Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Windows 7 startet nicht mehr - Schwarzer Bildschirm mit Mauszeiger (https://www.trojaner-board.de/156829-windows-7-startet-mehr-schwarzer-bildschirm-mauszeiger.html)

Pochemu 24.07.2014 18:08
Windows 7 startet nicht mehr - Schwarzer Bildschirm mit Mauszeiger
 
Hallo,

seit Mittwoch startet mein PC nicht mehr.
Am Dienstag hatte ich ihn noch normal benutzt und er lief soweit ohne Probleme.
Als ich am Mittwoch wieder hochfahren wollte, blieb der PC nach dem Windows Ladescreen hängen. Normalerweise würde dann an der Stelle der Anmeldebildschirm erscheinen, es tut sich aber nix. Ich hab zwar nen Mauszeiger, aber sonst ist der Bildschirm schwarz.
Ich weiß nicht ob ich von einem Virus befallen bin oder ob einfach nur Windows einen weg hat, aber um dies herauszufinden hab ich mich hier angemeldet.

Auf das Forum bin ich durch diesen Beitrag über die Google Suche aufmerksam geworden:
http://www.trojaner-board.de/139104-...-moeglich.html

Hab so ziemlich das selbe Problem, bis auf den Virenbefall. Zumindest hat sich kein Virus die letzte Zeit bemerkbar gemacht.

Hab bisher noch nix großartiges versucht, bis auf F8 und versucht die Reperatur zu starten, was allerdings nix gebracht hat :(

Ich hoffe ihr könnt mir Tipps geben um zu prüfen ob ich einen Virenbefall hab oder nicht. Dann müsste ich nur meine Daten retten und könnte Windows neu aufsetzen.

Danke :)

schrauber 24.07.2014 18:18
hi,

Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)
Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)
  • Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST Download FRST 32-Bit | FRST 64-Bit
  • Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.
  • Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:
Über den Boot Manager:
  • Starte den Rechner neu.
  • Während dem Hochfahren drücke mehrmals die F8 Taste
  • Wähle nun Computer reparieren.
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Mit Windows CD/DVD (auch bei Windows 8 möglich):
  • Lege die Windows CD in dein Laufwerk.
  • Starte den Rechner neu und starte von der CD.
  • Wähle die Spracheinstellungen und klicke "Weiter".
  • Klicke auf Computerreparaturoptionen !
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Wähle in den Reparaturoptionen: Eingabeaufforderung
  • Gib nun bitte notepad ein und drücke Enter.
  • Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
    Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.
  • Schließe Notepad wieder
  • Gib nun bitte folgenden Befehl ein.
    e:\frst.exe bzw. e:\frst64.exe
    Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.
  • Akzeptiere den Disclaimer mit Ja und klicke Untersuchen
Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).


Pochemu 24.07.2014 18:42
Ok, nachdem ich Farbar scannen lassen hatte, kam am Ende diese Meldung:

Farbar Recovery Scan Tool: frst64.exe - Datei beschädigt

Die Datei oder das Verzeichnis C:\Users\Benutzername\AppData\Local\The Witcher ist beschädigt und nicht lesbar. Fürhen Sie CHKDSK aus.


Kann die Meldung so oft ich will mit OK bestätigten, sie ging nicht weg.
Im Hintergrund hatte Farbar gemeldet, dass es fertig ist und die txt abgelegt wurde.
Hier der Code:


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-07-2014
Ran by SYSTEM on MININT-7SF3SVO on 24-07-2014 19:35:09
Running from H:\
Platform: Windows 7 Home Premium (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.




==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [106496 2010-01-22] (NEC Electronics Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [750160 2014-07-03] (Avira Operations GmbH & Co. KG)
HKLM\...\Winlogon: [Shell] explorer.exe
HKLM-x32\...\Winlogon: [Shell] explorer.exe [ ] ()
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\Default\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\Default User\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: EnhancedStorageShell -> {D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} =>  No File
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 1 (GFS Unread Stub) -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} =>  No File
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2 (GFS Stub) -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} =>  No File
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2.5 (GFS Unread Folder) -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} =>  No File
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 3 (GFS Folder) -> {16F3DD56-1AF5-4347-846D-7C10C4192619} =>  No File
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 4 (GFS Unread Mark) -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} =>  No File
ShellIconOverlayIdentifiers-x32: SharingPrivate -> {08244EE6-92F0-47f2-9FC9-929BAA2E7235} =>  No File

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2013-02-13] (Adobe Systems)
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-07-03] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-07-03] (Avira Operations GmbH & Co. KG)
S2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2014-06-26] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-03] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-03] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
S1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-05-25] (DT Soft Ltd)
S3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
S3 npusbio; C:\Windows\System32\Drivers\npusbio_x64.sys [38400 2012-07-09] ()
S3 SaiH075C; C:\Windows\System32\DRIVERS\SaiH075C.sys [171144 2007-05-01] (Saitek)
S3 SaiMini; C:\Windows\System32\DRIVERS\SaiMini.sys [22792 2010-08-10] (Saitek)
S3 SaiNtBus; C:\Windows\System32\drivers\SaiBus.sys [50056 2010-08-10] (Saitek)
S3 seehcri; C:\Windows\System32\DRIVERS\seehcri.sys [34032 2008-01-09] (Sony Ericsson Mobile Communications)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-24 19:34 - 2014-07-24 19:35 - 00000000 ____D () C:\FRST
2014-07-23 14:31 - 2014-07-23 14:31 - 00003360 ____N () C:\bootsqm.dat
2014-07-23 14:29 - 2014-07-23 14:29 - 00000000 __SHD () C:\found.000
2014-07-18 12:10 - 2014-06-19 03:12 - 02239488 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2014-07-18 12:10 - 2014-06-19 03:12 - 01366528 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2014-07-18 12:10 - 2014-06-19 03:12 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2014-07-18 12:10 - 2014-06-19 03:11 - 19277312 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-07-18 12:10 - 2014-06-19 03:11 - 00197120 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2014-07-18 12:10 - 2014-06-19 03:11 - 00097792 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 15369728 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 03959296 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 02650624 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 00452096 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 00281600 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 00255488 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2014-07-18 12:10 - 2014-06-19 03:09 - 01508864 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2014-07-18 12:10 - 2014-06-19 01:53 - 14368768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-18 12:10 - 2014-06-19 01:53 - 01766400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-18 12:10 - 2014-06-19 01:53 - 01141760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-18 12:10 - 2014-06-19 01:53 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-18 12:10 - 2014-06-19 01:53 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-18 12:10 - 2014-06-19 01:53 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 13732352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 02863616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 02051072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 01440768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-18 12:10 - 2014-06-19 01:52 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-18 12:10 - 2014-06-19 01:33 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2014-07-18 12:10 - 2014-06-19 01:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-18 12:10 - 2014-06-19 00:37 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2014-07-18 12:10 - 2014-06-19 00:34 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2014-07-18 12:10 - 2014-06-18 03:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\System32\osk.exe
2014-07-18 12:10 - 2014-06-18 02:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-18 12:10 - 2014-06-18 02:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2014-07-18 12:10 - 2014-05-30 09:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\System32\kerberos.dll
2014-07-18 12:10 - 2014-05-30 09:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\System32\schannel.dll
2014-07-18 12:10 - 2014-05-30 09:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\System32\msv1_0.dll
2014-07-18 12:10 - 2014-05-30 09:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
2014-07-18 12:10 - 2014-05-30 09:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\System32\wdigest.dll
2014-07-18 12:10 - 2014-05-30 09:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\System32\TSpkg.dll
2014-07-18 12:10 - 2014-05-30 09:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\System32\credssp.dll
2014-07-18 12:10 - 2014-05-30 08:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-18 12:10 - 2014-05-30 08:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-18 12:10 - 2014-05-30 08:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-18 12:10 - 2014-05-30 08:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-18 12:10 - 2014-05-30 08:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-18 12:10 - 2014-05-30 08:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-18 12:10 - 2014-05-30 08:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-18 12:09 - 2014-06-30 03:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2014-07-18 12:09 - 2014-06-30 03:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2014-07-18 12:09 - 2014-06-06 11:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\System32\qedit.dll
2014-07-18 12:09 - 2014-06-06 10:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-18 12:09 - 2014-06-05 15:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\System32\lsasrv.dll
2014-07-18 12:09 - 2014-06-05 15:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-18 12:09 - 2014-06-05 15:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-18 12:09 - 2014-05-30 07:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\afd.sys
2014-07-09 10:10 - 2014-07-09 10:10 - 00000000 ____D () C:\Users\Benutzername\AppData\Local\Adobe
2014-07-06 16:49 - 2014-07-06 16:49 - 00000000 ____D () C:\Program Files (x86)\Fraps
2014-06-26 22:57 - 2014-06-26 23:00 - 00000000 ____D () C:\Users\Benutzername\Documents\Assassin's Creed III

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-24 19:35 - 2014-07-24 19:34 - 00000000 ____D () C:\FRST
2014-07-24 16:25 - 2014-04-20 17:06 - 00017472 _____ () C:\Windows\setupact.log
2014-07-23 15:04 - 2009-07-14 05:45 - 00015136 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-23 15:04 - 2009-07-14 05:45 - 00015136 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-23 15:00 - 2009-07-14 18:58 - 00699416 _____ () C:\Windows\System32\perfh007.dat
2014-07-23 15:00 - 2009-07-14 18:58 - 00149556 _____ () C:\Windows\System32\perfc007.dat
2014-07-23 15:00 - 2009-07-14 06:13 - 01620612 _____ () C:\Windows\System32\PerfStringBackup.INI
2014-07-23 14:31 - 2014-07-23 14:31 - 00003360 ____N () C:\bootsqm.dat
2014-07-23 14:29 - 2014-07-23 14:29 - 00000000 __SHD () C:\found.000
2014-07-22 19:21 - 2014-01-04 13:17 - 01844334 _____ () C:\Windows\WindowsUpdate.log
2014-07-22 19:15 - 2012-05-22 12:21 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-07-22 19:15 - 2012-05-15 17:02 - 00000000 ____D () C:\Users\Benutzername\AppData\Roaming\TS3Client
2014-07-22 14:20 - 2013-06-25 15:33 - 00000000 ____D () C:\Users\Benutzername\AppData\Local\Arma 3
2014-07-22 13:51 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-21 17:15 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-07-19 16:25 - 2014-06-20 15:52 - 00000000 ____D () C:\Users\Benutzername\Documents\Euro Truck Simulator 2
2014-07-19 11:42 - 2012-06-15 14:58 - 00000000 ____D () C:\ProgramData\Origin
2014-07-19 11:39 - 2012-06-15 14:59 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-07-19 01:21 - 2012-05-22 21:34 - 00000000 ____D () C:\Users\Benutzername\AppData\Roaming\vlc
2014-07-18 12:22 - 2009-07-14 05:45 - 00343568 _____ () C:\Windows\System32\FNTCACHE.DAT
2014-07-18 12:20 - 2014-04-29 14:38 - 00000000 ___SD () C:\Windows\System32\CompatTel
2014-07-18 12:20 - 2009-07-14 19:18 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-18 12:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-18 12:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\System32\Dism
2014-07-18 12:15 - 2012-07-02 18:46 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-07-18 12:14 - 2013-07-12 11:23 - 00000000 ____D () C:\Windows\System32\MRT
2014-07-18 12:12 - 2012-05-17 11:55 - 96441528 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2014-07-15 13:36 - 2012-05-15 16:57 - 00000000 ____D () C:\Program Files (x86)\TeamSpeak 3 Client
2014-07-09 10:10 - 2014-07-09 10:10 - 00000000 ____D () C:\Users\Benutzername\AppData\Local\Adobe
2014-07-09 09:47 - 2012-05-15 17:11 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-09 09:47 - 2012-05-15 17:11 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-08 11:10 - 2013-05-02 09:24 - 00042040 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avnetflt.sys
2014-07-06 16:49 - 2014-07-06 16:49 - 00000000 ____D () C:\Program Files (x86)\Fraps
2014-07-05 18:58 - 2012-05-15 17:28 - 00007653 _____ () C:\Users\Benutzername\AppData\Local\Resmon.ResmonCfg
2014-07-03 17:45 - 2013-03-27 14:03 - 00117712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avgntflt.sys
2014-06-30 03:09 - 2014-07-18 12:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2014-06-30 03:04 - 2014-07-18 12:09 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2014-06-26 23:00 - 2014-06-26 22:57 - 00000000 ____D () C:\Users\Benutzername\Documents\Assassin's Creed III
2014-06-26 22:57 - 2014-05-06 15:14 - 00055723 _____ () C:\Windows\DirectX.log
2014-06-26 22:57 - 2012-06-11 18:31 - 00189248 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2014-06-26 22:57 - 2012-06-11 18:31 - 00075136 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-06-26 22:21 - 2012-07-15 12:44 - 03123272 _____ () C:\Windows\SysWOW64\pbsvc.exe
2014-06-25 13:46 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

Some content of TEMP:
====================
C:\Users\Benutzername\AppData\Local\Temp\avgnt.exe


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe IS MISSING <==== ATTENTION!.
C:\Windows\SysWOW64\explorer.exe IS MISSING <==== ATTENTION!.
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points  =========================


==================== Memory info ===========================

Percentage of memory in use: 9%
Total physical RAM: 8183.05 MB
Available physical RAM: 7386.33 MB
Total Pagefile: 8181.2 MB
Available Pagefile: 7376.93 MB
Total Virtual: 8192 MB
Available Virtual: 8191.89 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:931.41 GB) (Free:192.96 GB) NTFS
Drive d: (-) (Fixed) (Total:698.63 GB) (Free:143.66 GB) NTFS
Drive h: (STICK) (Removable) (Total:14.94 GB) (Free:14.94 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 38CA9B68)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 699 GB) (Disk ID: BDF1BDF1)
Partition 1: (Not Active) - (Size=699 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 15 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.


LastRegBack: 2014-07-21 17:08

==================== End Of Log ============================
--- --- ---


Achja, ich hab meinen Benutzernamen durch "Benutzername" ersetzt ;)

schrauber 25.07.2014 17:29
Bitte nochmal FRST in der REcovery öffnen, in das Search Feld bitte

explorer.ex*

eingeben und auf Search klicken. Logfile posten.

Pochemu 25.07.2014 18:09
Jetzt kommt noch während des Suchvorgangs die Meldung:

Farbar Recovery Scan Tool: frst64.exe - Datei beschädigt

Die Datei oder das Verzeichnis C:\Users\Benutzername\Music\iTunes\AlbumArtwork\Cache\3A0E091D77D69A78\09\11\09 ist beschädigt und nicht lesbar. Führen Sie CHKDSK aus.


Danach kommen noch mehrere Dateien die nicht lesbar und beschädigt sind, keine Ahnung ob ich die hier alle posten soll und ob das wichtig ist.


Log:

Code:
Farbar Recovery Scan Tool (x64) Version: 24-07-2014
Ran by SYSTEM at 2014-07-25 19:00:19
Running from H:\
Boot Mode: Recovery

================== Search Files: "explorer.ex*" =============

C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2012-05-17 11:31][2011-02-26 06:19] 2616320 ____A (Microsoft Corporation) 0FB9C74046656D1579A64660AD67B746

C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2012-05-17 13:13][2010-11-20 13:17] 2616320 ____A (Microsoft Corporation) 40D777B7A95E00593EB1568C68514493

C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2012-05-17 11:31][2011-02-26 06:51] 2614784 ____A (Microsoft Corporation) 255CF508D7CFB10E0794D6AC93280BD8

C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2012-05-17 11:31][2009-10-31 07:00] 2614272 ____A (Microsoft Corporation) C76153C7ECA00FA852BB0C193378F917

C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2014-07-23 14:57][2014-07-23 14:57] 2347511 ___AC () 8378BD5C386D303C665B09481E23C4BE

C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2012-05-17 11:31][2011-02-26 06:33] 2614784 ____A (Microsoft Corporation) 2AF58D15EDC06EC6FDACCE1F19482BBF

C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2012-05-17 11:31][2009-10-31 06:45] 2614272 ____A (Microsoft Corporation) 2626FC9755BE22F805D3CFA0CE3EE727

C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2012-05-17 11:30][2009-08-03 06:35] 2613248 ____A () D41D8CD98F00B204E9800998ECF8427E

C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2009-07-14 00:41][2009-07-14 02:14] 2613248 ____A (Microsoft Corporation) 15BC38A7492BEFE831966ADB477CF76F

C:\Windows\winsxs\wow64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_de-de_c34b4d1dd2d587d1\explorer.exe.mui
[2009-07-14 18:58][2009-07-14 18:58] 0025600 ____A (Microsoft Corporation) EB67605F636687E5F3C988B0059A8C46

C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2012-05-17 13:14][2010-11-20 14:24] 2872320 ____A (Microsoft Corporation) AC4C51EB24AA95B77F705AB159189E24

C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2012-05-17 11:31][2011-02-26 07:26] 2870784 ____A () D41D8CD98F00B204E9800998ECF8427E

C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2012-05-17 11:31][2009-10-31 07:38] 2870272 ____A (Microsoft Corporation) B8EC4BD49CE8F6FC457721BFC210B67F

C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2012-05-17 11:30][2009-08-03 07:19] 2868224 ____A () D41D8CD98F00B204E9800998ECF8427E

C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2012-05-17 11:31][2009-10-31 07:34] 2870272 ____A (Microsoft Corporation) 9AAAEC8DAC27AA17B053E6352AD233AE

C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009-07-14 00:56][2009-07-14 02:39] 2868224 ____A (Microsoft Corporation) C235A51CB740E45FFA0EBFB9BAFCDA64

C:\Windows\winsxs\amd64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b8f6a2cb9e74c5d6\explorer.exe.mui
[2009-07-14 18:58][2009-07-14 18:58] 0025600 ____A (Microsoft Corporation) 64E8A52EA68A8C36D0152F3108DA02D0

C:\Windows\SysWOW64\de-DE\explorer.exe.mui
[2009-07-14 18:58][2009-07-14 18:58] 0025600 ____A (Microsoft Corporation) EB67605F636687E5F3C988B0059A8C46

C:\Windows\de-DE\explorer.exe.mui
[2009-07-14 18:58][2009-07-14 18:58] 0025600 ____A (Microsoft Corporation) 64E8A52EA68A8C36D0152F3108DA02D0

====== End Of Search ======

schrauber 26.07.2014 10:46
Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
cmd: copy C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe C:\Windows
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Pochemu 26.07.2014 14:04
Kurze Zwischenfrage: Kann man schon erkennen ob mein System verseucht ist?

Edit: Bin erst heute mittag wieder Zuhause.

So hier das Log:

Zitat:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 24-07-2014
Ran by SYSTEM at 2014-07-26 15:03:08 Run:1
Running from H:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
cmd: copy C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe C:\Windows
*****************


========= copy C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe C:\Windows =========

1 Datei(en) kopiert.

========= End of CMD: =========


==== End of Fixlog ====

schrauber 26.07.2014 20:16
Startet der Rechner normal?

Pochemu 27.07.2014 16:11
Zitat:
Zitat von schrauber (Beitrag 1335626)
Startet der Rechner normal?
Muss ich probieren. Kann erst heute Mittag wieder ran.

Kann man jetzt schon erkennen ob ich nen Virus oder sonst was hab?

Edit: Ok hab es gerade probiert. Startet nicht. Selbes Fehlerbild wie bisher.
Hab am Anfang aber CHKDSK abgebrochen.

Edit2: Hab jetzt mal CHKDSK am Anfang laufen lassen, aber ändert auch nix :(

schrauber 27.07.2014 20:21
sieht nit nach Malware aus. Poste bitte nochmal ein frisches FRST log aus der Recovery.

Pochemu 27.07.2014 20:32
Diesmal kamen keine Fehlermeldungen



FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-07-2014
Ran by SYSTEM on MININT-P148JQT on 27-07-2014 21:29:43
Running from H:\
Platform: Windows 7 Home Premium (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.




==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [106496 2010-01-22] (NEC Electronics Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [750160 2014-07-03] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Winlogon: [Shell] explorer.exe [ ] ()
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\Default\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\Default User\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: EnhancedStorageShell -> {D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} =>  No File
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 1 (GFS Unread Stub) -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} =>  No File
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2 (GFS Stub) -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} =>  No File
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2.5 (GFS Unread Folder) -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} =>  No File
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 3 (GFS Folder) -> {16F3DD56-1AF5-4347-846D-7C10C4192619} =>  No File
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 4 (GFS Unread Mark) -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} =>  No File
ShellIconOverlayIdentifiers-x32: SharingPrivate -> {08244EE6-92F0-47f2-9FC9-929BAA2E7235} =>  No File

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2013-02-13] (Adobe Systems)
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-07-03] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-07-03] (Avira Operations GmbH & Co. KG)
S2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2014-06-26] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-03] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-03] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
S1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-05-25] (DT Soft Ltd)
S3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
S3 npusbio; C:\Windows\System32\Drivers\npusbio_x64.sys [38400 2012-07-09] ()
S3 SaiH075C; C:\Windows\System32\DRIVERS\SaiH075C.sys [171144 2007-05-01] (Saitek)
S3 SaiMini; C:\Windows\System32\DRIVERS\SaiMini.sys [22792 2010-08-10] (Saitek)
S3 SaiNtBus; C:\Windows\System32\drivers\SaiBus.sys [50056 2010-08-10] (Saitek)
S3 seehcri; C:\Windows\System32\DRIVERS\seehcri.sys [34032 2008-01-09] (Sony Ericsson Mobile Communications)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-27 13:42 - 2014-07-27 13:42 - 00067584 ____N () C:\bootex.log
2014-07-27 13:41 - 2014-07-27 13:41 - 00000000 __SHD () C:\found.001
2014-07-26 15:03 - 2011-02-26 06:19 - 02616320 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2014-07-24 19:34 - 2014-07-27 21:29 - 00000000 ____D () C:\FRST
2014-07-23 14:31 - 2014-07-23 14:31 - 00006656 ____N () C:\bootsqm.dat
2014-07-23 14:29 - 2014-07-23 14:29 - 00000000 __SHD () C:\found.000
2014-07-18 12:10 - 2014-06-19 03:12 - 02239488 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2014-07-18 12:10 - 2014-06-19 03:12 - 01366528 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2014-07-18 12:10 - 2014-06-19 03:12 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2014-07-18 12:10 - 2014-06-19 03:11 - 19277312 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-07-18 12:10 - 2014-06-19 03:11 - 00197120 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2014-07-18 12:10 - 2014-06-19 03:11 - 00097792 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 15369728 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 03959296 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 02650624 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 00452096 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 00281600 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 00255488 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2014-07-18 12:10 - 2014-06-19 03:09 - 01508864 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2014-07-18 12:10 - 2014-06-19 01:53 - 14368768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-18 12:10 - 2014-06-19 01:53 - 01766400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-18 12:10 - 2014-06-19 01:53 - 01141760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-18 12:10 - 2014-06-19 01:53 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-18 12:10 - 2014-06-19 01:53 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-18 12:10 - 2014-06-19 01:53 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 13732352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 02863616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 02051072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 01440768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-18 12:10 - 2014-06-19 01:52 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-18 12:10 - 2014-06-19 01:33 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2014-07-18 12:10 - 2014-06-19 01:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-18 12:10 - 2014-06-19 00:37 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2014-07-18 12:10 - 2014-06-19 00:34 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2014-07-18 12:10 - 2014-06-18 03:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\System32\osk.exe
2014-07-18 12:10 - 2014-06-18 02:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-18 12:10 - 2014-06-18 02:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2014-07-18 12:10 - 2014-05-30 09:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\System32\kerberos.dll
2014-07-18 12:10 - 2014-05-30 09:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\System32\schannel.dll
2014-07-18 12:10 - 2014-05-30 09:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\System32\msv1_0.dll
2014-07-18 12:10 - 2014-05-30 09:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
2014-07-18 12:10 - 2014-05-30 09:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\System32\wdigest.dll
2014-07-18 12:10 - 2014-05-30 09:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\System32\TSpkg.dll
2014-07-18 12:10 - 2014-05-30 09:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\System32\credssp.dll
2014-07-18 12:10 - 2014-05-30 08:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-18 12:10 - 2014-05-30 08:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-18 12:10 - 2014-05-30 08:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-18 12:10 - 2014-05-30 08:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-18 12:10 - 2014-05-30 08:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-18 12:10 - 2014-05-30 08:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-18 12:10 - 2014-05-30 08:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-18 12:09 - 2014-06-30 03:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2014-07-18 12:09 - 2014-06-30 03:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2014-07-18 12:09 - 2014-06-06 11:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\System32\qedit.dll
2014-07-18 12:09 - 2014-06-06 10:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-18 12:09 - 2014-06-05 15:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\System32\lsasrv.dll
2014-07-18 12:09 - 2014-06-05 15:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-18 12:09 - 2014-06-05 15:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-18 12:09 - 2014-05-30 07:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\afd.sys
2014-07-09 10:10 - 2014-07-09 10:10 - 00000000 ____D () C:\Users\Benutzername\AppData\Local\Adobe
2014-07-06 16:49 - 2014-07-06 16:49 - 00000000 ____D () C:\Program Files (x86)\Fraps

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-27 21:29 - 2014-07-24 19:34 - 00000000 ____D () C:\FRST
2014-07-27 13:43 - 2014-04-20 17:06 - 00017808 _____ () C:\Windows\setupact.log
2014-07-27 13:42 - 2014-07-27 13:42 - 00067584 ____N () C:\bootex.log
2014-07-27 13:41 - 2014-07-27 13:41 - 00000000 __SHD () C:\found.001
2014-07-23 15:04 - 2009-07-14 05:45 - 00015136 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-23 15:04 - 2009-07-14 05:45 - 00015136 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-23 15:01 - 2014-01-04 13:17 - 01844334 _____ () C:\Windows\WindowsUpdate.log
2014-07-23 15:00 - 2009-07-14 18:58 - 00699416 _____ () C:\Windows\System32\perfh007.dat
2014-07-23 15:00 - 2009-07-14 18:58 - 00149556 _____ () C:\Windows\System32\perfc007.dat
2014-07-23 15:00 - 2009-07-14 06:13 - 01620612 _____ () C:\Windows\System32\PerfStringBackup.INI
2014-07-23 14:31 - 2014-07-23 14:31 - 00006656 ____N () C:\bootsqm.dat
2014-07-23 14:29 - 2014-07-23 14:29 - 00000000 __SHD () C:\found.000
2014-07-22 19:15 - 2012-05-22 12:21 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-07-22 19:15 - 2012-05-15 17:02 - 00000000 ____D () C:\Users\Benutzername\AppData\Roaming\TS3Client
2014-07-22 14:20 - 2013-06-25 15:33 - 00000000 ____D () C:\Users\Benutzername\AppData\Local\Arma 3
2014-07-22 13:51 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-21 17:15 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-07-19 16:25 - 2014-06-20 15:52 - 00000000 ____D () C:\Users\Benutzername\Documents\Euro Truck Simulator 2
2014-07-19 11:42 - 2012-06-15 14:58 - 00000000 ____D () C:\ProgramData\Origin
2014-07-19 11:39 - 2012-06-15 14:59 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-07-19 01:21 - 2012-05-22 21:34 - 00000000 ____D () C:\Users\Benutzername\AppData\Roaming\vlc
2014-07-18 12:22 - 2009-07-14 05:45 - 00343568 _____ () C:\Windows\System32\FNTCACHE.DAT
2014-07-18 12:20 - 2014-04-29 14:38 - 00000000 ___SD () C:\Windows\System32\CompatTel
2014-07-18 12:20 - 2009-07-14 19:18 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-18 12:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-18 12:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\System32\Dism
2014-07-18 12:15 - 2012-07-02 18:46 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-07-18 12:14 - 2013-07-12 11:23 - 00000000 ____D () C:\Windows\System32\MRT
2014-07-18 12:12 - 2012-05-17 11:55 - 96441528 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2014-07-15 13:36 - 2012-05-15 16:57 - 00000000 ____D () C:\Program Files (x86)\TeamSpeak 3 Client
2014-07-09 10:10 - 2014-07-09 10:10 - 00000000 ____D () C:\Users\Benutzername\AppData\Local\Adobe
2014-07-09 09:47 - 2012-05-15 17:11 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-09 09:47 - 2012-05-15 17:11 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-08 11:10 - 2013-05-02 09:24 - 00042040 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avnetflt.sys
2014-07-06 16:49 - 2014-07-06 16:49 - 00000000 ____D () C:\Program Files (x86)\Fraps
2014-07-05 18:58 - 2012-05-15 17:28 - 00007653 _____ () C:\Users\Benutzername\AppData\Local\Resmon.ResmonCfg
2014-07-03 17:45 - 2013-03-27 14:03 - 00117712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avgntflt.sys
2014-06-30 03:09 - 2014-07-18 12:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2014-06-30 03:04 - 2014-07-18 12:09 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll

Some content of TEMP:
====================
C:\Users\Benutzername\AppData\Local\Temp\avgnt.exe


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe
[2014-07-26 15:03] - [2011-02-26 06:19] - 2616320 ____A (Microsoft Corporation) 0FB9C74046656D1579A64660AD67B746

C:\Windows\SysWOW64\explorer.exe IS MISSING <==== ATTENTION!.
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points  =========================


==================== Memory info ===========================

Percentage of memory in use: 9%
Total physical RAM: 8183.05 MB
Available physical RAM: 7382.37 MB
Total Pagefile: 8181.2 MB
Available Pagefile: 7376.9 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:931.41 GB) (Free:192.94 GB) NTFS
Drive d: (-) (Fixed) (Total:698.63 GB) (Free:143.66 GB) NTFS
Drive h: (STICK) (Removable) (Total:14.94 GB) (Free:14.94 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 38CA9B68)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 699 GB) (Disk ID: BDF1BDF1)
Partition 1: (Not Active) - (Size=699 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 15 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.


LastRegBack: 2014-07-21 17:08

==================== End Of Log ============================
--- --- ---

schrauber 27.07.2014 20:41
Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
HKLM-x32\...\Winlogon: [Shell] explorer.exe [ ] ()
cmd: copy C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe C:\Windows /f
cmd: copy C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe C:\Windows\SysWOW64
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Pochemu 27.07.2014 20:51
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 24-07-2014
Ran by SYSTEM at 2014-07-27 21:49:52 Run:2
Running from H:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
HKLM-x32\...\Winlogon: [Shell] explorer.exe [ ] ()
cmd: copy C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe C:\Windows /f
cmd: copy C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe C:\Windows\SysWOW64
*****************

HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value was restored successfully.

=========  copy C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe C:\Windows /f =========

Syntaxfehler.

========= End of CMD: =========


=========  copy C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe C:\Windows\SysWOW64 =========

        1 Datei(en) kopiert.

========= End of CMD: =========


==== End of Fixlog ====
Rechner startet nach wie vor nicht :(

schrauber 28.07.2014 18:00
frisches FRST log aus der Recovery bitte. So langsam wird es eng mit Ideen.

Pochemu 28.07.2014 20:06
Gibts ne Möglichkeit über ne Boot-CD (Stick) nen Scan zu starten?
Bzw. dass ich dann meine Daten von C: sichern kann und Windows neu aufsetzen?

Die Frage ist dann ob meine Sicherungsplatte D: nicht auch verseucht ist.


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-07-2014
Ran by SYSTEM on MININT-2PG7598 on 28-07-2014 21:03:59
Running from H:\
Platform: Windows 7 Home Premium (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.




==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [106496 2010-01-22] (NEC Electronics Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [750160 2014-07-03] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\Default\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\Default User\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: EnhancedStorageShell -> {D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} =>  No File
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 1 (GFS Unread Stub) -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} =>  No File
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2 (GFS Stub) -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} =>  No File
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2.5 (GFS Unread Folder) -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} =>  No File
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 3 (GFS Folder) -> {16F3DD56-1AF5-4347-846D-7C10C4192619} =>  No File
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 4 (GFS Unread Mark) -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} =>  No File
ShellIconOverlayIdentifiers-x32: SharingPrivate -> {08244EE6-92F0-47f2-9FC9-929BAA2E7235} =>  No File

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2013-02-13] (Adobe Systems)
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-07-03] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-07-03] (Avira Operations GmbH & Co. KG)
S2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2014-06-26] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-03] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-03] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
S1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-05-25] (DT Soft Ltd)
S3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
S3 npusbio; C:\Windows\System32\Drivers\npusbio_x64.sys [38400 2012-07-09] ()
S3 SaiH075C; C:\Windows\System32\DRIVERS\SaiH075C.sys [171144 2007-05-01] (Saitek)
S3 SaiMini; C:\Windows\System32\DRIVERS\SaiMini.sys [22792 2010-08-10] (Saitek)
S3 SaiNtBus; C:\Windows\System32\drivers\SaiBus.sys [50056 2010-08-10] (Saitek)
S3 seehcri; C:\Windows\System32\DRIVERS\seehcri.sys [34032 2008-01-09] (Sony Ericsson Mobile Communications)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-27 21:49 - 2011-02-26 06:19 - 02616320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2014-07-27 13:41 - 2014-07-27 13:41 - 00000000 __SHD () C:\found.001
2014-07-26 15:03 - 2011-02-26 06:19 - 02616320 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2014-07-24 19:34 - 2014-07-28 21:03 - 00000000 ____D () C:\FRST
2014-07-23 14:31 - 2014-07-23 14:31 - 00006656 ____N () C:\bootsqm.dat
2014-07-23 14:29 - 2014-07-23 14:29 - 00000000 __SHD () C:\found.000
2014-07-18 12:10 - 2014-06-19 03:12 - 02239488 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2014-07-18 12:10 - 2014-06-19 03:12 - 01366528 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2014-07-18 12:10 - 2014-06-19 03:12 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2014-07-18 12:10 - 2014-06-19 03:11 - 19277312 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-07-18 12:10 - 2014-06-19 03:11 - 00197120 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2014-07-18 12:10 - 2014-06-19 03:11 - 00097792 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 15369728 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 03959296 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 02650624 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 00452096 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 00281600 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 00255488 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2014-07-18 12:10 - 2014-06-19 03:10 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2014-07-18 12:10 - 2014-06-19 03:09 - 01508864 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2014-07-18 12:10 - 2014-06-19 01:53 - 14368768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-18 12:10 - 2014-06-19 01:53 - 01766400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-18 12:10 - 2014-06-19 01:53 - 01141760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-18 12:10 - 2014-06-19 01:53 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-18 12:10 - 2014-06-19 01:53 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-18 12:10 - 2014-06-19 01:53 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 13732352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 02863616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 02051072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 01440768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-18 12:10 - 2014-06-19 01:52 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-18 12:10 - 2014-06-19 01:52 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-18 12:10 - 2014-06-19 01:33 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2014-07-18 12:10 - 2014-06-19 01:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-18 12:10 - 2014-06-19 00:37 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2014-07-18 12:10 - 2014-06-19 00:34 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2014-07-18 12:10 - 2014-06-18 03:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\System32\osk.exe
2014-07-18 12:10 - 2014-06-18 02:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-18 12:10 - 2014-06-18 02:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2014-07-18 12:10 - 2014-05-30 09:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\System32\kerberos.dll
2014-07-18 12:10 - 2014-05-30 09:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\System32\schannel.dll
2014-07-18 12:10 - 2014-05-30 09:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\System32\msv1_0.dll
2014-07-18 12:10 - 2014-05-30 09:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
2014-07-18 12:10 - 2014-05-30 09:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\System32\wdigest.dll
2014-07-18 12:10 - 2014-05-30 09:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\System32\TSpkg.dll
2014-07-18 12:10 - 2014-05-30 09:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\System32\credssp.dll
2014-07-18 12:10 - 2014-05-30 08:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-18 12:10 - 2014-05-30 08:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-18 12:10 - 2014-05-30 08:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-18 12:10 - 2014-05-30 08:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-18 12:10 - 2014-05-30 08:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-18 12:10 - 2014-05-30 08:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-18 12:10 - 2014-05-30 08:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-18 12:09 - 2014-06-30 03:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2014-07-18 12:09 - 2014-06-30 03:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2014-07-18 12:09 - 2014-06-06 11:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\System32\qedit.dll
2014-07-18 12:09 - 2014-06-06 10:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-18 12:09 - 2014-06-05 15:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\System32\lsasrv.dll
2014-07-18 12:09 - 2014-06-05 15:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-18 12:09 - 2014-06-05 15:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-18 12:09 - 2014-05-30 07:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\afd.sys
2014-07-09 10:10 - 2014-07-09 10:10 - 00000000 ____D () C:\Users\Benutzername\AppData\Local\Adobe
2014-07-06 16:49 - 2014-07-06 16:49 - 00000000 ____D () C:\Program Files (x86)\Fraps

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-28 21:03 - 2014-07-24 19:34 - 00000000 ____D () C:\FRST
2014-07-27 20:50 - 2014-04-20 17:06 - 00018200 _____ () C:\Windows\setupact.log
2014-07-27 13:41 - 2014-07-27 13:41 - 00000000 __SHD () C:\found.001
2014-07-23 15:04 - 2009-07-14 05:45 - 00015136 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-23 15:04 - 2009-07-14 05:45 - 00015136 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-23 15:01 - 2014-01-04 13:17 - 01844334 _____ () C:\Windows\WindowsUpdate.log
2014-07-23 15:00 - 2009-07-14 18:58 - 00699416 _____ () C:\Windows\System32\perfh007.dat
2014-07-23 15:00 - 2009-07-14 18:58 - 00149556 _____ () C:\Windows\System32\perfc007.dat
2014-07-23 15:00 - 2009-07-14 06:13 - 01620612 _____ () C:\Windows\System32\PerfStringBackup.INI
2014-07-23 14:31 - 2014-07-23 14:31 - 00006656 ____N () C:\bootsqm.dat
2014-07-23 14:29 - 2014-07-23 14:29 - 00000000 __SHD () C:\found.000
2014-07-22 19:15 - 2012-05-22 12:21 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-07-22 19:15 - 2012-05-15 17:02 - 00000000 ____D () C:\Users\Benutzername\AppData\Roaming\TS3Client
2014-07-22 14:20 - 2013-06-25 15:33 - 00000000 ____D () C:\Users\Benutzername\AppData\Local\Arma 3
2014-07-22 13:51 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-21 17:15 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-07-19 16:25 - 2014-06-20 15:52 - 00000000 ____D () C:\Users\Benutzername\Documents\Euro Truck Simulator 2
2014-07-19 11:42 - 2012-06-15 14:58 - 00000000 ____D () C:\ProgramData\Origin
2014-07-19 11:39 - 2012-06-15 14:59 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-07-19 01:21 - 2012-05-22 21:34 - 00000000 ____D () C:\Users\Benutzername\AppData\Roaming\vlc
2014-07-18 12:22 - 2009-07-14 05:45 - 00343568 _____ () C:\Windows\System32\FNTCACHE.DAT
2014-07-18 12:20 - 2014-04-29 14:38 - 00000000 ___SD () C:\Windows\System32\CompatTel
2014-07-18 12:20 - 2009-07-14 19:18 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-18 12:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-18 12:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\System32\Dism
2014-07-18 12:15 - 2012-07-02 18:46 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-07-18 12:14 - 2013-07-12 11:23 - 00000000 ____D () C:\Windows\System32\MRT
2014-07-18 12:12 - 2012-05-17 11:55 - 96441528 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2014-07-15 13:36 - 2012-05-15 16:57 - 00000000 ____D () C:\Program Files (x86)\TeamSpeak 3 Client
2014-07-09 10:10 - 2014-07-09 10:10 - 00000000 ____D () C:\Users\Benutzername\AppData\Local\Adobe
2014-07-09 09:47 - 2012-05-15 17:11 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-09 09:47 - 2012-05-15 17:11 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-08 11:10 - 2013-05-02 09:24 - 00042040 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avnetflt.sys
2014-07-06 16:49 - 2014-07-06 16:49 - 00000000 ____D () C:\Program Files (x86)\Fraps
2014-07-05 18:58 - 2012-05-15 17:28 - 00007653 _____ () C:\Users\Benutzername\AppData\Local\Resmon.ResmonCfg
2014-07-03 17:45 - 2013-03-27 14:03 - 00117712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avgntflt.sys
2014-06-30 03:09 - 2014-07-18 12:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2014-06-30 03:04 - 2014-07-18 12:09 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll

Some content of TEMP:
====================
C:\Users\Benutzername\AppData\Local\Temp\avgnt.exe


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe
[2014-07-26 15:03] - [2011-02-26 06:19] - 2616320 ____A (Microsoft Corporation) 0FB9C74046656D1579A64660AD67B746

C:\Windows\SysWOW64\explorer.exe
[2014-07-27 21:49] - [2011-02-26 06:19] - 2616320 ____A (Microsoft Corporation) 0FB9C74046656D1579A64660AD67B746

C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points  =========================


==================== Memory info ===========================

Percentage of memory in use: 9%
Total physical RAM: 8183.05 MB
Available physical RAM: 7385.82 MB
Total Pagefile: 8181.2 MB
Available Pagefile: 7377.3 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:931.41 GB) (Free:192.94 GB) NTFS
Drive d: (-) (Fixed) (Total:698.63 GB) (Free:143.66 GB) NTFS
Drive h: (STICK) (Removable) (Total:14.94 GB) (Free:14.94 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 38CA9B68)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 699 GB) (Disk ID: BDF1BDF1)
Partition 1: (Not Active) - (Size=699 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 15 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.


LastRegBack: 2014-07-21 17:08

==================== End Of Log ============================
--- --- ---


Alle Zeitangaben in WEZ +1. Es ist jetzt 08:19 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131