GVU Trojaner - Win7 - kein abgesicherter Modus

bensa89 · 07.09.2013, 11:33

Hallo zusammen,
mein Zweitrechner (Win7 64Bit) hat sich wohl den GVU (Bundestrojaner) eingefangen. Auch wenn ich den Rechner im abgesicherten Modus starten möchte, fährt dieser konsequent direkt wieder runter. Quasi das gleiche Problem wie hier (http://www.trojaner-board.de/140714-...ne-runter.html) Ich habe nun wie in dem anderen Post von hier beschrieben den Rechner im Reperaturmodus gestartet und einen Scan mit FRS64 durchgeführt und das Logfile erhalten. Jetzt weiß ich nur nicht wie ich ein passendes FixFile erstelle, bzw. was drin stehen muss.

Vielen Dank für eure Hilfe!

edit: Tut mir Leid dass ich das File angehangen habe, habe die Code Funktion leider zu Spät entdeckt und weiß nicht wie ich den Anhang wieder entfernen kann

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-09-2013
Ran by SYSTEM on MININT-CNUHD7I on 07-09-2013 12:15:29
Running from G:\
Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [PC-Doctor for Windows localizer] - C:\Program Files\PC-Doctor for Windows\localizer.exe [95728 2009-09-16] (PC-Doctor, Inc.)
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2726728 2010-03-24] (CANON INC.)
HKLM\...\Policies\Explorer: [NoActiveDesktop] 1
HKLM\...\Policies\Explorer: [NoActiveDesktopChanges] 1
HKLM-x32\...\Run: [hpsysdrv] - c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard)
HKLM-x32\...\Run: [HP Remote Solution] - C:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe [656896 2009-08-24] (Hewlett-Packard)
HKLM-x32\...\Run: [HP Software Update] - c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54576 2008-12-08] (Hewlett-Packard)
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [60464 2009-09-02] (EasyBits Software AS)
HKLM-x32\...\Run: [CanonSolutionMenuEx] - C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1185112 2010-04-02] (CANON INC.)
HKLM-x32\...\Run: [AVMWlanClient] - C:\Program Files (x86)\avmwlanstick\wlangui.exe [2105344 2010-10-21] (AVM Berlin)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1573584 2012-10-18] (Ask)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-08-20] (Avira Operations GmbH & Co. KG)
HKU\Default\...\Run: [HPADVISOR] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe [1685048 2009-09-29] (Hewlett-Packard)
HKU\Default User\...\Run: [HPADVISOR] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe [1685048 2009-09-29] (Hewlett-Packard)
HKU\UpdatusUser\...\Run: [HPADVISOR] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe [1685048 2009-09-29] (Hewlett-Packard)
HKU\Wolle\...\Run: [HPADVISOR] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe [1685048 2009-09-29] (Hewlett-Packard)
HKU\Wolle\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3481408 2012-02-13] (DT Soft Ltd)
HKU\Wolle\...\Run: [NNdR26FL3S.exe] - C:\Users\Wolle\AppData\Local\qHpYczLSjZ\NNdR26FL3S.exe [123248 2013-09-06] (Microsoft Corporation)
HKU\Wolle\...\Command Processor: "C:\Users\Wolle\AppData\Local\qHpYczLSjZ\NNdR26FL3S.exe" <===== ATTENTION!
Startup: C:\Users\Wolle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3bnljw90.lnk
ShortcutTarget: 3bnljw90.lnk -> C:\PROGRA~3\09wjlnb3.plz ()

==================== Services (Whitelisted) =================

S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-08-20] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-20] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-08-20] (Avira Operations GmbH & Co. KG)
S2 AVM WLAN Connection Service; C:\Program Files (x86)\avmwlanstick\WlanNetService.exe [376832 2010-10-21] (AVM Berlin)
S3 pla; C:\Windows\system32\pla.dll [0 2010-11-20] ()
S2 Winmgmt; C:\PROGRA~3\3bnljw90.pzz [58456 2013-09-06] (Microsoft Corporation)
S2 Winmgmt; C:\PROGRA~3\3bnljw90.pzz [58456 2013-09-06] (Microsoft Corporation)
S2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [x]

==================== Drivers (Whitelisted) ====================

S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-03] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-08-20] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-27] (Avira Operations GmbH & Co. KG)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2010-10-21] (AVM Berlin)
S1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-04-01] (DT Soft Ltd)
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [460800 2010-10-21] (AVM GmbH)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-06 14:02 - 2013-09-06 14:02 - 00322560 _____ C:\Users\Wolle\AppData\Roaming\oQoNVO3Su
2013-09-06 14:02 - 2013-09-06 14:02 - 00322560 _____ C:\Users\Wolle\AppData\Local\QbvvW1f8N7j
2013-09-06 14:02 - 2013-09-06 14:02 - 00322560 _____ C:\ProgramData\OwUY0SoBl
2013-09-06 13:46 - 2013-09-06 13:46 - 00322560 _____ C:\Users\Wolle\AppData\Roaming\5YT5VV2U5Q
2013-09-06 13:46 - 2013-09-06 13:46 - 00322560 _____ C:\Users\Wolle\AppData\Local\IccpBoL3
2013-09-06 13:46 - 2013-09-06 13:46 - 00322560 _____ C:\ProgramData\BMkxFQm3V
2013-09-06 13:14 - 2013-09-07 01:51 - 00000000 _____ C:\ProgramData\3bnljw90.ctrl
2013-09-06 13:14 - 2013-09-06 19:35 - 95025368 ____T C:\ProgramData\3bnljw90.pff
2013-09-06 13:14 - 2013-09-06 13:16 - 00000000 ____D C:\Users\Wolle\AppData\Local\qHpYczLSjZ
2013-09-06 13:14 - 2013-09-06 13:14 - 00322560 _____ C:\Users\Wolle\AppData\Roaming\RCVArMUclt
2013-09-06 13:14 - 2013-09-06 13:14 - 00322560 _____ C:\Users\Wolle\AppData\Local\qoks3j3s
2013-09-06 13:14 - 2013-09-06 13:14 - 00322560 _____ C:\ProgramData\GdlfbmPH
2013-09-06 13:14 - 2013-09-06 13:14 - 00166912 _____ C:\ProgramData\09wjlnb3.plz
2013-09-06 13:14 - 2013-09-06 13:14 - 00058456 ____T (Microsoft Corporation) C:\ProgramData\3bnljw90.pzz
2013-08-29 20:15 - 2013-09-06 06:16 - 00000000 ____D C:\Users\Wolle\Desktop\Termine
2013-08-21 02:48 - 2013-08-21 02:48 - 00000000 ____D C:\Users\Wolle\AppData\Roaming\Malwarebytes
2013-08-21 02:47 - 2013-08-21 02:47 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-21 02:46 - 2013-08-21 02:47 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Wolle\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-20 06:25 - 2013-08-20 06:25 - 99508550 _____ C:\Windows\SysWOW64\ି鱛ᵌR
2013-08-08 19:55 - 2013-08-08 20:43 - 00000000 ____D C:\Users\Wolle\AppData\Roaming\Autodesk

==================== One Month Modified Files and Folders =======

2013-09-07 02:11 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-07 02:11 - 2009-07-13 20:51 - 00099134 _____ C:\Windows\setupact.log
2013-09-07 02:08 - 2012-04-01 07:18 - 01581475 _____ C:\Windows\WindowsUpdate.log
2013-09-07 02:02 - 2009-07-13 20:45 - 00015568 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-07 02:02 - 2009-07-13 20:45 - 00015568 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-07 01:51 - 2013-09-06 13:14 - 00000000 _____ C:\ProgramData\3bnljw90.ctrl
2013-09-07 01:51 - 2012-04-01 08:58 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-07 00:34 - 2012-04-01 08:58 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-07 00:09 - 2012-04-01 09:05 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-06 19:35 - 2013-09-06 13:14 - 95025368 ____T C:\ProgramData\3bnljw90.pff
2013-09-06 14:05 - 2010-01-06 17:28 - 00654006 _____ C:\Windows\System32\perfh007.dat
2013-09-06 14:05 - 2010-01-06 17:28 - 00129878 _____ C:\Windows\System32\perfc007.dat
2013-09-06 14:05 - 2009-07-13 21:13 - 01498506 _____ C:\Windows\System32\PerfStringBackup.INI
2013-09-06 14:02 - 2013-09-06 14:02 - 00322560 _____ C:\Users\Wolle\AppData\Roaming\oQoNVO3Su
2013-09-06 14:02 - 2013-09-06 14:02 - 00322560 _____ C:\Users\Wolle\AppData\Local\QbvvW1f8N7j
2013-09-06 14:02 - 2013-09-06 14:02 - 00322560 _____ C:\ProgramData\OwUY0SoBl
2013-09-06 13:46 - 2013-09-06 13:46 - 00322560 _____ C:\Users\Wolle\AppData\Roaming\5YT5VV2U5Q
2013-09-06 13:46 - 2013-09-06 13:46 - 00322560 _____ C:\Users\Wolle\AppData\Local\IccpBoL3
2013-09-06 13:46 - 2013-09-06 13:46 - 00322560 _____ C:\ProgramData\BMkxFQm3V
2013-09-06 13:16 - 2013-09-06 13:14 - 00000000 ____D C:\Users\Wolle\AppData\Local\qHpYczLSjZ
2013-09-06 13:14 - 2013-09-06 13:14 - 00322560 _____ C:\Users\Wolle\AppData\Roaming\RCVArMUclt
2013-09-06 13:14 - 2013-09-06 13:14 - 00322560 _____ C:\Users\Wolle\AppData\Local\qoks3j3s
2013-09-06 13:14 - 2013-09-06 13:14 - 00322560 _____ C:\ProgramData\GdlfbmPH
2013-09-06 13:14 - 2013-09-06 13:14 - 00166912 _____ C:\ProgramData\09wjlnb3.plz
2013-09-06 13:14 - 2013-09-06 13:14 - 00058456 ____T (Microsoft Corporation) C:\ProgramData\3bnljw90.pzz
2013-09-06 06:16 - 2013-08-29 20:15 - 00000000 ____D C:\Users\Wolle\Desktop\Termine
2013-09-06 06:10 - 2012-04-17 00:17 - 00000000 ____D C:\Users\Wolle\Desktop\extern Wolfgang bis 2012-11-25
2013-09-06 01:12 - 2012-04-04 21:34 - 00031760 _____ C:\Users\Wolle\AppData\Roaming\wklnhst.dat
2013-09-06 00:53 - 2013-05-19 00:33 - 00000000 ____D C:\Users\Wolle\Desktop\2€ Koffer
2013-09-03 22:16 - 2009-07-13 21:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-09-03 02:01 - 2013-03-27 19:47 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avgntflt.sys
2013-09-02 20:50 - 2012-05-09 05:34 - 00000000 ____D C:\Users\Wolle\Desktop\meine Familie
2013-09-02 04:13 - 2012-04-09 05:05 - 00000000 ____D C:\Users\Wolle\AppData\Roaming\HpUpdate
2013-09-02 04:13 - 2012-04-09 05:05 - 00000000 ____D C:\Users\Wolle\AppData\Roaming\HP Support Assistant
2013-08-31 00:24 - 2012-04-01 07:27 - 00000544 _____ C:\Windows\Tasks\PCDRScheduledMaintenance.job
2013-08-28 00:56 - 2012-04-18 00:07 - 00000000 ____D C:\Users\Wolle\Desktop\Wohnungs Ordner
2013-08-21 18:59 - 2010-01-06 08:38 - 00269904 _____ C:\Windows\PFRO.log
2013-08-21 02:48 - 2013-08-21 02:48 - 00000000 ____D C:\Users\Wolle\AppData\Roaming\Malwarebytes
2013-08-21 02:47 - 2013-08-21 02:47 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-21 02:47 - 2013-08-21 02:46 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Wolle\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-21 02:09 - 2012-04-01 09:05 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-21 02:09 - 2012-04-01 09:05 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-21 02:09 - 2012-04-01 09:05 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-20 06:25 - 2013-08-20 06:25 - 99508550 _____ C:\Windows\SysWOW64\ି鱛ᵌR
2013-08-20 00:26 - 2013-05-02 01:47 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avnetflt.sys
2013-08-20 00:26 - 2013-03-27 19:47 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avipbb.sys
2013-08-08 20:43 - 2013-08-08 19:55 - 00000000 ____D C:\Users\Wolle\AppData\Roaming\Autodesk
2013-08-08 20:27 - 2012-04-01 07:24 - 00000000 ____D C:\Users\Wolle\AppData\Local\VirtualStore

Files to move or delete:
====================
C:\Users\Wolle\AppData\Local\qHpYczLSjZ\NNdR26FL3S.exe
C:\Users\Wolle\AppData\Local\Temp\dngenibhfxwvnhetvte.bfg
C:\Users\Wolle\AppData\Local\Temp\GoogleToolbarInstaller_en32_signed.exe
C:\Users\Wolle\AppData\Local\Temp\inbmpg.dll
C:\Users\Wolle\AppData\Local\Temp\MSETUP4.EXE
C:\Users\Wolle\AppData\Local\Temp\NEW1390.tmp.exe
C:\Users\Wolle\AppData\Local\Temp\ose00000.exe
C:\Users\Wolle\AppData\Local\Temp\setup.exe

==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-08-28 05:47:55
Restore point made on: 2013-08-29 05:13:02
Restore point made on: 2013-08-29 10:19:16
Restore point made on: 2013-08-30 02:11:48
Restore point made on: 2013-08-30 07:27:15
Restore point made on: 2013-08-31 05:14:20
Restore point made on: 2013-09-01 04:20:23
Restore point made on: 2013-09-01 09:17:17
Restore point made on: 2013-09-02 00:59:47
Restore point made on: 2013-09-02 05:44:27
Restore point made on: 2013-09-03 04:15:01
Restore point made on: 2013-09-03 08:50:20
Restore point made on: 2013-09-04 09:50:37
Restore point made on: 2013-09-04 23:17:11
Restore point made on: 2013-09-05 05:05:44
Restore point made on: 2013-09-05 09:48:52
Restore point made on: 2013-09-06 06:08:14

==================== Memory info =========================== 

Percentage of memory in use: 19%
Total physical RAM: 4095.3 MB
Available physical RAM: 3303.45 MB
Total Pagefile: 4093.45 MB
Available Pagefile: 3316.19 MB
Total Virtual: 8192 MB
Available Virtual: 8191.87 MB

==================== Drives ================================

Drive c: (COMPAQ) (Fixed) (Total:453.54 GB) (Free:317.71 GB) NTFS
Drive e: (FACTORY_IMAGE) (Fixed) (Total:12.12 GB) (Free:1.7 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive g: () (Removable) (Total:14.83 GB) (Free:14.82 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.08 GB) (Free:0.07 GB) NTFS
Drive y: (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 466 GB) (Disk ID: 1549F232)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=454 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=12 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 15 GB) (Disk ID: 00000000)
Partition 1: (Not Active) - (Size=15 GB) - (Type=0B)


LastRegBack: 2013-09-01 00:33

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

aharonov · 07.09.2013, 11:41

Hi,

startet der Rechner nach diesem Fix wieder normal?

Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

HKU\Wolle\...\Run: [NNdR26FL3S.exe] - C:\Users\Wolle\AppData\Local\qHpYczLSjZ\NNdR26FL3S.exe [123248 2013-09-06] (Microsoft Corporation)
HKU\Wolle\...\Command Processor: "C:\Users\Wolle\AppData\Local\qHpYczLSjZ\NNdR26FL3S.exe" <===== ATTENTION!
C:\Users\Wolle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3bnljw90.lnk
C:\PROGRA~3\09wjlnb3.plz
C:\Users\Wolle\AppData\Local\qHpYczLSjZ
S2 Winmgmt; C:\PROGRA~3\3bnljw90.pzz [58456 2013-09-06] (Microsoft Corporation)
S2 Winmgmt; C:\PROGRA~3\3bnljw90.pzz [58456 2013-09-06] (Microsoft Corporation)
C:\Users\Wolle\AppData\Local\Temp\dngenibhfxwvnhetvte.bfg
2013-09-06 14:02 - 2013-09-06 14:02 - 00322560 _____ C:\Users\Wolle\AppData\Roaming\oQoNVO3Su
2013-09-06 14:02 - 2013-09-06 14:02 - 00322560 _____ C:\Users\Wolle\AppData\Local\QbvvW1f8N7j
2013-09-06 14:02 - 2013-09-06 14:02 - 00322560 _____ C:\ProgramData\OwUY0SoBl
2013-09-06 13:46 - 2013-09-06 13:46 - 00322560 _____ C:\Users\Wolle\AppData\Roaming\5YT5VV2U5Q
2013-09-06 13:46 - 2013-09-06 13:46 - 00322560 _____ C:\Users\Wolle\AppData\Local\IccpBoL3
2013-09-06 13:46 - 2013-09-06 13:46 - 00322560 _____ C:\ProgramData\BMkxFQm3V
2013-09-06 01:12 - 2012-04-04 21:34 - 00031760 _____ C:\Users\Wolle\AppData\Roaming\wklnhst.dat
2013-09-06 13:14 - 2013-09-07 01:51 - 00000000 _____ C:\ProgramData\3bnljw90.ctrl
2013-09-06 13:14 - 2013-09-06 19:35 - 95025368 ____T C:\ProgramData\3bnljw90.pff
2013-09-06 13:14 - 2013-09-06 13:16 - 00000000 ____D C:\Users\Wolle\AppData\Local\qHpYczLSjZ
2013-09-06 13:14 - 2013-09-06 13:14 - 00322560 _____ C:\Users\Wolle\AppData\Roaming\RCVArMUclt
2013-09-06 13:14 - 2013-09-06 13:14 - 00322560 _____ C:\Users\Wolle\AppData\Local\qoks3j3s
2013-09-06 13:14 - 2013-09-06 13:14 - 00322560 _____ C:\ProgramData\GdlfbmPH
2013-09-06 13:14 - 2013-09-06 13:14 - 00166912 _____ C:\ProgramData\09wjlnb3.plz
2013-09-06 13:14 - 2013-09-06 13:14 - 00058456 ____T (Microsoft Corporation) C:\ProgramData\3bnljw90.pzz

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

Starte deinen Rechner erneut in die Reparaturoptionen
Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

bensa89 · 07.09.2013, 11:54

Danke für die super schnelle Antwort! Der Rechner startet jetzt wieder normal! Gibt es noch etwas zu beachten?

Hier der Fixlog:

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 07-09-2013
Ran by SYSTEM at 2013-09-07 12:51:01 Run:1
Running from G:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
HKU\Wolle\...\Run: [NNdR26FL3S.exe] - C:\Users\Wolle\AppData\Local\qHpYczLSjZ\NNdR26FL3S.exe [123248 2013-09-06] (Microsoft Corporation)
HKU\Wolle\...\Command Processor: "C:\Users\Wolle\AppData\Local\qHpYczLSjZ\NNdR26FL3S.exe" <===== ATTENTION!
C:\Users\Wolle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3bnljw90.lnk
C:\PROGRA~3\09wjlnb3.plz
C:\Users\Wolle\AppData\Local\qHpYczLSjZ
S2 Winmgmt; C:\PROGRA~3\3bnljw90.pzz [58456 2013-09-06] (Microsoft Corporation)
S2 Winmgmt; C:\PROGRA~3\3bnljw90.pzz [58456 2013-09-06] (Microsoft Corporation)
C:\Users\Wolle\AppData\Local\Temp\dngenibhfxwvnhetvte.bfg
2013-09-06 14:02 - 2013-09-06 14:02 - 00322560 _____ C:\Users\Wolle\AppData\Roaming\oQoNVO3Su
2013-09-06 14:02 - 2013-09-06 14:02 - 00322560 _____ C:\Users\Wolle\AppData\Local\QbvvW1f8N7j
2013-09-06 14:02 - 2013-09-06 14:02 - 00322560 _____ C:\ProgramData\OwUY0SoBl
2013-09-06 13:46 - 2013-09-06 13:46 - 00322560 _____ C:\Users\Wolle\AppData\Roaming\5YT5VV2U5Q
2013-09-06 13:46 - 2013-09-06 13:46 - 00322560 _____ C:\Users\Wolle\AppData\Local\IccpBoL3
2013-09-06 13:46 - 2013-09-06 13:46 - 00322560 _____ C:\ProgramData\BMkxFQm3V
2013-09-06 01:12 - 2012-04-04 21:34 - 00031760 _____ C:\Users\Wolle\AppData\Roaming\wklnhst.dat
2013-09-06 13:14 - 2013-09-07 01:51 - 00000000 _____ C:\ProgramData\3bnljw90.ctrl
2013-09-06 13:14 - 2013-09-06 19:35 - 95025368 ____T C:\ProgramData\3bnljw90.pff
2013-09-06 13:14 - 2013-09-06 13:16 - 00000000 ____D C:\Users\Wolle\AppData\Local\qHpYczLSjZ
2013-09-06 13:14 - 2013-09-06 13:14 - 00322560 _____ C:\Users\Wolle\AppData\Roaming\RCVArMUclt
2013-09-06 13:14 - 2013-09-06 13:14 - 00322560 _____ C:\Users\Wolle\AppData\Local\qoks3j3s
2013-09-06 13:14 - 2013-09-06 13:14 - 00322560 _____ C:\ProgramData\GdlfbmPH
2013-09-06 13:14 - 2013-09-06 13:14 - 00166912 _____ C:\ProgramData\09wjlnb3.plz
2013-09-06 13:14 - 2013-09-06 13:14 - 00058456 ____T (Microsoft Corporation) C:\ProgramData\3bnljw90.pzz
         
*****************

HKU\Wolle\Software\Microsoft\Windows\CurrentVersion\Run\\NNdR26FL3S.exe => Value deleted successfully.
HKU\Wolle\Software\Microsoft\Command Processor\\AutoRun => Value deleted successfully.
C:\Users\Wolle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3bnljw90.lnk => Moved successfully.
C:\PROGRA~3\09wjlnb3.plz => Moved successfully.
C:\Users\Wolle\AppData\Local\qHpYczLSjZ => Moved successfully.
Winmgmt => Service restored successfully.
Winmgmt => Service restored successfully.
C:\Users\Wolle\AppData\Local\Temp\dngenibhfxwvnhetvte.bfg => Moved successfully.
C:\Users\Wolle\AppData\Roaming\oQoNVO3Su => Moved successfully.
C:\Users\Wolle\AppData\Local\QbvvW1f8N7j => Moved successfully.
C:\ProgramData\OwUY0SoBl => Moved successfully.
C:\Users\Wolle\AppData\Roaming\5YT5VV2U5Q => Moved successfully.
C:\Users\Wolle\AppData\Local\IccpBoL3 => Moved successfully.
C:\ProgramData\BMkxFQm3V => Moved successfully.
C:\Users\Wolle\AppData\Roaming\wklnhst.dat => Moved successfully.
C:\ProgramData\3bnljw90.ctrl => Moved successfully.
C:\ProgramData\3bnljw90.pff => Moved successfully.
"C:\Users\Wolle\AppData\Local\qHpYczLSjZ" => File/Directory not found.
C:\Users\Wolle\AppData\Roaming\RCVArMUclt => Moved successfully.
C:\Users\Wolle\AppData\Local\qoks3j3s => Moved successfully.
C:\ProgramData\GdlfbmPH => Moved successfully.
"C:\ProgramData\09wjlnb3.plz" => File/Directory not found.
C:\ProgramData\3bnljw90.pzz => Moved successfully.

==== End of Fixlog ====

aharonov · 07.09.2013, 12:25

Ja wir kontrollieren noch weiter:

Verschiebe die frst64.exe vom USB-Stick auf den Desktop

Starte dann FRST.
Setze bei Optional Scan den Haken bei Addition.txt und drücke Scan.
Wenn der Scan abgeschlossen ist, werden zwei neue Logfiles FRST.txt und Addition.txt erstellt und auf dem Desktop gespeichert.
Poste den Inhalt dieser beiden Logfiles bitte hier in deinen Thread.

bensa89 · 07.09.2013, 12:33

Alles klar. Hier beide Dateien:

Mir ist gerade aufgefallen dass ich so gut wie alle Dateien von Word, Bilder etc nicht mehr öffnen kann, weil er mir sagt dass sie schon in Verwendung sind.

FRST.txt

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-09-2013
Ran by Wolle (administrator) on WOLLE-PC on 07-09-2013 13:29:07
Running from C:\Users\Wolle\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\WlanNetService.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Hewlett-Packard Company) c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe
(Hewlett-Packard) C:\Program Files (x86)\hp\HP Software Update\hpwuschd2.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\WLanGUI.exe
(Ask) C:\Program Files (x86)\Ask.com\Updater\Updater.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [PC-Doctor for Windows localizer] - C:\Program Files\PC-Doctor for Windows\localizer.exe [95728 2009-09-17] (PC-Doctor, Inc.)
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2726728 2010-03-24] (CANON INC.)
HKLM\...\Policies\Explorer: [NoActiveDesktop] 1
HKLM\...\Policies\Explorer: [NoActiveDesktopChanges] 1
HKCU\...\Run: [HPADVISOR] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe [1685048 2009-09-29] (Hewlett-Packard)
HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3481408 2012-02-13] (DT Soft Ltd)
MountPoints2: {a74a9573-7c12-11e1-bf5d-f4ce460509ca} - H:\pushinst.exe
HKLM-x32\...\Run: [hpsysdrv] - c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard)
HKLM-x32\...\Run: [HP Remote Solution] - C:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe [656896 2009-08-25] (Hewlett-Packard)
HKLM-x32\...\Run: [HP Software Update] - c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54576 2008-12-08] (Hewlett-Packard)
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [60464 2009-09-02] (EasyBits Software AS)
HKLM-x32\...\Run: [CanonSolutionMenuEx] - C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1185112 2010-04-02] (CANON INC.)
HKLM-x32\...\Run: [AVMWlanClient] - C:\Program Files (x86)\avmwlanstick\wlangui.exe [2105344 2010-10-22] (AVM Berlin)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1573584 2012-10-19] (Ask)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-08-20] (Avira Operations GmbH & Co. KG)
HKU\Default\...\Run: [HPADVISOR] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe [1685048 2009-09-29] (Hewlett-Packard)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/CQDSK/4
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/CQDSK/4
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/CQDSK/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/CQDSK/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/CQDSK/4
URLSearchHook: (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} -  No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {8B219F21-6E60-444B-BF76-C4858EFE4B7A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CPDTDF&pc=CPDTDF&src=IE-SearchBox
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - DefaultScope {8B219F21-6E60-444B-BF76-C4858EFE4B7A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CPDTDF&pc=CPDTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - DefaultScope {8B219F21-6E60-444B-BF76-C4858EFE4B7A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CPDTDF&pc=CPDTDF&src=IE-SearchBox
SearchScopes: HKCU - {29BDC63D-74D7-4BAD-9B1F-B6B6D379B6CE} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=d1a2e751-6781-4453-abc4-2365402aad7e&apn_sauid=9C74826D-B547-4321-A714-A032398CBDCA
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
DPF: HKLM {DE625294-70E6-45ED-B895-CFFA13AEB044} hxxp://217.123.26.196/activex/AMC.cab
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWow64\EZUPBH~1.DLL [52272 2010-01-06] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-08-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-08-20] (Avira Operations GmbH & Co. KG)
R2 AVM WLAN Connection Service; C:\Program Files (x86)\avmwlanstick\WlanNetService.exe [376832 2010-10-22] (AVM Berlin)
S3 pla; C:\Windows\system32\pla.dll [0 2010-11-20] ()
R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-08-20] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-28] (Avira Operations GmbH & Co. KG)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2010-10-22] (AVM Berlin)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-04-01] (DT Soft Ltd)
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [460800 2010-10-22] (AVM GmbH)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-07 13:28 - 2013-09-07 01:35 - 01948604 _____ (Farbar) C:\Users\Wolle\Desktop\FRST64.exe
2013-09-07 13:16 - 2013-09-07 13:16 - 00000382 _____ C:\Users\Wolle\AppData\Roaming\wklnhst.dat
2013-08-30 06:15 - 2013-09-06 16:16 - 00000000 ____D C:\Users\Wolle\Desktop\Termine
2013-08-21 12:48 - 2013-08-21 12:48 - 00000000 ____D C:\Users\Wolle\AppData\Roaming\Malwarebytes
2013-08-21 12:47 - 2013-08-21 12:47 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-21 12:46 - 2013-08-21 12:47 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Wolle\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-20 16:25 - 2013-08-20 16:25 - 99508550 _____ C:\Windows\SysWOW64\ି鱛ᵌR
2013-08-09 05:55 - 2013-08-09 06:43 - 00000000 ____D C:\Users\Wolle\AppData\Roaming\Autodesk

==================== One Month Modified Files and Folders =======

2013-09-07 22:15 - 2013-09-07 22:15 - 00000000 ____D C:\FRST
2013-09-07 13:29 - 2012-04-01 17:18 - 01598056 _____ C:\Windows\WindowsUpdate.log
2013-09-07 13:22 - 2010-01-07 03:28 - 00654006 _____ C:\Windows\system32\perfh007.dat
2013-09-07 13:22 - 2010-01-07 03:28 - 00129878 _____ C:\Windows\system32\perfc007.dat
2013-09-07 13:22 - 2009-07-14 07:13 - 01498506 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-07 13:19 - 2009-07-14 06:45 - 00015568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-07 13:19 - 2009-07-14 06:45 - 00015568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-07 13:16 - 2013-09-07 13:16 - 00000382 _____ C:\Users\Wolle\AppData\Roaming\wklnhst.dat
2013-09-07 13:16 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-09-07 13:12 - 2012-04-01 18:58 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-07 13:12 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-07 13:12 - 2009-07-14 06:51 - 00099246 _____ C:\Windows\setupact.log
2013-09-07 13:09 - 2012-04-01 19:05 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-07 10:34 - 2012-04-01 18:58 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-07 01:35 - 2013-09-07 13:28 - 01948604 _____ (Farbar) C:\Users\Wolle\Desktop\FRST64.exe
2013-09-06 16:16 - 2013-08-30 06:15 - 00000000 ____D C:\Users\Wolle\Desktop\Termine
2013-09-06 16:10 - 2012-04-17 10:17 - 00000000 ____D C:\Users\Wolle\Desktop\extern Wolfgang bis 2012-11-25
2013-09-06 10:53 - 2013-05-19 10:33 - 00000000 ____D C:\Users\Wolle\Desktop\2€ Koffer
2013-09-04 08:16 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-09-03 12:01 - 2013-03-28 05:47 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-03 06:50 - 2012-05-09 15:34 - 00000000 ____D C:\Users\Wolle\Desktop\meine Familie
2013-09-02 14:13 - 2012-04-09 15:05 - 00000000 ____D C:\Users\Wolle\AppData\Roaming\HpUpdate
2013-09-02 14:13 - 2012-04-09 15:05 - 00000000 ____D C:\Users\Wolle\AppData\Roaming\HP Support Assistant
2013-08-31 10:24 - 2012-04-01 17:27 - 00000544 _____ C:\Windows\Tasks\PCDRScheduledMaintenance.job
2013-08-28 10:56 - 2012-04-18 10:07 - 00000000 ____D C:\Users\Wolle\Desktop\Wohnungs Ordner
2013-08-22 04:59 - 2010-01-06 18:38 - 00269904 _____ C:\Windows\PFRO.log
2013-08-21 12:48 - 2013-08-21 12:48 - 00000000 ____D C:\Users\Wolle\AppData\Roaming\Malwarebytes
2013-08-21 12:47 - 2013-08-21 12:47 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-21 12:47 - 2013-08-21 12:46 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Wolle\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-21 12:09 - 2012-04-01 19:05 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-21 12:09 - 2012-04-01 19:05 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-21 12:09 - 2012-04-01 19:05 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-20 16:25 - 2013-08-20 16:25 - 99508550 _____ C:\Windows\SysWOW64\ି鱛ᵌR
2013-08-20 10:26 - 2013-05-02 11:47 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-08-20 10:26 - 2013-03-28 05:47 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-08-09 06:43 - 2013-08-09 05:55 - 00000000 ____D C:\Users\Wolle\AppData\Roaming\Autodesk
2013-08-09 06:27 - 2012-04-01 17:24 - 00000000 ____D C:\Users\Wolle\AppData\Local\VirtualStore

Files to move or delete:
====================
C:\Users\Wolle\AppData\Local\Temp\GoogleToolbarInstaller_en32_signed.exe
C:\Users\Wolle\AppData\Local\Temp\inbmpg.dll
C:\Users\Wolle\AppData\Local\Temp\MSETUP4.EXE
C:\Users\Wolle\AppData\Local\Temp\NEW1390.tmp.exe
C:\Users\Wolle\AppData\Local\Temp\ose00000.exe
C:\Users\Wolle\AppData\Local\Temp\setup.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-01 10:33

==================== End Of Log ============================

--- --- ---

--- --- ---

Addition.txt

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-09-2013
Ran by Wolle at 2013-09-07 13:29:59
Running from C:\Users\Wolle\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

   
 Update for Microsoft Office 2007 (KB2508958) (x32)
ActiveCheck component for HP Active Support Library (x32 Version: 3.0.0.2)
Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.94)
Adobe Reader X (10.1.7) - Deutsch (x32 Version: 10.1.7)
Ask Toolbar (x32 Version: 1.15.13.0)
AutoSketch Release 9 (x32 Version: 9.0.0.88)
Avira Free Antivirus (x32 Version: 13.0.0.4052)
Avira SearchFree Toolbar plus Web Protection Updater (HKCU Version: 1.4.1.29781)
AVM FRITZ!WLAN (x32)
Bing Bar (x32 Version: 7.0.850.0)
Canon Easy-PhotoPrint EX (x32)
Canon MG5200 series Benutzerregistrierung (x32)
Canon MG5200 series MP Drivers
Canon MP Navigator EX 4.0 (x32)
Canon My Printer (x32)
Canon Solution Menu EX (x32)
CD-LabelPrint (x32)
Compatibility Pack für 2007 Office System (x32 Version: 12.0.6612.1000)
CyberLink DVD Suite Deluxe (x32 Version: 7.0.2115)
DAEMON Tools Lite (x32 Version: 4.45.3.0297)
DirectX for Managed Code Update (Summer 2004) (x32 Version: 9.02.2904)
Easy Poster Printer (x32 Version: 2.0.3)
Google Earth (x32 Version: 7.1.1.1888)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0)
Google Toolbar for Internet Explorer (x32 Version: 7.5.4413.1752)
Google Update Helper (x32 Version: 1.3.21.153)
Hardwarediagnosetools (Version: 6.0.5247.34)
HP Advisor (x32 Version: 3.3.9512.3162)
HP Customer Experience Enhancements (x32 Version: 6.0.1.3)
HP Odometer (x32 Version: 2.10.0000)
HP Remote Solution (x32 Version: 1.1.11.0)
HP Remote Solution (x32 Version: 1.1.12.0)
HP Setup (x32 Version: 1.2.3560.3170)
HP Support Assistant (x32 Version: 4.2.5.3)
HP Support Information (x32 Version: 10.1.0002)
HP Update (x32 Version: 5.001.000.014)
HPAsset component for HP Active Support Library (x32 Version: 3.0.0.7)
Java(TM) 6 Update 31 (64-bit) (Version: 6.0.310)
Junk Mail filter update (x32 Version: 14.0.8089.726)
LabelPrint (x32 Version: 2.5.2017)
LightScribe System Software (x32 Version: 1.18.8.1)
Magic Desktop (x32)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Choice Guard (x32 Version: 2.0.48.0)
Microsoft Office 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint Viewer 2007 (German) (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Standard 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Sync Framework Runtime Native v1.0 (x86) (x32 Version: 1.0.1215.0)
Microsoft Sync Framework Services Native v1.0 (x86) (x32 Version: 1.0.1215.0)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Works (x32 Version: 9.7.0621)
MSVCRT (x32 Version: 14.0.1468.721)
NVIDIA Drivers (Version: 1.9)
NVIDIA Grafiktreiber 296.19 (Version: 296.19)
NVIDIA Install Application (Version: 2.1002.62.312)
NVIDIA PhysX (x32 Version: 9.09.0814)
NVIDIA Systemsteuerung 296.19 (Version: 296.19)
NVIDIA Update 1.7.12 (Version: 1.7.12)
NVIDIA Update Components (Version: 1.7.12)
PlayReady PC Runtime amd64 (Version: 1.3.0)
Power2Go (x32 Version: 6.0.3304)
PowerDirector (x32 Version: 7.0.3405)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6531)
Recovery Manager (x32 Version: 5.5.2216)
rosoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Testversion von Microsoft Office Home and Student 2007
Update for 2007 Microsoft Office System (KB967642) (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2760586) 32-Bit Edition (x32)
Update für Microsoft Office Excel 2007 Help (KB963678) (x32)
Update für Microsoft Office Outlook 2007 Help (KB963677) (x32)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
Update für Microsoft Office Word 2007 Help (KB963665) (x32)
Windows Live Anmelde-Assistent (x32 Version: 5.000.818.5)
Windows Live Call (x32 Version: 14.0.8064.0206)
Windows Live Communications Platform (x32 Version: 14.0.8064.206)
Windows Live Essentials (x32 Version: 14.0.8089.0726)
Windows Live Essentials (x32 Version: 14.0.8089.726)
Windows Live Fotogalerie (x32 Version: 14.0.8081.709)
Windows Live Mail (x32 Version: 14.0.8089.0726)
Windows Live Messenger (x32 Version: 14.0.8089.0726)
Windows Live Movie Maker (x32 Version: 14.0.8091.0730)
Windows Live Sync (x32 Version: 14.0.8089.726)
Windows Live Writer (x32 Version: 14.0.8089.0726)
Windows Live-Uploadtool (x32 Version: 14.0.8014.1029)
WinRAR 4.20 (32-Bit) (x32 Version: 4.20.0)

==================== Restore Points  =========================

28-08-2013 13:47:46 Windows Update
29-08-2013 13:12:47 Windows Update
29-08-2013 18:19:10 Windows Update
30-08-2013 10:11:05 Windows Update
30-08-2013 15:27:10 Windows Update
31-08-2013 13:14:06 Windows Update
01-09-2013 12:20:09 Windows Update
01-09-2013 17:17:13 Windows Update
02-09-2013 08:59:33 Windows Update
02-09-2013 13:44:23 Windows Update
03-09-2013 12:14:44 Windows Update
03-09-2013 16:50:11 Windows Update
04-09-2013 17:50:28 Windows Update
05-09-2013 07:17:01 Windows Update
05-09-2013 13:05:40 Windows Update
05-09-2013 17:48:48 Windows Update
06-09-2013 14:08:04 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {044A6734-E90E-4F8F-B357-B2DC8AB3B5EC} - System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime => Sc.exe start w32time task_started
Task: {0589F69D-0004-4D3B-BD11-8E95E45B0CE5} - System32\Tasks\Hewlett-Packard\HP Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2009-09-24] (Hewlett-Packard)
Task: {22CFB68E-498E-4080-9A2F-BC103CB83585} - System32\Tasks\PCDRScheduledMaintenance => C:\Program Files\PC-Doctor for Windows\pcdrcui.exe [2009-09-18] (PC-Doctor, Inc.)
Task: {3465D7F4-0048-459F-97A3-389D11582A4B} - System32\Tasks\ExtendedServicePlan => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2009-10-20] ()
Task: {4A0AD6C9-1CC7-43D6-84C0-1AEC38A8EF78} - System32\Tasks\Registration => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2009-10-20] ()
Task: {57A6BC03-50BA-4603-8400-4AF6679E90EA} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-04-01] (Google Inc.)
Task: {6E776938-8974-4F14-B9A8-FB8AECF7E870} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2012-12-20] ()
Task: {7B7C1262-9545-4EE3-A239-A2C5735A1771} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-21] (Adobe Systems Incorporated)
Task: {8E2F6521-395A-491B-A03B-EF6FE7F74FE7} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-04-01] (Google Inc.)
Task: {A6E1EDDF-439E-4D71-B3AE-2CF574EE5607} - System32\Tasks\ServicePlan => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2009-10-20] ()
Task: {BB1284E1-72B6-4402-AD5C-9BFF68954EEC} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\System32\sdengin2.dll [2010-11-20] (Microsoft Corporation)
Task: {C0C9C2C8-D28E-4052-B96F-FC67998EE7D4} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: {C3213064-8FE2-48FF-BC19-6A16D1904EB8} - System32\Tasks\Hewlett-Packard\HP Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2009-09-24] (Hewlett-Packard)
Task: {C87F9C20-8EE8-4DE8-84A3-DAEF7E574854} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)
Task: {DD1CA8CA-F6FE-4C98-AE9E-14A82518F6EA} - System32\Tasks\RecoveryCDWin7 => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2009-10-20] ()
Task: {F834BD52-4E7D-4868-B9D7-639A6A267FFD} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-20] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\PCDRScheduledMaintenance.job => C:\Program Files\PC-Doctor for Windows\pcdrcui.exe

==================== Loaded Modules (whitelisted) =============

2009-07-14 02:22 - 2009-07-14 03:38 - 00081408 _____ (Fraunhofer Institut Integrierte Schaltungen IIS) C:\Windows\System32\l3codeca.acm
2009-07-13 23:59 - 2009-07-14 03:41 - 04326912 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2009-09-29 11:37 - 2012-03-07 00:44 - 00063296 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2012-06-20 18:35 - 2012-06-09 19:20 - 00196096 _____ (Alexander Roshal) C:\Program Files (x86)\WinRAR\rarext64.dll
2012-04-01 17:44 - 2010-03-24 19:50 - 00113152 _____ (CANON INC.) C:\Program Files\Canon\MyPrinter\cnmpu.dll
2012-04-01 17:44 - 2010-03-28 19:50 - 00068096 _____ (CANON INC.) C:\Program Files\Canon\MyPrinter\BJMyRes.dll
2012-04-01 17:43 - 2010-08-25 05:00 - 00715776 _____ (CANON INC.) C:\Windows\system32\spool\DRIVERS\x64\3\CNMDRAE.DLL
2012-04-01 17:43 - 2010-08-25 05:00 - 03124224 _____ (CANON INC.) C:\Windows\system32\spool\DRIVERS\x64\3\CNMUIAE.DLL
2012-05-23 20:23 - 2010-08-25 05:00 - 03104256 _____ (CANON INC.) C:\Windows\system32\spool\DRIVERS\x64\3\CNMXUIAE.DLL
2009-07-14 03:18 - 2010-11-20 15:27 - 00884224 _____ (Microsoft Corporation) C:\Windows\system32\spool\DRIVERS\x64\3\unidrvui.dll
2009-07-14 03:19 - 2010-11-20 15:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\spool\DRIVERS\x64\3\mxdwdui.DLL
2009-07-14 02:36 - 2010-11-20 15:26 - 00160256 _____ (Microsoft Corporation) C:\Windows\system32\spool\DRIVERS\x64\3\FXSUI.DLL
2009-07-14 02:36 - 2010-11-20 15:26 - 00156672 _____ (Microsoft Corporation) C:\Windows\system32\spool\DRIVERS\x64\3\FXSWZRD.dll
2009-07-14 02:35 - 2010-11-20 15:26 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\spool\DRIVERS\x64\3\FXSTIFF.dll
2009-07-14 03:19 - 2010-11-20 15:08 - 06566400 _____ (Microsoft Corporation) C:\Windows\system32\spool\DRIVERS\x64\3\FXSRES.DLL
2009-07-14 02:35 - 2010-11-20 15:26 - 00623104 _____ (Microsoft Corporation) C:\Windows\system32\spool\DRIVERS\x64\3\FXSAPI.DLL
2012-04-02 07:24 - 2011-11-17 07:38 - 01292080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-01-09 05:18 - 2012-11-30 06:53 - 01114112 _____ (Microsoft Corporation) C:\Windows\syswow64\kernel32.dll
2013-01-09 05:18 - 2012-11-30 06:53 - 00274944 _____ (Microsoft Corporation) C:\Windows\syswow64\KERNELBASE.dll
2012-04-03 15:51 - 2010-11-20 14:08 - 00833024 _____ (Microsoft Corporation) C:\Windows\syswow64\USER32.dll
2012-04-03 15:51 - 2010-11-20 14:08 - 00311296 _____ (Microsoft Corporation) C:\Windows\syswow64\GDI32.dll
2009-07-14 01:25 - 2009-07-14 03:11 - 00025600 _____ (Microsoft Corporation) C:\Windows\syswow64\LPK.dll
2013-01-09 05:19 - 2012-11-22 06:45 - 00626688 _____ (Microsoft Corporation) C:\Windows\syswow64\USP10.dll
2012-04-02 07:24 - 2011-12-16 09:52 - 00690688 _____ (Microsoft Corporation) C:\Windows\syswow64\msvcrt.dll
2012-04-03 15:51 - 2010-11-20 14:18 - 00640512 _____ (Microsoft Corporation) C:\Windows\syswow64\ADVAPI32.dll
2009-07-14 01:11 - 2009-07-14 03:16 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2012-04-03 15:51 - 2010-11-20 14:08 - 00663040 _____ (Microsoft Corporation) C:\Windows\syswow64\RPCRT4.dll
2012-07-11 05:56 - 2012-06-02 06:34 - 00096768 _____ (Microsoft Corporation) C:\Windows\syswow64\SspiCli.dll
2009-07-14 01:12 - 2009-07-14 03:15 - 00036864 _____ (Microsoft Corporation) C:\Windows\syswow64\CRYPTBASE.dll
2009-07-14 01:28 - 2009-07-14 03:15 - 00828928 _____ (Microsoft Corporation) C:\Windows\syswow64\MSCTF.dll
2012-07-11 05:56 - 2012-06-09 06:41 - 12873728 _____ (Microsoft Corporation) C:\Windows\syswow64\SHELL32.dll
2012-04-03 15:51 - 2010-11-20 14:21 - 00350208 _____ (Microsoft Corporation) C:\Windows\syswow64\SHLWAPI.dll
2012-11-03 05:07 - 2013-08-20 10:25 - 00055352 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\cfglib.dll
2012-11-03 05:07 - 2013-08-20 10:26 - 00218168 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\gpipc.dll
2012-11-03 05:07 - 2013-08-20 10:26 - 00109112 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\gpgen.dll
2012-11-03 05:07 - 2013-09-03 12:01 - 00128056 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\gpschd.dll
2009-07-14 01:12 - 2009-07-14 03:16 - 00008704 _____ (Microsoft Corporation) C:\Windows\syswow64\NSI.dll
2012-04-03 15:51 - 2010-11-20 14:21 - 00206848 _____ (Microsoft Corporation) C:\Windows\syswow64\WS2_32.dll
2012-11-03 05:07 - 2012-09-19 20:17 - 00397088 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2012-04-02 07:24 - 2011-05-24 12:39 - 00145920 _____ (Microsoft Corporation) C:\Windows\syswow64\CFGMGR32.dll
2012-04-03 15:52 - 2010-11-20 14:20 - 01414144 _____ (Microsoft Corporation) C:\Windows\syswow64\ole32.dll
2012-04-02 07:24 - 2011-08-27 06:26 - 00571904 _____ (Microsoft Corporation) C:\Windows\syswow64\OLEAUT32.dll
2012-10-10 06:53 - 2012-06-02 06:36 - 01159680 _____ (Microsoft Corporation) C:\Windows\syswow64\CRYPT32.dll
2012-04-03 15:51 - 2010-11-20 14:19 - 00034304 _____ (Microsoft Corporation) C:\Windows\syswow64\MSASN1.dll
2012-10-10 06:54 - 2012-08-24 18:57 - 00172544 _____ (Microsoft Corporation) C:\Windows\syswow64\WINTRUST.dll
2012-11-03 05:07 - 2013-08-20 10:26 - 00039480 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\gpgrd.dll
2012-11-03 05:07 - 2013-08-20 10:26 - 00057400 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\gpgui.dll
2012-11-03 05:07 - 2013-08-20 10:26 - 00042552 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\gplegacy.dll
2012-11-03 05:07 - 2013-08-20 10:26 - 00050744 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\gpgenrep.dll
2012-11-03 05:07 - 2013-08-20 10:26 - 00025656 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\onlcfg.dll
2013-06-27 14:44 - 2013-08-20 10:26 - 00110648 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\gavidb.dll
2012-11-03 05:07 - 2013-08-20 10:25 - 00497720 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\avlode.dll
2012-11-03 05:07 - 2013-06-27 14:43 - 00154112 _____ (Avira GmbH) C:\Program Files (x86)\Avira\AntiVir Desktop\apcfile.dll
2012-11-03 05:07 - 2012-10-02 12:43 - 00263992 _____ (The cURL library, hxxp://curl.haxx.se/) C:\Program Files (x86)\Avira\AntiVir Desktop\libcurl.dll
2012-04-03 15:51 - 2010-11-20 14:21 - 00269824 _____ (Microsoft Corporation) C:\Windows\syswow64\WLDAP32.dll
2012-11-03 05:07 - 2012-10-02 12:43 - 00187704 _____ (Apache Software Foundation) C:\Program Files (x86)\Avira\AntiVir Desktop\libaprutil-1.dll
2012-11-03 05:07 - 2012-10-02 12:43 - 00033592 _____ (Apache Software Foundation) C:\Program Files (x86)\Avira\AntiVir Desktop\libapriconv-1.dll
2012-11-03 05:07 - 2012-10-02 12:43 - 00138040 _____ (Apache Software Foundation) C:\Program Files (x86)\Avira\AntiVir Desktop\libapr-1.dll
2012-11-03 05:07 - 2013-08-20 10:26 - 00312888 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\gpavgio.dll
2012-11-03 05:07 - 2013-08-20 10:25 - 00134200 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\avesvc.dll
2012-11-03 05:07 - 2013-08-20 10:25 - 00014392 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\avesvcr.dll
2012-11-03 05:07 - 2013-08-20 10:25 - 00250424 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\avreg.dll
2010-10-22 02:00 - 2010-10-22 02:00 - 00197120 _____ (AVM GmbH) C:\Program Files (x86)\avmwlanstick\avmwlapi.dll
2010-10-22 02:00 - 2010-10-22 02:00 - 00331776 _____ (AVM Berlin) C:\Program Files (x86)\avmwlanstick\avmsysnet.dll
2012-12-13 11:05 - 2012-11-14 03:57 - 01129472 _____ (Microsoft Corporation) C:\Windows\syswow64\WININET.dll
2009-07-14 01:15 - 2009-07-14 03:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\syswow64\Normaliz.dll
2012-12-13 11:05 - 2012-11-14 03:46 - 01793024 _____ (Microsoft Corporation) C:\Windows\syswow64\iertutil.dll
2012-12-13 11:05 - 2012-11-14 03:57 - 01103872 _____ (Microsoft Corporation) C:\Windows\syswow64\urlmon.dll
2009-07-14 01:44 - 2009-07-14 03:15 - 00522240 _____ (Microsoft Corporation) C:\Windows\syswow64\CLBCatQ.DLL
2012-04-03 15:51 - 2010-11-20 14:20 - 00406528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netcfgx.dll
2009-07-14 01:35 - 2009-07-14 03:16 - 00027136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\slc.dll
2012-04-03 15:51 - 2010-11-20 14:21 - 01667584 _____ (Microsoft Corporation) C:\Windows\syswow64\SETUPAPI.dll
2012-04-02 07:24 - 2011-05-24 12:40 - 00064512 _____ (Microsoft Corporation) C:\Windows\syswow64\DEVOBJ.dll
2009-07-14 01:33 - 2009-07-14 03:17 - 00249680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcryptprimitives.dll
2012-04-02 07:24 - 2011-08-27 06:26 - 00571904 _____ (Microsoft Corporation) C:\Windows\syswow64\oleaut32.dll
2009-07-14 01:34 - 2009-07-14 03:16 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntmarta.dll
2012-12-13 11:05 - 2012-11-14 03:57 - 01129472 _____ (Microsoft Corporation) C:\Windows\syswow64\wininet.dll
2009-08-20 14:34 - 2009-08-20 14:34 - 00110592 _____ (Hewlett-Packard Company) c:\Program Files (x86)\Common Files\LightScribe\LSSProxy.dll
2009-07-14 01:15 - 2009-07-14 03:16 - 00006144 _____ (Microsoft Corporation) C:\Windows\syswow64\PSAPI.DLL
2009-08-20 14:34 - 2009-08-20 14:34 - 00033792 _____ (Hewlett-Packard Company) c:\Program Files (x86)\Common Files\LightScribe\LSLog.dll
2013-01-09 05:18 - 2012-11-30 06:53 - 01114112 _____ (Microsoft Corporation) C:\Windows\syswow64\KERNEL32.dll
2012-07-11 05:56 - 2012-06-09 06:41 - 12873728 _____ (Microsoft Corporation) C:\Windows\syswow64\shell32.dll
2012-04-11 21:53 - 2012-03-01 07:33 - 00159232 _____ (Microsoft Corporation) C:\Windows\syswow64\imagehlp.dll
2009-09-29 16:25 - 2009-09-29 16:25 - 00032768 _____ (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Advisor\CommonInterfaces.dll
2009-09-29 16:25 - 2009-09-29 16:25 - 00147456 _____ (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Advisor\CommonUtility.dll
2009-09-29 16:25 - 2009-09-29 16:25 - 00253952 _____ (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Pillars\PCHealthSecurity\PCHealthSecurityPillar.dll
2009-09-29 16:25 - 2009-09-29 16:25 - 00032768 _____ (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Content.dll
2009-09-29 16:25 - 2009-09-29 16:25 - 00143360 _____ (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Advisor\SystemStatus.dll
2009-09-29 16:25 - 2009-09-29 16:25 - 00061440 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Pillars\PCAlerts\PCAlertsPillar.dll
2009-09-29 16:25 - 2009-09-29 16:25 - 02359296 _____ (HP) C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Pillars\ECenter\ECenter.dll
2009-09-29 16:25 - 2009-09-29 16:25 - 00131072 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Pillars\ECenter\ECLibrary.dll
2009-09-29 16:25 - 2009-09-29 16:25 - 00040960 _____ (Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Advisor\CeeWriter.dll
2009-09-29 16:25 - 2009-09-29 16:25 - 00040960 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingServer.dll
2009-09-29 16:25 - 2009-09-29 16:25 - 00005632 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingInterface.dll
2009-09-29 16:25 - 2009-09-29 16:25 - 00018944 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingMessages.dll
2009-09-29 16:25 - 2009-09-29 16:25 - 00036864 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingClients.dll
2009-09-29 16:25 - 2009-09-29 16:25 - 00028672 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.Logging.dll
2009-09-29 16:25 - 2009-09-29 16:25 - 00007680 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\RemotingClient.dll
2010-01-06 18:57 - 2010-01-06 18:57 - 00115712 _____ (Hewlett-Packard) C:\Windows\assembly\GAC_MSIL\HP.ActiveSupportLibrary\2.0.0.1__01a974bc1760f423\HP.ActiveSupportLibrary.dll
2012-04-03 15:51 - 2010-11-20 14:21 - 01667584 _____ (Microsoft Corporation) C:\Windows\syswow64\SETUPAPI.DLL
2012-04-01 17:46 - 2010-04-08 13:43 - 00032768 _____ (CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\LangInfo\DE\CNSELANG.dll
2012-12-13 11:05 - 2012-11-14 03:57 - 01103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2012-11-03 05:07 - 2013-08-20 10:26 - 00349752 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccguard.dll
2012-11-03 05:07 - 2013-08-20 10:26 - 00029240 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccgrdrc.dll
2012-11-03 05:07 - 2013-08-20 10:26 - 00229432 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccgrdw.dll
2012-11-03 05:07 - 2013-08-20 10:26 - 00419384 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccwgrd.dll
2012-11-03 05:07 - 2013-08-20 10:26 - 00027192 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccwgrdrc.dll
2012-11-03 05:07 - 2013-08-20 10:26 - 00127544 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccwgrdw.dll
2012-11-03 05:07 - 2013-08-20 10:26 - 00807992 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccgen.dll
2012-11-03 05:07 - 2013-08-20 10:26 - 00049720 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccgenrc.dll
2012-11-03 05:07 - 2013-08-20 10:26 - 00220216 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccupdate.dll
2012-11-03 05:07 - 2013-08-20 10:26 - 00028728 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccupdrc.dll
2012-11-03 05:07 - 2013-08-20 10:26 - 00083000 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\cclic.dll
2012-11-03 05:07 - 2013-08-20 10:26 - 00009784 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\cclicrc.dll
2012-11-03 05:07 - 2013-08-20 10:26 - 00237624 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccmsg.dll
2012-11-03 05:07 - 2013-08-20 10:26 - 00010296 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccmsgrc.dll
2012-11-03 05:07 - 2013-08-20 10:26 - 00014392 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccmainrc.dll
2012-04-03 15:51 - 2010-11-20 14:18 - 00485888 _____ (Microsoft Corporation) C:\Windows\syswow64\COMDLG32.dll

==================== Alternate Data Streams (whitelisted) ==========



==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (09/07/2013 01:30:10 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: TrustedInstaller.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7989b
Name des fehlerhaften Moduls: wrpint.dll, Version: 6.1.7601.17592, Zeitstempel: 0x4da00365
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000087e8
ID des fehlerhaften Prozesses: 0xf70
Startzeit der fehlerhaften Anwendung: 0xTrustedInstaller.exe0
Pfad der fehlerhaften Anwendung: TrustedInstaller.exe1
Pfad des fehlerhaften Moduls: TrustedInstaller.exe2
Berichtskennung: TrustedInstaller.exe3

Error: (09/07/2013 01:29:40 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: TrustedInstaller.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7989b
Name des fehlerhaften Moduls: wrpint.dll, Version: 6.1.7601.17592, Zeitstempel: 0x4da00365
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000087e8
ID des fehlerhaften Prozesses: 0x81c
Startzeit der fehlerhaften Anwendung: 0xTrustedInstaller.exe0
Pfad der fehlerhaften Anwendung: TrustedInstaller.exe1
Pfad des fehlerhaften Moduls: TrustedInstaller.exe2
Berichtskennung: TrustedInstaller.exe3

Error: (09/07/2013 01:29:10 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: TrustedInstaller.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7989b
Name des fehlerhaften Moduls: wrpint.dll, Version: 6.1.7601.17592, Zeitstempel: 0x4da00365
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000087e8
ID des fehlerhaften Prozesses: 0xf34
Startzeit der fehlerhaften Anwendung: 0xTrustedInstaller.exe0
Pfad der fehlerhaften Anwendung: TrustedInstaller.exe1
Pfad des fehlerhaften Moduls: TrustedInstaller.exe2
Berichtskennung: TrustedInstaller.exe3

Error: (09/07/2013 01:28:40 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: TrustedInstaller.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7989b
Name des fehlerhaften Moduls: wrpint.dll, Version: 6.1.7601.17592, Zeitstempel: 0x4da00365
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000087e8
ID des fehlerhaften Prozesses: 0xfc8
Startzeit der fehlerhaften Anwendung: 0xTrustedInstaller.exe0
Pfad der fehlerhaften Anwendung: TrustedInstaller.exe1
Pfad des fehlerhaften Moduls: TrustedInstaller.exe2
Berichtskennung: TrustedInstaller.exe3

Error: (09/07/2013 01:28:10 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: TrustedInstaller.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7989b
Name des fehlerhaften Moduls: wrpint.dll, Version: 6.1.7601.17592, Zeitstempel: 0x4da00365
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000087e8
ID des fehlerhaften Prozesses: 0x954
Startzeit der fehlerhaften Anwendung: 0xTrustedInstaller.exe0
Pfad der fehlerhaften Anwendung: TrustedInstaller.exe1
Pfad des fehlerhaften Moduls: TrustedInstaller.exe2
Berichtskennung: TrustedInstaller.exe3

Error: (09/07/2013 01:27:40 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: TrustedInstaller.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7989b
Name des fehlerhaften Moduls: wrpint.dll, Version: 6.1.7601.17592, Zeitstempel: 0x4da00365
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000087e8
ID des fehlerhaften Prozesses: 0xe8c
Startzeit der fehlerhaften Anwendung: 0xTrustedInstaller.exe0
Pfad der fehlerhaften Anwendung: TrustedInstaller.exe1
Pfad des fehlerhaften Moduls: TrustedInstaller.exe2
Berichtskennung: TrustedInstaller.exe3

Error: (09/07/2013 01:27:10 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: TrustedInstaller.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7989b
Name des fehlerhaften Moduls: wrpint.dll, Version: 6.1.7601.17592, Zeitstempel: 0x4da00365
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000087e8
ID des fehlerhaften Prozesses: 0x7f0
Startzeit der fehlerhaften Anwendung: 0xTrustedInstaller.exe0
Pfad der fehlerhaften Anwendung: TrustedInstaller.exe1
Pfad des fehlerhaften Moduls: TrustedInstaller.exe2
Berichtskennung: TrustedInstaller.exe3

Error: (09/07/2013 01:26:40 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: TrustedInstaller.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7989b
Name des fehlerhaften Moduls: wrpint.dll, Version: 6.1.7601.17592, Zeitstempel: 0x4da00365
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000087e8
ID des fehlerhaften Prozesses: 0xdac
Startzeit der fehlerhaften Anwendung: 0xTrustedInstaller.exe0
Pfad der fehlerhaften Anwendung: TrustedInstaller.exe1
Pfad des fehlerhaften Moduls: TrustedInstaller.exe2
Berichtskennung: TrustedInstaller.exe3

Error: (09/07/2013 01:26:10 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: TrustedInstaller.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7989b
Name des fehlerhaften Moduls: wrpint.dll, Version: 6.1.7601.17592, Zeitstempel: 0x4da00365
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000087e8
ID des fehlerhaften Prozesses: 0xd7c
Startzeit der fehlerhaften Anwendung: 0xTrustedInstaller.exe0
Pfad der fehlerhaften Anwendung: TrustedInstaller.exe1
Pfad des fehlerhaften Moduls: TrustedInstaller.exe2
Berichtskennung: TrustedInstaller.exe3

Error: (09/07/2013 01:25:40 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: TrustedInstaller.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7989b
Name des fehlerhaften Moduls: wrpint.dll, Version: 6.1.7601.17592, Zeitstempel: 0x4da00365
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000087e8
ID des fehlerhaften Prozesses: 0x9cc
Startzeit der fehlerhaften Anwendung: 0xTrustedInstaller.exe0
Pfad der fehlerhaften Anwendung: TrustedInstaller.exe1
Pfad des fehlerhaften Moduls: TrustedInstaller.exe2
Berichtskennung: TrustedInstaller.exe3


System errors:
=============
Error: (09/07/2013 01:30:10 PM) (Source: Service Control Manager) (User: )
Description: Dienst "Windows Modules Installer" wurde unerwartet beendet. Dies ist bereits 31 Mal passiert.

Error: (09/07/2013 01:29:40 PM) (Source: Service Control Manager) (User: )
Description: Dienst "Windows Modules Installer" wurde unerwartet beendet. Dies ist bereits 30 Mal passiert.

Error: (09/07/2013 01:29:10 PM) (Source: Service Control Manager) (User: )
Description: Dienst "Windows Modules Installer" wurde unerwartet beendet. Dies ist bereits 29 Mal passiert.

Error: (09/07/2013 01:28:40 PM) (Source: Service Control Manager) (User: )
Description: Dienst "Windows Modules Installer" wurde unerwartet beendet. Dies ist bereits 28 Mal passiert.

Error: (09/07/2013 01:28:10 PM) (Source: Service Control Manager) (User: )
Description: Dienst "Windows Modules Installer" wurde unerwartet beendet. Dies ist bereits 27 Mal passiert.

Error: (09/07/2013 01:27:40 PM) (Source: Service Control Manager) (User: )
Description: Dienst "Windows Modules Installer" wurde unerwartet beendet. Dies ist bereits 26 Mal passiert.

Error: (09/07/2013 01:27:10 PM) (Source: Service Control Manager) (User: )
Description: Dienst "Windows Modules Installer" wurde unerwartet beendet. Dies ist bereits 25 Mal passiert.

Error: (09/07/2013 01:26:40 PM) (Source: Service Control Manager) (User: )
Description: Dienst "Windows Modules Installer" wurde unerwartet beendet. Dies ist bereits 24 Mal passiert.

Error: (09/07/2013 01:26:10 PM) (Source: Service Control Manager) (User: )
Description: Dienst "Windows Modules Installer" wurde unerwartet beendet. Dies ist bereits 23 Mal passiert.

Error: (09/07/2013 01:25:40 PM) (Source: Service Control Manager) (User: )
Description: Dienst "Windows Modules Installer" wurde unerwartet beendet. Dies ist bereits 22 Mal passiert.


Microsoft Office Sessions:
=========================
Error: (11/25/2012 11:13:59 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6662.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 807 seconds with 600 seconds of active time.  This session ended with a crash.

Error: (04/20/2012 10:27:21 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6612.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 5067 seconds with 3840 seconds of active time.  This session ended with a crash.


==================== Memory info =========================== 

Percentage of memory in use: 34%
Total physical RAM: 4095.3 MB
Available physical RAM: 2679.37 MB
Total Pagefile: 8188.8 MB
Available Pagefile: 6396.93 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (COMPAQ) (Fixed) (Total:453.54 GB) (Free:317.34 GB) NTFS
Drive d: (FACTORY_IMAGE) (Fixed) (Total:12.12 GB) (Free:1.7 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive g: () (Removable) (Total:14.83 GB) (Free:14.82 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 466 GB) (Disk ID: 1549F232)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=454 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=12 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 15 GB) (Disk ID: 00000000)
Partition 1: (Not Active) - (Size=15 GB) - (Type=0B)

==================== End Of Log ============================

aharonov · 07.09.2013, 12:44

Zitat:

Mir ist gerade aufgefallen dass ich so gut wie alle Dateien von Word, Bilder etc nicht mehr öffnen kann, weil er mir sagt dass sie schon in Verwendung sind.

Ist das auch nach einem Neustart noch so?
Und im abgesicherten Modus?

bensa89 · 07.09.2013, 13:03

Ein Neustart brachte keine Besserung. Im abgesicherten Modus kann ich alle Dateien normal öffnen.

Word sagt mir: Das die Datei von einem anderen Benutzer genutzt wird, ich kann auch keine Kopie der Datei öffnen. Auf meinem anderen Rechner aber schon.
Neuerstellte Word Dateien, kann ich ohne Probleme öffnen

Bei Bildern bekomme ich die Meldung dass ich keine Zugriffsberechtigung auf den Speicherort habe

aharonov · 09.09.2013, 12:36

ok.

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

aharonov · 16.09.2013, 17:29

Hi,

ich hab schon länger keine Antwort mehr von dir erhalten. Brauchst du weiterhin noch Hilfe?

Wenn ich in den nächsten 24 Stunden nichts von dir höre, gehe ich davon aus, dass sich das Thema erledigt hat und lösche es aus meinen Abos.

aharonov · 22.09.2013, 17:02

Fehlende Rückmeldung
Dieses Thema wurde aus meinen Abos gelöscht. Somit bekomme ich keine Benachrichtigung mehr über neue Antworten.
Schreib mir eine PM, falls du das Thema doch wieder fortsetzen möchtest. Dann machen wir hier weiter.

Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass dein Rechner schon sauber ist.

Jeder andere bitte diese Anleitung lesen und einen eigenen Thread erstellen.

16.09.2013, 17:29	#9
aharonov /// TB-Ausbilder	GVU Trojaner - Win7 - kein abgesicherter Modus Hi, ich hab schon länger keine Antwort mehr von dir erhalten. Brauchst du weiterhin noch Hilfe? Wenn ich in den nächsten 24 Stunden nichts von dir höre, gehe ich davon aus, dass sich das Thema erledigt hat und lösche es aus meinen Abos. __________________ cheers, Leo

GVU Trojaner - Win7 - kein abgesicherter Modus

Log-Analyse und Auswertung: GVU Trojaner - Win7 - kein abgesicherter Modus