Hallo,

der Laptop von einem Freund ist von einem Virus befallen. Beim Starten von Windows ( Win 7)
sieht man nur einen weissen Bildschirm.

Abgesicherter Modus usw. funktioniert auch nicht, da der Rechner sofort herunterfährt.

Ich habe hier einige Themen mit ähnlichen Problemen durchgelesen und habe dann mit frst gescannt.

Hier der frst.txt, ich bitte um Hilfe. Vielen Dank im Voraus.

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2014 04
Ran by SYSTEM on MININT-POKQJ9U on 01-02-2014 21:57:08
Running from G:\
Windows 7 Home Premium (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.


The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2226280 2011-05-22] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2587944 2010-12-31] (ELAN Microelectronics Corp.)
HKLM\...\Run: [Setwallpaper] - c:\programdata\SetWallpaper.cmd
HKLM-x32\...\Run: [Nuance PDF Reader-reminder] - C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe [328992 2008-11-03] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [ASUSPRP] - C:\Program Files (x86)\ASUS\APRP\APRP.EXE [2018032 2011-04-12] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [ASUSWebStorage] - C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe [731472 2011-02-23] (ecareme)
HKLM-x32\...\Run: [SonicMasterTray] - C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe [984400 2010-07-09] (Virage Logic Corporation / Sonic Focus)
HKLM-x32\...\Run: [ATKOSD2] - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [5732992 2010-08-17] (ASUS)
HKLM-x32\...\Run: [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-10-07] (ASUS)
HKLM-x32\...\Run: [HControlUser] - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [Wireless Console 3] - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [2255360 2011-06-10] (ASUS)
HKLM-x32\...\Run: [UpdateLBPShortCut] - C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GoShortCut] - C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254696 2011-06-09] (Sun Microsystems, Inc.)
HKU\canpolat\...\Run: [Facebook Update] - C:\Users\canpolat\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-09-29] (Facebook Inc.)
HKU\canpolat\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19604072 2013-06-03] (Skype Technologies S.A.)
HKU\canpolat\...\Winlogon: [Shell] explorer.exe,C:\Users\canpolat\AppData\Roaming\skype.dat [106496 2014-01-17] () <==== ATTENTION 

==================== Services (Whitelisted) =================

S2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)
S2 Mobile Partner. RunOuc; C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe [246112 2012-11-17] ()

==================== Drivers (Whitelisted) ====================

S3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-01 21:56 - 2014-02-01 21:57 - 00000000 ____D () C:\FRST
2014-01-31 11:00 - 2014-01-31 11:00 - 00003224 ____N () C:\bootsqm.dat
2014-01-19 08:40 - 2013-11-26 02:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2014-01-19 07:54 - 2013-11-26 03:25 - 00267936 ____N (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe
2014-01-19 06:55 - 2014-01-19 07:07 - 00002872 _____ () C:\Windows\System32\TmInstall.log
2014-01-19 06:55 - 2014-01-19 06:55 - 00004280 _____ () C:\Windows\SysWOW64\TmInstall.log
2014-01-19 06:45 - 2014-01-19 06:51 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-01-17 16:13 - 2014-02-01 12:32 - 00000004 _____ () C:\Users\canpolat\AppData\Roaming\skype.ini
2014-01-17 16:01 - 2013-11-26 17:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbhub.sys
2014-01-17 16:01 - 2013-11-26 17:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbport.sys
2014-01-17 16:01 - 2013-11-26 17:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbccgp.sys
2014-01-17 16:01 - 2013-11-26 17:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbehci.sys
2014-01-17 16:01 - 2013-11-26 17:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbuhci.sys
2014-01-17 16:01 - 2013-11-26 17:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbohci.sys
2014-01-17 16:01 - 2013-11-26 17:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbd.sys

==================== One Month Modified Files and Folders =======

2014-02-01 21:57 - 2014-02-01 21:56 - 00000000 ____D () C:\FRST
2014-02-01 21:29 - 2013-03-02 05:57 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2014-02-01 21:29 - 2012-02-08 15:18 - 00000000 ____D () C:\ProgramData\P4G
2014-02-01 21:29 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\registration
2014-02-01 12:35 - 2009-07-13 21:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-01 12:35 - 2009-07-13 20:51 - 00172236 _____ () C:\Windows\setupact.log
2014-02-01 12:32 - 2014-01-17 16:13 - 00000004 _____ () C:\Users\canpolat\AppData\Roaming\skype.ini
2014-02-01 12:32 - 2011-04-12 18:33 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-01 12:31 - 2011-09-14 00:17 - 00000000 ____D () C:\users\canpolat
2014-02-01 12:12 - 2011-09-14 00:18 - 00000000 ___HD () C:\ASUS.DAT
2014-01-31 11:00 - 2014-01-31 11:00 - 00003224 ____N () C:\bootsqm.dat
2014-01-31 10:18 - 2011-07-13 21:11 - 01867256 _____ () C:\Windows\WindowsUpdate.log
2014-01-26 11:42 - 2013-03-20 03:54 - 00000000 ____D () C:\Users\canpolat\AppData\Roaming\Skype
2014-01-26 11:42 - 2011-03-17 03:52 - 00008768 _____ () C:\Windows\System32\perfh019.dat
2014-01-26 11:42 - 2011-03-17 03:52 - 00006674 _____ () C:\Windows\System32\perfc019.dat
2014-01-26 11:42 - 2011-02-18 21:02 - 00007706 _____ () C:\Windows\System32\perfh00D.dat
2014-01-26 11:42 - 2011-02-18 21:02 - 00006270 _____ () C:\Windows\System32\perfc00D.dat
2014-01-26 11:42 - 2011-02-18 20:56 - 00563416 _____ () C:\Windows\System32\perfh008.dat
2014-01-26 11:42 - 2011-02-18 20:56 - 00093422 _____ () C:\Windows\System32\perfc008.dat
2014-01-26 11:42 - 2011-02-18 20:51 - 00006414 _____ () C:\Windows\System32\prfh0404.dat
2014-01-26 11:42 - 2011-02-18 20:51 - 00006270 _____ () C:\Windows\System32\prfc0404.dat
2014-01-26 11:42 - 2011-02-18 20:45 - 00008680 _____ () C:\Windows\System32\prfh0816.dat
2014-01-26 11:42 - 2011-02-18 20:45 - 00006510 _____ () C:\Windows\System32\prfc0816.dat
2014-01-26 11:42 - 2011-02-18 20:40 - 00009070 _____ () C:\Windows\System32\perfh013.dat
2014-01-26 11:42 - 2011-02-18 20:40 - 00006648 _____ () C:\Windows\System32\perfc013.dat
2014-01-26 11:42 - 2011-02-18 20:35 - 00008758 _____ () C:\Windows\System32\perfh010.dat
2014-01-26 11:42 - 2011-02-18 20:35 - 00006430 _____ () C:\Windows\System32\perfc010.dat
2014-01-26 11:42 - 2011-02-18 20:29 - 00008890 _____ () C:\Windows\System32\perfh00C.dat
2014-01-26 11:42 - 2011-02-18 20:29 - 00006406 _____ () C:\Windows\System32\perfc00C.dat
2014-01-26 11:42 - 2011-02-18 20:24 - 00665812 _____ () C:\Windows\System32\perfh007.dat
2014-01-26 11:42 - 2011-02-18 20:24 - 00133992 _____ () C:\Windows\System32\perfc007.dat
2014-01-26 11:42 - 2011-02-18 20:19 - 00705100 _____ () C:\Windows\System32\perfh00A.dat
2014-01-26 11:42 - 2011-02-18 20:19 - 00141048 _____ () C:\Windows\System32\perfc00A.dat
2014-01-26 11:42 - 2009-07-13 21:13 - 03071028 _____ () C:\Windows\System32\PerfStringBackup.INI
2014-01-26 11:40 - 2009-07-13 20:45 - 00009696 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-26 11:40 - 2009-07-13 20:45 - 00009696 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-19 13:19 - 2009-07-13 20:45 - 00276600 _____ () C:\Windows\System32\FNTCACHE.DAT
2014-01-19 13:16 - 2013-11-26 02:30 - 00127066 _____ () C:\Windows\IE11_main.log
2014-01-19 13:09 - 2013-03-02 05:56 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-19 13:02 - 2011-04-12 18:33 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-19 12:19 - 2012-09-29 11:14 - 00000940 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2414324467-2871492347-4123017065-1001UA.job
2014-01-19 12:19 - 2012-09-29 11:14 - 00000918 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2414324467-2871492347-4123017065-1001Core.job
2014-01-19 07:07 - 2014-01-19 06:55 - 00002872 _____ () C:\Windows\System32\TmInstall.log
2014-01-19 06:57 - 2011-04-12 17:39 - 00168400 _____ () C:\Windows\PFRO.log
2014-01-19 06:55 - 2014-01-19 06:55 - 00004280 _____ () C:\Windows\SysWOW64\TmInstall.log
2014-01-19 06:54 - 2011-04-12 18:51 - 00000000 ____D () C:\ProgramData\Trend Micro
2014-01-19 06:51 - 2014-01-19 06:45 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-01-18 12:49 - 2013-08-21 10:34 - 00000000 ____D () C:\Windows\System32\MRT
2014-01-18 12:49 - 2011-10-23 10:19 - 86054176 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2014-01-17 16:08 - 2013-05-31 16:06 - 00106496 ____R () C:\Users\canpolat\AppData\Roaming\skype.dat
2014-01-04 15:02 - 2011-07-13 21:20 - 00000087 _____ () C:\setup.log

Files to move or delete:
====================
C:\Users\canpolat\AppData\Roaming\skype.dat
C:\Users\canpolat\AppData\Roaming\skype.ini


Some content of TEMP:
====================
C:\Users\canpolat\AppData\Local\Temp\devcon.exe


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2011-12-05 12:31:40
Restore point made on: 2011-12-05 12:31:54
Restore point made on: 2011-12-05 12:31:56
Restore point made on: 2011-12-05 12:31:56
Restore point made on: 2011-12-05 12:32:21
Restore point made on: 2011-12-05 12:32:23
Restore point made on: 2011-12-05 12:32:24
Restore point made on: 2013-12-23 01:11:47
Restore point made on: 2013-12-23 03:37:44
Restore point made on: 2013-12-23 13:48:18
Restore point made on: 2013-12-24 05:35:13
Restore point made on: 2013-12-26 02:38:51
Restore point made on: 2013-12-26 06:24:53
Restore point made on: 2013-12-27 09:48:54
Restore point made on: 2013-12-28 15:09:20
Restore point made on: 2014-01-02 14:09:28
Restore point made on: 2014-01-03 13:35:19
Restore point made on: 2014-01-04 10:20:40
Restore point made on: 2014-01-04 12:15:39
Restore point made on: 2014-01-05 23:59:38
Restore point made on: 2014-01-06 01:19:39
Restore point made on: 2014-01-07 04:51:31
Restore point made on: 2014-01-09 11:58:52
Restore point made on: 2014-01-09 13:44:34
Restore point made on: 2014-01-16 11:50:54
Restore point made on: 2014-01-18 12:49:08
Restore point made on: 2014-01-18 14:31:22
Restore point made on: 2014-01-19 13:12:54
Restore point made on: 2014-01-31 10:19:42

==================== Memory info =========================== 

Percentage of memory in use: 15%
Total physical RAM: 3691.66 MB
Available physical RAM: 3116.46 MB
Total Pagefile: 3689.81 MB
Available Pagefile: 3098.01 MB
Total Virtual: 8192 MB
Available Virtual: 8191.88 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:128.18 GB) (Free:31 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATA) (Fixed) (Total:144.91 GB) (Free:144.77 GB) NTFS
Drive g: (canp) (Removable) (Total:1.8 GB) (Free:1.76 GB) NTFS
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 0CD9B3F5)
Partition 1: (Not Active) - (Size=25 GB) - (Type=1C)
Partition 2: (Active) - (Size=128 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=145 GB) - (Type=OF Extended)

========================================================
Disk: 2 (Size: 2 GB) (Disk ID: 920FBFA0)
Partition 1: (Active) - (Size=2 GB) - (Type=07 NTFS)


LastRegBack: 2012-06-08 03:35

==================== End Of Log ============================
         

Hallo,

ist der Sperrbildschirm nach folgendem Fix weg?


Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

HKU\canpolat\...\Winlogon: [Shell] explorer.exe,C:\Users\canpolat\AppData\Roaming\skype.dat [106496 2014-01-17] () <==== ATTENTION 
C:\Users\canpolat\AppData\Roaming\skype.dat
C:\Users\canpolat\AppData\Roaming\skype.ini
         

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

• Starte deinen Rechner erneut in die Reparaturoptionen
• Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Vielen Dank. Windows startet wieder wie gewohnt.

Super Arbeit. DANKE!

Hier die Fixlog:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 01-02-2014 04
Ran by SYSTEM at 2014-02-02 22:01:06 Run:1
Running from G:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
HKU\canpolat\...\Winlogon: [Shell] explorer.exe,C:\Users\canpolat\AppData\Roaming\skype.dat [106496 2014-01-17] () <==== ATTENTION 
C:\Users\canpolat\AppData\Roaming\skype.dat
C:\Users\canpolat\AppData\Roaming\skype.ini
         
*****************

HKU\canpolat\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.
C:\Users\canpolat\AppData\Roaming\skype.dat => Moved successfully.
C:\Users\canpolat\AppData\Roaming\skype.ini => Moved successfully.

==== End of Fixlog ====
         

Verschiebe die frst64.exe vom USB-Stick auf den Desktop.

• Starte dann FRST.
• Setze bei Optional Scan den Haken bei Addition.txt und drücke Scan.
• Wenn der Scan abgeschlossen ist, werden zwei neue Logfiles FRST.txt und Addition.txt erstellt und auf dem Desktop gespeichert.
• Poste den Inhalt dieser beiden Logfiles bitte hier in deinen Thread.

Werde es erst heute nachmittag machen können. Werde es dann sofort posten. Danke für die Hilfe aharonov.

Alles klar.

Hallo nochmals,

habe jetzt den scan gemacht.




FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2014 04
Ran by canpolat (administrator) on CANPOLAT-PC on 03-02-2014 17:12:05
Running from C:\Users\canpolat\Documents
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(ASUSTeK Computer Inc.) C:\Windows\System32\FBAgent.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
() C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUS) C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe
(ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(ASUS) C:\Windows\AsScrPro.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
(Virage Logic Corporation / Sonic Focus) C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
(ASUS) C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2226280 2011-05-22] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2587944 2010-12-31] (ELAN Microelectronics Corp.)
HKLM\...\Run: [Setwallpaper] - c:\programdata\SetWallpaper.cmd
HKLM-x32\...\Run: [Nuance PDF Reader-reminder] - C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe [328992 2008-11-03] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [ASUSPRP] - C:\Program Files (x86)\ASUS\APRP\APRP.EXE [2018032 2011-04-13] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [ASUSWebStorage] - C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe [731472 2011-02-23] (ecareme)
HKLM-x32\...\Run: [SonicMasterTray] - C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe [984400 2010-07-10] (Virage Logic Corporation / Sonic Focus)
HKLM-x32\...\Run: [ATKOSD2] - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [5732992 2010-08-17] (ASUS)
HKLM-x32\...\Run: [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-10-07] (ASUS)
HKLM-x32\...\Run: [HControlUser] - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [Wireless Console 3] - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [2255360 2011-06-10] (ASUS)
HKLM-x32\...\Run: [UpdateLBPShortCut] - C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GoShortCut] - C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254696 2011-06-09] (Sun Microsystems, Inc.)
HKU\S-1-5-21-2414324467-2871492347-4123017065-1001\...\Run: [Facebook Update] - C:\Users\canpolat\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-09-29] (Facebook Inc.)
HKU\S-1-5-21-2414324467-2871492347-4123017065-1001\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19604072 2013-06-03] (Skype Technologies S.A.)
HKU\S-1-5-21-2414324467-2871492347-4123017065-1001\...\MountPoints2: F - F:\AutoRun.exe
HKU\S-1-5-21-2414324467-2871492347-4123017065-1001\...\MountPoints2: H - H:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-2414324467-2871492347-4123017065-1001\...\MountPoints2: {22339124-30db-11e2-acef-f46d04687dfb} - F:\AutoRun.exe
HKU\S-1-5-21-2414324467-2871492347-4123017065-1001\...\MountPoints2: {22339135-30db-11e2-acef-f46d04687dfb} - F:\AutoRun.exe
HKU\S-1-5-21-2414324467-2871492347-4123017065-1001\...\MountPoints2: {4a73b1e3-811f-11e3-8086-f46d04687dfb} - H:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-2414324467-2871492347-4123017065-1001\...\MountPoints2: {4f412955-2ecb-11e3-8625-f46d04687dfb} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-2414324467-2871492347-4123017065-1001\...\MountPoints2: {60e49526-34a7-11e2-aaca-f46d04687dfb} - F:\Startme.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll (Google Inc.)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
BHO-x32: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (Google Inc.)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.185.1
Tcpip\..\Interfaces\{ED95026B-6C77-4BDB-9FA1-F6FA418BB346}: [NameServer]193.189.244.225 193.189.244.206

Chrome: 
=======
CHR HomePage: hxxp://de.msn.com/?pc=UP21&ocid=UP21DHP&dt=032013
CHR DefaultSearchKeyword: bing.com
CHR DefaultSearchProvider: Bing
CHR DefaultSearchURL: hxxp://www.bing.com/search?setmkt=de-DE&q={searchTerms}
CHR DefaultNewTabURL: 
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.102\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.102\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.102\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.290.11) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U29) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Plugin: (Zeon Plus) - C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Extension: (YouTube) - C:\Users\canpolat\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2011-12-15]
CHR Extension: (Google-Suche) - C:\Users\canpolat\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2011-12-15]
CHR Extension: (Google Wallet) - C:\Users\canpolat\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-25]
CHR Extension: (Google Mail) - C:\Users\canpolat\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2011-12-15]

==================== Services (Whitelisted) =================

R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)
S2 Mobile Partner. RunOuc; C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe [246112 2012-11-17] ()

==================== Drivers (Whitelisted) ====================

R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-03 17:12 - 2014-02-03 17:12 - 00012856 _____ () C:\Users\canpolat\Documents\FRST.txt
2014-02-03 17:11 - 2014-02-01 21:14 - 02080256 _____ (Farbar) C:\Users\canpolat\Documents\FRST64.exe
2014-02-03 14:34 - 2014-02-03 14:34 - 00000000 ____D () C:\Users\canpolat\Desktop\ses
2014-02-03 14:21 - 2014-02-03 14:21 - 00000000 ____D () C:\Users\canpolat\AppData\Local\{421A2A4B-FD7A-4758-9DCD-F93CBCFBFF11}
2014-02-02 06:56 - 2014-02-03 17:12 - 00000000 ____D () C:\FRST
2014-02-01 22:28 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-31 20:00 - 2014-01-31 20:00 - 00003224 ____N () C:\bootsqm.dat
2014-01-19 17:40 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-19 16:54 - 2014-01-16 09:59 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-01-19 15:55 - 2014-01-19 16:07 - 00002872 _____ () C:\Windows\system32\TmInstall.log
2014-01-19 15:55 - 2014-01-19 15:55 - 00004280 _____ () C:\Windows\SysWOW64\TmInstall.log
2014-01-19 15:45 - 2014-01-19 15:51 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-01-18 01:01 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-18 01:01 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-18 01:01 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-18 01:01 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-18 01:01 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-18 01:01 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-18 01:01 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys

==================== One Month Modified Files and Folders =======

2014-02-03 17:12 - 2014-02-03 17:12 - 00012856 _____ () C:\Users\canpolat\Documents\FRST.txt
2014-02-03 17:12 - 2014-02-02 06:56 - 00000000 ____D () C:\FRST
2014-02-03 17:12 - 2009-07-14 05:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-03 17:12 - 2009-07-14 05:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-03 17:11 - 2011-03-17 12:52 - 00008768 _____ () C:\Windows\system32\perfh019.dat
2014-02-03 17:11 - 2011-03-17 12:52 - 00006674 _____ () C:\Windows\system32\perfc019.dat
2014-02-03 17:11 - 2011-02-19 06:02 - 00007706 _____ () C:\Windows\system32\perfh00D.dat
2014-02-03 17:11 - 2011-02-19 06:02 - 00006270 _____ () C:\Windows\system32\perfc00D.dat
2014-02-03 17:11 - 2011-02-19 05:56 - 00563416 _____ () C:\Windows\system32\perfh008.dat
2014-02-03 17:11 - 2011-02-19 05:56 - 00093422 _____ () C:\Windows\system32\perfc008.dat
2014-02-03 17:11 - 2011-02-19 05:51 - 00006414 _____ () C:\Windows\system32\prfh0404.dat
2014-02-03 17:11 - 2011-02-19 05:51 - 00006270 _____ () C:\Windows\system32\prfc0404.dat
2014-02-03 17:11 - 2011-02-19 05:45 - 00008680 _____ () C:\Windows\system32\prfh0816.dat
2014-02-03 17:11 - 2011-02-19 05:45 - 00006510 _____ () C:\Windows\system32\prfc0816.dat
2014-02-03 17:11 - 2011-02-19 05:40 - 00009070 _____ () C:\Windows\system32\perfh013.dat
2014-02-03 17:11 - 2011-02-19 05:40 - 00006648 _____ () C:\Windows\system32\perfc013.dat
2014-02-03 17:11 - 2011-02-19 05:35 - 00008758 _____ () C:\Windows\system32\perfh010.dat
2014-02-03 17:11 - 2011-02-19 05:35 - 00006430 _____ () C:\Windows\system32\perfc010.dat
2014-02-03 17:11 - 2011-02-19 05:29 - 00008890 _____ () C:\Windows\system32\perfh00C.dat
2014-02-03 17:11 - 2011-02-19 05:29 - 00006406 _____ () C:\Windows\system32\perfc00C.dat
2014-02-03 17:11 - 2011-02-19 05:24 - 00665812 _____ () C:\Windows\system32\perfh007.dat
2014-02-03 17:11 - 2011-02-19 05:24 - 00133992 _____ () C:\Windows\system32\perfc007.dat
2014-02-03 17:11 - 2011-02-19 05:19 - 00705100 _____ () C:\Windows\system32\perfh00A.dat
2014-02-03 17:11 - 2011-02-19 05:19 - 00141048 _____ () C:\Windows\system32\perfc00A.dat
2014-02-03 17:11 - 2009-07-14 06:13 - 03071028 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-03 17:09 - 2013-03-02 14:56 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-03 17:08 - 2011-07-14 06:11 - 02090489 _____ () C:\Windows\WindowsUpdate.log
2014-02-03 17:06 - 2013-03-20 12:54 - 00000000 ____D () C:\Users\canpolat\AppData\Roaming\Skype
2014-02-03 17:05 - 2011-09-14 09:18 - 00000000 ___HD () C:\ASUS.DAT
2014-02-03 17:05 - 2011-04-13 03:33 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-03 17:05 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-03 17:04 - 2009-07-14 05:51 - 00173717 _____ () C:\Windows\setupact.log
2014-02-03 17:02 - 2011-04-13 03:33 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-03 15:19 - 2012-09-29 20:14 - 00000940 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2414324467-2871492347-4123017065-1001UA.job
2014-02-03 14:34 - 2014-02-03 14:34 - 00000000 ____D () C:\Users\canpolat\Desktop\ses
2014-02-03 14:21 - 2014-02-03 14:21 - 00000000 ____D () C:\Users\canpolat\AppData\Local\{421A2A4B-FD7A-4758-9DCD-F93CBCFBFF11}
2014-02-03 12:19 - 2011-09-17 20:25 - 00000000 ____D () C:\Users\canpolat\AppData\Local\Windows Live
2014-02-03 06:41 - 2013-11-26 11:30 - 00131324 _____ () C:\Windows\IE11_main.log
2014-02-02 06:29 - 2013-03-02 14:57 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2014-02-02 06:29 - 2012-02-09 00:18 - 00000000 ____D () C:\ProgramData\P4G
2014-02-02 06:29 - 2009-07-14 08:44 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-02-02 06:29 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2014-02-01 21:31 - 2011-09-14 09:17 - 00000000 ____D () C:\Users\canpolat
2014-02-01 21:14 - 2014-02-03 17:11 - 02080256 _____ (Farbar) C:\Users\canpolat\Documents\FRST64.exe
2014-01-31 20:00 - 2014-01-31 20:00 - 00003224 ____N () C:\bootsqm.dat
2014-01-19 22:19 - 2009-07-14 05:45 - 00276600 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-01-19 21:19 - 2012-09-29 20:14 - 00000918 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2414324467-2871492347-4123017065-1001Core.job
2014-01-19 16:07 - 2014-01-19 15:55 - 00002872 _____ () C:\Windows\system32\TmInstall.log
2014-01-19 15:57 - 2011-04-13 02:39 - 00168400 _____ () C:\Windows\PFRO.log
2014-01-19 15:55 - 2014-01-19 15:55 - 00004280 _____ () C:\Windows\SysWOW64\TmInstall.log
2014-01-19 15:54 - 2011-04-13 03:51 - 00000000 ____D () C:\ProgramData\Trend Micro
2014-01-19 15:51 - 2014-01-19 15:45 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-01-18 21:49 - 2013-08-21 19:34 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-18 21:49 - 2011-10-23 19:19 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-16 09:59 - 2014-01-19 16:54 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-01-05 00:02 - 2011-07-14 06:20 - 00000087 _____ () C:\setup.log

Some content of TEMP:
====================
C:\Users\canpolat\AppData\Local\Temp\devcon.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2012-06-08 12:35

==================== End Of Log ============================
         

--- --- ---

--- --- ---




Hier die Addition:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-02-2014 04
Ran by canpolat at 2014-02-03 17:14:49
Running from C:\Users\canpolat\Documents
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

7-Zip 9.20 (x32 Version:  - )
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (Version: 3.0.838.0 - Advanced Micro Devices, Inc.)
ASUS AI Recovery (x32 Version: 1.0.19 - ASUS)
ASUS FancyStart (x32 Version: 1.1.0 - ASUSTeK Computer Inc.)
ASUS LifeFrame3 (x32 Version: 3.0.27 - ASUS)
ASUS Live Update (x32 Version: 3.0.8 - ASUS)
ASUS Power4Gear Hybrid (Version: 1.1.50 - ASUS)
ASUS SmartLogon (x32 Version: 1.0.0011 - ASUS)
ASUS Virtual Camera (x32 Version: 1.0.21 - asus)
ASUS WebStorage (x32 Version: 3.0.84.161 - eCareme Technologies, Inc.)
ASUS_Screensaver (x32 Version:  - )
AsusVibe2.0 (x32 Version: 2.0.4.617 - ASUSTEK)
Atheros Client Installation Program (x32 Version: 7.0 - Atheros)
Atheros Client Installation Program (x32 Version: 9.0 - Atheros)
ATK Package (x32 Version: 1.0.0010 - ASUS)
Bing Bar (x32 Version: 7.0.610.0 - Microsoft Corporation)
Bookworm Deluxe (x32 Version:  - Oberon Media Inc.)
Catalyst Control Center InstallProxy (x32 Version: 2011.0713.1830.31376 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2011.0524.2351.41027 - ATI) Hidden
CCC Help Danish (x32 Version: 2011.0524.2351.41027 - ATI) Hidden
CCC Help German (x32 Version: 2011.0524.2351.41027 - ATI) Hidden
Cisco EAP-FAST Module (x32 Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (x32 Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (x32 Version: 1.1.6 - Cisco Systems, Inc.)
Complément Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Complemento Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Control ActiveX de Windows Live Mesh para conexiones remotas (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Contrôle ActiveX Windows Live Mesh pour connexions à distance (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Controlo ActiveX do Windows Live Mesh para Ligações Remotas (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Cooking Dash (x32 Version:  - Oberon Media Inc.)
CyberLink LabelPrint (x32 Version: 2.5.1908 - CyberLink Corp.)
CyberLink LabelPrint (x32 Version: 2.5.1908 - CyberLink Corp.) Hidden
CyberLink Power2Go (x32 Version: 6.1.3602c - CyberLink Corp.)
CyberLink Power2Go (x32 Version: 6.1.3602c - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
ETDWare PS/2-X64 8.0.5.1_WHQL (Version: 8.0.5.1 - ELAN Microelectronic Corp.)
Facebook Video Calling 2.0.0.447 (x32 Version: 2.0.447 - Skype Limited)
Fast Boot (Version: 1.0.9 - ASUS)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Game Park Console (x32 Version: 6.2.1.1 - Oberon Media, Inc.)
Google Chrome (x32 Version: 32.0.1700.102 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version:  - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Governor of Poker (x32 Version:  - Oberon Media Inc.)
Hotel Dash Suite Success (x32 Version:  - Oberon Media Inc.)
Java Auto Updater (x32 Version: 2.0.6.1 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 29 (x32 Version: 6.0.290 - Oracle)
Jewel Quest 3 (x32 Version:  - Oberon Media Inc.)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Luxor 3 (x32 Version:  - Oberon Media Inc.)
Mahjongg dimensions (x32 Version:  - Oberon Media Inc.)
McAfee Security Scan Plus (Version: 3.8.130.10 - McAfee, Inc.)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Messenger 分享元件 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (Version: 10.0.30319 - Microsoft Corporation)
Mobile Partner (x32 Version: 21.005.15.00.705 - Huawei Technologies Co.,Ltd)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
Nuance PDF Reader (x32 Version: 6.00.0041 - Nuance Communications, Inc.)
PC Inspector File Recovery (x32 Version: 4.0 - )
Plants vs Zombies (x32 Version:  - Oberon Media Inc.)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek Ethernet Controller Driver (x32 Version: 7.42.304.2011 - Realtek)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6373 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (x32 Version: 6.1.7600.30127 - Realtek Semiconductor Corp.)
Skype™ 6.5 (x32 Version: 6.5.158 - Skype Technologies S.A.)
Sonic Focus (x32 Version: 1.0.0.4 - Synopsys )
syncables desktop SE (x32 Version: 5.5.746.11492 - syncables)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
VLC media player 1.1.11 (x32 Version: 1.1.11 - VideoLAN)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Family Safety (Version: 15.4.3555.0308 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3555.0308 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Корпорация Майкрософт) Hidden
Windows Live Messenger Companion Core (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 影像中心 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 程式集 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WinFlash (x32 Version: 2.31.1 - ASUS)
Wireless Console 3 (x32 Version: 3.0.21 - ASUS)
World of Goo (x32 Version:  - Oberon Media Inc.)
Στοιχείο ελέγχου ActiveX του Windows Live Mesh για απομακρυσμένες συνδέσεις (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Компаньон Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Элемент управления Windows Live Mesh ActiveX для удаленных подключений (x32 Version: 15.4.5722.2 - Microsoft Corporation)
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
מסייע Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
פקד ActiveX של Windows Live Mesh עבור חיבורים מרוחקים (x32 Version: 15.4.5722.2 - Microsoft Corporation)
بريد Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
عنصر تحكم ActiveX الخاص بـ Windows Live Mesh للاتصالات البعيدة (x32 Version: 15.4.5722.2 - Microsoft Corporation)
معرض صور Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
適用遠端連線的 Windows Live Mesh ActiveX 控制項 (x32 Version: 15.4.5722.2 - Microsoft Corporation)

==================== Restore Points  =========================

24-12-2013 13:35:06 Windows Update
26-12-2013 10:38:45 Windows Update
26-12-2013 14:24:46 Windows Update
27-12-2013 17:48:45 Windows Update
28-12-2013 23:09:14 Windows Update
02-01-2014 22:09:13 Windows Update
03-01-2014 21:35:11 Windows Update
04-01-2014 18:20:33 Windows Update
04-01-2014 20:15:33 Windows Update
06-01-2014 07:59:29 Windows Update
06-01-2014 09:19:33 Windows Update
07-01-2014 12:51:21 Windows Update
09-01-2014 19:58:45 Windows Update
09-01-2014 21:44:27 Windows Update
16-01-2014 19:50:47 Windows Update
18-01-2014 20:49:01 Windows Update
18-01-2014 22:31:16 Windows Update
19-01-2014 21:12:48 Windows Update
31-01-2014 18:19:33 Windows Update
02-02-2014 14:31:40 Windows Update
03-02-2014 05:38:40 Windows Update

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {075BEB15-0D7B-48E5-AAE3-C51C3D668D2D} - System32\Tasks\ASUS P4G => C:\Program Files\ASUS\P4G\BatteryLife.exe [2011-11-15] (ASUS)
Task: {311C2B55-6A3F-4100-94A2-171E61060A58} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-11] (Adobe Systems Incorporated)
Task: {40C50B4B-F486-4C6F-B36E-F845BEA3A5CF} - System32\Tasks\ASUS Live Update => C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe [2011-11-17] (ASUSTeK Computer Inc.)
Task: {473F607E-3B17-49C2-A812-D57EFF1B1255} - System32\Tasks\ASUS SmartLogon Console Sensor => C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe [2010-11-15] (ASUS)
Task: {60F398C6-F009-4FEB-B4EF-955537F134F2} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-04-13] (Google Inc.)
Task: {6FF55545-27E5-42A1-BA10-08159518C0C4} - System32\Tasks\ATKOSD2 => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [2010-08-17] (ASUS)
Task: {84A77F86-B445-48DE-B57F-B89B693CD5C2} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-04-13] (Google Inc.)
Task: {A2FD8D7A-B039-45D3-9ABA-CA7FDF807603} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2414324467-2871492347-4123017065-1001UA => C:\Users\canpolat\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-09-29] (Facebook Inc.)
Task: {C7566057-D7CC-4C11-BD34-F1DF0D8B4973} - System32\Tasks\AIRecoveryRemind => C:\Program Files (x86)\ASUS\AI Recovery\AIRecoveryRemind.exe [2011-11-24] (ASUSTek Computer Inc.)
Task: {F782359E-F60F-450A-91B9-00F23FB44250} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2414324467-2871492347-4123017065-1001Core => C:\Users\canpolat\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-09-29] (Facebook Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2414324467-2871492347-4123017065-1001Core.job => C:\Users\canpolat\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2414324467-2871492347-4123017065-1001UA.job => C:\Users\canpolat\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2010-07-14 16:11 - 2010-07-14 16:11 - 00031360 _____ () C:\Program Files\ASUS\P4G\DevMng.dll
2012-11-17 18:28 - 2012-11-17 18:26 - 00011362 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\mingwm10.dll
2012-11-17 18:28 - 2012-11-17 18:26 - 00043008 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\libgcc_s_dw2-1.dll
2012-11-17 18:28 - 2012-11-17 18:26 - 02415104 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtCore4.dll
2012-11-17 18:28 - 2012-11-17 18:26 - 01148416 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtNetwork4.dll
2012-11-17 18:28 - 2012-11-17 18:26 - 00384512 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QueryStrategy.dll
2012-11-17 18:28 - 2012-11-17 18:26 - 00398336 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtXml4.dll
2011-11-17 11:33 - 2011-11-17 11:33 - 00209920 _____ () C:\Program Files (x86)\ASUS\ASUS Live Update\alvupdt.dll
2009-11-02 22:20 - 2009-11-02 22:20 - 00619816 ____N () C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
2009-11-02 22:23 - 2009-11-02 22:23 - 00013096 ____N () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
2011-06-10 18:49 - 2011-06-10 18:49 - 01163264 _____ () C:\Program Files (x86)\ASUS\Wireless Console 3\acAuth.dll
2014-02-03 06:44 - 2014-01-23 06:56 - 00715544 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.102\libglesv2.dll
2014-02-03 06:44 - 2014-01-23 06:56 - 00100120 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.102\libegl.dll
2014-02-03 06:44 - 2014-01-23 06:56 - 04055320 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.102\pdf.dll
2014-02-03 06:44 - 2014-01-23 06:57 - 00399640 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.102\ppGoogleNaClPluginChrome.dll
2014-02-03 06:43 - 2014-01-23 06:55 - 01634584 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.102\ffmpegsumo.dll
2014-02-03 06:44 - 2014-01-23 06:56 - 13615896 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.102\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/03/2014 06:38:45 AM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddCoreCsiFiles : GetNextFileMapContent() failed.

System Error:
Falscher Parameter.
.

Error: (02/03/2014 06:38:40 AM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddCoreCsiFiles : GetNextFileMapContent() failed.

System Error:
Falscher Parameter.
.

Error: (02/02/2014 03:31:44 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddCoreCsiFiles : GetNextFileMapContent() failed.

System Error:
Falscher Parameter.
.

Error: (02/02/2014 03:31:39 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddCoreCsiFiles : GetNextFileMapContent() failed.

System Error:
Falscher Parameter.
.

Error: (02/01/2014 09:31:56 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeb033f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000001049
ID des fehlerhaften Prozesses: 0x714
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3

Error: (02/01/2014 08:49:39 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521eaf24
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000003fefc
ID des fehlerhaften Prozesses: 0xb28
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3

Error: (01/31/2014 08:05:47 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521eaf24
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000002b0e
ID des fehlerhaften Prozesses: 0x67c
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3

Error: (01/31/2014 08:01:28 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521eaf24
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000002b0e
ID des fehlerhaften Prozesses: 0x680
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3

Error: (01/31/2014 07:19:41 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddCoreCsiFiles : GetNextFileMapContent() failed.

System Error:
Falscher Parameter.
.

Error: (01/31/2014 07:19:32 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddCoreCsiFiles : GetNextFileMapContent() failed.

System Error:
Falscher Parameter.
.


System errors:
=============
Error: (02/03/2014 05:05:10 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Mobile Partner. OUC" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (02/03/2014 05:05:10 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Mobile Partner. OUC erreicht.

Error: (02/03/2014 05:02:38 PM) (Source: DCOM) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Error: (02/03/2014 11:10:42 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Mobile Partner. OUC" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (02/03/2014 11:10:42 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Mobile Partner. OUC erreicht.

Error: (02/03/2014 06:46:17 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Internet Explorer 11 für Windows 7 für x64-basierte Systeme

Error: (02/03/2014 06:46:08 AM) (Source: DCOM) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Error: (02/02/2014 10:07:43 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Google Update Service (gupdate)" wurde nicht richtig gestartet.

Error: (02/02/2014 10:03:34 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Mobile Partner. OUC" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (02/02/2014 10:03:34 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Mobile Partner. OUC erreicht.


Microsoft Office Sessions:
=========================
Error: (02/03/2014 06:38:45 AM) (Source: Microsoft-Windows-CAPI2)(User: )
Description: 
Details:
AddCoreCsiFiles : GetNextFileMapContent() failed.

System Error:
Falscher Parameter.

Error: (02/03/2014 06:38:40 AM) (Source: Microsoft-Windows-CAPI2)(User: )
Description: 
Details:
AddCoreCsiFiles : GetNextFileMapContent() failed.

System Error:
Falscher Parameter.

Error: (02/02/2014 03:31:44 PM) (Source: Microsoft-Windows-CAPI2)(User: )
Description: 
Details:
AddCoreCsiFiles : GetNextFileMapContent() failed.

System Error:
Falscher Parameter.

Error: (02/02/2014 03:31:39 PM) (Source: Microsoft-Windows-CAPI2)(User: )
Description: 
Details:
AddCoreCsiFiles : GetNextFileMapContent() failed.

System Error:
Falscher Parameter.

Error: (02/01/2014 09:31:56 PM) (Source: Application Error)(User: )
Description: Explorer.EXE6.1.7601.175674d672ee4msvcrt.dll7.0.7601.177444eeb033fc0000005000000000000104971401cf1f8c94902155C:\Windows\Explorer.EXEC:\Windows\system32\msvcrt.dlle459a4c7-8b7f-11e3-81fa-f46d04687dfb

Error: (02/01/2014 08:49:39 PM) (Source: Application Error)(User: )
Description: Explorer.EXE6.1.7601.175674d672ee4ntdll.dll6.1.7601.18247521eaf24c0000005000000000003fefcb2801cf1f86b635c806C:\Windows\Explorer.EXEC:\Windows\SYSTEM32\ntdll.dllfbb4382b-8b79-11e3-8644-f46d04687dfb

Error: (01/31/2014 08:05:47 PM) (Source: Application Error)(User: )
Description: Explorer.EXE6.1.7601.175674d672ee4ntdll.dll6.1.7601.18247521eaf24c00000050000000000002b0e67c01cf1eb768f76466C:\Windows\Explorer.EXEC:\Windows\SYSTEM32\ntdll.dllb0aebd6c-8aaa-11e3-ab6f-f46d04687dfb

Error: (01/31/2014 08:01:28 PM) (Source: Application Error)(User: )
Description: Explorer.EXE6.1.7601.175674d672ee4ntdll.dll6.1.7601.18247521eaf24c00000050000000000002b0e68001cf1eb6d071cc9eC:\Windows\Explorer.EXEC:\Windows\SYSTEM32\ntdll.dll163c68cc-8aaa-11e3-befd-f46d04687dfb

Error: (01/31/2014 07:19:41 PM) (Source: Microsoft-Windows-CAPI2)(User: )
Description: 
Details:
AddCoreCsiFiles : GetNextFileMapContent() failed.

System Error:
Falscher Parameter.

Error: (01/31/2014 07:19:32 PM) (Source: Microsoft-Windows-CAPI2)(User: )
Description: 
Details:
AddCoreCsiFiles : GetNextFileMapContent() failed.

System Error:
Falscher Parameter.


==================== Memory info =========================== 

Percentage of memory in use: 40%
Total physical RAM: 3691.66 MB
Available physical RAM: 2187.29 MB
Total Pagefile: 7381.5 MB
Available Pagefile: 5570.05 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:128.18 GB) (Free:30.58 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATA) (Fixed) (Total:144.91 GB) (Free:144.77 GB) NTFS
Drive e: (Disk) (CDROM) (Total:0.81 GB) (Free:0 GB) CDFS
Drive f: (canp) (Removable) (Total:1.8 GB) (Free:1.76 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 0CD9B3F5)
Partition 1: (Not Active) - (Size=25 GB) - (Type=1C)
Partition 2: (Active) - (Size=128 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=145 GB) - (Type=OF Extended)

========================================================
Disk: 1 (Size: 2 GB) (Disk ID: 920FBFA0)
Partition 1: (Active) - (Size=2 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

Wie läuft der Rechner jetzt?

Hinweis: Kein Antivirenprogramm

Ich sehe in deinen Logfiles kein laufendes Antivirenprogramm mit Hintergrundwächter.

Das ist gefährlich. Auch wenn so ein Wächter niemals alle Bedrohungen abwehren kann, ist er doch ein wichtiger Bestandteil, um den Rechner sauber zu halten.
Downloade und installiere bitte ein Antivirenprogramm mit Hintergrundwächter.

Wenn du ein kommerzielles Produkt kaufen möchtest, kann ich dir Emsisoft empfehlen:

• Emsisoft Anti-Malware

Die Freeware-Version davon reicht aber nicht, denn die hat keinen Echtzeitschutz.

Bevorzugst du ein kostenloses Programm, dann sind das zwei mögliche Vorschläge:

• Avast! Free Antivirus
• Microsoft Security Essentials

Schritt 1

Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Schritt 2


ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Rechner funktioniert ganz normal.

Habe MSE runtergeladen und installiert.

Schritt 1 ist fertig.

Eset läuft seit knapp 2h und scannt immernoch weiter. Sobald es fertig ist poste ich den log.

Hier der Log von Malwarebytes Anti-Malware:

 Malwarebytes Anti-Malware  (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.02.03.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16750
canpolat :: CANPOLAT-PC [Administrator]

Schutz: Aktiviert

03.02.2014 18:05:02
mbam-log-2014-02-03 (18-05-02).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 213341
Laufzeit: 13 Minute(n), 11 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 5
C:\Users\canpolat\AppData\Local\Temp\Temp1_video_hd (1).zip\video_hd.zip (Malware.Packer.LDGA) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\canpolat\AppData\Local\Temp\Temp1_video_hd.zip\video_hd.exe (Malware.Packer.LDGA) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\canpolat\Downloads\video.hd.zip (Trojan.Kelihos.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\canpolat\Downloads\video_hd (1).zip (Malware.Packer.LDGA) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\canpolat\Downloads\video_hd.zip (Malware.Packer.LDGA) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         

ESET Log:

 Malwarebytes Anti-Malware  (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.02.03.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16750
canpolat :: CANPOLAT-PC [Administrator]

Schutz: Aktiviert

03.02.2014 18:05:02
mbam-log-2014-02-03 (18-05-02).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 213341
Laufzeit: 13 Minute(n), 11 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 5
C:\Users\canpolat\AppData\Local\Temp\Temp1_video_hd (1).zip\video_hd.zip (Malware.Packer.LDGA) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\canpolat\AppData\Local\Temp\Temp1_video_hd.zip\video_hd.exe (Malware.Packer.LDGA) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\canpolat\Downloads\video.hd.zip (Trojan.Kelihos.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\canpolat\Downloads\video_hd (1).zip (Malware.Packer.LDGA) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\canpolat\Downloads\video_hd.zip (Malware.Packer.LDGA) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         

Das ist 2 mal das MBAM-Log.

ups sry

Muss meinen Freund mal anrufen. Ermuss nochmal den Rechner bringen. Sobald ich es habe poste ich den log.

Danke nochmal für alles.

Ich habe jetzt den Rechner.

Also ich habe gestern als letztes mit Eset gescannt und danach eset wie in Schritt 2 gefordert gelöscht.

Habe aber den falschen log hier gepostet. Jetzt ist die log auch weg.


Ich denke ich muss Schritt 2 jetzt wiederholen.

Gab es denn Funde?

Ja es gab einen Fund. Ich erinnere mich nur an Kryptik .....Trojan.

Den neuen Scan kann ich erst morgen machen.

ok.

sorry war ein bisschen spät.
Vielen dank nochmal für alles.
Eset log:

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=3811eabcfefae74a8f816497f2ae5b02
# engine=16937
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-02-04 09:49:15
# local_time=2014-02-04 10:49:15 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 127352 143180405 0 0
# scanned=326004
# found=1
# cleaned=0
# scan_time=14765
sh=267E86D389216488FF24F1495370A8C02BE10088 ft=1 fh=3bc601663e756744 vn="a variant of Win32/Kryptik.BCLF trojan" ac=I fn="C:\FRST\Quarantine\skype.dat02-02-2014_22-01-06"