0000 0000
140: 0000 0000 0000 0000 0000 0000 0000 0000 4001 0000
150: 8000 0000 4643 0000 0000 6253 5371 6262 0000 0000
160: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
170: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
180: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
190: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
200: 0000 0000 0000 0000 0000 0000 003D 0000 0000 0000
210: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
220: 0000 0000 100F 0021 0000 0000 0000 0000 0000 0000
230: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
240: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
250: 0000 0000 0000 0000 0000 5FA5
-- SMART_READ_DATA ---------------------------------------------------------
+0 +1 +2 +3 +4 +5 +6 +7 +8 +9 +A +B +C +D +E +F
000: 10 00 01 0B 00 64 64 00 00 00 00 00 00 00 02 05
010: 00 64 64 00 00 00 00 00 00 00 03 07 00 D8 D8 01
020: 00 00 00 12 00 00 04 12 00 5D 5D A7 2B 00 00 00
030: 00 00 05 33 00 64 64 00 00 00 00 00 00 00 07 0B
040: 00 64 64 00 00 00 00 00 00 00 08 05 00 64 64 00
050: 00 00 00 00 00 00 09 12 00 3F 3F F0 3F 00 00 00
060: 00 00 0A 13 00 64 64 00 00 00 00 00 00 00 0C 32
070: 00 60 60 8D 1D 00 00 00 00 00 BF 0A 00 64 64 00
080: 00 00 00 00 00 00 C0 32 00 64 64 3D 00 00 00 00
090: 00 00 C1 12 00 51 51 B3 EE 02 00 00 00 00 C2 02
0A0: 00 86 86 29 00 12 00 35 00 00 C4 32 00 64 64 0D
0B0: 00 00 00 00 00 00 C5 22 00 64 64 05 00 00 00 00
0C0: 00 00 C6 08 00 64 64 00 00 00 00 00 00 00 C7 0A
0D0: 00 C8 C8 00 00 00 00 00 00 00 DF 0A 00 64 64 00
0E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
160: 00 00 00 00 00 00 00 00 00 00 00 00 85 02 01 5B
170: 03 00 01 00 02 DA 00 00 00 00 00 00 00 00 00 00
180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10
-- SMART_READ_THRESHOLD ----------------------------------------------------
+0 +1 +2 +3 +4 +5 +6 +7 +8 +9 +A +B +C +D +E +F
000: 10 00 01 3E 00 00 00 00 00 00 00 00 00 00 02 28
010: 00 00 00 00 00 00 00 00 00 00 03 21 00 00 00 00
020: 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00
030: 00 00 05 05 00 00 00 00 00 00 00 00 00 00 07 43
040: 00 00 00 00 00 00 00 00 00 00 08 28 00 00 00 00
050: 00 00 00 00 00 00 09 00 00 00 00 00 00 00 00 00
060: 00 00 0A 3C 00 00 00 00 00 00 00 00 00 00 0C 00
070: 00 00 00 00 00 00 00 00 00 00 BF 00 00 00 00 00
080: 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00
090: 00 00 C1 00 00 00 00 00 00 00 00 00 00 00 C2 00
0A0: 00 00 00 00 00 00 00 00 00 00 C4 00 00 00 00 00
0B0: 00 00 00 00 00 00 C5 00 00 00 00 00 00 00 00 00
0C0: 00 00 C6 00 00 00 00 00 00 00 00 00 00 00 C7 00
0D0: 00 00 00 00 00 00 00 00 00 00 DF 00 00 00 00 00
0E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 89

Noch was zum aktuellen Status. Die ständige 100%-Auslastung hat sich erledigt. Bin jetzt immer so bei 10-20%. Laptop läuft auch ruhig und stabil. Es sei denn, ich Deinstalliere Programme. Das erste klappt meistens noch, aber beim zweiten Programm bleibt der Laptop dann einfach stehen. Als ob er sich ausschaltet, aber das Bild bleibt bestehen. Keine Festplattenaktivität mehr, kein Lüfter. Dann muss ich hart ausschalten und dann macht er bei jedem 2. oder 3. mal chkdsk.


Alle Zeitangaben in WEZ +1. Es ist jetzt 19:40 Uhr.
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131