Win7 hängt sich einfach so auf...

[SwordstaR88]

Sehr geehrte epvp Community,

ich habe seit gestern ein Problem - undzwar hängt sich mein System nach einiger Zeit (unterschiedlich) auf. Es beginnt meist bei einem Prozess (zbs Firefox) und endet damit, das ich nichtmal mehr den Taskmanager starten kann und ich den PC via Power Button herunterfahre. Gestern Nacht kam ein einziger Bluescreen, konnte mich nichtmehr an den Inhalt erinnern, jedoch stand dort etwas von Problemen von Systemteilen oder so...
Nunja, mein Ziel ist es eigendlich, mein System ohne Neuinstallation wieder herzurichten, natürlich Virenfrei und funktionstüchtig.

Malwarebytes:

 Spoiler

lwarebytes Anti-Malware (Test) 1.75.0.1300


Datenbank Version: v2013.06.17.02

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Admin :: ADMIN-PC [Administrator]

Schutz: Aktiviert

17.06.2013 13:15:13
MBAM-log-2013-06-17 (13-54-30).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|R:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 417760
Laufzeit: 18 Minute(n), 56 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 16
C:\Windows\AutoKMS.exe (Riskware.Keygen) -> Keine Aktion durchgeführt.
C:\Windows\KMSEmulator.exe (RiskWare.Tool.CK) -> Keine Aktion durchgeführt.
D:\Downloads\PickUp-Bot (Vista & 7).dll (Flooder.SpamBot) -> Keine Aktion durchgeführt.
D:\Downloads\PickUp-Bot (XP).dll (Flooder.SpamBot) -> Keine Aktion durchgeführt.
D:\Downloads\Switch-Bot (Vista & 7).dll (Flooder.SpamBot) -> Keine Aktion durchgeführt.
D:\Downloads\Switch-Bot (XP).dll (Flooder.SpamBot) -> Keine Aktion durchgeführt.
D:\Downloads\Tools einstellen (Vista & 7).dll (Flooder.SpamBot) -> Keine Aktion durchgeführt.
D:\Downloads\Tools einstellen (XP).dll (Flooder.SpamBot) -> Keine Aktion durchgeführt.
D:\Downloads\Upp-Tool (Vista & 7).dll (Flooder.SpamBot) -> Keine Aktion durchgeführt.
D:\Downloads\Upp-Tool (XP).dll (Flooder.SpamBot) -> Keine Aktion durchgeführt.
D:\Metin2\M2Bob - Version 2.2.12\M2Bob.exe (Trojan.FakeMS) -> Keine Aktion durchgeführt.
D:\Metin2\M2Bob - Version 2.2.12\Ressources\m2bobclient_2217.bin (Trojan.FakeMS) -> Keine Aktion durchgeführt.
D:\Metin2\M2Bob - Version 2.2.12\Ressources\m2bobclient_2219.bin (Trojan.FakeMS) -> Keine Aktion durchgeführt.
D:\Metin2\M2Bob - Version 2.2.12\Ressources\m2bobclient_2222.bin (Trojan.FakeMS) -> Keine Aktion durchgeführt.
D:\Metin2\M2Bob - Version 2.2.12\Ressources\m2bobclient_2293.bin (Trojan.FakeMS) -> Keine Aktion durchgeführt.
D:\Metin2\M2Bob - Version 2.2.12\Ressources\m2bobclient_2295.bin (Trojan.FakeMS) -> Keine Aktion durchgeführt.

Otl:

 Spoiler

OTL logfile created on: 20.07.2013 17:38:19 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Admin\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

9,99 Gb Total Physical Memory | 6,77 Gb Available Physical Memory | 67,73% Memory free
10,99 Gb Paging File | 7,63 Gb Available in Paging File | 69,42% Paging File free
Paging file location(s): c:\pagefile.sys 1024 1024 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 59,62 Gb Total Space | 12,08 Gb Free Space | 20,26% Space Free | Partition Type: NTFS
Drive D: | 781,25 Gb Total Space | 609,55 Gb Free Space | 78,02% Space Free | Partition Type: NTFS
Drive E: | 616,01 Gb Total Space | 595,13 Gb Free Space | 96,61% Space Free | Partition Type: NTFS
Drive R: | 1021,97 Mb Total Space | 1021,95 Mb Free Space | 100,00% Space Free | Partition Type: FAT32

Computer Name: ADMIN-PC | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013.07.20 17:38:03 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Admin\Downloads\OTL.exe
PRC - [2013.07.14 20:40:01 | 000,567,880 | ---- | M] () -- C:\Program Files (x86)\puush\puush.exe
PRC - [2013.05.20 11:56:08 | 000,440,992 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Windows Phone\WindowsPhone.exe
PRC - [2013.04.17 14:28:38 | 000,917,400 | ---- | M] (Mozilla Corporation) -- D:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2012.07.09 01:40:10 | 000,104,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msco rsvw.exe
PRC - [2010.08.12 17:45:00 | 000,024,064 | ---- | M] () -- C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\capiws.exe
PRC - [2005.11.14 16:24:00 | 000,121,064 | ---- | M] (Macrovision Corporation) -- C:\Program Files (x86)\Realtek\Audio\Drivers\HDADrv\Setup.exe


========== Modules (No Company Name) ==========

MOD - [2013.07.20 16:06:54 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Runtime.Remo#\c8ea295fd4dce110b32c3c4f0e3807b2 \System.Runtime.Remoting.ni.dll
MOD - [2013.07.20 16:06:37 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Windows.Forms\178644ab40108f3becd8b91049a254c3 \System.Windows.Forms.ni.dll
MOD - [2013.07.20 16:06:32 | 001,593,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Drawing\bfa7a95284aec941f4b03bae0debe07c\Syste m.Drawing.ni.dll
MOD - [2013.07.20 16:06:29 | 005,464,064 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Xml\32066405eb9ab14056b2af3115d2a6de\System.Xm l.ni.dll
MOD - [2013.07.20 16:06:26 | 000,978,432 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Configuration\9e24b9ffd816c0c90efc4d3fc9fd745f \System.Configuration.ni.dll
MOD - [2013.07.20 16:06:16 | 007,989,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Sys tem\187c13e8967097d2ed1e5f123e7d890a\System.ni.dll
MOD - [2013.07.20 16:06:12 | 011,499,520 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\msc orlib\9a6c1b7af18b4d5a91dc7f8d6617522f\mscorlib.ni .dll
MOD - [2013.07.20 15:00:49 | 018,545,152 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Pre sentatio5ae0f00f#\4bb52b02b721bb5f8739eab898723751 \PresentationFramework.ni.dll
MOD - [2013.07.20 15:00:40 | 010,926,592 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Pre sentationCore\aa489a04fe509025c1baeb8a3a8185f4\Pre sentationCore.ni.dll
MOD - [2013.07.20 15:00:40 | 007,566,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Sys tem.Xml\38a0a29884a7c5bb50d9114ceb6866c5\System.Xm l.ni.dll
MOD - [2013.07.20 15:00:36 | 006,998,016 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Sys tem.Core\ed2841e8c3c99feb0d04e4ea5ca0a152\System.C ore.ni.dll
MOD - [2013.07.20 15:00:36 | 001,880,576 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Sys tem.Xaml\c5f14d8d1109365283a352a54f0a10cf\System.X aml.ni.dll
MOD - [2013.07.20 15:00:34 | 003,910,144 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Win dowsBase\eee141c3bb48eaa1a0379fb82b3c4298\WindowsB ase.ni.dll
MOD - [2013.07.20 15:00:34 | 001,156,608 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Sys tem.Management\389618567077f42c6247fed59cd7f87a\Sy stem.Management.ni.dll
MOD - [2013.07.20 15:00:33 | 000,964,096 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Sys tem.Configuration\e4ffebb0f0a92f5e8caaacb697537040 \System.Configuration.ni.dll
MOD - [2013.07.20 15:00:32 | 009,937,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Sys tem\0c7fff6c73e859736f1f84b20f6b0b0a\System.ni.dll
MOD - [2013.07.20 15:00:32 | 000,462,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Pre sentatio1c9175f8#\7bddc53dc2d50b327afaa798cb47c5b8 \PresentationFramework.Aero.ni.dll
MOD - [2013.07.20 15:00:27 | 016,547,328 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\msc orlib\aa3538b86646ec3401d133b7f9bc8465\mscorlib.ni .dll
MOD - [2013.07.14 20:40:01 | 000,567,880 | ---- | M] () -- C:\Program Files (x86)\puush\puush.exe
MOD - [2013.04.21 21:44:32 | 000,087,952 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2013.04.21 21:44:04 | 001,242,952 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2013.04.17 14:28:37 | 002,402,200 | ---- | M] () -- D:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2013.01.20 03:03:39 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2. 0.0.0_de_b77a5c561934e089\mscorlib.resources.dll


========== Services (SafeList) ==========

SRV:64bit: - [2013.03.29 03:34:18 | 000,241,152 | ---- | M] (AMD) [Disabled | Stopped] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009.07.14 03:38:59 | 000,019,456 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\CISVC.EXE -- (CISVC)
SRV - [2013.06.21 09:53:36 | 000,162,408 | R--- | M] (Skype Technologies) [Auto | Stopped] -- D:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013.05.17 16:47:46 | 000,024,576 | ---- | M] (Realtek Semiconductor.) [Auto | Running] -- C:\Program Files (x86)\Realtek\Audio\SetupAfterRebootService.exe -- (SetupARService)
SRV - [2013.01.24 20:15:10 | 000,045,056 | ---- | M] () [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\BattlEye\BEService.exe -- (BEService)
SRV - [2013.01.24 14:30:21 | 000,541,608 | ---- | M] (Valve Corporation) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.07.09 01:40:10 | 000,104,912 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msco rsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.08.12 17:45:00 | 000,024,064 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\capiws.exe -- (OpenVPNAccessClient)
SRV - [2010.02.19 14:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2010.01.09 22:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EX E -- (osppsvc)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\msco rsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2004.06.14 01:00:00 | 000,057,344 | ---- | M] (brother Industries Ltd) [On_Demand | Stopped] -- C:\Windows\SysWOW64\brsvc01a.exe -- (Brother XP spl Service)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2013.06.30 20:23:41 | 000,231,376 | ---- | M] (TrueCrypt Foundation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\truecrypt.sys -- (truecrypt)
DRV:64bit: - [2013.04.12 11:41:28 | 000,131,856 | ---- | M] (Oracle Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)
DRV:64bit: - [2013.03.29 04:35:02 | 011,658,752 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2013.03.29 03:09:44 | 000,581,120 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2013.03.01 03:49:12 | 000,036,600 | ---- | M] (Riverbed Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\npf.sys -- (NPF)
DRV:64bit: - [2013.02.22 03:53:00 | 000,042,184 | ---- | M] (Anchorfree Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\taphss6.sys -- (taphss6)
DRV:64bit: - [2013.01.20 03:03:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2013.01.17 22:15:12 | 000,066,800 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGSHidFilt.Sys -- (LGSHidFilt)
DRV:64bit: - [2012.11.29 12:50:06 | 000,073,552 | ---- | M] (Dataram, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RAMDiskVE.sys -- (RAMDiskVE)
DRV:64bit: - [2012.09.21 21:04:24 | 000,024,608 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lvbflt64.sys -- (CompFilter64)
DRV:64bit: - [2012.09.21 21:04:22 | 004,763,680 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lvuvc64.sys -- (LVUVC64)
DRV:64bit: - [2012.09.21 21:04:22 | 000,351,520 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lvrs64.sys -- (LVRS64)
DRV:64bit: - [2012.09.17 16:05:26 | 000,123,704 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\jraid.sys -- (JRAID)
DRV:64bit: - [2012.08.21 14:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2012.06.05 13:45:16 | 000,237,968 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtHDMIVX.sys -- (RTHDMIAzAudService)
DRV:64bit: - [2012.05.30 13:42:10 | 000,569,152 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2012.02.02 11:43:02 | 000,509,104 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1k62x64.sys -- (e1kexpress)
DRV:64bit: - [2011.11.03 03:01:00 | 000,056,208 | ---- | M] (Rovi Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2011.04.11 22:01:00 | 000,341,832 | ---- | M] (Logitech) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ladfGSRamd64.sys -- (LADF_RenderOnly)
DRV:64bit: - [2011.04.11 22:00:18 | 000,410,184 | ---- | M] (Logitech) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ladfGSCamd64.sys -- (LADF_CaptureOnly)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.08.03 16:25:30 | 000,030,720 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tapoas.sys -- (tapoas)
DRV:64bit: - [2009.11.24 03:38:00 | 000,016,008 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LGVirHid.sys -- (LGVirHid)
DRV:64bit: - [2009.11.24 03:37:50 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.03.18 16:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B4 36 B4 5F B1 F6 CD 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledAddons: %7Bf36c6cd1-da73-491d-b290-8fc9115bfa55%7D:2.2.1
FF - prefs.js..extensions.enabledAddons: firefox%40mega.co.nz:1.0.3
FF - prefs.js..extensions.enabledAddons: ich%40maltegoetz.de:1.5.1
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.5
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_70 0_224.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDet ect64.dll (Adobe Systems)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_70 0_224.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: E:\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\3.0.40818.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@ngm.nexoneu.com/NxGame: C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDet ect32.dll (Adobe Systems)
FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Users\Admin\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)

64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Ex tensions\\: C:\PROGRAM FILES\ESET\ESET NOD32 ANTIVIRUS\MOZILLA THUNDERBIRD
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Ex tensions\\: C:\PROGRAM FILES\BITDEFENDER\BITDEFENDER\BDTBEXT [2013.07.04 11:51:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extens ions\\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}: C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.5\extensions\\Components: D:\Program Files (x86)\Mozilla Firefox\components [2013.07.20 14:53:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.5\extensions\\Plugins: D:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Ex tensions\\: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Ex tensions\\: C:\Program Files\Bitdefender\Bitdefender\bdtbext [2013.07.04 11:51:54 | 000,000,000 | ---D | M]

[2013.06.28 19:38:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Extensions
[2013.06.28 19:38:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Extensions\ net.openvpn.client
[2013.07.01 14:55:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Pro files\9oid3g3q.default\extensions
[2013.04.16 18:20:59 | 000,000,000 | ---D | M] (Flashblock) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Pro files\9oid3g3q.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}
[2013.06.30 00:24:30 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Pro files\9oid3g3q.default\extensions\[email protected] e
[2013.03.23 19:37:42 | 000,004,366 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\pro files\9oid3g3q.default\extensions\. nz.xpi
[2013.05.08 21:20:33 | 000,870,680 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\pro files\9oid3g3q.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013.02.26 17:38:45 | 000,745,166 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\pro files\9oid3g3q.default\extensions\{f36c6cd1-da73-491d-b290-8fc9115bfa55}.xpi
[2013.03.21 21:17:50 | 000,001,050 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\pro files\9oid3g3q.default\searchplugins\11-suche.xml
[2013.03.21 21:17:50 | 000,002,418 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\pro files\9oid3g3q.default\searchplugins\englische-ergebnisse.xml
[2013.03.21 21:17:50 | 000,010,701 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\pro files\9oid3g3q.default\searchplugins\gmx-suche.xml
[2013.03.21 21:17:50 | 000,002,432 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\pro files\9oid3g3q.default\searchplugins\lastminute.xm l
[2013.03.21 21:17:50 | 000,005,682 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\pro files\9oid3g3q.default\searchplugins\webde-suche.xml

Bluescreen:

 Spoiler

[Verleihnix]

Intressant,aber englisches windows ist doch etwas ungewöhnlich...
Wären mehr systemangaben möglich?
Was wurde im system verändert,bevor der fehler auftrat?

[Lasch24]

Der Rechner ist nicht einmal in der Lage, ein Dump zu erstellen.

Mögliche Ursachen: Schadsoftware, Defekte Festplatte/SATA-Controller, instabile Übertaktungen,..

edit:

C:\Windows\AutoKMS.exe (Riskware.Keygen) -> Keine Aktion durchgeführt.
C:\Windows\KMSEmulator.exe (RiskWare.Tool.CK) -> Keine Aktion durchgeführt.

Oh, garnicht aufgefallen..bis jetzt.

[Kyato]

Würde, wie Lasch24 schon sagte, auf eine instabile Übertaktung tendieren.
Ich hatte das Problem als ich meine CPU unter Windows 7 auf 4,21 GHz getaktet habe. Nach einiger Zeit ist der mir auch hängen geblieben bis ich wieder zurück getaktet habe. Danach lief wieder alles einwandfrei.

[Frutex]

Tja, gecrackte Systeme werden hier leider nicht unterstützt.
#closed