Trojaner-Board - Windows 7: Logdatei zur Analyse

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Windows 7: Logdatei zur Analyse (https://www.trojaner-board.de/173436-windows-7-logdatei-analyse.html)

Windows 7: Logdatei zur Analyse

Hallo,
ich kann meinen PC nicht mehr hochfahren, folgendes gibt die Logdatei aus. Könnt ihr mir bitte weiterhelfen, was zu tun ist?

vielen dank vorab für die Hilfe!

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:23-11-2015

Ran by SYSTEM on MININT-ERO2OK9 (24-11-2015 19:37:31)

Running from H:\

Platform: Windows 7 Home Premium (X64) Language: Englisch (USA)

Internet Explorer Version 11

Boot Mode: Recovery

Default: ControlSet001
 ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.
 

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Registry (Whitelisted) ===========================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6463592 2012-02-13] (Realtek Semiconductor)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2885904 2012-02-23] (Synaptics Incorporated)

HKLM\...\Run: [SetDefault] => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [44880 2011-12-19] (Hewlett-Packard Development Company, L.P.)

HKLM\...\Run: [CIS_{81EFDD93-DBBE-415B-BE6E-49B9664E3E82}] => "C:\ProgramData\cisC2.exe" --PostUninstall {81EFDD93-DBBE-415B-BE6E-49B9664E3E82}

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [557768 2015-02-03] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [PDF Complete] => C:\Program Files (x86)\PDF Complete\pdfsty.exe [684024 2012-02-19] (PDF Complete Inc)

HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-11-05] (Samsung Electronics Co., Ltd.)

HKLM-x32\...\Run: [tvncontrol] => "C:\Program Files (x86)\Common Files\COMODO\GeekBuddyRSP.exe" -controlservice -slave

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5512912 2015-04-10] (Avast Software s.r.o.)

HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2694320 2015-02-15] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-06-08] (Oracle Corporation)

HKLM\...\RunOnce: [*Restore] => C:\Windows\system32\rstrui.exe [296960 2015-09-28] (Microsoft Corporation)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\frank\...\Run: [KiesPreload] => C:\Program Files (x86)\Samsung\Kies\Kies.exe [1564528 2013-11-05] (Samsung)

HKU\frank\...\Run: [KiesAirMessage] => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup

HKU\frank\...\Run: [WA5H2V3YUCUB0IWZAIUQZUDADO] => C:\4gEJsVyiA73\58A598376D5.exe /q

HKU\frank\...\Run: [] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [845168 2013-11-05] (Samsung)

HKU\frank\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [53655680 2015-07-28] (Skype Technologies S.A.)

HKU\frank\...\Run: [Dropbox Update] => C:\Users\frank\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-22] (Dropbox, Inc.)

HKU\frank\...\Run: [BingSvc] => C:\Users\frank\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-11-19] (© 2015 Microsoft Corporation)

Startup: C:\Users\frank\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-11-15]

ShortcutTarget: Dropbox.lnk ->  (No File)
 

==================== Services (Whitelisted) ========================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-04-10] (Avast Software s.r.o.)

S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-07] (Intel Corporation)

S2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1134584 2012-02-19] (PDF Complete Inc)

S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)

S2 HitmanPro37CrusaderBoot; "F:\HitmanPro_x64.exe" /crusader:boot [X]
 

===================== Drivers (Whitelisted) ==========================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

S2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-04-10] ()

S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [88408 2015-04-10] (Avast Software s.r.o.)

S1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-04-10] (Avast Software s.r.o.)

S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-04-10] ()

S1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-04-10] (Avast Software s.r.o.)

S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-04-10] (Avast Software s.r.o.)

S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [136752 2015-04-10] (Avast Software s.r.o.)

S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [271200 2015-04-10] ()

S3 BthAvrcp; C:\Windows\System32\DRIVERS\BthAvrcp.sys [29184 2009-08-12] (CSR, plc)

S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)

S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-02-05] ()

S3 RSP2STOR; C:\Windows\System32\DRIVERS\RtsP2Stor.sys [259688 2011-10-27] (Realtek Semiconductor Corp.)

S3 SmbDrv; C:\Windows\system32\drivers\Smb_driver.sys [21264 2012-02-23] (Synaptics Incorporated)
 

==================== NetSvcs (Whitelisted) ===================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 

==================== One Month Created files and folders ========
 

(If an entry is included in the fixlist, the file/folder will be moved.)
 

2015-11-24 19:37 - 2015-11-24 19:37 - 00000000 ____D C:\FRST

2015-11-21 04:24 - 2015-11-24 10:01 - 284250998 _____ C:\Windows\MEMORY.DMP

2015-11-12 10:53 - 2015-10-01 10:00 - 00275456 _____ (Microsoft Corporation) C:\Windows\System32\InkEd.dll

2015-11-12 10:53 - 2015-10-01 09:50 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
 

==================== One Month Modified files and folders ========
 

(If an entry is included in the fixlist, the file/folder will be moved.)
 

2015-11-24 10:01 - 2010-11-20 19:47 - 01180032 _____ C:\Windows\PFRO.log

2015-11-21 04:22 - 2013-11-11 09:05 - 00000000 ____D C:\ProgramData\Microsoft Help

2015-11-21 04:19 - 2012-03-15 05:45 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-11-21 04:11 - 2015-06-22 03:13 - 00001224 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1640999226-3979880844-3937512731-1000UA.job

2015-11-21 04:10 - 2015-06-22 03:13 - 00001172 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1640999226-3979880844-3937512731-1000Core.job

2015-11-21 04:10 - 2013-04-11 11:47 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-11-21 04:10 - 2012-12-22 05:09 - 02055289 _____ C:\Windows\WindowsUpdate.log

2015-11-19 10:58 - 2009-07-13 20:45 - 00031248 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-11-19 10:58 - 2009-07-13 20:45 - 00031248 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-11-19 10:51 - 2013-11-24 01:32 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update

2015-11-19 10:50 - 2012-12-28 15:44 - 00000000 ____D C:\Users\frank\AppData\Local\CrashDumps

2015-11-16 13:01 - 2012-12-22 05:17 - 00000000 ____D C:\Users\frank\AppData\Roaming\Skype

2015-11-15 13:33 - 2012-12-24 04:56 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log

2015-11-15 08:55 - 2014-09-09 11:13 - 00000000 ___RD C:\Users\frank\Dropbox

2015-11-15 08:55 - 2014-09-09 11:10 - 00000000 ____D C:\Users\frank\AppData\Roaming\Dropbox

2015-11-15 08:50 - 2012-03-15 05:56 - 00000000 ____D C:\ProgramData\PDFC

2015-11-12 10:43 - 2012-03-15 05:45 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-11-12 10:43 - 2012-03-15 05:45 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-11-12 10:43 - 2012-03-15 05:45 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2015-11-10 09:21 - 2012-03-15 14:01 - 00700134 _____ C:\Windows\System32\perfh007.dat

2015-11-10 09:21 - 2012-03-15 14:01 - 00149984 _____ C:\Windows\System32\perfc007.dat

2015-11-10 09:21 - 2009-07-13 21:13 - 01622300 _____ C:\Windows\System32\PerfStringBackup.INI

2015-11-07 01:30 - 2009-07-13 20:51 - 00109347 _____ C:\Windows\setupact.log

2015-11-03 11:23 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache

2015-11-01 03:55 - 2015-07-13 11:43 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task

2015-11-01 03:53 - 2013-07-30 14:16 - 00000000 ____D C:\Users\frank\AppData\Local\Adobe

2015-10-25 01:29 - 2012-12-22 05:17 - 00000000 ____D C:\Users\frank\AppData\Local\PDFC
 

Files to move or delete:

====================

C:\ProgramData\0179173.bat

C:\ProgramData\0179173.pad

C:\ProgramData\0179173.reg
 
 

Some files in TEMP:

====================

C:\Users\frank\AppData\Local\Temp\2jfuweif.exe

C:\Users\frank\AppData\Local\Temp\5QC20EE.exe

C:\Users\frank\AppData\Local\Temp\7CCAAA0.exe

C:\Users\frank\AppData\Local\Temp\7CcE639.exe

C:\Users\frank\AppData\Local\Temp\bfl5yokj.dll

C:\Users\frank\AppData\Local\Temp\BingSvc.exe

C:\Users\frank\AppData\Local\Temp\bitool.dll

C:\Users\frank\AppData\Local\Temp\BSvcProcessor.exe

C:\Users\frank\AppData\Local\Temp\BSvcUpdater.exe

C:\Users\frank\AppData\Local\Temp\Buwuharoyig.exe

C:\Users\frank\AppData\Local\Temp\C7C9C0F.exe

C:\Users\frank\AppData\Local\Temp\C7CAADE.exe

C:\Users\frank\AppData\Local\Temp\C7cB846.exe

C:\Users\frank\AppData\Local\Temp\C7CCB49.exe

C:\Users\frank\AppData\Local\Temp\cCCA5FE.exe

C:\Users\frank\AppData\Local\Temp\cCcA8CC.exe

C:\Users\frank\AppData\Local\Temp\CcCB8F2.exe

C:\Users\frank\AppData\Local\Temp\CcCF324.exe

C:\Users\frank\AppData\Local\Temp\DefaultPack.EXE

C:\Users\frank\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmphlxbla.dll

C:\Users\frank\AppData\Local\Temp\DseShExt-x64.dll

C:\Users\frank\AppData\Local\Temp\DseShExt-x86.dll

C:\Users\frank\AppData\Local\Temp\E3O5649.exe

C:\Users\frank\AppData\Local\Temp\Extract.exe

C:\Users\frank\AppData\Local\Temp\f1pmraph.dll

C:\Users\frank\AppData\Local\Temp\HitmanPro.exe

C:\Users\frank\AppData\Local\Temp\HPHelpUpdater.exe

C:\Users\frank\AppData\Local\Temp\jfwnpvo1.dll

C:\Users\frank\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe

C:\Users\frank\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe

C:\Users\frank\AppData\Local\Temp\jre-8u51-windows-au.exe

C:\Users\frank\AppData\Local\Temp\jre-8u66-windows-au.exe

C:\Users\frank\AppData\Local\Temp\libnspr4.dll

C:\Users\frank\AppData\Local\Temp\nsa68ED.exe

C:\Users\frank\AppData\Local\Temp\nsaE40B.exe

C:\Users\frank\AppData\Local\Temp\nsc5602.exe

C:\Users\frank\AppData\Local\Temp\nsc66C6.exe

C:\Users\frank\AppData\Local\Temp\nscB349.exe

C:\Users\frank\AppData\Local\Temp\nsgA786.exe

C:\Users\frank\AppData\Local\Temp\nsgADE.exe

C:\Users\frank\AppData\Local\Temp\nsl5F1D.exe

C:\Users\frank\AppData\Local\Temp\nsm5D91.exe

C:\Users\frank\AppData\Local\Temp\nsmBC10.exe

C:\Users\frank\AppData\Local\Temp\nsv732B.exe

C:\Users\frank\AppData\Local\Temp\nsvDBB1.exe

C:\Users\frank\AppData\Local\Temp\nsw25BC.exe

C:\Users\frank\AppData\Local\Temp\nswAB8A.exe

C:\Users\frank\AppData\Local\Temp\Resource.exe

C:\Users\frank\AppData\Local\Temp\SDShelEx-win32.dll

C:\Users\frank\AppData\Local\Temp\SDShelEx-x64.dll

C:\Users\frank\AppData\Local\Temp\Show-Password_1030-8100.exe

C:\Users\frank\AppData\Local\Temp\SkypeSetup.exe

C:\Users\frank\AppData\Local\Temp\SP56942.exe

C:\Users\frank\AppData\Local\Temp\sp58915.exe

C:\Users\frank\AppData\Local\Temp\SP59202.exe

C:\Users\frank\AppData\Local\Temp\sp64126.exe

C:\Users\frank\AppData\Local\Temp\UM7C0CE.exe

C:\Users\frank\AppData\Local\Temp\uninst1.exe

C:\Users\frank\AppData\Local\Temp\UninstallHPSA.exe

C:\Users\frank\AppData\Local\Temp\vlc-2.1.2-win64.exe

C:\Users\frank\AppData\Local\Temp\vlc-2.1.4-win64.exe

C:\Users\frank\AppData\Local\Temp\vlc-2.1.5-win64.exe
 
 

==================== Known DLLs (Whitelisted) =========================
 
 

==================== Bamital & volsnap =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\dnsapi.dll => MD5 is legit

C:\Windows\SysWOW64\dnsapi.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 

==================== EXE Association (Whitelisted) =============
 
 

==================== Restore Points =========================
 

Restore point date: 2015-10-22 11:19

Restore point date: 2015-10-23 05:12

Restore point date: 2015-10-30 08:02

Restore point date: 2015-11-03 07:54

Restore point date: 2015-11-07 01:44

Restore point date: 2015-11-10 09:35

Restore point date: 2015-11-16 10:54

Restore point date: 2015-11-19 11:15

Restore point date: 2015-11-21 04:14

Restore point date: 2015-11-21 04:15
 

==================== Memory info =========================== 
 

Percentage of memory in use: 19%

Total physical RAM: 3996.36 MB

Available physical RAM: 3229.55 MB

Total Virtual: 3994.51 MB

Available Virtual: 3224.01 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:445.67 GB) (Free:194.35 GB) NTFS ==>[system with boot components (obtained from drive)]

Drive e: (Recovery) (Fixed) (Total:19.8 GB) (Free:2.11 GB) NTFS ==>[system with boot components (obtained from drive)]

Drive f: (HP_TOOLS) (Fixed) (Total:0.1 GB) (Free:0.08 GB) FAT32

Drive h: () (Removable) (Total:0.94 GB) (Free:0.93 GB) FAT

Drive x: (Boot) (Fixed) (Total:0.25 GB) (Free:0.25 GB) NTFS

Drive y: (SYSTEM) (Fixed) (Total:0.19 GB) (Free:0.16 GB) NTFS ==>[system with boot components (obtained from drive)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: E7E8DEA5)

Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=445.7 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=19.8 GB) - (Type=07 NTFS)

Partition 4: (Not Active) - (Size=103 MB) - (Type=0C)
 

========================================================

Disk: 1 (Size: 961 MB) (Disk ID: 9866BAFB)

Partition 1: (Active) - (Size=961 MB) - (Type=06)
 
 

LastRegBack: 2015-11-03 11:10
 

==================== End of FRST.txt ============================

Hi,

definier mal bitte "kannst nicht mehr hochfahren".

Hi,
sorry!

Ich hatte meinen Laptop längere Zeit nicht mehr ganz runtergefahren. Als ich das vor 2 Tagen gemacht habe konnte ich ihn nicht mehr gewohnt starten.

Beim anschalten des PC´s:
- Windows wirt gestartet,
- Blauer Bildschirm: "a problem has been deteced and windows has been shut down to prevent damage"

In allen 3 abgesicherten Modis fährt der Pc bis zur folgenden Datei windows\system 32\drivers\aswRvrt.sys hoch.

System reparieren -> system repraratur -> keine Fehler gefunden -> Neustart -> gleiches Problem wie oben beschrieben

Jaja, unser allseits geliebtes Avast....

Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

HKLM\...\Run: [CIS_{81EFDD93-DBBE-415B-BE6E-49B9664E3E82}] => "C:\ProgramData\cisC2.exe" --PostUninstall {81EFDD93-DBBE-415B-BE6E-49B9664E3E82}

HKU\frank\...\Run: [WA5H2V3YUCUB0IWZAIUQZUDADO] => C:\4gEJsVyiA73\58A598376D5.exe /q

C:\ProgramData\0179173.bat

C:\ProgramData\0179173.pad

C:\ProgramData\0179173.reg

C:\ProgramData\cisC2.exe

C:\4gEJsVyiA73

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

Starte deinen Rechner erneut in die Reparaturoptionen
Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Hallo Schrauber,

danke für deine Antwort.
ich komme gar nicht auf den Deskop, frage mich daher gerade wie ich in den"ausführen modus" komme.

Kannst du bitte noch einen Satz dazu sagen?

Danke1

Du musst das Script auf einem andern Rechner erstellen und dann auf dem Stick speichern :)

Fixlog.txt

Code:

Fix result of Farbar Recovery Scan Tool (x64) Version:23-11-2015

Ran by SYSTEM (2015-12-01 21:44:21) Run:2

Running from H:\

Boot Mode: Recovery

==============================================
 

fixlist content:

*****************

HKLM\...\Run: [CIS_{81EFDD93-DBBE-415B-BE6E-49B9664E3E82}] => "C:\ProgramData\cisC2.exe" --PostUninstall {81EFDD93-DBBE-415B-BE6E-49B9664E3E82}

HKU\frank\...\Run: [WA5H2V3YUCUB0IWZAIUQZUDADO] => C:\4gEJsVyiA73\58A598376D5.exe /q

C:\ProgramData\0179173.bat

C:\ProgramData\0179173.pad

C:\ProgramData\0179173.reg

C:\ProgramData\cisC2.exe

C:\4gEJsVyiA73

         

*****************
 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\CIS_{81EFDD93-DBBE-415B-BE6E-49B9664E3E82} => value removed successfully

HKU\frank\Software\Microsoft\Windows\CurrentVersion\Run\\WA5H2V3YUCUB0IWZAIUQZUDADO => value removed successfully

C:\ProgramData\0179173.bat => moved successfully

C:\ProgramData\0179173.pad => moved successfully

C:\ProgramData\0179173.reg => moved successfully

"C:\ProgramData\cisC2.exe" => not found.

C:\4gEJsVyiA73 => moved successfully
 

==== End of Fixlog 21:44:22 ====

die neue Fixlog (im Anschluss erstellt):

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:23-11-2015

Ran by SYSTEM on MININT-0VMR1MK (01-12-2015 22:01:12)

Running from H:\

Platform: Windows 7 Home Premium (X64) Language: Englisch (USA)

Internet Explorer Version 11

Boot Mode: Recovery

Default: ControlSet001
 ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.
 

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Registry (Whitelisted) ===========================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6463592 2012-02-13] (Realtek Semiconductor)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2885904 2012-02-23] (Synaptics Incorporated)

HKLM\...\Run: [SetDefault] => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [44880 2011-12-19] (Hewlett-Packard Development Company, L.P.)

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [557768 2015-02-03] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [PDF Complete] => C:\Program Files (x86)\PDF Complete\pdfsty.exe [684024 2012-02-19] (PDF Complete Inc)

HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-11-05] (Samsung Electronics Co., Ltd.)

HKLM-x32\...\Run: [tvncontrol] => "C:\Program Files (x86)\Common Files\COMODO\GeekBuddyRSP.exe" -controlservice -slave

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5512912 2015-04-10] (Avast Software s.r.o.)

HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2694320 2015-02-15] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-06-08] (Oracle Corporation)

HKLM\...\RunOnce: [*Restore] => C:\Windows\system32\rstrui.exe [296960 2015-09-28] (Microsoft Corporation)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\frank\...\Run: [KiesPreload] => C:\Program Files (x86)\Samsung\Kies\Kies.exe [1564528 2013-11-05] (Samsung)

HKU\frank\...\Run: [KiesAirMessage] => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup

HKU\frank\...\Run: [] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [845168 2013-11-05] (Samsung)

HKU\frank\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [53655680 2015-07-28] (Skype Technologies S.A.)

HKU\frank\...\Run: [Dropbox Update] => C:\Users\frank\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-22] (Dropbox, Inc.)

HKU\frank\...\Run: [BingSvc] => C:\Users\frank\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-11-19] (© 2015 Microsoft Corporation)

Startup: C:\Users\frank\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-11-15]

ShortcutTarget: Dropbox.lnk ->  (No File)
 

==================== Services (Whitelisted) ========================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-04-10] (Avast Software s.r.o.)

S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-07] (Intel Corporation)

S2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1134584 2012-02-19] (PDF Complete Inc)

S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)

S2 HitmanPro37CrusaderBoot; "F:\HitmanPro_x64.exe" /crusader:boot [X]
 

===================== Drivers (Whitelisted) ==========================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

S2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-04-10] ()

S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [88408 2015-04-10] (Avast Software s.r.o.)

S1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-04-10] (Avast Software s.r.o.)

S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-04-10] ()

S1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-04-10] (Avast Software s.r.o.)

S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-04-10] (Avast Software s.r.o.)

S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [136752 2015-04-10] (Avast Software s.r.o.)

S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [271200 2015-04-10] ()

S3 BthAvrcp; C:\Windows\System32\DRIVERS\BthAvrcp.sys [29184 2009-08-12] (CSR, plc)

S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)

S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-02-05] ()

S3 RSP2STOR; C:\Windows\System32\DRIVERS\RtsP2Stor.sys [259688 2011-10-27] (Realtek Semiconductor Corp.)

S3 SmbDrv; C:\Windows\system32\drivers\Smb_driver.sys [21264 2012-02-23] (Synaptics Incorporated)
 

==================== NetSvcs (Whitelisted) ===================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 

==================== One Month Created files and folders ========
 

(If an entry is included in the fixlist, the file/folder will be moved.)
 

2015-11-24 19:37 - 2015-12-01 22:01 - 00000000 ____D C:\FRST

2015-11-21 04:24 - 2015-12-01 12:58 - 352763107 _____ C:\Windows\MEMORY.DMP

2015-11-12 10:53 - 2015-10-01 10:00 - 00275456 _____ (Microsoft Corporation) C:\Windows\System32\InkEd.dll

2015-11-12 10:53 - 2015-10-01 09:50 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
 

==================== One Month Modified files and folders ========
 

(If an entry is included in the fixlist, the file/folder will be moved.)
 

2015-12-01 12:58 - 2010-11-20 19:47 - 01380736 _____ C:\Windows\PFRO.log

2015-11-21 04:22 - 2013-11-11 09:05 - 00000000 ____D C:\ProgramData\Microsoft Help

2015-11-21 04:22 - 2012-12-22 05:09 - 02055289 _____ C:\Windows\WindowsUpdate.log

2015-11-21 04:19 - 2012-03-15 05:45 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-11-21 04:11 - 2015-06-22 03:13 - 00001224 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1640999226-3979880844-3937512731-1000UA.job

2015-11-21 04:10 - 2015-06-22 03:13 - 00001172 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1640999226-3979880844-3937512731-1000Core.job

2015-11-21 04:10 - 2013-04-11 11:47 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-11-19 10:58 - 2009-07-13 20:45 - 00031248 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-11-19 10:58 - 2009-07-13 20:45 - 00031248 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-11-19 10:51 - 2013-11-24 01:32 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update

2015-11-19 10:50 - 2012-12-28 15:44 - 00000000 ____D C:\Users\frank\AppData\Local\CrashDumps

2015-11-16 13:01 - 2012-12-22 05:17 - 00000000 ____D C:\Users\frank\AppData\Roaming\Skype

2015-11-15 13:33 - 2012-12-24 04:56 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log

2015-11-15 08:55 - 2014-09-09 11:13 - 00000000 ___RD C:\Users\frank\Dropbox

2015-11-15 08:55 - 2014-09-09 11:10 - 00000000 ____D C:\Users\frank\AppData\Roaming\Dropbox

2015-11-15 08:50 - 2012-03-15 05:56 - 00000000 ____D C:\ProgramData\PDFC

2015-11-12 10:43 - 2012-03-15 05:45 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-11-12 10:43 - 2012-03-15 05:45 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-11-12 10:43 - 2012-03-15 05:45 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2015-11-10 09:21 - 2012-03-15 14:01 - 00700134 _____ C:\Windows\System32\perfh007.dat

2015-11-10 09:21 - 2012-03-15 14:01 - 00149984 _____ C:\Windows\System32\perfc007.dat

2015-11-10 09:21 - 2009-07-13 21:13 - 01622300 _____ C:\Windows\System32\PerfStringBackup.INI

2015-11-07 01:30 - 2009-07-13 20:51 - 00109347 _____ C:\Windows\setupact.log

2015-11-03 11:23 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache

2015-11-01 03:55 - 2015-07-13 11:43 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task

2015-11-01 03:53 - 2013-07-30 14:16 - 00000000 ____D C:\Users\frank\AppData\Local\Adobe
 

Some files in TEMP:

====================

C:\Users\frank\AppData\Local\Temp\2jfuweif.exe

C:\Users\frank\AppData\Local\Temp\5QC20EE.exe

C:\Users\frank\AppData\Local\Temp\7CCAAA0.exe

C:\Users\frank\AppData\Local\Temp\7CcE639.exe

C:\Users\frank\AppData\Local\Temp\bfl5yokj.dll

C:\Users\frank\AppData\Local\Temp\BingSvc.exe

C:\Users\frank\AppData\Local\Temp\bitool.dll

C:\Users\frank\AppData\Local\Temp\BSvcProcessor.exe

C:\Users\frank\AppData\Local\Temp\BSvcUpdater.exe

C:\Users\frank\AppData\Local\Temp\Buwuharoyig.exe

C:\Users\frank\AppData\Local\Temp\C7C9C0F.exe

C:\Users\frank\AppData\Local\Temp\C7CAADE.exe

C:\Users\frank\AppData\Local\Temp\C7cB846.exe

C:\Users\frank\AppData\Local\Temp\C7CCB49.exe

C:\Users\frank\AppData\Local\Temp\cCCA5FE.exe

C:\Users\frank\AppData\Local\Temp\cCcA8CC.exe

C:\Users\frank\AppData\Local\Temp\CcCB8F2.exe

C:\Users\frank\AppData\Local\Temp\CcCF324.exe

C:\Users\frank\AppData\Local\Temp\DefaultPack.EXE

C:\Users\frank\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmphlxbla.dll

C:\Users\frank\AppData\Local\Temp\DseShExt-x64.dll

C:\Users\frank\AppData\Local\Temp\DseShExt-x86.dll

C:\Users\frank\AppData\Local\Temp\E3O5649.exe

C:\Users\frank\AppData\Local\Temp\Extract.exe

C:\Users\frank\AppData\Local\Temp\f1pmraph.dll

C:\Users\frank\AppData\Local\Temp\HitmanPro.exe

C:\Users\frank\AppData\Local\Temp\HPHelpUpdater.exe

C:\Users\frank\AppData\Local\Temp\jfwnpvo1.dll

C:\Users\frank\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe

C:\Users\frank\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe

C:\Users\frank\AppData\Local\Temp\jre-8u51-windows-au.exe

C:\Users\frank\AppData\Local\Temp\jre-8u66-windows-au.exe

C:\Users\frank\AppData\Local\Temp\libnspr4.dll

C:\Users\frank\AppData\Local\Temp\nsa68ED.exe

C:\Users\frank\AppData\Local\Temp\nsaE40B.exe

C:\Users\frank\AppData\Local\Temp\nsc5602.exe

C:\Users\frank\AppData\Local\Temp\nsc66C6.exe

C:\Users\frank\AppData\Local\Temp\nscB349.exe

C:\Users\frank\AppData\Local\Temp\nsgA786.exe

C:\Users\frank\AppData\Local\Temp\nsgADE.exe

C:\Users\frank\AppData\Local\Temp\nsl5F1D.exe

C:\Users\frank\AppData\Local\Temp\nsm5D91.exe

C:\Users\frank\AppData\Local\Temp\nsmBC10.exe

C:\Users\frank\AppData\Local\Temp\nsv732B.exe

C:\Users\frank\AppData\Local\Temp\nsvDBB1.exe

C:\Users\frank\AppData\Local\Temp\nsw25BC.exe

C:\Users\frank\AppData\Local\Temp\nswAB8A.exe

C:\Users\frank\AppData\Local\Temp\Resource.exe

C:\Users\frank\AppData\Local\Temp\SDShelEx-win32.dll

C:\Users\frank\AppData\Local\Temp\SDShelEx-x64.dll

C:\Users\frank\AppData\Local\Temp\Show-Password_1030-8100.exe

C:\Users\frank\AppData\Local\Temp\SkypeSetup.exe

C:\Users\frank\AppData\Local\Temp\SP56942.exe

C:\Users\frank\AppData\Local\Temp\sp58915.exe

C:\Users\frank\AppData\Local\Temp\SP59202.exe

C:\Users\frank\AppData\Local\Temp\sp64126.exe

C:\Users\frank\AppData\Local\Temp\UM7C0CE.exe

C:\Users\frank\AppData\Local\Temp\uninst1.exe

C:\Users\frank\AppData\Local\Temp\UninstallHPSA.exe

C:\Users\frank\AppData\Local\Temp\vlc-2.1.2-win64.exe

C:\Users\frank\AppData\Local\Temp\vlc-2.1.4-win64.exe

C:\Users\frank\AppData\Local\Temp\vlc-2.1.5-win64.exe
 
 

==================== Known DLLs (Whitelisted) =========================
 
 

==================== Bamital & volsnap =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\dnsapi.dll => MD5 is legit

C:\Windows\SysWOW64\dnsapi.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 

==================== EXE Association (Whitelisted) =============
 
 

==================== Restore Points =========================
 

Restore point date: 2015-10-22 11:19

Restore point date: 2015-10-23 05:12

Restore point date: 2015-10-30 08:02

Restore point date: 2015-11-03 07:54

Restore point date: 2015-11-07 01:44

Restore point date: 2015-11-10 09:35

Restore point date: 2015-11-16 10:54

Restore point date: 2015-11-19 11:15

Restore point date: 2015-11-21 04:14

Restore point date: 2015-11-21 04:15
 

==================== Memory info =========================== 
 

Percentage of memory in use: 19%

Total physical RAM: 3996.36 MB

Available physical RAM: 3222.44 MB

Total Virtual: 3994.51 MB

Available Virtual: 3215.61 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:445.67 GB) (Free:194.28 GB) NTFS ==>[system with boot components (obtained from drive)]

Drive e: (Recovery) (Fixed) (Total:19.8 GB) (Free:2.11 GB) NTFS ==>[system with boot components (obtained from drive)]

Drive f: (HP_TOOLS) (Fixed) (Total:0.1 GB) (Free:0.08 GB) FAT32

Drive h: () (Removable) (Total:0.94 GB) (Free:0.94 GB) FAT

Drive x: (Boot) (Fixed) (Total:0.25 GB) (Free:0.25 GB) NTFS

Drive y: (SYSTEM) (Fixed) (Total:0.19 GB) (Free:0.16 GB) NTFS ==>[system with boot components (obtained from drive)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: E7E8DEA5)

Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=445.7 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=19.8 GB) - (Type=07 NTFS)

Partition 4: (Not Active) - (Size=103 MB) - (Type=0C)
 

========================================================

Disk: 1 (Size: 961 MB) (Disk ID: 9866BAFB)

Partition 1: (Active) - (Size=961 MB) - (Type=06)
 
 

LastRegBack: 2015-11-03 11:10
 

==================== End of FRST.txt ============================

--- --- ---

--- --- ---

--- --- ---

Kannste den Rechner immer noch nicht normal starten?

Nein, leider nicht. Ich habe alle 3 abgesicherten Modi probiert und bei allen bleibt er bei:
... aswRvrt.sys hängen.

identischer Pfad, wie bereits gelistet.

Viele Grüße!

Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-04-10] ()

C:\Windows\System32\Drivers\aswRvrt.sys

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

Starte deinen Rechner erneut in die Reparaturoptionen
Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Erledigt:

Fixlog

Code:

Fix result of Farbar Recovery Scan Tool (x64) Version:23-11-2015

Ran by SYSTEM (2015-12-03 22:17:55) Run:3

Running from H:\

Boot Mode: Recovery

==============================================
 

fixlist content:

*****************

S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-04-10] ()

C:\Windows\System32\Drivers\aswRvrt.sys

         

*****************
 

aswRvrt => service removed successfully

C:\Windows\System32\Drivers\aswRvrt.sys => moved successfully
 

==== End of Fixlog 22:17:56 ====

nun fährt der PC im abgesicherten Modus bis:
C:\Windows\System32\Drivers\aswvmm.sys hoch - wie ich gelesen habe ebenfalls im Zusammenhang mit Avast.

Hier die FRST dazu:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:23-11-2015

Ran by SYSTEM on MININT-Q23J4PF (03-12-2015 22:25:33)

Running from H:\

Platform: Windows 7 Home Premium (X64) Language: Englisch (USA)

Internet Explorer Version 11

Boot Mode: Recovery

Default: ControlSet001
 ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.
 

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Registry (Whitelisted) ===========================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6463592 2012-02-13] (Realtek Semiconductor)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2885904 2012-02-23] (Synaptics Incorporated)

HKLM\...\Run: [SetDefault] => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [44880 2011-12-19] (Hewlett-Packard Development Company, L.P.)

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [557768 2015-02-03] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [PDF Complete] => C:\Program Files (x86)\PDF Complete\pdfsty.exe [684024 2012-02-19] (PDF Complete Inc)

HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-11-05] (Samsung Electronics Co., Ltd.)

HKLM-x32\...\Run: [tvncontrol] => "C:\Program Files (x86)\Common Files\COMODO\GeekBuddyRSP.exe" -controlservice -slave

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5512912 2015-04-10] (Avast Software s.r.o.)

HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2694320 2015-02-15] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-06-08] (Oracle Corporation)

HKLM\...\RunOnce: [*Restore] => C:\Windows\system32\rstrui.exe [296960 2015-09-28] (Microsoft Corporation)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\frank\...\Run: [KiesPreload] => C:\Program Files (x86)\Samsung\Kies\Kies.exe [1564528 2013-11-05] (Samsung)

HKU\frank\...\Run: [KiesAirMessage] => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup

HKU\frank\...\Run: [] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [845168 2013-11-05] (Samsung)

HKU\frank\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [53655680 2015-07-28] (Skype Technologies S.A.)

HKU\frank\...\Run: [Dropbox Update] => C:\Users\frank\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-22] (Dropbox, Inc.)

HKU\frank\...\Run: [BingSvc] => C:\Users\frank\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-11-19] (© 2015 Microsoft Corporation)

Startup: C:\Users\frank\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-11-15]

ShortcutTarget: Dropbox.lnk ->  (No File)
 

==================== Services (Whitelisted) ========================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-04-10] (Avast Software s.r.o.)

S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-07] (Intel Corporation)

S2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1134584 2012-02-19] (PDF Complete Inc)

S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)

S2 HitmanPro37CrusaderBoot; "F:\HitmanPro_x64.exe" /crusader:boot [X]
 

===================== Drivers (Whitelisted) ==========================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

S2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-04-10] ()

S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [88408 2015-04-10] (Avast Software s.r.o.)

S1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-04-10] (Avast Software s.r.o.)

S1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-04-10] (Avast Software s.r.o.)

S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-04-10] (Avast Software s.r.o.)

S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [136752 2015-04-10] (Avast Software s.r.o.)

S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [271200 2015-04-10] ()

S3 BthAvrcp; C:\Windows\System32\DRIVERS\BthAvrcp.sys [29184 2009-08-12] (CSR, plc)

S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)

S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-02-05] ()

S3 RSP2STOR; C:\Windows\System32\DRIVERS\RtsP2Stor.sys [259688 2011-10-27] (Realtek Semiconductor Corp.)

S3 SmbDrv; C:\Windows\system32\drivers\Smb_driver.sys [21264 2012-02-23] (Synaptics Incorporated)
 

==================== NetSvcs (Whitelisted) ===================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 

==================== One Month Created files and folders ========
 

(If an entry is included in the fixlist, the file/folder will be moved.)
 

2015-11-24 19:37 - 2015-12-03 22:25 - 00000000 ____D C:\FRST

2015-11-21 04:24 - 2015-12-03 13:24 - 352955619 _____ C:\Windows\MEMORY.DMP

2015-11-12 10:53 - 2015-10-01 10:00 - 00275456 _____ (Microsoft Corporation) C:\Windows\System32\InkEd.dll

2015-11-12 10:53 - 2015-10-01 09:50 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
 

==================== One Month Modified files and folders ========
 

(If an entry is included in the fixlist, the file/folder will be moved.)
 

2015-12-03 13:23 - 2010-11-20 19:47 - 01549590 _____ C:\Windows\PFRO.log

2015-11-21 04:22 - 2013-11-11 09:05 - 00000000 ____D C:\ProgramData\Microsoft Help

2015-11-21 04:22 - 2012-12-22 05:09 - 02055289 _____ C:\Windows\WindowsUpdate.log

2015-11-21 04:19 - 2012-03-15 05:45 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-11-21 04:11 - 2015-06-22 03:13 - 00001224 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1640999226-3979880844-3937512731-1000UA.job

2015-11-21 04:10 - 2015-06-22 03:13 - 00001172 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1640999226-3979880844-3937512731-1000Core.job

2015-11-21 04:10 - 2013-04-11 11:47 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-11-19 10:58 - 2009-07-13 20:45 - 00031248 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-11-19 10:58 - 2009-07-13 20:45 - 00031248 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-11-19 10:51 - 2013-11-24 01:32 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update

2015-11-19 10:50 - 2012-12-28 15:44 - 00000000 ____D C:\Users\frank\AppData\Local\CrashDumps

2015-11-16 13:01 - 2012-12-22 05:17 - 00000000 ____D C:\Users\frank\AppData\Roaming\Skype

2015-11-15 13:33 - 2012-12-24 04:56 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log

2015-11-15 08:55 - 2014-09-09 11:13 - 00000000 ___RD C:\Users\frank\Dropbox

2015-11-15 08:55 - 2014-09-09 11:10 - 00000000 ____D C:\Users\frank\AppData\Roaming\Dropbox

2015-11-15 08:50 - 2012-03-15 05:56 - 00000000 ____D C:\ProgramData\PDFC

2015-11-12 10:43 - 2012-03-15 05:45 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-11-12 10:43 - 2012-03-15 05:45 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-11-12 10:43 - 2012-03-15 05:45 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2015-11-10 09:21 - 2012-03-15 14:01 - 00700134 _____ C:\Windows\System32\perfh007.dat

2015-11-10 09:21 - 2012-03-15 14:01 - 00149984 _____ C:\Windows\System32\perfc007.dat

2015-11-10 09:21 - 2009-07-13 21:13 - 01622300 _____ C:\Windows\System32\PerfStringBackup.INI

2015-11-07 01:30 - 2009-07-13 20:51 - 00109347 _____ C:\Windows\setupact.log

2015-11-03 11:23 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache
 

Some files in TEMP:

====================

C:\Users\frank\AppData\Local\Temp\2jfuweif.exe

C:\Users\frank\AppData\Local\Temp\5QC20EE.exe

C:\Users\frank\AppData\Local\Temp\7CCAAA0.exe

C:\Users\frank\AppData\Local\Temp\7CcE639.exe

C:\Users\frank\AppData\Local\Temp\bfl5yokj.dll

C:\Users\frank\AppData\Local\Temp\BingSvc.exe

C:\Users\frank\AppData\Local\Temp\bitool.dll

C:\Users\frank\AppData\Local\Temp\BSvcProcessor.exe

C:\Users\frank\AppData\Local\Temp\BSvcUpdater.exe

C:\Users\frank\AppData\Local\Temp\Buwuharoyig.exe

C:\Users\frank\AppData\Local\Temp\C7C9C0F.exe

C:\Users\frank\AppData\Local\Temp\C7CAADE.exe

C:\Users\frank\AppData\Local\Temp\C7cB846.exe

C:\Users\frank\AppData\Local\Temp\C7CCB49.exe

C:\Users\frank\AppData\Local\Temp\cCCA5FE.exe

C:\Users\frank\AppData\Local\Temp\cCcA8CC.exe

C:\Users\frank\AppData\Local\Temp\CcCB8F2.exe

C:\Users\frank\AppData\Local\Temp\CcCF324.exe

C:\Users\frank\AppData\Local\Temp\DefaultPack.EXE

C:\Users\frank\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmphlxbla.dll

C:\Users\frank\AppData\Local\Temp\DseShExt-x64.dll

C:\Users\frank\AppData\Local\Temp\DseShExt-x86.dll

C:\Users\frank\AppData\Local\Temp\E3O5649.exe

C:\Users\frank\AppData\Local\Temp\Extract.exe

C:\Users\frank\AppData\Local\Temp\f1pmraph.dll

C:\Users\frank\AppData\Local\Temp\HitmanPro.exe

C:\Users\frank\AppData\Local\Temp\HPHelpUpdater.exe

C:\Users\frank\AppData\Local\Temp\jfwnpvo1.dll

C:\Users\frank\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe

C:\Users\frank\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe

C:\Users\frank\AppData\Local\Temp\jre-8u51-windows-au.exe

C:\Users\frank\AppData\Local\Temp\jre-8u66-windows-au.exe

C:\Users\frank\AppData\Local\Temp\libnspr4.dll

C:\Users\frank\AppData\Local\Temp\nsa68ED.exe

C:\Users\frank\AppData\Local\Temp\nsaE40B.exe

C:\Users\frank\AppData\Local\Temp\nsc5602.exe

C:\Users\frank\AppData\Local\Temp\nsc66C6.exe

C:\Users\frank\AppData\Local\Temp\nscB349.exe

C:\Users\frank\AppData\Local\Temp\nsgA786.exe

C:\Users\frank\AppData\Local\Temp\nsgADE.exe

C:\Users\frank\AppData\Local\Temp\nsl5F1D.exe

C:\Users\frank\AppData\Local\Temp\nsm5D91.exe

C:\Users\frank\AppData\Local\Temp\nsmBC10.exe

C:\Users\frank\AppData\Local\Temp\nsv732B.exe

C:\Users\frank\AppData\Local\Temp\nsvDBB1.exe

C:\Users\frank\AppData\Local\Temp\nsw25BC.exe

C:\Users\frank\AppData\Local\Temp\nswAB8A.exe

C:\Users\frank\AppData\Local\Temp\Resource.exe

C:\Users\frank\AppData\Local\Temp\SDShelEx-win32.dll

C:\Users\frank\AppData\Local\Temp\SDShelEx-x64.dll

C:\Users\frank\AppData\Local\Temp\Show-Password_1030-8100.exe

C:\Users\frank\AppData\Local\Temp\SkypeSetup.exe

C:\Users\frank\AppData\Local\Temp\SP56942.exe

C:\Users\frank\AppData\Local\Temp\sp58915.exe

C:\Users\frank\AppData\Local\Temp\SP59202.exe

C:\Users\frank\AppData\Local\Temp\sp64126.exe

C:\Users\frank\AppData\Local\Temp\UM7C0CE.exe

C:\Users\frank\AppData\Local\Temp\uninst1.exe

C:\Users\frank\AppData\Local\Temp\UninstallHPSA.exe

C:\Users\frank\AppData\Local\Temp\vlc-2.1.2-win64.exe

C:\Users\frank\AppData\Local\Temp\vlc-2.1.4-win64.exe

C:\Users\frank\AppData\Local\Temp\vlc-2.1.5-win64.exe
 
 

==================== Known DLLs (Whitelisted) =========================
 
 

==================== Bamital & volsnap =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\dnsapi.dll => MD5 is legit

C:\Windows\SysWOW64\dnsapi.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 

==================== EXE Association (Whitelisted) =============
 
 

==================== Restore Points =========================
 

Restore point date: 2015-10-22 11:19

Restore point date: 2015-10-23 05:12

Restore point date: 2015-10-30 08:02

Restore point date: 2015-11-03 07:54

Restore point date: 2015-11-07 01:44

Restore point date: 2015-11-10 09:35

Restore point date: 2015-11-16 10:54

Restore point date: 2015-11-19 11:15

Restore point date: 2015-11-21 04:14

Restore point date: 2015-11-21 04:15
 

==================== Memory info =========================== 
 

Percentage of memory in use: 19%

Total physical RAM: 3996.36 MB

Available physical RAM: 3220.45 MB

Total Virtual: 3994.51 MB

Available Virtual: 3215.29 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:445.67 GB) (Free:194.28 GB) NTFS ==>[system with boot components (obtained from drive)]

Drive e: (Recovery) (Fixed) (Total:19.8 GB) (Free:2.11 GB) NTFS ==>[system with boot components (obtained from drive)]

Drive f: (HP_TOOLS) (Fixed) (Total:0.1 GB) (Free:0.08 GB) FAT32

Drive h: () (Removable) (Total:0.94 GB) (Free:0.94 GB) FAT

Drive x: (Boot) (Fixed) (Total:0.25 GB) (Free:0.25 GB) NTFS

Drive y: (SYSTEM) (Fixed) (Total:0.19 GB) (Free:0.16 GB) NTFS ==>[system with boot components (obtained from drive)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: E7E8DEA5)

Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=445.7 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=19.8 GB) - (Type=07 NTFS)

Partition 4: (Not Active) - (Size=103 MB) - (Type=0C)
 

========================================================

Disk: 1 (Size: 961 MB) (Disk ID: 9866BAFB)

Partition 1: (Active) - (Size=961 MB) - (Type=06)
 
 

LastRegBack: 2015-11-03 11:10
 

==================== End of FRST.txt ============================

--- --- ---

Avast.....ich hasse Avast. Immer der ewig gleiche Scheiss.

geht beim Hochfahren F8 > letzte als funktionierend bekannte Config?

Wenn nicht fixen wir jetzt jedes File von Avast weg.

Hallo schrauber,
nein funktioniert leider nicht, wenn ihch die config ausführe, versucht der PC zu starten, macht dann aber wieder einen Neustart in den Windows-Fehlerbehebung Modus :
- Starthilfe
-Windows Normal starten

beides klappt nicht.

Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-04-10] (Avast Software s.r.o.)

C:\Program Files\AVAST Software

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5512912 2015-04-10] (Avast Software s.r.o.)

S2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-04-10] ()

S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [88408 2015-04-10] (Avast Software s.r.o.)

S1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-04-10] (Avast Software s.r.o.)

S1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-04-10] (Avast Software s.r.o.)

S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-04-10] (Avast Software s.r.o.)

S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [136752 2015-04-10] (Avast Software s.r.o.)

S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [271200 2015-04-10] ()

C:\Windows\system32\drivers\aswHwid.sys

C:\Windows\system32\drivers\aswMonFlt.sys

C:\Windows\system32\drivers\aswRdr2.sys

C:\Windows\system32\drivers\aswSnx.sys

C:\Windows\system32\drivers\aswSP.sys

C:\Windows\system32\drivers\aswStm.sys

C:\Windows\System32\Drivers\aswVmm.sys

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

Starte deinen Rechner erneut in die Reparaturoptionen
Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

erledigt

Code:

Fix result of Farbar Recovery Scan Tool (x64) Version:23-11-2015

Ran by SYSTEM (2015-12-05 22:12:31) Run:4

Running from H:\

Boot Mode: Recovery

==============================================
 

fixlist content:

*****************

S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-04-10] (Avast Software s.r.o.)

C:\Program Files\AVAST Software

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5512912 2015-04-10] (Avast Software s.r.o.)

S2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-04-10] ()

S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [88408 2015-04-10] (Avast Software s.r.o.)

S1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-04-10] (Avast Software s.r.o.)

S1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-04-10] (Avast Software s.r.o.)

S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-04-10] (Avast Software s.r.o.)

S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [136752 2015-04-10] (Avast Software s.r.o.)

S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [271200 2015-04-10] ()

C:\Windows\system32\drivers\aswHwid.sys

C:\Windows\system32\drivers\aswMonFlt.sys

C:\Windows\system32\drivers\aswRdr2.sys

C:\Windows\system32\drivers\aswSnx.sys

C:\Windows\system32\drivers\aswSP.sys

C:\Windows\system32\drivers\aswStm.sys

C:\Windows\System32\Drivers\aswVmm.sys

         

*****************
 

avast! Antivirus => service removed successfully

C:\Program Files\AVAST Software => moved successfully

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\AvastUI.exe => value removed successfully

aswHwid => service removed successfully

aswMonFlt => service removed successfully

aswRdr => service removed successfully

aswSnx => service removed successfully

aswSP => service removed successfully

aswStm => service removed successfully

aswVmm => service removed successfully

C:\Windows\system32\drivers\aswHwid.sys => moved successfully

C:\Windows\system32\drivers\aswMonFlt.sys => moved successfully

C:\Windows\system32\drivers\aswRdr2.sys => moved successfully

C:\Windows\system32\drivers\aswSnx.sys => moved successfully

C:\Windows\system32\drivers\aswSP.sys => moved successfully

C:\Windows\system32\drivers\aswStm.sys => moved successfully

C:\Windows\System32\Drivers\aswVmm.sys => moved successfully
 

==== End of Fixlog 22:12:32 ====

Nun fährt er hoch bis classpnp.sys :/
die anschließende FRST:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:23-11-2015

Ran by SYSTEM on MININT-KHLOHO2 (05-12-2015 22:12:48)

Running from H:\

Platform: Windows 7 Home Premium (X64) Language: Englisch (USA)

Internet Explorer Version 11

Boot Mode: Recovery

Default: ControlSet001
 ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.
 

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Registry (Whitelisted) ===========================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6463592 2012-02-13] (Realtek Semiconductor)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2885904 2012-02-23] (Synaptics Incorporated)

HKLM\...\Run: [SetDefault] => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [44880 2011-12-19] (Hewlett-Packard Development Company, L.P.)

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [557768 2015-02-03] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [PDF Complete] => C:\Program Files (x86)\PDF Complete\pdfsty.exe [684024 2012-02-19] (PDF Complete Inc)

HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-11-05] (Samsung Electronics Co., Ltd.)

HKLM-x32\...\Run: [tvncontrol] => "C:\Program Files (x86)\Common Files\COMODO\GeekBuddyRSP.exe" -controlservice -slave

HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2694320 2015-02-15] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-06-08] (Oracle Corporation)

HKLM\...\RunOnce: [*Restore] => C:\Windows\system32\rstrui.exe [296960 2015-09-28] (Microsoft Corporation)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\frank\...\Run: [KiesPreload] => C:\Program Files (x86)\Samsung\Kies\Kies.exe [1564528 2013-11-05] (Samsung)

HKU\frank\...\Run: [KiesAirMessage] => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup

HKU\frank\...\Run: [] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [845168 2013-11-05] (Samsung)

HKU\frank\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [53655680 2015-07-28] (Skype Technologies S.A.)

HKU\frank\...\Run: [Dropbox Update] => C:\Users\frank\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-22] (Dropbox, Inc.)

HKU\frank\...\Run: [BingSvc] => C:\Users\frank\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-11-19] (© 2015 Microsoft Corporation)

Startup: C:\Users\frank\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-11-15]

ShortcutTarget: Dropbox.lnk ->  (No File)
 

==================== Services (Whitelisted) ========================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-07] (Intel Corporation)

S2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1134584 2012-02-19] (PDF Complete Inc)

S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)

S2 HitmanPro37CrusaderBoot; "F:\HitmanPro_x64.exe" /crusader:boot [X]
 

===================== Drivers (Whitelisted) ==========================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

S3 BthAvrcp; C:\Windows\System32\DRIVERS\BthAvrcp.sys [29184 2009-08-12] (CSR, plc)

S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)

S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-02-05] ()

S3 RSP2STOR; C:\Windows\System32\DRIVERS\RtsP2Stor.sys [259688 2011-10-27] (Realtek Semiconductor Corp.)

S3 SmbDrv; C:\Windows\system32\drivers\Smb_driver.sys [21264 2012-02-23] (Synaptics Incorporated)
 

==================== NetSvcs (Whitelisted) ===================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 

==================== One Month Created files and folders ========
 

(If an entry is included in the fixlist, the file/folder will be moved.)
 

2015-11-24 19:37 - 2015-12-05 22:12 - 00000000 ____D C:\FRST

2015-11-21 04:24 - 2015-12-04 08:31 - 352775395 _____ C:\Windows\MEMORY.DMP

2015-11-12 10:53 - 2015-10-01 10:00 - 00275456 _____ (Microsoft Corporation) C:\Windows\System32\InkEd.dll

2015-11-12 10:53 - 2015-10-01 09:50 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
 

==================== One Month Modified files and folders ========
 

(If an entry is included in the fixlist, the file/folder will be moved.)
 

2015-12-04 08:31 - 2010-11-20 19:47 - 01610938 _____ C:\Windows\PFRO.log

2015-11-21 04:22 - 2013-11-11 09:05 - 00000000 ____D C:\ProgramData\Microsoft Help

2015-11-21 04:22 - 2012-12-22 05:09 - 02055289 _____ C:\Windows\WindowsUpdate.log

2015-11-21 04:19 - 2012-03-15 05:45 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-11-21 04:11 - 2015-06-22 03:13 - 00001224 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1640999226-3979880844-3937512731-1000UA.job

2015-11-21 04:10 - 2015-06-22 03:13 - 00001172 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1640999226-3979880844-3937512731-1000Core.job

2015-11-21 04:10 - 2013-04-11 11:47 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-11-19 10:58 - 2009-07-13 20:45 - 00031248 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-11-19 10:58 - 2009-07-13 20:45 - 00031248 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-11-19 10:51 - 2013-11-24 01:32 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update

2015-11-19 10:50 - 2012-12-28 15:44 - 00000000 ____D C:\Users\frank\AppData\Local\CrashDumps

2015-11-16 13:01 - 2012-12-22 05:17 - 00000000 ____D C:\Users\frank\AppData\Roaming\Skype

2015-11-15 13:33 - 2012-12-24 04:56 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log

2015-11-15 08:55 - 2014-09-09 11:13 - 00000000 ___RD C:\Users\frank\Dropbox

2015-11-15 08:55 - 2014-09-09 11:10 - 00000000 ____D C:\Users\frank\AppData\Roaming\Dropbox

2015-11-15 08:50 - 2012-03-15 05:56 - 00000000 ____D C:\ProgramData\PDFC

2015-11-12 10:43 - 2012-03-15 05:45 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-11-12 10:43 - 2012-03-15 05:45 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-11-12 10:43 - 2012-03-15 05:45 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2015-11-10 09:21 - 2012-03-15 14:01 - 00700134 _____ C:\Windows\System32\perfh007.dat

2015-11-10 09:21 - 2012-03-15 14:01 - 00149984 _____ C:\Windows\System32\perfc007.dat

2015-11-10 09:21 - 2009-07-13 21:13 - 01622300 _____ C:\Windows\System32\PerfStringBackup.INI

2015-11-07 01:30 - 2009-07-13 20:51 - 00109347 _____ C:\Windows\setupact.log
 

Some files in TEMP:

====================

C:\Users\frank\AppData\Local\Temp\2jfuweif.exe

C:\Users\frank\AppData\Local\Temp\5QC20EE.exe

C:\Users\frank\AppData\Local\Temp\7CCAAA0.exe

C:\Users\frank\AppData\Local\Temp\7CcE639.exe

C:\Users\frank\AppData\Local\Temp\bfl5yokj.dll

C:\Users\frank\AppData\Local\Temp\BingSvc.exe

C:\Users\frank\AppData\Local\Temp\bitool.dll

C:\Users\frank\AppData\Local\Temp\BSvcProcessor.exe

C:\Users\frank\AppData\Local\Temp\BSvcUpdater.exe

C:\Users\frank\AppData\Local\Temp\Buwuharoyig.exe

C:\Users\frank\AppData\Local\Temp\C7C9C0F.exe

C:\Users\frank\AppData\Local\Temp\C7CAADE.exe

C:\Users\frank\AppData\Local\Temp\C7cB846.exe

C:\Users\frank\AppData\Local\Temp\C7CCB49.exe

C:\Users\frank\AppData\Local\Temp\cCCA5FE.exe

C:\Users\frank\AppData\Local\Temp\cCcA8CC.exe

C:\Users\frank\AppData\Local\Temp\CcCB8F2.exe

C:\Users\frank\AppData\Local\Temp\CcCF324.exe

C:\Users\frank\AppData\Local\Temp\DefaultPack.EXE

C:\Users\frank\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmphlxbla.dll

C:\Users\frank\AppData\Local\Temp\DseShExt-x64.dll

C:\Users\frank\AppData\Local\Temp\DseShExt-x86.dll

C:\Users\frank\AppData\Local\Temp\E3O5649.exe

C:\Users\frank\AppData\Local\Temp\Extract.exe

C:\Users\frank\AppData\Local\Temp\f1pmraph.dll

C:\Users\frank\AppData\Local\Temp\HitmanPro.exe

C:\Users\frank\AppData\Local\Temp\HPHelpUpdater.exe

C:\Users\frank\AppData\Local\Temp\jfwnpvo1.dll

C:\Users\frank\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe

C:\Users\frank\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe

C:\Users\frank\AppData\Local\Temp\jre-8u51-windows-au.exe

C:\Users\frank\AppData\Local\Temp\jre-8u66-windows-au.exe

C:\Users\frank\AppData\Local\Temp\libnspr4.dll

C:\Users\frank\AppData\Local\Temp\nsa68ED.exe

C:\Users\frank\AppData\Local\Temp\nsaE40B.exe

C:\Users\frank\AppData\Local\Temp\nsc5602.exe

C:\Users\frank\AppData\Local\Temp\nsc66C6.exe

C:\Users\frank\AppData\Local\Temp\nscB349.exe

C:\Users\frank\AppData\Local\Temp\nsgA786.exe

C:\Users\frank\AppData\Local\Temp\nsgADE.exe

C:\Users\frank\AppData\Local\Temp\nsl5F1D.exe

C:\Users\frank\AppData\Local\Temp\nsm5D91.exe

C:\Users\frank\AppData\Local\Temp\nsmBC10.exe

C:\Users\frank\AppData\Local\Temp\nsv732B.exe

C:\Users\frank\AppData\Local\Temp\nsvDBB1.exe

C:\Users\frank\AppData\Local\Temp\nsw25BC.exe

C:\Users\frank\AppData\Local\Temp\nswAB8A.exe

C:\Users\frank\AppData\Local\Temp\Resource.exe

C:\Users\frank\AppData\Local\Temp\SDShelEx-win32.dll

C:\Users\frank\AppData\Local\Temp\SDShelEx-x64.dll

C:\Users\frank\AppData\Local\Temp\Show-Password_1030-8100.exe

C:\Users\frank\AppData\Local\Temp\SkypeSetup.exe

C:\Users\frank\AppData\Local\Temp\SP56942.exe

C:\Users\frank\AppData\Local\Temp\sp58915.exe

C:\Users\frank\AppData\Local\Temp\SP59202.exe

C:\Users\frank\AppData\Local\Temp\sp64126.exe

C:\Users\frank\AppData\Local\Temp\UM7C0CE.exe

C:\Users\frank\AppData\Local\Temp\uninst1.exe

C:\Users\frank\AppData\Local\Temp\UninstallHPSA.exe

C:\Users\frank\AppData\Local\Temp\vlc-2.1.2-win64.exe

C:\Users\frank\AppData\Local\Temp\vlc-2.1.4-win64.exe

C:\Users\frank\AppData\Local\Temp\vlc-2.1.5-win64.exe
 
 

==================== Known DLLs (Whitelisted) =========================
 
 

==================== Bamital & volsnap =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\dnsapi.dll => MD5 is legit

C:\Windows\SysWOW64\dnsapi.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 

==================== EXE Association (Whitelisted) =============
 
 

==================== Restore Points =========================
 

Restore point date: 2015-10-22 11:19

Restore point date: 2015-10-23 05:12

Restore point date: 2015-10-30 08:02

Restore point date: 2015-11-03 07:54

Restore point date: 2015-11-07 01:44

Restore point date: 2015-11-10 09:35

Restore point date: 2015-11-16 10:54

Restore point date: 2015-11-19 11:15

Restore point date: 2015-11-21 04:14

Restore point date: 2015-11-21 04:15
 

==================== Memory info =========================== 
 

Percentage of memory in use: 19%

Total physical RAM: 3996.36 MB

Available physical RAM: 3224.41 MB

Total Virtual: 3994.51 MB

Available Virtual: 3213.81 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:445.67 GB) (Free:194.28 GB) NTFS ==>[system with boot components (obtained from drive)]

Drive e: (Recovery) (Fixed) (Total:19.8 GB) (Free:2.11 GB) NTFS ==>[system with boot components (obtained from drive)]

Drive f: (HP_TOOLS) (Fixed) (Total:0.1 GB) (Free:0.08 GB) FAT32

Drive h: () (Removable) (Total:0.94 GB) (Free:0.94 GB) FAT

Drive x: (Boot) (Fixed) (Total:0.25 GB) (Free:0.25 GB) NTFS

Drive y: (SYSTEM) (Fixed) (Total:0.19 GB) (Free:0.16 GB) NTFS ==>[system with boot components (obtained from drive)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: E7E8DEA5)

Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=445.7 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=19.8 GB) - (Type=07 NTFS)

Partition 4: (Not Active) - (Size=103 MB) - (Type=0C)
 

========================================================

Disk: 1 (Size: 961 MB) (Disk ID: 9866BAFB)

Partition 1: (Active) - (Size=961 MB) - (Type=06)
 
 

LastRegBack: 2015-11-03 11:10
 

==================== End of FRST.txt ============================

--- --- ---

--- --- ---