Windows 7: Malwarebytes Anti-Malware meldet hunderte Infizierungen mit diversen PUP.Optional Dateien
Schönen Guten Abend!
Seit gestern bekomme ich in Intervallen von ca. 45 Minuten PC-Crashes (meistens einfach schwarzer Bildschirm, gefolgt von untenstehender Nachricht; 2 Mal hab ich für den Bruchteil einer Sekunde einen Bluescreen gesehen)
Die Nachricht:
Reboot and Select proper Boot device
or Insert Boot Media in selected Boot device and press a key
Wenn ich einfach resette, kommt immer wieder nur diese Aufforderung, doch wenn ich den PC durch langes Drücken des Power-Knopfs ausschalte und wieder einschalte, komme ich wie gehabt zu Windows. Dann nach ca. 45 Minuten passiert das ganze wieder.
Habe heute früh den PC neu aufgesetzt, in der Hoffnung dass das etwas bringt, jedoch ohne Erfolg.
Nun brauche ich bitte eure Hilfe! Bin während des Schreibens dieses Themas auch 1 mal rausgeflogen und habe den PC neu booten müssen
Hier die benötigten Logfiles:
Mit Malwarebytes Anti-Malware Logfile war der Post zu lang, werde, wenn aufgefordert, die File nachher posten!
Defogger Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 20:57 on 01/09/2013 (Tim)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST Logfile:
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-09-2013 01
Ran by Tim (administrator) on T-PC on 01-09-2013 22:05:49
Running from C:\Users\Tim\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(cFos Software GmbH) C:\Program Files\ASRock\XFast LAN\spd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(cFos Software GmbH) C:\Program Files\ASRock\XFast LAN\cfosspeed.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Smartbar) C:\Users\Tim\AppData\Local\Smartbar\Application\QuickShare.exe
() C:\Program Files (x86)\NETGEAR\WG111v3\WG111v3.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(FNet Co., Ltd.) C:\Program Files (x86)\XFastUsb\XFastUsb.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Google Inc.) C:\Users\Tim\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Tim\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Tim\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Tim\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Tim\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Tim\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Tim\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Tim\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Tim\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Tim\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Malwarebytes Corporation) E:\Malwarebytes' Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Windows\SysWOW64\NOTEPAD.EXE
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11860072 2011-06-09] (Realtek Semiconductor)
HKLM\...\Run: [XFast LAN] - C:\Program Files\ASRock\XFast LAN\cFosSpeed.exe [1441152 2011-07-04] (cFos Software GmbH)
HKLM\...\Run: [THXCfg64] - C:\Windows\system32\THXCfg64.dll [26624 2011-05-13] (Creative Technology Ltd.)
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1356240 2013-07-18] (Microsoft Corporation)
HKLM\...\Policies\Explorer: [NoActiveDesktop] 1
HKLM\...\Policies\Explorer: [NoActiveDesktopChanges] 1
HKCU\...\Run: [ASRockXTU] - [x]
HKCU\...\Run: [zASRockInstantBoot] - [x]
HKCU\...\Run: [Google Update] - C:\Users\Tim\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-11-28] (Google Inc.)
HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1242448 2011-03-16] (Valve Corporation)
HKCU\...\Run: [Browser Infrastructure Helper] - C:\Users\Tim\AppData\Local\Smartbar\Application\QuickShare.exe [20248 2013-08-26] (Smartbar)
MountPoints2: {cd453f49-1949-11e1-9a74-806e6f6e6963} - D:\ASRSetup.exe
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-05-20] (Intel Corporation)
HKLM-x32\...\Run: [XFastUsb] - C:\Program Files (x86)\XFastUsb\XFastUsb.exe [4942336 2011-11-28] (FNet Co., Ltd.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [34672 2008-06-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [THX TruStudio NB Settings] - C:\Program Files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe [909824 2011-05-19] (Creative Technology Ltd)
HKLM-x32\...\Run: [UpdReg] - C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2011-10-25] (Advanced Micro Devices, Inc.)
AppInit_DLLs: C:\PROGRA~1\LUCIDL~1\VIRTU\APPINI~1.DLL [187488 2011-06-19] (Lucidlogix Inc.)
AppInit_DLLs-x32: C:\PROGRA~1\LUCIDL~1\VIRTU\x86\APPINI~1.DLL [157792 2011-06-19] (Lucidlogix Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WG111v3 Setup-Assistent.lnk
ShortcutTarget: NETGEAR WG111v3 Setup-Assistent.lnk -> C:\Program Files (x86)\NETGEAR\WG111v3\WG111v3.exe ()
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://at.msn.com/?ocid=iehp
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=ASRK
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=ASRK
BHO: QuickShare WidgetEngine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: QuickShare WidgetEngine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM - QuickShare Widget - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - QuickShare Widget - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Users\Tim\AppData\Local\Google\Chrome\Application\29.0.1547.62\gcswf32.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Tim\AppData\Local\Google\Chrome\Application\29.0.1547.62\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Tim\AppData\Local\Google\Chrome\Application\29.0.1547.62\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Users\Tim\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (QuickShare Widget) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl\1.4_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0
CHR StartMenuInternet: Google Chrome - C:\Users\Tim\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Services (Whitelisted) =================
R2 cFosSpeedS; C:\Program Files\ASRock\XFast LAN\spd.exe [395136 2011-07-04] (cFos Software GmbH)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2013-07-18] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [366600 2013-07-18] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
S3 FNETTBOH_305; C:\Windows\System32\drivers\FNETTBOH_305.SYS [31808 2011-11-28] (FNet Co., Ltd.)
R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [15936 2011-11-28] (FNet Co., Ltd.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [247216 2013-06-18] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [139616 2013-06-18] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-01 21:10 - 2013-09-01 21:10 - 00000085 _____ C:\Windows\wininit.ini
2013-09-01 21:07 - 2013-09-01 21:13 - 00000827 _____ C:\Users\Tim\Desktop\Gmer.txt
2013-09-01 21:00 - 2013-09-01 21:00 - 00377856 _____ C:\Users\Tim\Desktop\gmer_2.1.19163.exe
2013-09-01 20:58 - 2013-09-01 20:58 - 00042414 _____ C:\Users\Tim\Desktop\Addition.txt
2013-09-01 20:57 - 2013-09-01 20:57 - 00000000 ____D C:\FRST
2013-09-01 20:53 - 2013-09-01 20:57 - 00000468 _____ C:\Users\Tim\Desktop\defogger_disable.log
2013-09-01 20:53 - 2013-09-01 20:53 - 00000000 _____ C:\Users\Tim\defogger_reenable
2013-09-01 20:51 - 2013-09-01 20:51 - 00050477 _____ C:\Users\Tim\Desktop\Defogger.exe
2013-09-01 20:26 - 2013-09-01 20:31 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-09-01 20:26 - 2013-09-01 20:26 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2013-09-01 20:22 - 2013-09-01 20:24 - 37672592 _____ (Safer-Networking Ltd. ) C:\Users\Tim\Downloads\spybotsd-2.1.21-SR2.exe
2013-09-01 20:19 - 2013-09-01 20:19 - 00000618 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-09-01 20:19 - 2013-09-01 20:19 - 00000000 ____D C:\Users\Tim\AppData\Roaming\Malwarebytes
2013-09-01 20:19 - 2013-09-01 20:19 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-01 20:19 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-09-01 20:17 - 2013-09-01 20:18 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Tim\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-01 20:14 - 2013-09-01 20:14 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-09-01 20:13 - 2013-09-01 20:14 - 00000000 ____D C:\Users\Tim\AppData\Local\Smartbar
2013-09-01 20:09 - 2013-09-01 20:09 - 00001912 _____ C:\Windows\epplauncher.mif
2013-09-01 20:09 - 2013-09-01 20:09 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-09-01 20:09 - 2013-09-01 20:09 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2013-09-01 20:08 - 2013-09-01 20:08 - 13842112 _____ (Microsoft Corporation) C:\Users\Tim\Downloads\mseinstall.exe
2013-09-01 19:57 - 2013-09-01 19:57 - 00159144 _____ (Microsoft Corporation) C:\Users\Tim\Downloads\WindowsActivationUpdate.exe
2013-09-01 19:53 - 2012-06-03 00:19 - 02428952 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2013-09-01 19:53 - 2012-06-03 00:19 - 00057880 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2013-09-01 19:53 - 2012-06-03 00:19 - 00044056 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2013-09-01 19:53 - 2012-06-03 00:15 - 02622464 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2013-09-01 19:53 - 2012-06-02 15:19 - 00186752 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2013-09-01 19:53 - 2012-06-02 15:15 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2013-09-01 19:50 - 2013-09-01 19:50 - 00003288 ____N C:\bootsqm.dat
2013-09-01 14:05 - 2013-09-01 16:26 - 00000000 ____D C:\Users\Tim\Desktop\WG111v3
2013-09-01 14:01 - 2013-09-01 14:01 - 00000000 ____D C:\ProgramData\AVAST Software
2013-09-01 14:01 - 2013-09-01 14:01 - 00000000 ____D C:\Program Files\AVAST Software
==================== One Month Modified Files and Folders =======
2013-09-01 21:57 - 2009-07-14 06:45 - 00021856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-01 21:57 - 2009-07-14 06:45 - 00021856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-01 21:56 - 2011-04-12 09:43 - 00643628 _____ C:\Windows\system32\perfh007.dat
2013-09-01 21:56 - 2011-04-12 09:43 - 00126188 _____ C:\Windows\system32\perfc007.dat
2013-09-01 21:56 - 2009-07-14 07:13 - 01472002 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-01 21:53 - 2011-11-28 00:52 - 02007137 _____ C:\Windows\WindowsUpdate.log
2013-09-01 21:50 - 2011-11-28 02:27 - 00000000 ____D C:\Program Files (x86)\Steam
2013-09-01 21:50 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-01 21:50 - 2009-07-14 06:51 - 00026032 _____ C:\Windows\setupact.log
2013-09-01 21:13 - 2013-09-01 21:07 - 00000827 _____ C:\Users\Tim\Desktop\Gmer.txt
2013-09-01 21:12 - 2011-11-28 02:20 - 00001112 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-91856065-2198446350-1970827252-1000UA.job
2013-09-01 21:10 - 2013-09-01 21:10 - 00000085 _____ C:\Windows\wininit.ini
2013-09-01 21:10 - 2010-11-21 05:47 - 00266860 _____ C:\Windows\PFRO.log
2013-09-01 21:00 - 2013-09-01 21:00 - 00377856 _____ C:\Users\Tim\Desktop\gmer_2.1.19163.exe
2013-09-01 20:58 - 2013-09-01 20:58 - 00042414 _____ C:\Users\Tim\Desktop\Addition.txt
2013-09-01 20:57 - 2013-09-01 20:57 - 00000000 ____D C:\FRST
2013-09-01 20:57 - 2013-09-01 20:53 - 00000468 _____ C:\Users\Tim\Desktop\defogger_disable.log
2013-09-01 20:53 - 2013-09-01 20:53 - 00000000 _____ C:\Users\Tim\defogger_reenable
2013-09-01 20:53 - 2011-11-28 00:52 - 00000000 ____D C:\Users\Tim
2013-09-01 20:51 - 2013-09-01 20:51 - 00050477 _____ C:\Users\Tim\Desktop\Defogger.exe
2013-09-01 20:31 - 2013-09-01 20:26 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-09-01 20:26 - 2013-09-01 20:26 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2013-09-01 20:24 - 2013-09-01 20:22 - 37672592 _____ (Safer-Networking Ltd. ) C:\Users\Tim\Downloads\spybotsd-2.1.21-SR2.exe
2013-09-01 20:19 - 2013-09-01 20:19 - 00000618 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-09-01 20:19 - 2013-09-01 20:19 - 00000000 ____D C:\Users\Tim\AppData\Roaming\Malwarebytes
2013-09-01 20:19 - 2013-09-01 20:19 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-01 20:18 - 2013-09-01 20:17 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Tim\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-01 20:16 - 2011-11-28 02:21 - 00002316 _____ C:\Users\Tim\Desktop\Google Chrome.lnk
2013-09-01 20:16 - 2011-11-28 02:21 - 00000000 ____D C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2013-09-01 20:14 - 2013-09-01 20:14 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-09-01 20:14 - 2013-09-01 20:13 - 00000000 ____D C:\Users\Tim\AppData\Local\Smartbar
2013-09-01 20:12 - 2011-11-28 02:20 - 00001060 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-91856065-2198446350-1970827252-1000Core.job
2013-09-01 20:09 - 2013-09-01 20:09 - 00001912 _____ C:\Windows\epplauncher.mif
2013-09-01 20:09 - 2013-09-01 20:09 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-09-01 20:09 - 2013-09-01 20:09 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2013-09-01 20:08 - 2013-09-01 20:08 - 13842112 _____ (Microsoft Corporation) C:\Users\Tim\Downloads\mseinstall.exe
2013-09-01 20:07 - 2011-11-28 02:20 - 00004078 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-91856065-2198446350-1970827252-1000UA
2013-09-01 20:07 - 2011-11-28 02:20 - 00003682 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-91856065-2198446350-1970827252-1000Core
2013-09-01 19:57 - 2013-09-01 19:57 - 00159144 _____ (Microsoft Corporation) C:\Users\Tim\Downloads\WindowsActivationUpdate.exe
2013-09-01 19:50 - 2013-09-01 19:50 - 00003288 ____N C:\bootsqm.dat
2013-09-01 16:26 - 2013-09-01 14:05 - 00000000 ____D C:\Users\Tim\Desktop\WG111v3
2013-09-01 16:26 - 2011-11-28 01:48 - 00000000 ____D C:\Users\Tim\Desktop\WG111v3_v2.0.0_Setup.exe
2013-09-01 16:26 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-09-01 14:01 - 2013-09-01 14:01 - 00000000 ____D C:\ProgramData\AVAST Software
2013-09-01 14:01 - 2013-09-01 14:01 - 00000000 ____D C:\Program Files\AVAST Software
2013-09-01 13:55 - 2011-11-28 00:52 - 00000000 __SHD C:\Recovery
2013-09-01 13:55 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\Recovery
2013-09-01 13:54 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\Msdtc
Files to move or delete:
====================
C:\Users\Tim\AppData\Local\Temp\{0AB0B578-BCBF-4A81-B47F-60380CAD1DE2}\_Setup.dll
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2011-11-28 00:47
==================== End Of Log ============================
--- --- ---
--- --- ---
--- --- ---
[/CODE]
Habe keine File Namens Additions.txt am Desktop.
GMER Code:
GMER Logfile:
Code:
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-01 22:12:50
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 M4-CT128 rev.0009 119,24GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Tim\AppData\Local\Temp\pxldipog.sys
---- User code sections - GMER 2.1 ----
.text C:\Users\Tim\AppData\Local\Smartbar\Application\QuickShare.exe[2220] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000763e1465 2 bytes [3E, 76]
.text C:\Users\Tim\AppData\Local\Smartbar\Application\QuickShare.exe[2220] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000763e14bb 2 bytes [3E, 76]
.text ... * 2
---- EOF - GMER 2.1 ----
--- --- ---
Mit freundlichen Grüßen
Timbo | 
AdwCleaner auf deinen Desktop.
SecurityCheck und:
