Hallo,

seit einiger Zeit ist der PC meiner Schwiegermutter extrem langsam. Darauf sind fast keine Daten, wird nur zum Surfen und Mailschreiben und für Fotos verwendet.

Virenscanner (Avira) hat nicht angeschlagen, aber ich habe auch nicht gescannt.
Folgende zwei Prozesse ohne Benutzer und Beschreibung sind im Taskmanager zu sehen:
csrss.exe
winlogon.exe
Sie können auch nicht beendet werden.

Da fast keine Daten drauf sind, habe ich diese gesichert und den PC auf Werkszustand (Win 7) von mitgelieferter Backup-Partition zurückgesetzt. Die zwei Prozesse sind immer noch da. Es sind noch keine Windows Updates installiert. Ich lasse den Rechner jetzt laufen und hoffe, dass sich diese UPdates in der Zwischenzeit nicht von alleine installieren.

Hier sind die Logfiles:
defogger_disable.txt

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:51 on 07/12/2014 (Admin)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

FRST.txt

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-12-2014 01
Ran by Admin (administrator) on MONIKAPC on 07-12-2014 13:53:48
Running from C:\Users\Admin\Downloads
Loaded Profile: Admin (Available profiles: Admin)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Dell, Inc.) C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\Titanium\TiMiniService.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\Titanium\TiResumeSrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\WINDOWS\System32\dllhost.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe
() C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
(Microsoft Corporation) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(Intel Corporation) C:\WINDOWS\System32\igfxtray.exe
(Intel Corporation) C:\WINDOWS\System32\hkcmd.exe
(Intel Corporation) C:\WINDOWS\System32\igfxpers.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
() C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
(Microsoft Corporation) C:\WINDOWS\System32\taskmgr.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\BingBar.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\BingApp.exe
(Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_11_2_202_228_ActiveX.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE
(Dell Products, LP.) C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe
() C:\Users\Admin\Downloads\Defogger.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [VizorHtmlDialog.exe] => C:\Program Files\Trend Micro\Titanium\UIFramework\VizorHtmlDialog.exe [1139992 2011-05-21] (Trend Micro Inc.)
HKLM\...\Run: [Trend Micro Client Framework] => C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe [192520 2011-05-21] (Trend Micro Inc.)
HKLM\...\Run: [Trend Micro Titanium] => C:\Program Files\Trend Micro\Titanium\VizorShortCut.exe [328400 2011-05-21] (Trend Micro Inc.)
HKLM-x32\...\Run: [Dell DataSafe Online] => C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe [1117528 2010-08-25] (Dell, Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [36760 2010-10-25] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [821144 2010-10-25] (Adobe Systems Inc.)
HKLM-x32\...\Run: [RoxWatchTray] => C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [240112 2010-11-25] (Sonic Solutions)
HKLM-x32\...\Run: [Desktop Disc Tool] => C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe [514544 2010-11-17] ()
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1942581463-3501322674-2157282599-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www1.euro.dell.com/content/default.aspx?c=at&l=de&s=gen
HKU\S-1-5-21-1942581463-3501322674-2157282599-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www1.euro.dell.com/content/default.aspx?c=at&l=de&s=gen
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM -> DefaultScope {3703AF7C-E5D8-4EA7-B5A7-9F0C2761B154} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLSDF8&pc=MDDR&src=IE-SearchBox
SearchScopes: HKLM -> {3703AF7C-E5D8-4EA7-B5A7-9F0C2761B154} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLSDF8&pc=MDDR&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {3703AF7C-E5D8-4EA7-B5A7-9F0C2761B154} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLSDF8&pc=MDDR&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {3703AF7C-E5D8-4EA7-B5A7-9F0C2761B154} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLSDF8&pc=MDDR&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1942581463-3501322674-2157282599-1001 -> DefaultScope {3703AF7C-E5D8-4EA7-B5A7-9F0C2761B154} URL = 
BHO: TmIEPlugInBHO Class -> {1CA1377B-DC1D-4A52-9585-6E06050FAC53} -> C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1464\6.6.1077\TmIEPlg.dll (Trend Micro Inc.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: TmBpIeBHO Class -> {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} -> C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe64.dll (Trend Micro Inc.)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: TmIEPlugInBHO Class -> {1CA1377B-DC1D-4A52-9585-6E06050FAC53} -> C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1464\6.6.1077\TmIEPlg32.dll (Trend Micro Inc.)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: TmBpIeBHO Class -> {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} -> C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll (Trend Micro Inc.)
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKU\S-1-5-21-1942581463-3501322674-2157282599-1001 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe64.dll (Trend Micro Inc.)
Handler-x32: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll (Trend Micro Inc.)
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1464\6.6.1077\TmIEPlg.dll (Trend Micro Inc.)
Handler-x32: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1464\6.6.1077\TmIEPlg32.dll (Trend Micro Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2012-07-12]
FF HKLM-x32\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1464\6.6.1077\firefoxextension
FF Extension: Trend Micro NSC Firefox Extension - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1464\6.6.1077\firefoxextension [2012-07-12]

Chrome: 
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 DellDigitalDelivery; c:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe [166912 2012-04-10] (Dell Products, LP.) [File not signed]
R2 TiMiniService; C:\Program Files\Trend Micro\Titanium\TiMiniService.exe [244440 2011-05-21] (Trend Micro Inc.)
S3 Amsp; "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=rb -dt=60000 [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 tmactmon; C:\Windows\System32\DRIVERS\tmactmon.sys [90896 2011-05-21] (Trend Micro Inc.)
R2 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [144656 2011-05-21] (Trend Micro Inc.)
R2 tmevtmgr; C:\Windows\System32\DRIVERS\tmevtmgr.sys [69392 2011-05-21] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [105552 2011-05-21] (Trend Micro Inc.)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-07 13:53 - 2014-12-07 13:53 - 00010924 _____ () C:\Users\Admin\Downloads\FRST.txt
2014-12-07 13:53 - 2014-12-07 13:53 - 00000000 ____D () C:\FRST
2014-12-07 13:52 - 2014-12-07 13:52 - 02119680 _____ (Farbar) C:\Users\Admin\Downloads\FRST64.exe
2014-12-07 13:51 - 2014-12-07 13:51 - 00000472 _____ () C:\Users\Admin\Downloads\defogger_disable.log
2014-12-07 13:51 - 2014-12-07 13:51 - 00000000 _____ () C:\Users\Admin\defogger_reenable
2014-12-07 13:50 - 2014-12-07 13:50 - 00050477 _____ () C:\Users\Admin\Downloads\Defogger.exe
2014-12-07 13:43 - 2014-12-07 13:43 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Macromedia
2014-12-07 13:41 - 2014-12-07 13:43 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Adobe
2014-12-07 13:41 - 2014-12-07 13:41 - 00001505 _____ () C:\Users\Admin\Desktop\Trend Micro Titanium Internet Security.lnk
2014-12-07 13:41 - 2014-12-07 13:41 - 00001411 _____ () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2014-12-07 13:41 - 2014-12-07 13:41 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Roxio
2014-12-07 13:41 - 2014-12-07 13:41 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Trend Micro Titanium Internet Security
2014-12-07 13:41 - 2014-12-07 13:41 - 00000000 ____D () C:\Users\Admin\AppData\Local\Adobe
2014-12-07 13:40 - 2014-12-07 13:41 - 00001445 _____ () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-12-07 13:40 - 2014-12-07 13:40 - 00000000 ____D () C:\Users\Admin\AppData\Local\VirtualStore
2014-12-07 13:38 - 2014-12-07 13:38 - 00074792 _____ () C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-12-07 13:38 - 2014-12-07 13:38 - 00001979 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hilfedokumentation von Dell.lnk
2014-12-07 13:38 - 2014-12-07 13:38 - 00000020 ___SH () C:\Users\Admin\ntuser.ini
2014-12-07 13:38 - 2014-12-07 13:38 - 00000000 _SHDL () C:\Users\Admin\Vorlagen
2014-12-07 13:38 - 2014-12-07 13:38 - 00000000 _SHDL () C:\Users\Admin\Startmenü
2014-12-07 13:38 - 2014-12-07 13:38 - 00000000 _SHDL () C:\Users\Admin\Netzwerkumgebung
2014-12-07 13:38 - 2014-12-07 13:38 - 00000000 _SHDL () C:\Users\Admin\Lokale Einstellungen
2014-12-07 13:38 - 2014-12-07 13:38 - 00000000 _SHDL () C:\Users\Admin\Eigene Dateien
2014-12-07 13:38 - 2014-12-07 13:38 - 00000000 _SHDL () C:\Users\Admin\Druckumgebung
2014-12-07 13:38 - 2014-12-07 13:38 - 00000000 _SHDL () C:\Users\Admin\Documents\Eigene Musik
2014-12-07 13:38 - 2014-12-07 13:38 - 00000000 _SHDL () C:\Users\Admin\Documents\Eigene Bilder
2014-12-07 13:38 - 2014-12-07 13:38 - 00000000 _SHDL () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-12-07 13:38 - 2014-12-07 13:38 - 00000000 _SHDL () C:\Users\Admin\AppData\Local\Verlauf
2014-12-07 13:38 - 2014-12-07 13:38 - 00000000 _SHDL () C:\Users\Admin\AppData\Local\Anwendungsdaten
2014-12-07 13:38 - 2014-12-07 13:38 - 00000000 _SHDL () C:\Users\Admin\Anwendungsdaten
2014-12-07 13:38 - 2014-12-07 13:38 - 00000000 ____D () C:\Users\Admin\AppData\Local\SoftThinks
2014-12-07 13:38 - 2014-05-14 17:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-12-07 13:38 - 2014-05-14 17:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-12-07 13:38 - 2014-05-14 17:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-12-07 13:38 - 2014-05-14 17:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-12-07 13:38 - 2014-05-14 17:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-12-07 13:38 - 2014-05-14 17:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-12-07 13:38 - 2014-05-14 17:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-12-07 13:38 - 2014-05-14 17:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-12-07 13:38 - 2014-05-14 17:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-12-07 13:38 - 2014-05-14 17:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-12-07 13:38 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-12-07 13:38 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-12-07 13:38 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-12-07 13:38 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-12-07 13:38 - 2009-07-14 05:54 - 00000000 ___RD () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-12-07 13:38 - 2009-07-14 05:49 - 00000000 ___RD () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-12-07 13:37 - 2014-12-07 13:51 - 00000000 ____D () C:\Users\Admin
2014-12-07 13:37 - 2014-12-07 13:37 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Musik
2014-12-07 13:37 - 2014-12-07 13:37 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Bilder
2014-12-07 13:37 - 2014-12-07 13:37 - 00000000 _SHDL () C:\Users\Default\Vorlagen
2014-12-07 13:37 - 2014-12-07 13:37 - 00000000 _SHDL () C:\Users\Default\Startmenü
2014-12-07 13:37 - 2014-12-07 13:37 - 00000000 _SHDL () C:\Users\Default\Netzwerkumgebung
2014-12-07 13:37 - 2014-12-07 13:37 - 00000000 _SHDL () C:\Users\Default\Lokale Einstellungen
2014-12-07 13:37 - 2014-12-07 13:37 - 00000000 _SHDL () C:\Users\Default\Eigene Dateien
2014-12-07 13:37 - 2014-12-07 13:37 - 00000000 _SHDL () C:\Users\Default\Druckumgebung
2014-12-07 13:37 - 2014-12-07 13:37 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Musik
2014-12-07 13:37 - 2014-12-07 13:37 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Bilder
2014-12-07 13:37 - 2014-12-07 13:37 - 00000000 _SHDL () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-12-07 13:37 - 2014-12-07 13:37 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Verlauf
2014-12-07 13:37 - 2014-12-07 13:37 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Anwendungsdaten
2014-12-07 13:37 - 2014-12-07 13:37 - 00000000 _SHDL () C:\Users\Default\Anwendungsdaten
2014-12-07 13:37 - 2014-12-07 13:37 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Musik
2014-12-07 13:37 - 2014-12-07 13:37 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Bilder
2014-12-07 13:37 - 2014-12-07 13:37 - 00000000 _SHDL () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-12-07 13:37 - 2014-12-07 13:37 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Verlauf
2014-12-07 13:37 - 2014-12-07 13:37 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Anwendungsdaten
2014-12-07 13:37 - 2014-12-07 13:37 - 00000000 _SHDL () C:\Programme
2014-12-07 13:37 - 2014-12-07 13:37 - 00000000 _SHDL () C:\ProgramData\Vorlagen
2014-12-07 13:37 - 2014-12-07 13:37 - 00000000 _SHDL () C:\ProgramData\Startmenü
2014-12-07 13:37 - 2014-12-07 13:37 - 00000000 _SHDL () C:\ProgramData\Microsoft\Windows\Start Menu\Programme
2014-12-07 13:37 - 2014-12-07 13:37 - 00000000 _SHDL () C:\ProgramData\Favoriten
2014-12-07 13:37 - 2014-12-07 13:37 - 00000000 _SHDL () C:\ProgramData\Dokumente
2014-12-07 13:37 - 2014-12-07 13:37 - 00000000 _SHDL () C:\ProgramData\Anwendungsdaten
2014-12-07 13:37 - 2014-12-07 13:37 - 00000000 _SHDL () C:\Program Files\Gemeinsame Dateien
2014-12-07 13:37 - 2014-12-07 13:37 - 00000000 _SHDL () C:\Dokumente und Einstellungen
2014-12-07 13:21 - 2014-12-07 13:21 - 00000000 ____D () C:\Windows\SMINST

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-07 13:52 - 2009-07-14 05:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-07 13:52 - 2009-07-14 05:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-07 13:42 - 2012-07-12 15:41 - 00017964 _____ () C:\Windows\RPSETUP.EXE.LOG
2014-12-07 13:42 - 2012-07-12 15:39 - 00000000 ____D () C:\Program Files (x86)\Dell DataSafe Local Backup
2014-12-07 13:41 - 2012-07-12 16:06 - 00000000 ____D () C:\ProgramData\Trend Micro
2014-12-07 13:41 - 2012-07-12 16:00 - 00000000 ____D () C:\ProgramData\Sonic
2014-12-07 13:39 - 2010-11-21 07:50 - 00708094 _____ () C:\Windows\system32\perfh007.dat
2014-12-07 13:39 - 2010-11-21 07:50 - 00151730 _____ () C:\Windows\system32\perfc007.dat
2014-12-07 13:39 - 2009-07-14 06:13 - 01643692 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-07 13:38 - 2012-07-12 16:10 - 00000000 ____D () C:\Users\Default\AppData\Local\SoftThinks
2014-12-07 13:38 - 2012-07-12 16:10 - 00000000 ____D () C:\Users\Default User\AppData\Local\SoftThinks
2014-12-07 13:38 - 2012-07-12 14:08 - 00988365 _____ () C:\Windows\WindowsUpdate.log
2014-12-07 13:38 - 2011-02-11 18:12 - 00000000 ____D () C:\dell
2014-12-07 13:37 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Public\Libraries
2014-12-07 13:37 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2014-12-07 13:37 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-12-07 13:37 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Windows NT
2014-12-07 13:36 - 2012-07-12 15:14 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-12-07 13:36 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-07 13:35 - 2011-02-11 18:13 - 00000000 ____D () C:\Windows\panther
2014-12-07 13:35 - 2009-07-14 05:51 - 00030647 _____ () C:\Windows\setupact.log

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2011-02-11 11:13

==================== End Of Log ============================
         

--- --- ---


Addition.txt

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-12-2014 01
Ran by Admin at 2014-12-07 13:55:16
Running from C:\Users\Admin\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Trend Micro Titanium Internet Security (Disabled - Up to date) {68F968AC-2AA0-091D-848C-803E83E35902}
AS: Trend Micro Titanium Internet Security (Disabled - Up to date) {D3988948-0C9A-0693-BE3C-BB4CF86413BF}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Acrobat X Standard - English, Français, Deutsch (HKLM-x32\...\{AC76BA86-1033-F400-BA7E-000000000005}) (Version: 10.0.0 - Adobe Systems)
Adobe Flash Player 11 ActiveX 64-bit (HKLM\...\Adobe Flash Player ActiveX) (Version: 11.2.202.228 - Adobe Systems Incorporated)
Adobe Reader X MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.0.0 - Adobe Systems Incorporated)
Bing Bar (HKLM-x32\...\{C28D96C0-6A90-459E-A077-A6706F4EC0FC}) (Version: 7.0.765.0 - Microsoft Corporation)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.50.4.0 - Conexant)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dell DataSafe Local Backup - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 9.4.67 - Dell Inc.)
Dell DataSafe Local Backup (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 9.4.67 - Dell Inc.)
Dell DataSafe Online (HKLM-x32\...\{7EC66A95-AC2D-4127-940B-0445A526AB2F}) (Version: 2.1.19634 - Dell)
Dell Digital Delivery (HKLM-x32\...\{9DDFE322-6BA0-4F90-8689-D98382492371}) (Version: 2.1.1002.0 - Dell Products, LP)
Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)
Dell Support Center (HKLM\...\Dell Support Center) (Version: 3.1.5907.16 - Dell Inc.)
Dell Support Center (Version: 3.1.5907.16 - PC-Doctor, Inc.) Hidden
DirectX 9 Runtime (x32 Version: 1.00.0000 - Sonic Solutions) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2291 - Intel Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.50401.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{820B6609-4C97-3A2B-B644-573B06A0F0CC}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
PhotoShowExpress (x32 Version: 2.0.063 - Sonic Solutions) Hidden
RBVirtualFolder64Inst (Version: 1.00.0000 - Roxio, Inc.) Hidden
Roxio Creator Starter (HKLM-x32\...\{6F0BBEFE-BE1C-419B-BA1F-D36C9E7915BC}) (Version: 12.1.77.0 - Roxio)
Roxio File Backup (Version: 1.3.2 - Roxio) Hidden
Sonic CinePlayer Decoder Pack (x32 Version: 4.3.0 - Sonic Solutions) Hidden
Trend Micro Titanium Internet Security (HKLM\...\{ABBD4BA8-6703-40D2-AB1E-5BB1F7DB49A4}) (Version: 3.1 - Trend Micro Inc.)
Trend Micro Titanium Internet Security (Version: 3.00 - Trend Micro Inc.) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {556B43C5-3063-40A6-8F6E-4D28F9FEA3C5} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-12] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2012-07-12 16:05 - 2011-05-21 09:01 - 00047104 _____ () C:\Program Files\Trend Micro\AMSP\boost_thread-vc80-mt-1_36.dll
2012-07-12 16:05 - 2011-05-21 09:01 - 00042496 _____ () C:\Program Files\Trend Micro\AMSP\boost_date_time-vc80-mt-1_36.dll
2012-07-12 15:40 - 2012-01-26 21:49 - 02751808 _____ () C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
2012-07-12 22:39 - 2011-01-27 16:11 - 00094208 _____ () C:\WINDOWS\System32\IccLibDll_x64.dll
2010-11-17 10:35 - 2010-11-17 10:35 - 00514544 _____ () C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
2014-12-07 13:50 - 2014-12-07 13:50 - 00050477 _____ () C:\Users\Admin\Downloads\Defogger.exe
2010-10-25 15:13 - 2010-10-25 15:13 - 00019968 _____ () C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Locale\de_DE\acrotray.deu
2010-11-24 22:44 - 2010-11-24 22:44 - 00375280 _____ () c:\program files (x86)\common files\roxio shared\dllshared\SQLite352.dll
2012-04-10 00:33 - 2012-04-10 00:33 - 00102912 _____ () c:\Program Files (x86)\Dell Digital Delivery\ServiceTagPlusPlus.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Admin (S-1-5-21-1942581463-3501322674-2157282599-1001 - Administrator - Enabled) => C:\Users\Admin
Administrator (S-1-5-21-1942581463-3501322674-2157282599-500 - Administrator - Disabled)
Gast (S-1-5-21-1942581463-3501322674-2157282599-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1942581463-3501322674-2157282599-1002 - Limited - Enabled)

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (12/07/2014 01:49:26 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )
Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.


System errors:
=============

Microsoft Office Sessions:
=========================
Error: (12/07/2014 01:49:26 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )
Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.


==================== Memory info =========================== 

Processor: Intel(R) Celeron(R) CPU G460 @ 1.80GHz
Percentage of memory in use: 66%
Total physical RAM: 1960.64 MB
Available physical RAM: 658.6 MB
Total Pagefile: 3921.29 MB
Available Pagefile: 2227.86 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:452.08 GB) (Free:432.98 GB) NTFS
Drive z: () (Fixed) (Total:0.04 GB) (Free:0.04 GB) FAT

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: 2D523100)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=13.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=452.1 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

Gmer.txt

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-12-07 14:10:39
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST500DM002-1BD142 rev.KC45 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\Admin\AppData\Local\Temp\uwloypod.sys


---- User code sections - GMER 2.1 ----

.text   c:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe[2244] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   0000000076571465 2 bytes [57, 76]
.text   c:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe[2244] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  00000000765714bb 2 bytes [57, 76]
.text   ...                                                                                                                              * 2

---- Threads - GMER 2.1 ----

Thread  C:\Windows\system32\winlogon.exe [452:516]                                                                                       000007fefd50a5e4
Thread  C:\Windows\system32\winlogon.exe [452:540]                                                                                       000007fefd50a5e4
Thread  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3448:3952]                                                           0000000076a27587
Thread  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3448:3968]                                                           000000006b780cb3
Thread  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3448:3972]                                                           0000000077352e25
Thread  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3448:3772]                                                           0000000077353e45
Thread  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3448:4604]                                                           0000000077353e45
Thread  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3448:1288]                                                           0000000077353e45

---- EOF - GMER 2.1 ----
         

Danke!!!

hi,

die beiden Prozesse sind normal.

Gewusst wie: Durchführen eines sauberen Neustarts in Windows

Bitte einen Clean Boot machen. Wenn das Problem dann weg ist, einzeln wieder Dienste aktivieren, dazwischen immer einen Reboot machen. Solange bis Du weißt welcher Dienst die Probleme macht.

Diesen dann hier benennen.