Frisches FRST, dann räumen wir noch auf

FRST.txt


FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by hardy (administrator) on HARDY-PC on 03-04-2015 19:48:16
Running from C:\Users\hardy\Desktop
Loaded Profiles: hardy (Available profiles: hardy & Gast)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
() C:\Program Files (x86)\Mobile Partner Manager\AssistantServices.exe
(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9643552 2009-12-11] (Realtek Semiconductor)
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [860192 2010-02-05] (Acer Incorporated)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5512912 2015-03-27] (Avast Software s.r.o.)
HKU\S-1-5-21-2271405061-675543758-3622770059-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30877280 2014-12-11] (Skype Technologies S.A.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (Avast Software s.r.o.)
ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec MyWinLocker\x64\psdprotect.dll (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec MyWinLocker\x86\psdprotect.dll (Egis Technology Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-2271405061-675543758-3622770059-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
AutoConfigURL: [.DEFAULT] => 4913522262749519
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-2271405061-675543758-3622770059-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/?pc=UP21&ocid=UP21DHP&dt=050913
HKU\S-1-5-21-2271405061-675543758-3622770059-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2271405061-675543758-3622770059-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE396
SearchScopes: HKU\S-1-5-21-2271405061-675543758-3622770059-1000 -> {74F210F1-1B34-40A6-905E-6F56D7CC7751} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE396
SearchScopes: HKU\S-1-5-21-2271405061-675543758-3622770059-1000 -> {AF951302-5F3D-4B2E-8C32-840D6BF7B6EA} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=685749&p={searchTerms}
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-03-27] (Avast Software s.r.o.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27] (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2015-03-29] (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-03-27] (Avast Software s.r.o.)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-29] (Oracle Corporation)
Toolbar: HKU\S-1-5-21-2271405061-675543758-3622770059-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
DPF: HKLM-x32 {20A60F0D-9AFA-4515-A0FD-83BD84642501} hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
DPF: HKLM-x32 {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} -  No File
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\hardy\AppData\Roaming\Mozilla\Firefox\Profiles\xr818ppx.default
FF SearchEngineOrder.3: Bing 
FF SelectedSearchEngine: Bing 
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll [2015-03-29] ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll [2015-03-29] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2012-08-08] ()
FF Plugin-x32: @java.com/DTPlugin,version=10.10.2 -> C:\Windows\SysWOW64\npDeployJava1.dll [2013-01-13] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-29] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Extension: Adblock Edge - C:\Users\hardy\AppData\Roaming\Mozilla\Firefox\Profiles\xr818ppx.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2013-08-09]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-03-27]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]

Chrome: 
=======
CHR HomePage: Profile 1 -> hxxp://de.msn.com/?pc=UP21&ocid=UP21DHP&dt=050913
CHR StartupUrls: Profile 1 -> "hxxp://www.google.de/"
CHR DefaultSuggestURL: Profile 1 -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Users\hardy\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U4) - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Java Deployment Toolkit 7.0.40.255) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Profile: C:\Users\hardy\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\hardy\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-03-02]
CHR Extension: (Google Search) - C:\Users\hardy\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-03-02]
CHR Extension: (Gmail) - C:\Users\hardy\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-03-02]
CHR Profile: C:\Users\hardy\AppData\Local\Google\Chrome\User Data\Profile 1
CHR Extension: (AdBlock) - C:\Users\hardy\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-04-01]
CHR Extension: (Avast Online Security) - C:\Users\hardy\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-03-27]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\hardy\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-15]
CHR Extension: (Google Wallet) - C:\Users\hardy\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx [2015-03-27]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-03-27]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

ATTENTION: => Could not perform signature verification. Cryptographic Service is not running.

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-03-27] (Avast Software s.r.o.)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4030800 2015-03-27] (Avast Software)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
S3 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305448 2009-12-02] (Egis Technology Inc.)
R2 UI Assistant Service; C:\Program Files (x86)\Mobile Partner Manager\AssistantServices.exe [247296 2010-01-13] ()
S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-03-27] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [88408 2015-03-27] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-03-27] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-03-27] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-03-27] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-03-27] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [136752 2015-03-27] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [271200 2015-03-27] ()
S3 HabuFltr; C:\Windows\System32\drivers\habu.sys [13696 2006-10-26] (Razer (Asia-Pacific) Pte Ltd)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-03-17] (Malwarebytes Corporation)
S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [102600 2009-06-18] (McAfee, Inc.)
R1 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [307400 2009-06-18] (McAfee, Inc.)
S3 mferkdk; C:\Windows\System32\drivers\mferkdk.sys [40904 2009-06-18] (McAfee, Inc.)
S3 mfesmfk; C:\Windows\System32\drivers\mfesmfk.sys [49480 2009-06-18] (McAfee, Inc.)
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [273824 2015-03-27] (Avast Software)
R2 {B154377D-700F-42cc-9474-23858FBDF4BD}; c:\Program Files (x86)\CyberLink\PowerDVD9\000.fcl [146928 2010-01-22] (CyberLink Corp.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-02 22:51 - 2015-04-02 22:51 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-HARDY-PC-Windows-7-Home-Premium-(64-bit).dat
2015-04-02 22:51 - 2015-04-02 22:51 - 00000000 ____D () C:\RegBackup
2015-04-02 10:46 - 2015-04-02 10:46 - 12840520 _____ () C:\Users\hardy\Downloads\tweaking.com_windows_repair_aio_setup (1).exe
2015-04-01 20:55 - 2015-04-02 10:47 - 00002163 _____ () C:\Users\hardy\Desktop\Tweaking.com - Windows Repair (All in One).lnk
2015-04-01 20:54 - 2015-04-01 20:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2015-04-01 20:54 - 2015-04-01 20:54 - 00000000 ____D () C:\Program Files (x86)\Tweaking.com
2015-04-01 20:53 - 2015-04-01 20:53 - 12840520 _____ () C:\Users\hardy\Downloads\tweaking.com_windows_repair_aio_setup.exe
2015-04-01 00:33 - 2015-04-01 00:34 - 40710624 _____ () C:\Users\hardy\Downloads\firefox_setup_37.0.exe
2015-04-01 00:31 - 2015-04-01 00:31 - 00243576 _____ () C:\Users\hardy\Downloads\Firefox Setup Stub 37.0.exe
2015-03-31 23:58 - 2015-03-31 23:58 - 00000987 _____ () C:\Users\hardy\Desktop\checkup.txt
2015-03-31 23:53 - 2015-03-31 23:53 - 00852607 _____ () C:\Users\hardy\Desktop\SecurityCheck.exe
2015-03-31 19:32 - 2015-03-31 19:32 - 02347384 _____ (ESET) C:\Users\hardy\Downloads\esetsmartinstaller_deu.exe
2015-03-30 22:36 - 2015-03-30 22:36 - 00078685 _____ () C:\Users\hardy\Desktop\JRT.txt
2015-03-30 22:30 - 2015-03-30 22:30 - 01389097 _____ (Thisisu) C:\Users\hardy\Desktop\JRT.exe
2015-03-30 21:29 - 2015-03-30 21:29 - 518674973 _____ () C:\Windows\MEMORY.DMP
2015-03-30 21:29 - 2015-03-30 21:29 - 00274872 _____ () C:\Windows\Minidump\033015-60731-01.dmp
2015-03-30 21:24 - 2015-03-30 22:26 - 00001232 _____ () C:\Users\hardy\Desktop\AdwCleaner[S2].txt
2015-03-30 21:07 - 2015-03-30 21:07 - 02208768 _____ () C:\Users\hardy\Downloads\AdwCleaner_4.200.exe
2015-03-30 21:02 - 2015-03-30 21:02 - 00001208 _____ () C:\Users\hardy\Desktop\mbam.txt
2015-03-30 20:09 - 2015-03-30 20:09 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\hardy\Downloads\mbam-setup-2.1.4.1018.exe
2015-03-30 14:23 - 2015-03-30 14:23 - 00107072 _____ () C:\ComboFix.txt
2015-03-30 11:02 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-03-30 11:02 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-03-30 11:02 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-03-30 11:02 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-03-30 11:02 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-03-30 11:02 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2015-03-30 11:02 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2015-03-30 11:02 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2015-03-30 11:01 - 2015-03-30 14:24 - 00000000 ____D () C:\Qoobox
2015-03-30 11:00 - 2015-03-30 11:58 - 00000000 ____D () C:\Windows\erdnt
2015-03-30 10:58 - 2015-03-30 10:59 - 05617067 ____R (Swearware) C:\Users\hardy\Desktop\ComboFix.exe
2015-03-30 10:49 - 2015-03-30 10:49 - 00001268 _____ () C:\Users\hardy\Desktop\Revo Uninstaller.lnk
2015-03-30 10:49 - 2015-03-30 10:49 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-03-30 10:48 - 2015-03-30 10:48 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\hardy\Downloads\revosetup95.exe
2015-03-29 20:56 - 2015-03-29 20:57 - 00039609 _____ () C:\Users\hardy\Desktop\Addition.txt
2015-03-29 20:55 - 2015-04-03 19:48 - 00018203 _____ () C:\Users\hardy\Desktop\FRST.txt
2015-03-29 20:54 - 2015-03-29 20:52 - 02095616 _____ (Farbar) C:\Users\hardy\Desktop\FRST64.exe
2015-03-29 20:52 - 2015-04-03 19:48 - 00000000 ____D () C:\FRST
2015-03-29 20:52 - 2015-03-29 20:52 - 02095616 _____ (Farbar) C:\Users\hardy\Downloads\FRST64.exe
2015-03-29 20:52 - 2015-03-29 20:52 - 00014506 _____ () C:\Users\hardy\Downloads\FRST.txt
2015-03-29 20:51 - 2015-03-29 20:51 - 01135104 _____ (Farbar) C:\Users\hardy\Downloads\FRST.exe
2015-03-29 18:27 - 2011-02-19 12:09 - 2527395840 _____ () C:\Users\hardy\Desktop\win7x86sp1.iso
2015-03-29 17:49 - 2015-04-02 23:13 - 00002034 _____ () C:\Windows\PFRO.log
2015-03-29 16:45 - 2015-03-29 16:45 - 02168320 _____ () C:\Users\hardy\Downloads\AdwCleaner_4.113 (1).exe
2015-03-29 16:34 - 2015-03-29 17:35 - 1300000000 _____ () C:\Users\hardy\Downloads\win7x86sp1.part1.exe
2015-03-29 16:34 - 2015-03-29 17:28 - 1011950210 _____ () C:\Users\hardy\Downloads\win7x86sp1.part2.rar
2015-03-29 16:28 - 2015-03-29 16:28 - 00243648 _____ () C:\Users\hardy\Downloads\Firefox Setup Stub 36.0.4.exe
2015-03-29 15:01 - 2015-04-03 19:30 - 00983386 _____ () C:\Windows\WindowsUpdate.log
2015-03-29 14:44 - 2015-04-03 19:07 - 00001064 _____ () C:\Windows\setupact.log
2015-03-29 14:44 - 2015-03-29 14:44 - 00000000 _____ () C:\Windows\setuperr.log
2015-03-29 13:35 - 2015-03-29 13:35 - 00020170 _____ () C:\Users\hardy\Documents\cc_20150329_133502.reg
2015-03-29 12:30 - 2013-01-13 12:49 - 00859072 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2015-03-29 12:30 - 2013-01-13 12:49 - 00779704 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2015-03-29 12:28 - 2015-03-29 12:49 - 00000000 ____D () C:\ProgramData\Oracle
2015-03-29 12:28 - 2015-03-29 12:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-03-28 01:34 - 2015-03-28 01:34 - 00183844 _____ () C:\Users\hardy\Documents\cc_20150328_003421.reg
2015-03-27 23:40 - 2015-03-27 23:40 - 00013380 _____ () C:\Users\hardy\Desktop\Minecraft (2).lnk
2015-03-27 16:19 - 2015-03-29 16:27 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-27 03:11 - 2015-03-27 03:11 - 00000000 ____D () C:\Users\hardy\AppData\Roaming\AVAST Software
2015-03-27 03:07 - 2015-04-02 10:22 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-03-27 03:07 - 2015-03-27 03:15 - 00000000 ____D () C:\Windows\SysWOW64\vbox
2015-03-27 03:07 - 2015-03-27 03:15 - 00000000 ____D () C:\Windows\system32\vbox
2015-03-27 03:07 - 2015-03-27 03:07 - 00001926 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-03-27 03:07 - 2015-03-27 03:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-03-27 03:06 - 2015-03-27 03:06 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys
2015-03-27 03:06 - 2015-03-27 03:06 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys
2015-03-27 03:06 - 2015-03-27 03:06 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe
2015-03-27 03:06 - 2015-03-27 03:06 - 00271200 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-03-27 03:06 - 2015-03-27 03:06 - 00136752 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswStm.sys
2015-03-27 03:06 - 2015-03-27 03:06 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr2.sys
2015-03-27 03:06 - 2015-03-27 03:06 - 00088408 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-03-27 03:06 - 2015-03-27 03:06 - 00065736 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-03-27 03:06 - 2015-03-27 03:06 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr
2015-03-27 03:06 - 2015-03-27 03:06 - 00029168 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-03-27 03:05 - 2015-03-27 03:05 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-03-27 03:05 - 2015-03-27 03:05 - 00000000 ____D () C:\Program Files\AVAST Software
2015-03-27 02:58 - 2015-03-27 03:02 - 150062624 _____ (Avast Software s.r.o.) C:\Users\hardy\Downloads\avast_free_antivirus_setup_10.2.2215.exe
2015-03-27 02:30 - 2015-03-27 02:30 - 00000000 ____D () C:\OETemp
2015-03-27 01:54 - 2015-03-30 21:14 - 00000000 ____D () C:\AdwCleaner
2015-03-27 01:10 - 2015-03-27 01:11 - 02168320 _____ () C:\Users\hardy\Downloads\AdwCleaner_4.113.exe
2015-03-27 01:00 - 2015-03-27 01:00 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\73A42603.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-03 19:45 - 2012-07-27 13:16 - 00000000 ____D () C:\Users\hardy\AppData\Roaming\Skype
2015-04-03 19:40 - 2013-03-12 20:12 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-04-03 19:19 - 2009-07-14 06:45 - 00025840 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-03 19:19 - 2009-07-14 06:45 - 00025840 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-03 19:16 - 2010-09-06 22:06 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-03 19:13 - 2011-12-25 22:47 - 01925120 ___SH () C:\Users\hardy\Desktop\Thumbs.db
2015-04-03 19:13 - 2010-08-09 19:08 - 00079608 _____ () C:\Users\hardy\AppData\Local\GDIPFONTCACHEV1.DAT
2015-04-03 19:08 - 2010-09-06 22:06 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-03 19:07 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-02 23:18 - 2010-04-08 18:55 - 00645354 _____ () C:\Windows\system32\perfh007.dat
2015-04-02 23:18 - 2010-04-08 18:55 - 00130892 _____ () C:\Windows\system32\perfc007.dat
2015-04-02 23:18 - 2009-07-14 07:13 - 01516610 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-02 23:13 - 2009-07-14 06:45 - 00334792 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-04-02 23:08 - 2009-07-14 04:34 - 00000546 _____ () C:\Windows\win.ini
2015-03-30 23:51 - 2013-12-30 13:24 - 01594964 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-03-30 21:29 - 2013-09-20 10:14 - 00000000 ____D () C:\Windows\Minidump
2015-03-30 20:13 - 2014-09-10 12:05 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-30 20:12 - 2014-09-10 12:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-03-30 20:12 - 2014-09-10 12:02 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-03-30 20:12 - 2012-08-05 09:24 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-03-30 14:23 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2015-03-30 11:45 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2015-03-30 11:45 - 2009-07-14 04:34 - 00000027 _____ () C:\Windows\system32\Drivers\etc\hosts_bak_781
2015-03-30 11:33 - 2010-08-09 19:08 - 00000000 ____D () C:\Users\hardy
2015-03-29 13:33 - 2012-03-02 23:53 - 00000979 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2015-03-29 12:28 - 2013-01-13 12:49 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-03-29 12:28 - 2012-03-02 20:59 - 00000000 ____D () C:\Program Files (x86)\Java
2015-03-29 12:19 - 2013-03-12 20:12 - 00778928 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-03-29 12:19 - 2013-03-12 20:12 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-03-29 12:19 - 2011-08-24 13:21 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-03-28 17:30 - 2014-09-10 12:14 - 00000000 ____D () C:\Users\hardy\AppData\Roaming\.minecraft
2015-03-28 01:12 - 2014-09-11 09:03 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-03-28 01:12 - 2009-07-27 22:41 - 00000000 ____D () C:\Windows\Panther
2015-03-27 02:40 - 2014-05-29 13:55 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-03-27 02:32 - 2010-02-11 04:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer GameZone
2015-03-27 02:32 - 2010-02-11 04:42 - 00000000 ____D () C:\Program Files (x86)\Acer GameZone
2015-03-27 02:31 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-03-27 02:30 - 2014-05-29 13:55 - 00000000 ____D () C:\ProgramData\Package Cache
2015-03-27 02:30 - 2012-07-13 16:43 - 00000000 ____D () C:\ProgramData\Avira
2015-03-27 01:54 - 2012-01-27 22:24 - 00425472 ___SH () C:\Users\hardy\Documents\Thumbs.db
2015-03-24 16:52 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-03-17 06:15 - 2014-09-10 12:02 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-03-17 06:15 - 2014-09-10 12:02 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-03-17 06:15 - 2012-02-10 17:18 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-03-12 10:01 - 2010-02-11 04:19 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-03-12 09:59 - 2013-08-02 00:18 - 00000000 ____D () C:\Windows\system32\MRT
2015-03-12 01:54 - 2010-09-07 19:35 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

==================== Files in the root of some directories =======

2010-09-07 16:49 - 2014-02-14 16:48 - 0000092 _____ () C:\Users\hardy\AppData\Roaming\wklnhst.dat
2013-04-14 14:16 - 2015-02-28 12:07 - 0010240 _____ () C:\Users\hardy\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2010-02-11 04:43 - 2009-07-18 04:57 - 0036136 _____ (Oberon Media) C:\ProgramData\FullRemove.exe

Some content of TEMP:
====================
C:\Users\hardy\AppData\Local\Temp\Quarantine.exe
C:\Users\hardy\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2015-03-25 12:44

==================== End Of Log ============================
         

--- --- ---


Ab und zu braucht der Laptop immer noch einige Anlaufzeit. Beim letzten Reboot
war es leider wieder sehr schlimm. Wobei ich gestehen muss, dass es manchmal
schwer auszumachen ist, ob der Laptop jetzt aufgrund von Viren/Trojanern länger
braucht, oder einfach, weil der Laptop schon 5 Jahre alt ist.

Der Balken unten ist übrigens immer noch in diesem merkwürdigen weißgrau, wie
im von mir verlinkten Bild zu sehen ist. Muss ich das noch manuell ändern?

Kannst Du das Bild bitte direkt hier im Thread anhängen?

Aber natürlich doch.
Wie gesagt, hat sich erst seit Beginn der Bekämpfung die Leiste unten und
die Farbe vom Skype-Logo geändert.

Habe jetzt leider wieder teils extreme Bearbeitungszeit des Laptops zu beklagen.
Jedes Fenster, welches ich anklicke, öffnet sich zwar, reagiert aber nicht.
Klicke ich erneut auf das Fenster, steht oben in Klammern "Reagiert nicht".
Für das Bild hier im Anhang, habe ich mehrere Minuten gebraucht, anzuhängen.

Das ist doch nicht normal, oder?

Klick mal mit Rechtsklick auf die Taskleiste > Eigenschaften. Da ist der alte Modus als Anzeige eingestellt, das einfach umstellen.


Gewusst wie: Durchführen eines sauberen Neustarts in Windows

Bitte einen Clean Boot machen. Wenn das Problem dann weg ist, einzeln wieder Dienste aktivieren, dazwischen immer einen Reboot machen. Solange bis Du weißt welcher Dienst die Probleme macht.

Diesen dann hier benennen.

Ich habe das jetzt mal so nach Anleitung gemacht. Leider besteht das Problem
weiterhin. Was ich vergessen hatte, zu erwähnen: Der Laptop hat jedes Mal
beim Herunterfahren ein Windows-Update installiert. Mit diesem standard blauen
Bildschirm, wie man es gewohnt ist.
Das fiel weg, nachdem ich einen Clean Boot gemacht habe.

Und trotz Cleanboot ist die Kiste langsam? Also auch wenn alles deaktiviert ist?

Manchmal ja, das ist ja das merkwürdige. Und das Update, von dem ich
gesprochen habe, installiert trotzdem erneut beim Herunterfahren.

Windows 7 DVD oder Image da? Dann ziehen wir ein Inplace Upgrade drüber.

Leider nicht. Das DVD-Laufwerk funktioniert auch nicht mehr.

Das dumme ist, morgen fahre ich wieder nach Hause. Im Prinzip kann man
mit dem Laptop jetzt arbeiten, die größten Probleme sind beseitigt. Dauert halt
alles teilweise nur sehr langsam. :/

Da muss auf jeden Fall einmal sauber Windows drüber, Inplace Upgrade oder richtig Neuaufsetzen. Da ist irgendwas in Windows verbogen.

Das habe ich fast befürchtet. Aber dennoch vielen, vielen Dank für die
Hilfe und Geduld. Wie gesagt, zumindest funktioniert der Laptop jetzt
wieder, waren ja genügend Viren/Trojaner vorhanden.

Vielen lieben Dank und liebe Grüße,
Shadow315

Gern Geschehen