| |
| |||||||
Log-Analyse und Auswertung: Vista- nach booten Absturz mit weißem BildWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
29.11.2013, 00:03
| #1 |
| |  Vista- nach booten Absturz mit weißem Bild Hallo. Ich habe einen Acer Aspire 7738 mit Viste Home SP2. Als ich gestern den Rechner hochfahren wollte, konnte ich mich wie üblich anmelden und alles startete normal. Es gab wie üblich einen Ruckler, weil bei jedem Neustart der ISATAP- Treiber installiert wird. Daher nichts verdächtiges, bis ich feststellte, dass ich nichts anklicken kann und kurz darauf der Desktop von einem milchigen Weiß überlagert wurde und nur noch der Mauszeiger bewegt werden konnte. Kein klicken, keine Tastatureingaben waren möglich. Dies änderte sich auch nach längerem warten nicht und nach mehrmaligen Neustarts zeigte sich immer wieder das gleiche Bild. Im Abgesicherten Modus mit Netzwerkunterstützung gab es ebenfalls nach wenigen Momenten einen Absturz. Es ist nur noch das Starten im Abgesicherten Modus möglich. Hier habe ich einen kompletten Systemscan von Avira Antivir laufen lassen, der jedoch, als er Thunderbird durchleuchtete, hängen blieb und beim Stopp-Versuch abstürzte. Eine Suche mit den Symptomen brachte mich hierher, da hier scheinbar ähnliche Fälle auftauchen. Ich habe im Abgesicherten Modus Defogger, FRST und GMER ausgeführt. Mein Nachname ist mit ****** überschrieben. Hier die Logs: Defogger: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 11:30 on 28/11/2013 (René ******)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
SPTD -> Disabled
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 27-11-2013 01
Ran by René ****** (administrator) on DERGRAFIKER on 28-11-2013 11:32:33
Running from C:\Users\René ******\Desktop
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Safe Mode (minimal)
==================== Processes (Whitelisted) ===================
(Microsoft Corporation) C:\Windows\HelpPane.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe [440864 2009-04-15] (Acer Incorporated)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7711264 2009-08-18] (Realtek Semiconductor)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192 2013-08-20] (Avira Operations GmbH & Co. KG)
HKCU\...\Run: [Miranda IM] - C:\Program Files\Miranda IM\miranda32.exe [829524 2013-10-21] (Miranda IM)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [125952 2008-01-21] (Microsoft Corporation)
MountPoints2: E - E:\autorun.exe
MountPoints2: {1a240747-efcb-11e2-b48b-0015834057d7} - F:\LaunchU3.exe -a
MountPoints2: {274cd158-0733-11df-a352-0022fa1a03b8} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL LAdeN.exE
MountPoints2: {2bcf7e94-c948-11de-bab1-001f16a7712b} - F:\Torchlight_Setup.exe
MountPoints2: {37505443-a1f5-11de-adf6-0022fa1a03b8} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL LadEN.eXE
MountPoints2: {5b577a55-338a-11e1-9d9c-001f16a7712b} - I:\Startme.exe
MountPoints2: {613620a9-730e-11e0-8711-0015834057d7} - "G:\WD SmartWare.exe" autoplay=true
MountPoints2: {668e6923-ebc9-11de-be42-806e6f6e6963} - F:\AutoRun.exe
MountPoints2: {6f64f75a-0725-11df-a85a-0022fa1a03b8} - E:\LaunchU3.exe -a
MountPoints2: {942b5184-ec65-11de-8cf1-806e6f6e6963} - E:\AutoRun.exe
MountPoints2: {b0cb3923-f7ca-11de-a723-806e6f6e6963} - E:\AutoRun.exe
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default\...\Run: [ProductReg] - C:\Program Files\Acer\WR_PopUp\ProductReg.exe [ 2008-11-17] (Acer)
HKU\Default\...\RunOnce: [ScrSav] - C:\Windows\Screensavers\logon\run_logon.exe
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\Run: [ProductReg] - C:\Program Files\Acer\WR_PopUp\ProductReg.exe [ 2008-11-17] (Acer)
HKU\Default User\...\RunOnce: [ScrSav] - C:\Windows\Screensavers\logon\run_logon.exe
HKU\Veranstaltungen\...\Run: [ProductReg] - C:\Program Files\Acer\WR_PopUp\ProductReg.exe [ 2008-11-17] (Acer)
Lsa: [Notification Packages] c:\Program Files\Acer Bio Protection\PwdFilter
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.hiergehtslos.de
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=0609&m=aspire_7738
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=0609&m=aspire_7738
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=0609&m=aspire_7738
URLSearchHook: HKLM - Vuze Remote Toolbar - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\prxtbVuz2.dll (Conduit Ltd.)
URLSearchHook: HKCU - Vuze Remote Toolbar - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\prxtbVuz2.dll (Conduit Ltd.)
URLSearchHook: HKCU - (No Name) - {7e111a5c-3d11-4f56-9463-5310c3c69025} - No File
SearchScopes: HKLM - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2736476
SearchScopes: HKLM - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2736476
SearchScopes: HKCU - DefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://isearch.babylon.com/web/{searchTerms}?babsrc=browsersearch
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://isearch.babylon.com/web/{searchTerms}?babsrc=browsersearch
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2736476
BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Vuze Remote Toolbar - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\prxtbVuz2.dll (Conduit Ltd.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Vuze Remote Toolbar - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\prxtbVuz2.dll (Conduit Ltd.)
Toolbar: HKLM - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
Toolbar: HKCU - Vuze Remote Toolbar - {BA14329E-9550-4989-B3F2-9732E92D17CC} - C:\Program Files\Vuze_Remote\prxtbVuz2.dll (Conduit Ltd.)
Toolbar: HKCU - No Name - {7E111A5C-3D11-4F56-9463-5310C3C69025} - No File
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 05 C:\Program Files\Bonjour\mdnsNSP.dll [147456] (Apple Inc.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\René ******\AppData\Roaming\Mozilla\Firefox\Profiles\h6dzmzd4.default-1366638308200
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_152.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.8 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @wacom.com/wacom-plugin,version=1.1.0.10 - C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF Plugin: @wacom.com/wtPlugin,version=2.0.0.1 - C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.2 - C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\René ******\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\René ******\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @talk.google.com/O3DPlugin - C:\Users\René ******\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\René ******\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\René ******\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: wacom.com/WacomTabletPlugin - C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\babylon.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\...\Firefox\Extensions: [{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}] - C:\Program Files\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}
FF Extension: Adobe Contribute Toolbar - C:\Program Files\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}
========================== Services (Whitelisted) =================
S2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-08-20] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-20] (Avira Operations GmbH & Co. KG)
S2 BlueSoleilCS; C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe [1466476 2009-09-02] (IVT Corporation)
S3 BsHelpCS; C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe [102503 2009-09-02] (IVT Corporation)
S2 CLHNService; C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [75048 2008-12-18] ()
S2 ePowerSvc; C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [703008 2009-04-15] (Acer Incorporated)
S2 IGBASVC; c:\Program Files\Acer Bio Protection\BASVC.exe [3440640 2009-02-13] (Egis Technology Inc.)
S2 NTISchedulerSvc; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [144632 2008-09-23] (NewTech Infosystems, Inc.)
S2 RS_Service; C:\Program Files\Acer\Acer VCM\RS_Service.exe [237568 2008-11-27] (Acer Incorporated)
S3 TuneUp.Defrag; C:\Windows\System32\TuneUpDefragService.exe [362240 2009-09-14] (TuneUp Software)
S2 TuneUp.ProgramStatisticsSvc; C:\Windows\System32\TUProgSt.exe [603904 2009-09-14] (TuneUp Software)
S2 WTabletServiceCon; C:\Program Files\Tablet\Pen\WTabletServiceCon.exe [526208 2012-11-14] (Wacom Technology, Corp.)
==================== Drivers (Whitelisted) ====================
S2 acedrv11; C:\Windows\system32\drivers\acedrv11.sys [185472 2010-02-24] (Protect Software GmbH)
R0 AlfaFF; C:\Windows\System32\drivers\AlfaFF.sys [42608 2009-02-13] (Alfa Corporation)
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [278984 2011-07-12] ()
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-02] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-08-20] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-03-29] (Avira Operations GmbH & Co. KG)
S3 BT; C:\Windows\System32\DRIVERS\btnetdrv.sys [17928 2009-06-17] (IVT Corporation.)
S3 Btcsrusb; C:\Windows\System32\Drivers\btcusb.sys [39304 2009-07-08] (IVT Corporation.)
R0 BtHidBus; C:\Windows\System32\Drivers\BtHidBus.sys [20744 2009-06-17] (IVT Corporation.)
S3 btnetBUs; C:\Windows\System32\Drivers\btnetBus.sys [29192 2009-06-17] ()
S3 DJM-5000Audio; C:\Windows\System32\drivers\DJM-5000Audio.sys [28160 2010-05-17] (Pioneer Corporation.)
S2 FPSensor; C:\Windows\System32\Drivers\FPSensor.sys [26928 2008-12-24] (Egis)
R0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] ()
S3 hidkmdf; C:\Windows\System32\DRIVERS\hidkmdf.sys [11680 2012-10-12] (Windows (R) Win 7 DDK provider)
R3 hidshim; C:\Windows\System32\DRIVERS\hidshim.sys [5632 2008-10-08] (Windows (R) Codename Longhorn DDK provider)
S2 int15; c:\Windows\system32\drivers\int15.sys [69632 2009-02-13] ()
S3 IvtBtBUs; C:\Windows\System32\Drivers\IvtBtBus.sys [25480 2009-06-17] (IVT Corporation.)
S3 ivusb; C:\Windows\System32\DRIVERS\ivusb.sys [25112 2010-07-29] (Initio Corporation)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [18048 2010-11-10] ()
S3 NETwNv32; C:\Windows\System32\DRIVERS\NETwNv32.sys [7346176 2011-10-31] (Intel Corporation)
R0 nhcDriverDevice; C:\Windows\System32\drivers\nhcDriver.sys [71552 2010-12-15] (Notebook Hardware Control)
R3 nuvotonhidgeneric; C:\Windows\System32\DRIVERS\nuvotonhidgeneric.sys [22528 2008-10-08] (Nuvoton Technology Corporation)
R0 speedfan; C:\Windows\System32\speedfan.sys [25240 2011-03-18] (Almico Software)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2009-11-04] (Duplex Secure Ltd.)
S3 Spyder3; C:\Windows\System32\DRIVERS\Spyder3.sys [12288 2007-12-12] ()
S1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-02-23] (Avira GmbH)
S3 VComm; C:\Windows\System32\DRIVERS\VComm.sys [14856 2009-06-17] (IVT Corporation.)
S3 VcommMgr; C:\Windows\System32\Drivers\VcommMgr.sys [32392 2009-06-17] (IVT Corporation.)
S3 WacHidRouter; C:\Windows\System32\DRIVERS\wachidrouter.sys [69024 2012-10-12] (Wacom Technology)
S3 wacomrouterfilter; C:\Windows\System32\DRIVERS\wacomrouterfilter.sys [13728 2012-10-12] (Wacom Technology)
S2 adfs; No ImagePath
U5 BlueletAudio; C:\Windows\System32\Drivers\BlueletAudio.sys [33800 2009-06-17] (IVT Corporation.)
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 massfilter; system32\drivers\massfilter.sys [x]
U3 massfilter_hs; system32\drivers\massfilter_hs.sys
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 wacommousefilter; system32\DRIVERS\wacommousefilter.sys [x]
S3 wacomvhid; system32\DRIVERS\wacomvhid.sys [x]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [x]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [x]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-28 11:32 - 2013-11-28 11:33 - 00015414 _____ C:\Users\René ******\Desktop\FRST.txt
2013-11-28 11:32 - 2013-11-28 11:32 - 00000000 ____D C:\FRST
2013-11-28 11:31 - 2013-11-28 11:19 - 01091827 _____ (Farbar) C:\Users\René ******\Desktop\FRST.exe
2013-11-28 11:30 - 2013-11-28 11:30 - 00000516 _____ C:\Users\René ******\Desktop\defogger_disable.log
2013-11-28 11:30 - 2013-11-28 11:30 - 00000020 _____ C:\Users\René ******\defogger_reenable
2013-11-28 11:29 - 2013-11-28 11:18 - 00050477 _____ C:\Users\René ******\Desktop\Defogger.exe
2013-11-27 15:06 - 2013-11-27 19:02 - 00002313 _____ C:\Windows\WindowsUpdate.log
2013-11-27 10:33 - 2013-11-27 10:33 - 00000000 __SHD C:\found.000
2013-11-24 19:03 - 2013-11-24 20:24 - 00004660 _____ C:\Users\René ******\Desktop\tlvmv antwort.txt
2013-11-23 23:52 - 2013-11-23 23:52 - 105869762 _____ C:\Windows\system32\笵載ᴼ§
2013-11-22 11:48 - 2013-11-22 11:48 - 105626457 _____ C:\Windows\system32\벑ᴼ™
2013-11-21 18:10 - 2013-11-21 18:10 - 105531440 _____ C:\Windows\system32\찇ᴼ£
2013-11-21 16:17 - 2012-01-04 00:51 - 00000874 _____ C:\Users\René ******\Desktop\Mozilla Firefox.lnk
2013-11-20 01:47 - 2013-11-20 01:48 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-17 19:18 - 2013-11-18 01:18 - 104760117 _____ C:\Windows\system32\橮倚ᴼx
2013-11-15 13:36 - 2013-11-16 04:43 - 104513208 _____ C:\Windows\system32\鎡⢬ᴼŸ
2013-11-14 03:48 - 2013-11-14 15:27 - 104225154 _____ C:\Windows\system32\汋ᩑᴼ“
2013-11-08 08:41 - 2013-11-08 08:41 - 103075526 _____ C:\Windows\system32\ٍᘱᴼ[
2013-11-07 18:30 - 2013-11-08 00:29 - 103066299 _____ C:\Windows\system32\ﰸ䬰ᴼ”
2013-11-06 19:56 - 2013-11-07 12:29 - 102894578 _____ C:\Windows\system32\췢冬ᴼ‰
2013-11-05 18:17 - 2013-11-06 12:27 - 102722523 _____ C:\Windows\system32\筞⻲ᴼ‰
2013-11-05 12:18 - 2013-11-05 12:18 - 105043933 _____ C:\Windows\system32\ᴼ”
2013-11-04 14:24 - 2013-11-04 14:24 - 104867914 _____ C:\Windows\system32\ケ䂱ᴼ“
2013-11-01 10:47 - 2013-11-02 12:56 - 104620600 _____ C:\Windows\system32\駙稾ᴼ”
2013-10-30 15:46 - 2013-10-30 15:46 - 104158698 _____ C:\Windows\system32\㛯lᴼ¢
2013-10-30 11:20 - 2013-11-26 11:04 - 00000000 ____D C:\Program Files\Mozilla Thunderbird
2013-10-30 09:46 - 2013-10-30 09:46 - 104098187 _____ C:\Windows\system32\袙㉻ᴼ§
2013-10-29 11:12 - 2013-10-29 11:12 - 103932228 _____ C:\Windows\system32\钺ᴼ™
==================== One Month Modified Files and Folders =======
2013-11-28 11:33 - 2013-11-28 11:32 - 00015414 _____ C:\Users\René ******\Desktop\FRST.txt
2013-11-28 11:32 - 2013-11-28 11:32 - 00000000 ____D C:\FRST
2013-11-28 11:30 - 2013-11-28 11:30 - 00000516 _____ C:\Users\René ******\Desktop\defogger_disable.log
2013-11-28 11:30 - 2013-11-28 11:30 - 00000020 _____ C:\Users\René ******\defogger_reenable
2013-11-28 11:30 - 2009-08-04 15:32 - 00000000 ____D C:\Users\René ******
2013-11-28 11:29 - 2006-11-02 11:33 - 03593192 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-28 11:19 - 2013-11-28 11:31 - 01091827 _____ (Farbar) C:\Users\René ******\Desktop\FRST.exe
2013-11-28 11:18 - 2013-11-28 11:29 - 00050477 _____ C:\Users\René ******\Desktop\Defogger.exe
2013-11-27 19:02 - 2013-11-27 15:06 - 00002313 _____ C:\Windows\WindowsUpdate.log
2013-11-27 18:46 - 2011-04-05 15:38 - 00005065 _____ C:\Windows\system32\LOCALSERVICE.INI
2013-11-27 18:44 - 2013-04-28 23:45 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-27 18:44 - 2010-07-09 10:43 - 00000416 _____ C:\Windows\Tasks\PCConfidential.job
2013-11-27 18:44 - 2009-09-07 14:42 - 00001137 _____ C:\Windows\system32\bscs.ini
2013-11-27 18:43 - 2006-11-02 14:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-27 18:25 - 2006-11-02 13:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-27 18:25 - 2006-11-02 13:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-27 17:34 - 2012-08-16 18:12 - 00001144 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1650648295-756086892-3871820350-1000UA.job
2013-11-27 17:24 - 2009-08-29 08:59 - 00001356 _____ C:\Users\René ******\AppData\Local\d3d9caps.dat
2013-11-27 15:58 - 2006-11-02 13:47 - 00036864 _____ C:\Windows\system32\umstartup.etl
2013-11-27 15:54 - 2011-10-29 09:39 - 00000000 ____D C:\Windows\pss
2013-11-27 12:19 - 2010-06-14 13:24 - 00000000 ____D C:\Users\René ******\AppData\Roaming\Azureus
2013-11-27 11:51 - 2013-10-20 13:32 - 00000000 ____D C:\Users\René ******\Desktop\dessetoff
2013-11-27 11:51 - 2013-07-15 22:47 - 00000000 ____D C:\Program Files\PNotes
2013-11-27 11:51 - 2011-04-05 15:37 - 00000000 ____D C:\Users\René ******\AppData\Local\bluesoleil
2013-11-27 11:51 - 2010-06-14 13:15 - 00000000 ____D C:\Program Files\Azureus
2013-11-27 11:51 - 2009-10-09 13:11 - 00000000 ____D C:\Program Files\IrfanView
2013-11-27 11:51 - 2009-08-29 16:24 - 00000000 ____D C:\Users\René ******\AppData\Roaming\vlc
2013-11-27 11:51 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\system32\spool
2013-11-27 11:51 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\system32\Msdtc
2013-11-27 11:51 - 2006-11-02 11:22 - 51642368 _____ C:\Windows\system32\config\software_previous
2013-11-27 11:51 - 2006-11-02 11:22 - 40894464 _____ C:\Windows\system32\config\components_previous
2013-11-27 11:51 - 2006-11-02 11:22 - 36438016 _____ C:\Windows\system32\config\system_previous
2013-11-27 11:51 - 2006-11-02 11:22 - 00262144 _____ C:\Windows\system32\config\security_previous
2013-11-27 11:51 - 2006-11-02 11:22 - 00262144 _____ C:\Windows\system32\config\sam_previous
2013-11-27 11:51 - 2006-11-02 11:22 - 00262144 _____ C:\Windows\system32\config\default_previous
2013-11-27 11:50 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\registration
2013-11-27 10:33 - 2013-11-27 10:33 - 00000000 __SHD C:\found.000
2013-11-26 11:04 - 2013-10-30 11:20 - 00000000 ____D C:\Program Files\Mozilla Thunderbird
2013-11-26 11:04 - 2011-11-07 00:35 - 00000000 ____D C:\Users\René ******\AppData\Roaming\Dropbox
2013-11-26 11:01 - 2011-11-30 08:09 - 00001456 _____ C:\Users\René ******\AppData\Local\Adobe Save for Web 12.0 Prefs
2013-11-26 03:59 - 2009-09-21 13:24 - 00000000 ____D C:\Users\René ******\AppData\Roaming\foobar2000
2013-11-24 20:24 - 2013-11-24 19:03 - 00004660 _____ C:\Users\René ******\Desktop\tlvmv antwort.txt
2013-11-24 13:57 - 2012-08-09 17:03 - 00000000 _____ C:\END
2013-11-24 01:18 - 2013-04-28 23:45 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-24 01:11 - 2012-04-03 15:22 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-23 23:52 - 2013-11-23 23:52 - 105869762 _____ C:\Windows\system32\笵載ᴼ§
2013-11-23 19:34 - 2012-08-16 18:12 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1650648295-756086892-3871820350-1000Core.job
2013-11-22 13:57 - 2010-01-22 16:19 - 00000000 ____D C:\Users\René ******\AppData\Roaming\FileZilla
2013-11-22 11:55 - 2009-09-14 18:10 - 00000000 ____D C:\Users\René ******\AppData\Local\Adobe
2013-11-22 11:52 - 2012-04-03 15:22 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-11-22 11:52 - 2011-07-04 19:29 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-11-22 11:48 - 2013-11-22 11:48 - 105626457 _____ C:\Windows\system32\벑ᴼ™
2013-11-21 19:25 - 2006-11-02 14:01 - 00032608 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-11-21 19:21 - 2012-05-20 13:06 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-11-21 18:10 - 2013-11-21 18:10 - 105531440 _____ C:\Windows\system32\찇ᴼ£
2013-11-20 01:48 - 2013-11-20 01:47 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-18 01:18 - 2013-11-17 19:18 - 104760117 _____ C:\Windows\system32\橮倚ᴼx
2013-11-17 22:59 - 2010-11-14 14:01 - 00000000 ____D C:\Program Files\SpeedFan
2013-11-17 18:45 - 2006-11-02 13:47 - 04349736 _____ C:\Windows\system32\FNTCACHE.DAT
2013-11-17 17:32 - 2010-10-28 23:36 - 00000000 ____D C:\ProgramData\Soulseek
2013-11-17 16:46 - 2009-08-04 15:33 - 00256736 _____ C:\Users\René ******\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-17 16:35 - 2011-06-24 16:01 - 00000000 ____D C:\Workspace
2013-11-16 04:43 - 2013-11-15 13:36 - 104513208 _____ C:\Windows\system32\鎡⢬ᴼŸ
2013-11-14 15:27 - 2013-11-14 03:48 - 104225154 _____ C:\Windows\system32\汋ᩑᴼ“
2013-11-13 00:22 - 2009-12-07 12:30 - 00000000 ____D C:\Users\René ******\AppData\Roaming\Skype
2013-11-08 23:50 - 2009-11-04 13:54 - 00000000 ____D C:\Users\René ******\AppData\Roaming\Mozilla
2013-11-08 08:41 - 2013-11-08 08:41 - 103075526 _____ C:\Windows\system32\ٍᘱᴼ[
2013-11-08 00:29 - 2013-11-07 18:30 - 103066299 _____ C:\Windows\system32\ﰸ䬰ᴼ”
2013-11-07 12:29 - 2013-11-06 19:56 - 102894578 _____ C:\Windows\system32\췢冬ᴼ‰
2013-11-06 12:27 - 2013-11-05 18:17 - 102722523 _____ C:\Windows\system32\筞⻲ᴼ‰
2013-11-05 12:18 - 2013-11-05 12:18 - 105043933 _____ C:\Windows\system32\ᴼ”
2013-11-05 01:59 - 2011-11-07 00:35 - 00000000 ____D C:\Users\René ******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-11-04 14:24 - 2013-11-04 14:24 - 104867914 _____ C:\Windows\system32\ケ䂱ᴼ“
2013-11-03 16:46 - 2009-08-29 16:53 - 00158720 _____ C:\Users\René ******\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-11-02 12:56 - 2013-11-01 10:47 - 104620600 _____ C:\Windows\system32\駙稾ᴼ”
2013-10-30 15:46 - 2013-10-30 15:46 - 104158698 _____ C:\Windows\system32\㛯lᴼ¢
2013-10-30 09:46 - 2013-10-30 09:46 - 104098187 _____ C:\Windows\system32\袙㉻ᴼ§
2013-10-29 11:12 - 2013-10-29 11:12 - 103932228 _____ C:\Windows\system32\钺ᴼ™
Files to move or delete:
====================
C:\ProgramData\0tbpw.pad
Some content of TEMP:
====================
C:\Users\Veranstaltungen\AppData\Local\Temp\AskSLib.dll
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-11-27 19:05
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 27-11-2013 01
Ran by René ****** at 2013-11-28 11:33:49
Running from C:\Users\René ******\Desktop
Boot Mode: Safe Mode (minimal)
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
32 Bit HP CIO Components Installer (Version: 1.0.0)
7-Zip 4.65
Acer Bio Protection (Version: 6.1.20)
Acer Crystal Eye webcam Ver:1.1.79.326 (Version: 1.1.79.326)
Acer eRecovery Management (Version: 4.00.3005)
Acer PowerSmart Manager (Version: 4.01.3013)
Acer Product Registration (Version: 3.0.0.10)
Acer ScreenSaver
Acer VCM (Version: 4.00.3004)
Adobe AIR (Version: 2.6.0.19140)
Adobe Community Help (Version: 3.0.0)
Adobe Community Help (Version: 3.0.0.400)
Adobe Creative Suite 5 Master Collection (Version: 5.0)
Adobe Flash Player 11 ActiveX (Version: 11.9.900.117)
Adobe Flash Player 11 Plugin (Version: 11.9.900.152)
Adobe Media Player (Version: 0.0.0)
Adobe Media Player (Version: 1.1)
Adobe Reader X (10.1.4) (Version: 10.1.4)
Adobe Shockwave Player 11.6 (Version: 11.6.8.638)
Agere Systems HDA Modem
ALPS Touch Pad Driver (Version: 7.5.2015.101)
AmIcoSingLun (Version: 1.2.117.1)
Avira Free Antivirus (Version: 13.0.0.4052)
Axialis IconWorkshop 5.0
Azureus (Version: 2.5.0.4)
Bamboo (Version: 5.3.0-3)
Bamboo Dock (Version: 4.1)
Bamboo Dock (Version: 4.1.0)
Bamboo Tablets Tutorial (Version: 3.0.20)
Bluesoleil 5.4.277.0 (Version: 5.4.277.0)
Bonjour (Version: 1.0.106)
Broadcom Gigabit NetLink Controller (Version: 11.34.02)
BufferChm (Version: 100.0.170.000)
C4400 (Version: 100.0.206.000)
C4400_Help (Version: 100.0.206.000)
CCleaner (Version: 4.06)
CDex extraction audio
ColorPic (Version: 4.1)
Compatibility Pack für 2007 Office System (Version: 12.0.4518.1014)
Copy (Version: 100.0.170.000)
Corel Graphics - Windows Shell Extension (Version: 15.0.0.487)
Corel Graphics - Windows Shell Extension (Version: 15.0.487)
CorelDRAW Graphics Suite X5 - Capture (Version: 15.0)
CorelDRAW Graphics Suite X5 - Common (Version: 15.0)
CorelDRAW Graphics Suite X5 - Connect (Version: 15.0)
CorelDRAW Graphics Suite X5 - Custom Data (Version: 15.0)
CorelDRAW Graphics Suite X5 - Draw (Version: 15.0)
CorelDRAW Graphics Suite X5 - EN (Version: 15.0)
CorelDRAW Graphics Suite X5 - Filters (Version: 15.0)
CorelDRAW Graphics Suite X5 - FontNav (Version: 15.0)
CorelDRAW Graphics Suite X5 - IPM (Version: 15.0)
CorelDRAW Graphics Suite X5 - PHOTO-PAINT (Version: 15.0)
CorelDRAW Graphics Suite X5 - Photozoom Plugin (Version: 15.0)
CorelDRAW Graphics Suite X5 - Redist (Version: 15.0)
CorelDRAW Graphics Suite X5 - Setup Files (Version: 15.0)
CorelDRAW Graphics Suite X5 - VBA (Version: 15.0)
CorelDRAW Graphics Suite X5 - VideoBrowser (Version: 15.0)
CorelDRAW Graphics Suite X5 - VSTA (Version: 15.0)
CorelDRAW Graphics Suite X5 - WT (Version: 15.0)
CorelDRAW Graphics Suite X5 (Version: 15.0)
CorelDRAW(R) Graphics Suite X5 (Version: 15.0.0.486)
Destination Component (Version: 100.0.0.0)
DeviceDiscovery (Version: 100.0.190.000)
DeviceManagementQFolder (Version: 1.00.0000)
DocProc (Version: 10.0.0.0)
DocProcQFolder (Version: 1.00.0000)
Dota 2
Dropbox (HKCU Version: 2.4.6)
ElsterFormular (Version: 14.3.11574)
eSupportQFolder (Version: 1.00.0000)
Evernote (Version: 4.5.1)
FileZilla Client 3.7.2 (HKCU Version: 3.7.2)
Fingerprint Solution (Version: 6.1.20.0)
foobar2000 v1.2.9 (Version: 1.2.9)
Free Audio CD Burner version 1.4
Ghostscript GPL 8.64 (Msi Setup) (Version: 8.64)
GIMP 2.6.11 (Version: 2.6.11)
Google Earth Plug-in (Version: 7.1.1.1888)
Google Talk Plugin (Version: 4.9.1.16010)
Google Update Helper (Version: 1.3.21.165)
GPBaseService (Version: 100.0.187.000)
HP Imaging Device Functions 10.0 (Version: 10.0)
HP Photosmart C4400 All-In-One Driver Software 10.0 Rel .3 (Version: 10.0)
HP Smart Web Printing (Version: 3.5)
HP Solution Center 10.0 (Version: 10.0)
HPProductAssistant (Version: 100.0.170.000)
IconEdit32
Intel PROSet Wireless
Intel(R) PROSet/Wireless WiFi-Software (Version: 14.03.0000)
IrfanView (remove only)
Java 7 Update 21 (Version: 7.0.210)
Java Auto Updater (Version: 2.1.9.5)
Launch Manager (Version: 2.0.01)
LibreOffice 3.5 (Version: 3.5.3.2)
LibreOffice 3.5 Help Pack (German) (Version: 3.5.3.2)
Malwarebytes Anti-Malware Version 1.62.0.1300 (Version: 1.62.0.1300)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Games for Windows - LIVE (Version: 3.0.86.0)
Microsoft Games for Windows - LIVE Redistributable (Version: 3.0.17.0)
Microsoft Office PowerPoint Viewer 2007 (German) (Version: 12.0.4518.1014)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218 (Version: 9.0.21022.218)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual Studio Tools for Applications 2.0 - ENU (Version: 9.0.30729)
Microsoft Visual Studio Tools for Applications 2.0 Runtime (Version: 9.0.30729)
Microsoft_VC80_ATL_x86 (Version: 8.0.50727.4053)
Microsoft_VC80_CRT_x86 (Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86 (Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86 (Version: 8.0.50727.4053)
Microsoft_VC90_ATL_x86 (Version: 1.00.0000)
Microsoft_VC90_CRT_x86 (Version: 1.00.0000)
Microsoft_VC90_MFC_x86 (Version: 1.00.0000)
MinuteTimer 1.4
Miranda IM 0.10.18 (Version: 0.10.18)
Mobile Partner (Version: 11.300.05.03.40)
Mozilla Firefox 25.0.1 (x86 de) (Version: 25.0.1)
Mozilla Maintenance Service (Version: 25.0.1)
Mozilla Thunderbird 24.1.0 (x86 de) (Version: 24.1.0)
MSVC80_x86_v2 (Version: 1.0.3.0)
MSVC90_x86 (Version: 1.0.1.2)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
NTI Backup Now 5 (Version: 5.1.2.616)
NTI Backup Now Standard (Version: 5.1.2.616)
Nuvoton EC Generic HID Driver (Version: 7.80.5000)
NVIDIA Grafiktreiber 295.73 (Version: 295.73)
NVIDIA HD-Audiotreiber 1.3.18.0 (Version: 1.3.18.0)
NVIDIA Install Application (Version: 2.1002.109.718)
NVIDIA PhysX (Version: 9.10.0514)
NVIDIA PhysX-Systemsoftware 260.99 (Version: 260.99)
NVIDIA Systemsteuerung 295.73 (Version: 295.73)
OCR Software by I.R.I.S. 10.0 (Version: 10.0)
PanoStandAlone (Version: 100.0.170.000)
PC Connectivity Solution (Version: 10.50.2.0)
PDF Settings CS5 (Version: 10.0)
Pioneer DJM-5000 Driver (Version: 1.200.000.000)
PNotes 9.3.0 (Version: 9.3.0)
PowerISO (Version: 4.8)
ProtectDisc Driver, Version 11 (Version: 11.0.0.14)
PS_AIO_03_C4400_ProductContext (Version: 100.0.215.000)
PS_AIO_03_C4400_Software (Version: 100.0.206.000)
PS_AIO_03_C4400_Software_Min (Version: 100.0.213.000)
PxMergeModule (Version: 1.00.0000)
QuickTime (Version: 7.65.17.80)
QuickTime Alternative 2.9.2 (Version: 2.9.2)
Realtek High Definition Audio Driver (Version: 6.0.1.5919)
Scan (Version: 10.1.0.0)
Scribus 1.4.2 (Version: 1.4.2)
SecureW2 EAP Suite 1.1.3 for Windows
Skype™ 5.8 (Version: 5.8.158)
SmartWebPrintingOC (Version: 100.0.189.000)
SolutionCenter (Version: 100.0.175.000)
SoulSeek 157 NS 13e
SpeedFan (remove only)
SRWare Iron Version 23.0.1300.0 (Version: 23.0.1300.0)
Status (Version: 100.0.175.000)
STDU Viewer version 1.6.251.0 (Version: 1.6.251.0)
Steam (Version: 1.0.0.0)
swMSM (Version: 12.0.0.1)
Toolbox (Version: 100.0.170.000)
Total Eclipse
TrayApp (Version: 100.0.170.000)
TuneUp Utilities 2009 (Version: 8.0.1100.43)
UnloadSupport (Version: 10.0.0)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Virtual DJ Pro Full - Atomix Productions
Visual Basic for Applications (R) Core - English (Version: 6.4.99.69)
Visual Basic for Applications (R) Core (Version: 6.4.99.69)
VLC media player 2.0.8 (Version: 2.0.8)
Vuze (Version: 5.0.0.0)
Vuze Remote Toolbar (Version: 6.3.0.26)
WebReg (Version: 100.0.170.000)
WebTablet FB Plugin 32 bit (Version: 2.1.0.2)
WebTablet IE Plugin (Version: 1.1.0.12)
WebTablet Netscape Plugin (Version: 1.1.0.10)
WinRAR
XAMPP 1.8.1-0 (Version: 1.8.1-0)
==================== Restore Points =========================
==================== Hosts content: ==========================
2006-11-02 11:23 - 2009-09-14 19:56 - 00000794 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
127.0.0.1 activate.adobe.com
==================== Scheduled Tasks (whitelisted) =============
Task: {09FBF91B-7791-4BA0-A7BF-10BFB67F5CC7} - System32\Tasks\Acer\Burn Notification => C:\Program Files\Acer\Acer eRecovery Management\NotificationCenter\Notification.exe [2009-02-05] (Acer)
Task: {178C2C8D-6B8D-4B20-A878-E0AEAD5980EB} - System32\Tasks\PCConfidential => C:\Program Files\Winferno\PC Confidential\PCConfidential.exe
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {3B7B9487-BF12-4CCD-B68C-E6D3FE3F94D2} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-04-28] (Google Inc.)
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\System32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {9BA32F68-453C-4B45-BA00-F83629F147BB} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-09-19] (Piriform Ltd)
Task: {9E1DEF2D-C381-4FD8-93E2-9F99E6CCF207} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe [2008-01-21] (Microsoft Corporation)
Task: {A728AE6B-5AB8-4223-AD3E-E6341441A01C} - System32\Tasks\Microsoft\Windows\PLA\System\ConvertLogEntries => C:\Windows\System32\pla.dll [2008-01-21] (Microsoft Corporation)
Task: {AF1BB99D-8703-43AC-9304-65F0413C2E9A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-11-22] (Adobe Systems Incorporated)
Task: {C5D383B5-9178-4BB6-AC7E-31CF15095CCF} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-04-28] (Google Inc.)
Task: {DAFF9139-6F66-434D-869B-D5EB8F64D80E} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1650648295-756086892-3871820350-1000UA => C:\Users\René ******\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-16] (Google Inc.)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\System32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: {FBE9DF19-6998-4E31-AA1C-E57434797870} - System32\Tasks\Java Update Scheduler => C:\Program Files\Java\jre6\bin\jusched.exe
Task: {FCE8AB3E-A92B-4940-B0CB-D002E3FA629A} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1650648295-756086892-3871820350-1000Core => C:\Users\René ******\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-16] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1650648295-756086892-3871820350-1000Core.job => C:\Users\René ******\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1650648295-756086892-3871820350-1000UA.job => C:\Users\René ******\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\PCConfidential.job => C:\Program Files\Winferno\PC Confidential\PCConfidential.exe
==================== Loaded Modules (whitelisted) =============
2013-08-06 18:43 - 2013-08-06 18:43 - 00093696 _____ () C:\Program Files\FileZilla FTP Client\fzshellext.dll
2009-09-17 13:15 - 2009-08-16 16:06 - 00141312 _____ () C:\Program Files\WinRAR\rarext.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData:gs5sys
AlternateDataStreams: C:\Users\All Users:gs5sys
AlternateDataStreams: C:\Users\René ******:gs5sys
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:gs5sys
AlternateDataStreams: C:\ProgramData\Temp:41099CE9
AlternateDataStreams: C:\ProgramData\Vorlagen:gs5sys
AlternateDataStreams: C:\Users\Public\Documents\desktop.ini:gs5sys
AlternateDataStreams: C:\Users\René ******\Anwendungsdaten:gs5sys
AlternateDataStreams: C:\Users\René ******\Cookies:gs5sys
AlternateDataStreams: C:\Users\René ******\Lokale Einstellungen:gs5sys
AlternateDataStreams: C:\Users\René ******\Vorlagen:gs5sys
AlternateDataStreams: C:\Users\René ******\Desktop\desktop.ini:gs5sys
AlternateDataStreams: C:\Users\René ******\AppData\Local:gs5sys
AlternateDataStreams: C:\Users\René ******\AppData\Roaming:gs5sys
AlternateDataStreams: C:\Users\René ******\AppData\Local\Anwendungsdaten:gs5sys
AlternateDataStreams: C:\Users\René ******\AppData\Local\Verlauf:gs5sys
AlternateDataStreams: C:\Users\René ******\Documents\desktop.ini:gs5sys
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="1"
==================== Faulty Device Manager Devices =============
Name: 6TO4 Adapter
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: 6TO4 Adapter
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: 6TO4 Adapter
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: isatap.kiste.hgw
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (11/28/2013 11:29:35 AM) (Source: LoadPerf) (User: )
Description: WmiApRplWmiApRpl8
Error: (11/28/2013 11:29:35 AM) (Source: LoadPerf) (User: )
Description: Performance16
Error: (11/28/2013 11:29:35 AM) (Source: LoadPerf) (User: )
Description: Performance16
Error: (11/28/2013 11:28:53 AM) (Source: LoadPerf) (User: )
Description: WmiApRplWmiApRpl8
Error: (11/28/2013 11:28:53 AM) (Source: LoadPerf) (User: )
Description: Performance16
Error: (11/28/2013 11:28:53 AM) (Source: LoadPerf) (User: )
Description: Performance16
Error: (11/28/2013 11:26:16 AM) (Source: EventSystem) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c
Error: (11/28/2013 11:26:01 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/27/2013 06:54:25 PM) (Source: LoadPerf) (User: )
Description: WmiApRplWmiApRpl8
Error: (11/27/2013 06:54:25 PM) (Source: LoadPerf) (User: )
Description: Performance16
System errors:
=============
Error: (11/28/2013 11:26:54 AM) (Source: Service Control Manager) (User: )
Description: NetzwerklistendienstNLA (Network Location Awareness)%%1068
Error: (11/28/2013 11:26:52 AM) (Source: DCOM) (User: )
Description: 1084WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}
Error: (11/28/2013 11:26:52 AM) (Source: DCOM) (User: )
Description: 1084WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
Error: (11/28/2013 11:26:52 AM) (Source: Service Control Manager) (User: )
Description: NetzwerklistendienstNLA (Network Location Awareness)%%1068
Error: (11/28/2013 11:26:18 AM) (Source: Service Control Manager) (User: )
Description: NetzwerklistendienstNLA (Network Location Awareness)%%1068
Error: (11/28/2013 11:26:18 AM) (Source: Service Control Manager) (User: )
Description: NetzwerklistendienstNLA (Network Location Awareness)%%1068
Error: (11/28/2013 11:26:18 AM) (Source: DCOM) (User: )
Description: 1068fdPHost{145B4335-FE2A-4927-A040-7C35AD3180EF}
Error: (11/28/2013 11:26:18 AM) (Source: DCOM) (User: )
Description: 1068netprofm{A47979D2-C419-11D9-A5B4-001185AD2B89}
Error: (11/28/2013 11:26:18 AM) (Source: DCOM) (User: )
Description: 1068netman{BA126AD1-2166-11D1-B1D0-00805FC1270E}
Error: (11/28/2013 11:26:16 AM) (Source: DCOM) (User: )
Description: 1084EventSystem{1BE1F766-5536-11D1-B726-00C04FB926AF}
Microsoft Office Sessions:
=========================
Error: (11/28/2013 11:29:35 AM) (Source: LoadPerf)(User: )
Description: WmiApRplWmiApRpl8
Error: (11/28/2013 11:29:35 AM) (Source: LoadPerf)(User: )
Description: Performance16
Error: (11/28/2013 11:29:35 AM) (Source: LoadPerf)(User: )
Description: Performance16
Error: (11/28/2013 11:28:53 AM) (Source: LoadPerf)(User: )
Description: WmiApRplWmiApRpl8
Error: (11/28/2013 11:28:53 AM) (Source: LoadPerf)(User: )
Description: Performance16
Error: (11/28/2013 11:28:53 AM) (Source: LoadPerf)(User: )
Description: Performance16
Error: (11/28/2013 11:26:16 AM) (Source: EventSystem)(User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c
Error: (11/28/2013 11:26:01 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/27/2013 06:54:25 PM) (Source: LoadPerf)(User: )
Description: WmiApRplWmiApRpl8
Error: (11/27/2013 06:54:25 PM) (Source: LoadPerf)(User: )
Description: Performance16
==================== Memory info ===========================
Percentage of memory in use: 17%
Total physical RAM: 3065.98 MB
Available physical RAM: 2527.31 MB
Total Pagefile: 6338.11 MB
Available Pagefile: 6011.43 MB
Total Virtual: 3071.88 MB
Available Virtual: 2963.49 MB
==================== Drives ================================
Drive c: (ACER) (Fixed) (Total:452.99 GB) (Free:48.6 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: () (Removable) (Total:3.66 GB) (Free:2.29 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 466 GB) (Disk ID: D5E391A8)
Partition 1: (Not Active) - (Size=10 GB) - (Type=27)
Partition 2: (Active) - (Size=453 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=3 GB) - (Type=12)
========================================================
Disk: 1 (Size: 4 GB) (Disk ID: 00000000)
Partition 1: (Not Active) - (Size=4 GB) - (Type=0B)
==================== End Of Log ============================
Die GMER Logdatei ist 18 MB groß. Wie soll ich damit verfahren? Danke schon Mal für eure Hilfe! |
|
29.11.2013, 02:59
| #2 | |
| /// the machine /// TB-Ausbilder    | Vista- nach booten Absturz mit weißem Bild hi,
__________________Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ |
|
29.11.2013, 10:50
| #3 |
| | Vista- nach booten Absturz mit weißem Bild Hier die Combofix.txt:
__________________Code:
ATTFilter ComboFix 13-11-27.01 - René ****** 29.11.2013 10:34:55.1.2 - x86 MINIMAL
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.3066.2445 [GMT 1:00]
ausgeführt von:: c:\users\RenÚ ******\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\END
C:\Install.exe
c:\program files\SecureW2
c:\program files\SecureW2\Uninstall.exe
c:\programdata\AC25D770BD.sys
c:\programdata\Microsoft\Windows\Start Menu\Programs\SecureW2
c:\programdata\Microsoft\Windows\Start Menu\Programs\SecureW2\TTLS Manager.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\SecureW2\Uninstall.lnk
c:\programdata\Roaming
c:\windows\system32\ccrpTmr6.dll
c:\windows\system32\FlashPlayerApp.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-10-28 bis 2013-11-29 ))))))))))))))))))))))))))))))
.
.
2013-11-28 21:37 . 2013-11-28 21:37 103680 ----a-w- C:\pxdiyaod.sys
2013-11-28 10:32 . 2013-11-28 10:32 -------- d-----w- C:\FRST
2013-11-27 09:33 . 2013-11-27 09:33 -------- d-----w- C:\found.000
2013-10-30 10:20 . 2013-11-26 10:04 -------- d-----w- c:\program files\Mozilla Thunderbird
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-11-22 10:52 . 2011-07-04 18:29 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-09-02 13:14 . 2013-02-26 02:02 88840 ----a-w- c:\windows\system32\drivers\avgntflt.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files\Vuze_Remote\prxtbVuz2.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
2011-05-09 09:49 176936 ----a-w- c:\program files\Vuze_Remote\prxtbVuz2.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files\Vuze_Remote\prxtbVuz2.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{BA14329E-9550-4989-B3F2-9732E92D17CC}"= "c:\program files\Vuze_Remote\prxtbVuz2.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\René ******\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\René ******\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\René ******\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\René ******\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Miranda IM"="c:\program files\Miranda IM\miranda32.exe" [2013-10-21 829524]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acer ePower Management"="c:\program files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe" [2009-04-15 440864]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-08-18 7711264]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-08-20 347192]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Acer VCM.lnk - c:\program files\Acer\Acer VCM\AcerVCM.exe [2009-6-17 565248]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ c:\program files\Acer Bio Protection\PwdFilter
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^Users^René ******^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^PNotes.lnk]
path=c:\users\René ******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PNotes.lnk
backup=c:\windows\pss\PNotes.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BambooCore]
2012-10-16 09:39 646744 ----a-w- c:\program files\Bamboo Dock\BambooCore.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-10-14 19:17 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]
2009-02-24 00:16 870920 ----a-w- c:\program files\Launch Manager\LManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PLFSetI]
2009-06-17 22:53 200704 ----a-w- c:\windows\PLFSetI.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2013-03-12 05:32 253816 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard]
2010-02-19 12:37 517096 ----a-w- c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VitaKeyPdtWzd]
2009-02-13 01:01 3549696 ----a-w- c:\program files\Acer Bio Protection\PdtWzd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-21 02:23 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe_ID0ENQBO"=c:\progra~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1650648295-756086892-3871820350-1000]
"EnableNotificationsRef"=dword:00000001
.
R2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [2010-02-24 185472]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - ECACHE
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Inhalt des "geplante Tasks" Ordners
.
2013-11-24 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-03 10:52]
.
2013-11-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-04-28 22:45]
.
2013-11-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-04-28 22:45]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.hiergehtslos.de
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=0609&m=aspire_7738
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: An vorhandene PDF-Datei anfügen - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: In Adobe PDF konvertieren - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\René ******\AppData\Roaming\Mozilla\Firefox\Profiles\h6dzmzd4.default-1366638308200\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{7e111a5c-3d11-4f56-9463-5310c3c69025} - (no file)
WebBrowser-{7E111A5C-3D11-4F56-9463-5310C3C69025} - (no file)
AddRemove-Malwarebytes' Anti-Malware_is1 - c:\program files\Malwarebytes' Anti-Malware\unins000.exe
AddRemove-SecureW2 EAP Suite - c:\program files\SecureW2\Uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2013-11-29 10:43
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-1650648295-756086892-3871820350-1000\Software\AppDataLow\Software\Conduit\Community Alerts\Settings\Locales\e*n**<ûXÚb]
"LP_LastUpdateTime"="0"
"LP_LastCheckTime"=dword:501065e9
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'lsass.exe'(452)
c:\program files\Acer Bio Protection\PwdFilter.dll
.
Zeit der Fertigstellung: 2013-11-29 10:45:43
ComboFix-quarantined-files.txt 2013-11-29 09:45
.
Vor Suchlauf: 26 Verzeichnis(se), 52.222.861.312 Bytes frei
Nach Suchlauf: 30 Verzeichnis(se), 52.633.219.072 Bytes frei
.
- - End Of File - - 39A01C22CA120E7FE7D4CC2FC4CD5728
5586EABCC0D095DB340D873E2B236896
|
|
30.11.2013, 13:59
| #4 |
| /// the machine /// TB-Ausbilder | Vista- nach booten Absturz mit weißem Bild Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Vista- nach booten Absturz mit weißem Bild |
| 4d36e972-e325-11ce-bfc1-08002be10318, absturz, acer aspire, antivir, antivirus, avira, bonjour, booten, desktop, einstellungen, error, flash player, frst log, ftp, helper, home, hängen, mozilla, performance, plug-in, popup, realtek, registry, rundll, security, software, starten, svchost.exe, vista, weißer bildschirm nach systemstart, windows, wsearch |
Linear-Darstellung
