Trojaner-Board - Win 7 startet nur im abgesicherten Modus - USB Massenspeicher den es nicht gibt wird angezeigt

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Win 7 startet nur im abgesicherten Modus - USB Massenspeicher den es nicht gibt wird angezeigt (https://www.trojaner-board.de/140466-win-7-startet-nur-abgesicherten-modus-usb-massenspeicher-gibt-angezeigt.html)

Win 7 startet nur im abgesicherten Modus - USB Massenspeicher den es nicht gibt wird angezeigt

Hallo, ich bin neu hier und hoffe, dass ihr mir helfen könnt.
Seit einiger Zeit startet mein Computer (win 7) nur noch im abgesicherten Modus. Mein Virenprogramm war leider abgelaufen und dies habe ich zu spät bemerkt. Ich vermute daher, dass ich mir einen Virus eingefangen habe.
Im Explorer werden vier USB Massenspeicher angezeigt, die es nicht gibt. Ich bekomme diese auch nicht auf Dauer deinstalliert. Beim Neustart immer wieder das gleiche. Windows wird gestartet und dann wird der Bildschirm schwarz - und zwar bevor ich mein Passwort eingeben kann. Die "Windowsmusik" hört man ganz leicht im Hintergrund.
Mein Norton lässt sich leider im abges. Modus nicht installieren. Ich habe bereits Avira Rescue System von CD gestartet und meinen Compi prüfen lassen. Es wurden auch 6 Fehler gefunden und angeblich repariert. Aber das Problem ist geblieben.

Gibt es einen zuverlässigen Virenscanner für den abgesicherten Modus? Wie kann ich die USB Massenspeicher auf Dauer entfernen?

hi,

Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)

Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)

Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST 32-Bit | FRST 64-Bit

Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.

Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:

Über den Boot Manager:

Starte den Rechner neu.

Während dem Hochfahren drücke mehrmals die F8 Taste

Wähle nun Computer reparieren.

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD (auch bei Windows 8 möglich):

Lege die Windows CD in dein Laufwerk.

Starte den Rechner neu und starte von der CD.

Wähle die Spracheinstellungen und klicke "Weiter".

Klicke auf Computerreparaturoptionen !

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Wähle in den Reparaturoptionen: Eingabeaufforderung

Gib nun bitte notepad ein und drücke Enter.

Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.

Schließe Notepad wieder

Gib nun bitte folgenden Befehl ein.
e:\frst.exe bzw. e:\frst64.exe
Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.

Akzeptiere den Disclaimer mit Ja und klicke Untersuchen

Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).

Danke für die Bemühungen. Hier das logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-08-2013

Ran by SYSTEM on 26-08-2013 12:18:06

Running from F:\

Windows 7 Home Premium (X64) OS Language: German Standard

Internet Explorer Version 9

Boot Mode: Recovery
 

The current controlset is ControlSet001
 ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.
 

==================== Registry (Whitelisted) ==================
 

Winlogon\Notify\klogon: %SystemRoot%\System32\klogon.dll (Kaspersky Lab ZAO)

HKLM-x32\...\Run: [] -  [x]

HKLM-x32\...\Run: [AVP] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\avp.exe [387696 2011-04-13] (Kaspersky Lab ZAO)

AppInit_DLLs: C:\PROGRA~2\KASPER~1\KASPER~1\x64\kloehk.dll,C:\PROGRA~2\KASPER~1\KASPER~1\x64\sbhook64.dll [31120 2011-04-13] (Kaspersky Lab ZAO)

AppInit_DLLs-x32: C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~2\KASPER~1\KASPER~1\sbhook.dll [31120 2011-04-13] ()
 

==================== Services (Whitelisted) =================
 

S2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\avp.exe [387696 2011-04-13] (Kaspersky Lab ZAO)

S2 FreemiumSelfUpdateService; C:\Program Files (x86)\Freetec\SystemStore\Freemium.SelfUpdate.exe [5686272 2012-09-26] ()

S2 SelfUpdateService; C:\Program Files (x86)\Freetec\SystemStore\SelfUpdate.exe [5663232 2012-11-14] ()

S2 SystemStoreService; C:\Program Files (x86)\Freetec\SystemStore\SystemStore.exe [462848 2013-01-25] ()

S3 TuneUp.Defrag; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe [607040 2012-07-01] (TuneUp Software)

S2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [1403200 2011-11-21] (TuneUp Software)
 

==================== Drivers (Whitelisted) ====================
 

S3 azvusb; C:\Windows\System32\DRIVERS\azvusb.sys [54784 2009-08-24] (AzureWave Technologies, Inc.)

S0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [460888 2010-06-09] (Kaspersky Lab ZAO)

S1 kl2; C:\Windows\System32\DRIVERS\kl2.sys [11864 2010-06-09] (Kaspersky Lab ZAO)

S1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [556120 2012-08-26] (Kaspersky Lab)

S1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [27736 2010-04-22] (Kaspersky Lab ZAO)

S3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [22544 2009-11-02] (Kaspersky Lab)

S3 Ltn_stk7070P_64; C:\Windows\System32\DRIVERS\Ltn_stk7070P_64.sys [543232 2007-10-19] (LITEON)

S3 Ltn_stkrc_64; C:\Windows\System32\DRIVERS\Ltn_stkrc_64.sys [16256 2007-10-19] (LITEON)

S3 nmwcdx64; C:\Windows\System32\drivers\nmwcdx64.sys [173056 2007-06-28] (Nokia)

S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2010-03-30] (RapidSolution Software AG)

S3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2010-03-30] (RapidSolution Software AG)

S3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [11856 2010-02-25] (TuneUp Software)
 

========================== Drivers MD5 =======================
 

C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit

C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit

C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\adp94xx.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\adpahci.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\adpu320.sys ==> MD5 is legit

C:\Windows\system32\drivers\afd.sys 1C7857B62DE5994A75B054A9FD4C3825

C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit

C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit

C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\amdk8.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\amdppm.sys ==> MD5 is legit

C:\Windows\system32\drivers\amdsata.sys D4121AE6D0C0E7E13AA221AA57EF2D49

C:\Windows\system32\DRIVERS\amdsbs.sys ==> MD5 is legit

C:\Windows\System32\drivers\amdxata.sys 540DAF1CEA6094886D72126FD7C33048

C:\Windows\system32\drivers\appid.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\arc.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\arcsas.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit

C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\atikmdag.sys 77E980EB1CC596FB6073C5C540E85F62

C:\Windows\System32\DRIVERS\azvusb.sys 9F4320BA8E7CE2342517B182A2F2C0E6

C:\Windows\system32\DRIVERS\bxvbda.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\b57nd60a.sys ==> MD5 is legit

C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\BrFiltLo.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\BrFiltUp.sys ==> MD5 is legit

C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit

C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit

C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit

C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\bthmodem.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\circlass.sys ==> MD5 is legit

C:\Windows\System32\CLFS.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\CmBatt.sys ==> MD5 is legit

C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit

C:\Windows\System32\Drivers\cng.sys 9AC4F97C2D3E93367E2148EA940CD2CD

C:\Windows\system32\DRIVERS\compbatt.sys ==> MD5 is legit

C:\Windows\system32\drivers\CompositeBus.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\crcdisk.sys ==> MD5 is legit

C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit

C:\Windows\System32\drivers\discache.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\disk.sys ==> MD5 is legit

C:\Windows\System32\drivers\drmkaud.sys ==> MD5 is legit

C:\Windows\System32\drivers\dxgkrnl.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\e1e6032e.sys 416A2007878ED1D6FC5DDDB9E1F6DB3E

C:\Windows\system32\DRIVERS\evbda.sys ==> MD5 is legit

C:\Windows\System32\Drivers\ElbyCDIO.sys 9A47AC3DFCF81D30922CDAAF1C2D579F

C:\Windows\system32\DRIVERS\elxstor.sys ==> MD5 is legit

C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit

C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit

C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\fdc.sys ==> MD5 is legit

C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit

C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\flpydisk.sys ==> MD5 is legit

C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit

C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit

C:\Windows\System32\Drivers\Fs_Rec.sys 6BD9295CC032DD3077C671FCCF579A7B

C:\Windows\System32\DRIVERS\fvevol.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\gagp30kx.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\GEARAspiWDM.sys ==> MD5 is legit

C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit

C:\Windows\system32\drivers\HdAudio.sys 975761C778E33CD22498059B91E7373A

C:\Windows\system32\drivers\HDAudBus.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\HidBatt.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\hidbth.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\hidir.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit

C:\Windows\System32\drivers\hppdbulkio.sys E325F85012E793CEE74B73C4F22AE311

C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit

C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit

C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit

C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit

C:\Windows\system32\drivers\iaStorV.sys AAAF44DB3BD0B9D1FB6969B23ECC8366

C:\Windows\system32\DRIVERS\iirsp.sys ==> MD5 is legit

C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit

C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit

C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit

C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit

C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit

C:\Windows\system32\drivers\msiscsi.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\kbdhid.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\kl1.sys 8D7120743A0973CEAB548B475C9D4289

C:\Windows\System32\DRIVERS\kl2.sys CD146D8E525D6EEBDCAF24120A8AB9CE

C:\Windows\System32\DRIVERS\klif.sys C1786C2F8DE0F62E076F7EF8DEA4E87A

C:\Windows\System32\DRIVERS\klim6.sys 2A64B3A9EED93A2E96537B67C079FC96

C:\Windows\System32\DRIVERS\klmouflt.sys 9468D07E91BA136D82415F5DFC1FE168

C:\Windows\System32\Drivers\ksecdd.sys 97A7070AEA4C058B6418519E869A63B4

C:\Windows\System32\Drivers\ksecpkg.sys 26C43A7C2862447EC59DEDA188D1DA07

C:\Windows\system32\drivers\ksthunk.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\lsi_fc.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\lsi_sas.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\lsi_sas2.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\lsi_scsi.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\Ltn_stk7070P_64.sys 639D24E769BDBEC6145E4C1921669B73

C:\Windows\System32\DRIVERS\Ltn_stkrc_64.sys E028DF5A96827A87898D4D7EB768E3AB

C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\megasas.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\MegaSR.sys ==> MD5 is legit

C:\Windows\System32\drivers\modem.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit

C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit

C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit

C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit

C:\Windows\system32\drivers\mrxdav.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\mrxsmb.sys A5D9106A73DC88564C825D317CAC68AC

C:\Windows\System32\DRIVERS\mrxsmb10.sys D711B3C1D5F42C0C2415687BE09FC163

C:\Windows\System32\DRIVERS\mrxsmb20.sys 9423E9D355C8D303E76B8CFBD8A5C30C

C:\Windows\system32\drivers\msahci.sys ==> MD5 is legit

C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit

C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit

C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit

C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit

C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit

C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit

C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit

C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit

C:\Windows\system32\drivers\mssmbios.sys ==> MD5 is legit

C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\MTConfig.sys ==> MD5 is legit

C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit

C:\Windows\System32\drivers\ndis.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit

C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\nfrd960.sys ==> MD5 is legit

C:\Windows\System32\drivers\ccdcmbx64.sys 903681BAB213D5F84717C0FC42AFB28A

C:\Windows\System32\drivers\ccdcmbox64.sys EC4C5EBD003E0395BF4EA5A2EFD13CE6

C:\Windows\System32\drivers\nmwcdnsux64.sys 7983D9201788407C4D1FC4D0BAA04E32

C:\Windows\System32\drivers\nmwcdx64.sys AD8C3895155EE8D057F073856B2D5851

C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit

C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit

C:\Windows\System32\Drivers\Ntfs.sys E453ACF4E7D44E5530B5D5F2B9CA8563

C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit

C:\Windows\system32\drivers\nvraid.sys 0A92CB65770442ED0DC44834632F66AD

C:\Windows\system32\drivers\nvstor.sys DAB0E87525C10052BF65F06152F37E4A

C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit

C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\parport.sys ==> MD5 is legit

C:\Windows\System32\drivers\partmgr.sys E9766131EEADE40A27DC27D2D68FBA9C

C:\Windows\System32\drivers\pci.sys ==> MD5 is legit

C:\Windows\System32\drivers\pciide.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\pcmcia.sys ==> MD5 is legit

C:\Windows\System32\Drivers\pcouffin.sys AF7CE12C4F3DC8CB2B07685C916BBCFE

C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit

C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\processr.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\ql2300.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\ql40xx.sys ==> MD5 is legit

C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\rdpbus.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit

C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit

C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit

C:\Windows\System32\Drivers\RDPWD.sys E61608AA35E98999AF9AAEEEA6114B0A

C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rrnetcap.sys 2ABD2B3BA2EF0C3BA82284C2A5E28675

C:\Windows\System32\DRIVERS\rrnetcap.sys 2ABD2B3BA2EF0C3BA82284C2A5E28675

C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit

C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit

C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\serenum.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\serial.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\sermouse.sys ==> MD5 is legit

C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit

C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit

C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\sfloppy.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\SiSRaid2.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\sisraid4.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit

C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\srv.sys 441FBA48BFF01FDB9D5969EBC1838F0B

C:\Windows\System32\DRIVERS\srv2.sys B4ADEBBF5E3677CCE9651E0F01F7CC28

C:\Windows\System32\DRIVERS\srvnet.sys 27E461F0BE5BFF5FC737328F749538C3

C:\Windows\system32\DRIVERS\stexstor.sys ==> MD5 is legit

C:\Windows\system32\drivers\swenum.sys ==> MD5 is legit

C:\Windows\System32\drivers\tbhsd.sys 93F0F5EF8A4CA261372DF98B31B2BD05

C:\Windows\System32\drivers\tcpip.sys ACB82BDA8F46C84F465C1AFA517DC4B9

C:\Windows\System32\DRIVERS\tcpip.sys ACB82BDA8F46C84F465C1AFA517DC4B9

C:\Windows\System32\drivers\tcpipreg.sys ==> MD5 is legit

C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit

C:\Windows\System32\drivers\tdtcp.sys 51C5ECEB1CDEE2468A1748BE550CFBC8

C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit

C:\Windows\system32\drivers\termdd.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\tssecsrv.sys ==> MD5 is legit

C:\Windows\System32\drivers\tsusbflt.sys ==> MD5 is legit

C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys DCC94C51D27C7EC0DADECA8F64C94FCF

C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\uagp35.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit

C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit

C:\Windows\system32\drivers\umbus.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\umpass.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\usbser_lowerfltx64.sys 4E93C8496359E97830C75AC36393654D

C:\Windows\System32\Drivers\usbaapl64.sys CD03479F2DA26500B203ED075C146A7A

C:\Windows\System32\DRIVERS\usbccgp.sys 6F1A3157A1C89435352CEB543CDB359C

C:\Windows\system32\drivers\usbcir.sys ==> MD5 is legit

C:\Windows\system32\drivers\usbehci.sys C025055FE7B87701EB042095DF1A2D7B

C:\Windows\System32\DRIVERS\usbhub.sys 287C6C9410B111B68B52CA298F7B8C24

C:\Windows\system32\drivers\usbohci.sys 9840FC418B4CBD632D3D0A667A725C31

C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\usbscan.sys ==> MD5 is legit

C:\Windows\system32\drivers\usbser.sys 4ACEE387FA8FD39F83564FCD2FC234F2

C:\Windows\System32\DRIVERS\usbser_lowerfltjx64.sys 66C25CB20B2974E0C0CFDAB49FB72A02

C:\Windows\System32\DRIVERS\USBSTOR.SYS FED648B01349A3C8395A5169DB5FB7D6

C:\Windows\system32\drivers\usbuhci.sys 62069A34518BCF9C1FD9E74B3F6DB7CD

C:\Windows\System32\DRIVERS\usb8023x.sys 70D05EE263568A742D14E1876DF80532

C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit

C:\Windows\System32\drivers\vga.sys ==> MD5 is legit

C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit

C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit

C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit

C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit

C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\vsmraid.sys ==> MD5 is legit

C:\Windows\System32\drivers\vwifibus.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\wacompen.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\wd.sys ==> MD5 is legit

C:\Windows\System32\drivers\Wdf01000.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit

C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit

C:\Windows\SysWow64\drivers\wimmount.sys ==> MD5 is legit

C:\Windows\system32\drivers\WinUSB.SYS FE88B288356E7B47B74B13372ADD906D

C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit

C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit

C:\Windows\System32\drivers\WudfPf.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\WUDFRd.sys ==> MD5 is legit
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-08-10 17:31 - 2013-08-10 17:31 - 00003240 ____N C:\bootsqm.dat

2013-08-08 06:35 - 2013-08-25 11:15 - 00000000 ____D C:\Windows\System32\Tasks\Norton Internet Security CBE

2013-08-07 20:45 - 2013-08-07 20:45 - 00000000 ____D C:\ProgramData\AVAST Software

2013-08-07 20:45 - 2013-08-07 20:45 - 00000000 ____D C:\Program Files\AVAST Software

2013-08-07 20:41 - 2013-08-07 20:41 - 00000002 _____ C:\AvastSetup.log

2013-08-07 11:29 - 2013-08-25 11:15 - 00000000 ____D C:\Program Files\Common Files\Symantec Shared

2013-08-07 11:29 - 2013-08-07 11:29 - 00000000 ____D C:\Program Files\Symantec

2013-08-07 11:10 - 2013-08-25 11:15 - 00000000 ____D C:\Program Files (x86)\Norton Bootable Recovery Tool Wizard

2013-08-04 14:13 - 2013-08-04 14:13 - 00000000 ____D C:\Users\Kopp\AppData\Local\.elfohilfe
 

==================== One Month Modified Files and Folders =======
 

2013-08-26 12:17 - 2013-08-26 12:17 - 00000000 ____D C:\FRST

2013-08-26 10:53 - 2010-05-15 10:47 - 00262144 _____ C:\Windows\System32\Ikeext.etl

2013-08-25 21:03 - 2012-07-02 12:50 - 00014101 _____ C:\Windows\setupact.log

2013-08-25 21:03 - 2010-05-07 07:53 - 00000000 ____D C:\ProgramData\Kaspersky Lab

2013-08-25 21:03 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-08-25 20:59 - 2009-07-14 18:58 - 00653304 _____ C:\Windows\System32\perfh007.dat

2013-08-25 20:59 - 2009-07-14 18:58 - 00131260 _____ C:\Windows\System32\perfc007.dat

2013-08-25 20:59 - 2009-07-14 06:13 - 01499760 _____ C:\Windows\System32\PerfStringBackup.INI

2013-08-25 20:52 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\tracing

2013-08-25 12:17 - 2010-12-16 17:59 - 00000000 ____D C:\Program Files (x86)\DVDFab 8

2013-08-25 12:15 - 2010-05-08 14:51 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-08-25 12:14 - 2010-05-06 19:51 - 00000000 ____D C:\users\Kopp

2013-08-25 12:13 - 2012-06-22 18:58 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-08-25 12:12 - 2010-05-06 19:40 - 01770391 _____ C:\Windows\WindowsUpdate.log

2013-08-25 12:07 - 2012-06-22 18:58 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2013-08-25 12:07 - 2012-06-22 18:57 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-08-25 12:07 - 2011-06-29 18:17 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-08-25 11:27 - 2009-07-14 05:45 - 00013216 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-08-25 11:27 - 2009-07-14 05:45 - 00013216 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-08-25 11:16 - 2012-11-15 19:48 - 00000000 ____D C:\Users\Kopp\Desktop\Stick

2013-08-25 11:16 - 2012-08-26 11:13 - 00000000 ____D C:\Users\Kopp\Desktop\Spiele

2013-08-25 11:16 - 2012-06-22 18:57 - 00000000 ____D C:\Windows\System32\Macromed

2013-08-25 11:16 - 2012-04-12 15:50 - 00000000 ____D C:\Users\Kopp\Desktop\alle-kalenderwochen-2012.php-Dateien

2013-08-25 11:16 - 2012-01-15 12:23 - 00000000 ____D C:\Users\Kopp\Desktop\Drucker, Scanner

2013-08-25 11:16 - 2010-09-06 17:41 - 00000000 ____D C:\Users\Kopp\AppData\Roaming\mp3DirectCut

2013-08-25 11:16 - 2010-06-10 16:35 - 00000000 ____D C:\Users\Kopp\AppData\Roaming\Audacity

2013-08-25 11:16 - 2010-05-25 16:34 - 00000000 ____D C:\Users\Kopp\AppData\Roaming\dvdcss

2013-08-25 11:16 - 2010-05-13 15:51 - 00000000 ____D C:\Users\Kopp\AppData\Roaming\Mp3tag

2013-08-25 11:16 - 2010-05-08 18:04 - 00000000 ____D C:\Users\Kopp\AppData\Roaming\vlc

2013-08-25 11:16 - 2009-07-14 04:20 - 00000000 __RSD C:\Windows\Media

2013-08-25 11:16 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\System32\NDF

2013-08-25 11:16 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\servicing

2013-08-25 11:16 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache

2013-08-25 11:15 - 2013-08-08 06:35 - 00000000 ____D C:\Windows\System32\Tasks\Norton Internet Security CBE

2013-08-25 11:15 - 2013-08-07 11:29 - 00000000 ____D C:\Program Files\Common Files\Symantec Shared

2013-08-25 11:15 - 2013-08-07 11:10 - 00000000 ____D C:\Program Files (x86)\Norton Bootable Recovery Tool Wizard

2013-08-25 11:15 - 2013-06-01 16:37 - 00000000 ____D C:\Program Files (x86)\Turtle Odyssey 2

2013-08-25 11:15 - 2013-05-25 17:43 - 00000000 ____D C:\Program Files (x86)\DVDFab 9

2013-08-25 11:15 - 2013-05-12 22:13 - 00000000 ____D C:\ProgramData\Norton

2013-08-25 11:15 - 2013-02-10 19:04 - 00000000 ____D C:\Program Files (x86)\streamWriter

2013-08-25 11:15 - 2013-02-01 11:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-08-25 11:15 - 2012-11-09 00:14 - 00000000 ____D C:\Users\Kopp\AppData\Local\Freetec

2013-08-25 11:15 - 2012-11-09 00:13 - 00000000 ____D C:\Program Files (x86)\Freetec

2013-08-25 11:15 - 2012-10-27 10:49 - 00000000 ____D C:\Program Files (x86)\PDF24

2013-08-25 11:15 - 2012-08-26 10:37 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab

2013-08-25 11:15 - 2012-01-14 15:34 - 00000000 ___HD C:\ProgramData\CanonIJScan

2013-08-25 11:15 - 2010-05-12 17:27 - 00000000 ____D C:\Program Files (x86)\Adobe

2013-08-25 11:15 - 2010-05-08 17:34 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2013-08-25 11:15 - 2010-05-07 14:25 - 00000000 ____D C:\Program Files (x86)\DVDFab 7

2013-08-25 11:15 - 2010-05-07 13:46 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-08-25 11:15 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration

2013-08-25 11:15 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared

2013-08-25 11:10 - 2012-12-06 17:00 - 00000000 ____D C:\Users\Kopp\Desktop\Spiele gesichert

2013-08-25 11:10 - 2012-07-01 22:37 - 00000000 ____D C:\Users\Kopp\Documents\MyHeritage

2013-08-25 11:10 - 2012-07-01 22:37 - 00000000 ____D C:\Users\Kopp\AppData\Roaming\MyHeritage

2013-08-25 11:10 - 2012-06-03 14:13 - 00000000 ____D C:\Users\Kopp\Documents\Fax

2013-08-25 11:10 - 2011-05-01 09:50 - 00000000 ____D C:\Users\Kopp\AppData\Roaming\Lasersoft Imaging

2013-08-25 11:10 - 2010-05-07 14:26 - 00000000 ____D C:\Users\Kopp\Documents\DVDFab

2013-08-25 11:09 - 2010-05-12 17:27 - 00000000 ____D C:\ProgramData\Adobe

2013-08-25 11:09 - 2010-05-09 14:08 - 00000000 ____D C:\Users\Kopp\AppData\Local\Google

2013-08-25 11:08 - 2012-07-11 13:35 - 00000000 ____D C:\BigFishGamesCache

2013-08-25 11:08 - 2010-05-09 14:07 - 00000000 ____D C:\Program Files (x86)\Google

2013-08-10 17:31 - 2013-08-10 17:31 - 00003240 ____N C:\bootsqm.dat

2013-08-07 20:45 - 2013-08-07 20:45 - 00000000 ____D C:\ProgramData\AVAST Software

2013-08-07 20:45 - 2013-08-07 20:45 - 00000000 ____D C:\Program Files\AVAST Software

2013-08-07 20:41 - 2013-08-07 20:41 - 00000002 _____ C:\AvastSetup.log

2013-08-07 11:29 - 2013-08-07 11:29 - 00000000 ____D C:\Program Files\Symantec

2013-08-07 11:28 - 2013-05-12 22:13 - 00000000 ____D C:\Program Files (x86)\Norton Internet Security CBE

2013-08-04 14:13 - 2013-08-04 14:13 - 00000000 ____D C:\Users\Kopp\AppData\Local\.elfohilfe

2013-08-04 12:58 - 2013-05-27 22:38 - 00000000 ____D C:\Program Files (x86)\Supermarket Management 2

2013-08-03 18:54 - 2013-05-03 10:45 - 00000000 ____D C:\MainMovie

2013-08-03 09:15 - 2010-05-06 20:08 - 00068264 _____ C:\Users\Kopp\AppData\Local\GDIPFONTCACHEV1.DAT

2013-08-02 00:03 - 2013-05-28 18:32 - 00000000 ____D C:\Program Files (x86)\Campgrounds

2013-08-02 00:03 - 2013-05-28 17:53 - 00000000 ____D C:\Program Files (x86)\Toy Defense

2013-08-02 00:03 - 2013-05-27 22:42 - 00000000 ____D C:\Program Files (x86)\Garden Rescue - Weihnachtsedition

2013-08-02 00:03 - 2013-05-25 00:17 - 00000000 ____D C:\Program Files (x86)\Garden Rescue

2013-08-02 00:03 - 2013-05-12 22:46 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2013-08-01 18:59 - 2010-06-27 13:05 - 00000000 ____D C:\Users\Kopp\Documents\TubeBox!
 

Files to move or delete:

====================

C:\Users\Kopp\AppData\Local\Temp\pylA91D.tmp.exe
 

==================== Known DLLs (Whitelisted) ================
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 

==================== EXE ASSOCIATION =====================
 

HKLM\...\.exe: exefile => OK

HKLM\...\exefile\DefaultIcon: %1 => OK

HKLM\...\exefile\open\command: "%1" %* => OK
 

==================== Restore Points  =========================
 

Restore point made on: 2013-01-30 05:49:11

Restore point made on: 2013-02-15 18:29:10

Restore point made on: 2013-03-13 02:23:01

Restore point made on: 2013-04-01 12:47:48

Restore point made on: 2013-04-05 02:06:41

Restore point made on: 2013-05-12 02:18:05

Restore point made on: 2013-05-12 22:42:55

Restore point made on: 2013-08-04 12:47:42

Restore point made on: 2013-08-25 11:40:10
 

==================== BCD ================================
 

Windows-Start-Manager

---------------------

Bezeichner              {bootmgr}

device                  partition=C:

path                    \bootmgr

description             Windows Boot Manager

locale                  de-DE

inherit                 {globalsettings}

default                 {default}

resumeobject            {a7da6ec8-5946-11df-a617-e249ef136fc8}

displayorder            {default}

toolsdisplayorder       {memdiag}

timeout                 30
 

Windows-Startladeprogramm

-------------------------

Bezeichner              {default}

device                  partition=C:

path                    \Windows\system32\winload.exe

description             Windows 7

locale                  de-DE

inherit                 {bootloadersettings}

recoverysequence        {current}

recoveryenabled         Yes

osdevice                partition=C:

systemroot              \Windows

resumeobject            {a7da6ec8-5946-11df-a617-e249ef136fc8}

nx                      OptIn
 

Windows-Startladeprogramm

-------------------------

Bezeichner              {current}

device                  ramdisk=[C:]\Recovery\a7da6eca-5946-11df-a617-e249ef136fc8\Winre.wim,{a7da6ecb-5946-11df-a617-e249ef136fc8}

path                    \windows\system32\winload.exe

description             Windows Recovery Environment

inherit                 {bootloadersettings}

osdevice                ramdisk=[C:]\Recovery\a7da6eca-5946-11df-a617-e249ef136fc8\Winre.wim,{a7da6ecb-5946-11df-a617-e249ef136fc8}

systemroot              \windows

nx                      OptIn

winpe                   Yes
 

Wiederaufnahme aus dem Ruhezustand

----------------------------------

Bezeichner              {a7da6ec8-5946-11df-a617-e249ef136fc8}

device                  partition=C:

path                    \Windows\system32\winresume.exe

description             Windows Resume Application

locale                  de-DE

inherit                 {resumeloadersettings}

filedevice              partition=C:

filepath                \hiberfil.sys

debugoptionenabled      No
 

Windows-Speichertestprogramm

----------------------------

Bezeichner              {memdiag}

device                  partition=C:

path                    \boot\memtest.exe

description             Windows-Speicherdiagnose

locale                  de-DE

inherit                 {globalsettings}

badmemoryaccess         Yes
 

Windows-Legacybetriebssystem-Ladeprogramm

-----------------------------------------

Bezeichner              {ntldr}

device                  partition=C:

path                    \ntldr

description             Frhere Windows-Version
 

EMS-Einstellungen

-----------------

Bezeichner              {emssettings}

bootems                 Yes
 

Debuggereinstellungen

---------------------

Bezeichner              {dbgsettings}

debugtype               Serial

debugport               1

baudrate                115200
 

RAM-Defekte

-----------

Bezeichner              {badmemory}
 

Globale Einstellungen

---------------------

Bezeichner              {globalsettings}

inherit                 {dbgsettings}

                        {emssettings}

                        {badmemory}
 

Startladeprogramm-Einstellungen

-------------------------------

Bezeichner              {bootloadersettings}

inherit                 {globalsettings}

                        {hypervisorsettings}
 

Hypervisoreinstellungen

-------------------

Bezeichner              {hypervisorsettings}

hypervisordebugtype     Serial

hypervisordebugport     1

hypervisorbaudrate      115200
 

Einstellungen zur Ladeprogrammfortsetzung

-----------------------------------------

Bezeichner              {resumeloadersettings}

inherit                 {globalsettings}
 

Ger„teoptionen

--------------

Bezeichner              {a7da6ecb-5946-11df-a617-e249ef136fc8}

description             Ramdisk Options

ramdisksdidevice        partition=C:

ramdisksdipath          \Recovery\a7da6eca-5946-11df-a617-e249ef136fc8\boot.sdi
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 17%

Total physical RAM: 3070.18 MB

Available physical RAM: 2536.05 MB

Total Pagefile: 3068.32 MB

Available Pagefile: 2528 MB

Total Virtual: 8192 MB

Available Virtual: 8191.86 MB
 

==================== Drives ================================
 

Drive c: (System) (Fixed) (Total:465.76 GB) (Free:116.66 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

Drive d: (Daten) (Fixed) (Total:465.76 GB) (Free:35.88 GB) NTFS

Drive f: () (Removable) (Total:29.18 GB) (Free:8.8 GB) FAT32

Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 00000001)

Partition 1: (Active) - (Size=466 GB) - (Type=07 NTFS)
 

========================================================

Disk: 1 (Size: 466 GB) (Disk ID: 7E3AB180)

Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)
 

========================================================

Disk: 2 (Size: 29 GB) (Disk ID: C51F42B5)

Partition 1: (Not Active) - (Size=29 GB) - (Type=0C)
 
 

LastRegBack: 2013-08-07 23:57
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Hm, mal bitte aus dem abgeischerten Modus:

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-08-2013

Ran by xxx (administrator) on 26-08-2013 15:33:39

Running from F:\

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 9

Boot Mode: Safe Mode (with Networking)
 

==================== Processes (Whitelisted) =================
 

(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
 

==================== Registry (Whitelisted) ==================
 

Winlogon\Notify\klogon: %SystemRoot%\System32\klogon.dll (Kaspersky Lab ZAO)

MountPoints2: E - E:\wubi.exe

MountPoints2: K - K:\DTLplus_Launcher.exe

MountPoints2: {34781e52-5c92-11e2-bc44-00219b0afcad} - K:\DTLplus_Launcher.exe

HKLM-x32\...\Run: [] -  [x]

HKLM-x32\...\Run: [AVP] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\avp.exe [387696 2011-04-13] (Kaspersky Lab ZAO)

AppInit_DLLs: C:\PROGRA~2\KASPER~1\KASPER~1\x64\kloehk.dll,C:\PROGRA~2\KASPER~1\KASPER~1\x64\sbhook64.dll [31120 2011-04-13] (Kaspersky Lab ZAO)

AppInit_DLLs-x32: C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~2\KASPER~1\KASPER~1\sbhook.dll [31120 2011-04-13] ()
 

==================== Internet (Whitelisted) ====================
 

ProxyServer: http=216.115.8.130:80

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKCU - DefaultScope {B3667A8A-A364-4EC9-A85C-4DF0DA96D38F} URL = hxxp://www.google.de/search?q={searchTerms}

SearchScopes: HKCU - {B3667A8A-A364-4EC9-A85C-4DF0DA96D38F} URL = hxxp://www.google.de/search?q={searchTerms}

SearchScopes: HKCU - {E9CB6E06-4EF7-4FCE-A1AF-199DA5164AB0} URL = hxxp://de.wikipedia.org/w/index.php?title=Spezial:Suche&search={searchTerms}

BHO: IEVkbdBHO Class - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\x64\ievkbd.dll (Kaspersky Lab ZAO)

BHO: FilterBHO Class - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\x64\klwtbbho.dll (Kaspersky Lab ZAO)

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: IEVkbdBHO Class - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\ievkbd.dll (Kaspersky Lab ZAO)

BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN\Toolbar\3.0.0744.0\msneshellx.dll (Microsoft Corp.)

BHO-x32: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

BHO-x32: FilterBHO Class - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\klwtbbho.dll (Kaspersky Lab ZAO)

Toolbar: HKLM-x32 - MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files (x86)\MSN\Toolbar\3.0.0744.0\msneshellx.dll (Microsoft Corp.)

Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)

Toolbar: HKCU - No Name - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} -  No File

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\Kopp\AppData\Roaming\Mozilla\Firefox\Profiles\2x4gnuuh.default

FF user.js: detected! => C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\2x4gnuuh.default\user.js

FF NetworkProxy: "no_proxies_on", "*.local"

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_146.dll ()

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.)

FF Extension: No Name - C:\Users\xxx\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

FF Extension: WOT - C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\2x4gnuuh.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

FF Extension: DownloadHelper - C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\2x4gnuuh.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

FF Extension: Evernote Web Clipper - C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\2x4gnuuh.default\Extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}

FF Extension: youtube2mp3 - C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\2x4gnuuh.default\Extensions\youtube2mp3@mondayx.de.xpi

FF Extension: No Name - C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\2x4gnuuh.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

FF Extension: No Name - C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\2x4gnuuh.default\Extensions\{E6C1199F-E687-42da-8C24-E7770CC3AE66}.xpi

FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@Kaspersky.ru

FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru

FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.com

CHR RestoreOnStartup: "hxxp://www.google.com"

CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}

CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}

CHR Extension: (Docs) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0

CHR Extension: (Google Drive) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0

CHR Extension: (YouTube) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0

CHR Extension: (Google Search) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0

CHR Extension: (Norton Identity Protection) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2013.1.1.4_0

CHR Extension: (Gmail) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
 

==================== Services (Whitelisted) =================
 

S2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\avp.exe [387696 2011-04-13] (Kaspersky Lab ZAO)

S2 FreemiumSelfUpdateService; C:\Program Files (x86)\Freetec\SystemStore\Freemium.SelfUpdate.exe [5686272 2012-09-26] ()

S2 SelfUpdateService; C:\Program Files (x86)\Freetec\SystemStore\SelfUpdate.exe [5663232 2012-11-14] ()

S2 SystemStoreService; C:\Program Files (x86)\Freetec\SystemStore\SystemStore.exe [462848 2013-01-25] ()

S3 TuneUp.Defrag; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe [607040 2012-07-01] (TuneUp Software)

S2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [1403200 2011-11-21] (TuneUp Software)
 

==================== Drivers (Whitelisted) ====================
 

R3 azvusb; C:\Windows\System32\DRIVERS\azvusb.sys [54784 2009-08-24] (AzureWave Technologies, Inc.)

R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [460888 2010-06-09] (Kaspersky Lab ZAO)

R1 kl2; C:\Windows\System32\DRIVERS\kl2.sys [11864 2010-06-09] (Kaspersky Lab ZAO)

S1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [556120 2012-08-26] (Kaspersky Lab)

R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [27736 2010-04-22] (Kaspersky Lab ZAO)

S3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [22544 2009-11-02] (Kaspersky Lab)

S3 Ltn_stk7070P_64; C:\Windows\System32\DRIVERS\Ltn_stk7070P_64.sys [543232 2007-10-19] (LITEON)

S3 Ltn_stkrc_64; C:\Windows\System32\DRIVERS\Ltn_stkrc_64.sys [16256 2007-10-19] (LITEON)

S3 nmwcdx64; C:\Windows\System32\drivers\nmwcdx64.sys [173056 2007-06-28] (Nokia)

S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2010-03-30] (RapidSolution Software AG)

R3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2010-03-30] (RapidSolution Software AG)

S3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [11856 2010-02-25] (TuneUp Software)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-08-26 13:17 - 2013-08-26 13:17 - 00000000 ____D C:\FRST

2013-08-10 18:31 - 2013-08-10 18:31 - 00003240 ____N C:\bootsqm.dat

2013-08-08 07:35 - 2013-08-25 12:15 - 00000000 ____D C:\Windows\System32\Tasks\Norton Internet Security CBE

2013-08-07 21:45 - 2013-08-07 21:45 - 00000000 ____D C:\ProgramData\AVAST Software

2013-08-07 21:45 - 2013-08-07 21:45 - 00000000 ____D C:\Program Files\AVAST Software

2013-08-07 21:41 - 2013-08-07 21:41 - 00000002 _____ C:\AvastSetup.log

2013-08-07 12:29 - 2013-08-25 12:15 - 00000000 ____D C:\Program Files\Common Files\Symantec Shared

2013-08-07 12:29 - 2013-08-07 12:29 - 00000000 ____D C:\Program Files\Symantec

2013-08-07 12:10 - 2013-08-25 12:15 - 00000000 ____D C:\Program Files (x86)\Norton Bootable Recovery Tool Wizard

2013-08-04 15:13 - 2013-08-04 15:13 - 00000000 ____D C:\Users\xxx\AppData\Local\.elfohilfe
 

==================== One Month Modified Files and Folders =======
 

2013-08-26 15:32 - 2009-07-14 19:58 - 00653304 _____ C:\Windows\system32\perfh007.dat

2013-08-26 15:32 - 2009-07-14 19:58 - 00131260 _____ C:\Windows\system32\perfc007.dat

2013-08-26 15:32 - 2009-07-14 07:13 - 01499760 _____ C:\Windows\system32\PerfStringBackup.INI

2013-08-26 15:30 - 2010-05-15 11:47 - 00000000 _____ C:\Windows\system32\Ikeext.etl

2013-08-26 13:17 - 2013-08-26 13:17 - 00000000 ____D C:\FRST

2013-08-25 22:03 - 2012-07-02 13:50 - 00014101 _____ C:\Windows\setupact.log

2013-08-25 22:03 - 2010-05-07 08:53 - 00000000 ____D C:\ProgramData\Kaspersky Lab

2013-08-25 22:03 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-08-25 21:52 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\tracing

2013-08-25 13:17 - 2010-12-16 18:59 - 00000000 ____D C:\Program Files (x86)\DVDFab 8

2013-08-25 13:15 - 2010-05-08 15:51 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-08-25 13:14 - 2010-05-06 20:51 - 00000000 ____D C:\Users\xxx

2013-08-25 13:13 - 2012-06-22 19:58 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-08-25 13:12 - 2010-05-06 20:40 - 01770391 _____ C:\Windows\WindowsUpdate.log

2013-08-25 13:07 - 2012-06-22 19:58 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2013-08-25 13:07 - 2012-06-22 19:57 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-08-25 13:07 - 2011-06-29 19:17 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-08-25 12:27 - 2009-07-14 06:45 - 00013216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-08-25 12:27 - 2009-07-14 06:45 - 00013216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-08-25 12:16 - 2012-11-15 20:48 - 00000000 ____D C:\Users\xxx\Desktop\Stick

2013-08-25 12:16 - 2012-08-26 12:13 - 00000000 ____D C:\Users\xxx\Desktop\Spiele

2013-08-25 12:16 - 2012-06-22 19:57 - 00000000 ____D C:\Windows\system32\Macromed

2013-08-25 12:16 - 2012-04-12 16:50 - 00000000 ____D C:\Users\xxx\Desktop\alle-kalenderwochen-2012.php-Dateien

2013-08-25 12:16 - 2012-01-15 13:23 - 00000000 ____D C:\Users\xxx\Desktop\Drucker, Scanner

2013-08-25 12:16 - 2010-09-06 18:41 - 00000000 ____D C:\Users\xxx\AppData\Roaming\mp3DirectCut

2013-08-25 12:16 - 2010-06-10 17:35 - 00000000 ____D C:\Users\xxx\AppData\Roaming\Audacity

2013-08-25 12:16 - 2010-05-25 17:34 - 00000000 ____D C:\Users\xxx\AppData\Roaming\dvdcss

2013-08-25 12:16 - 2010-05-13 16:51 - 00000000 ____D C:\Users\xxx\AppData\Roaming\Mp3tag

2013-08-25 12:16 - 2010-05-08 19:04 - 00000000 ____D C:\Users\xxx\AppData\Roaming\vlc

2013-08-25 12:16 - 2009-07-14 05:20 - 00000000 __RSD C:\Windows\Media

2013-08-25 12:16 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF

2013-08-25 12:16 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\servicing

2013-08-25 12:16 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache

2013-08-25 12:15 - 2013-08-08 07:35 - 00000000 ____D C:\Windows\System32\Tasks\Norton Internet Security CBE

2013-08-25 12:15 - 2013-08-07 12:29 - 00000000 ____D C:\Program Files\Common Files\Symantec Shared

2013-08-25 12:15 - 2013-08-07 12:10 - 00000000 ____D C:\Program Files (x86)\Norton Bootable Recovery Tool Wizard

2013-08-25 12:15 - 2013-06-01 17:37 - 00000000 ____D C:\Program Files (x86)\Turtle Odyssey 2

2013-08-25 12:15 - 2013-05-25 18:43 - 00000000 ____D C:\Program Files (x86)\DVDFab 9

2013-08-25 12:15 - 2013-05-12 23:13 - 00000000 ____D C:\ProgramData\Norton

2013-08-25 12:15 - 2013-02-10 20:04 - 00000000 ____D C:\Program Files (x86)\streamWriter

2013-08-25 12:15 - 2013-02-01 12:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-08-25 12:15 - 2012-11-09 01:14 - 00000000 ____D C:\Users\xxx\AppData\Local\Freetec

2013-08-25 12:15 - 2012-11-09 01:13 - 00000000 ____D C:\Program Files (x86)\Freetec

2013-08-25 12:15 - 2012-10-27 11:49 - 00000000 ____D C:\Program Files (x86)\PDF24

2013-08-25 12:15 - 2012-08-26 11:37 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab

2013-08-25 12:15 - 2012-01-14 16:34 - 00000000 ___HD C:\ProgramData\CanonIJScan

2013-08-25 12:15 - 2010-05-12 18:27 - 00000000 ____D C:\Program Files (x86)\Adobe

2013-08-25 12:15 - 2010-05-08 18:34 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2013-08-25 12:15 - 2010-05-07 15:25 - 00000000 ____D C:\Program Files (x86)\DVDFab 7

2013-08-25 12:15 - 2010-05-07 14:46 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-08-25 12:15 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration

2013-08-25 12:15 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared

2013-08-25 12:10 - 2012-12-06 18:00 - 00000000 ____D C:\Users\xxx\Desktop\Spiele gesichert

2013-08-25 12:10 - 2012-07-01 23:37 - 00000000 ____D C:\Users\xxx\Documents\MyHeritage

2013-08-25 12:10 - 2012-07-01 23:37 - 00000000 ____D C:\Users\xxx\AppData\Roaming\MyHeritage

2013-08-25 12:10 - 2012-06-03 15:13 - 00000000 ____D C:\Users\xxx\Documents\Fax

2013-08-25 12:10 - 2011-05-01 10:50 - 00000000 ____D C:\Users\xxx\AppData\Roaming\Lasersoft Imaging

2013-08-25 12:10 - 2010-05-07 15:26 - 00000000 ____D C:\Users\xxx\Documents\DVDFab

2013-08-25 12:09 - 2010-05-12 18:27 - 00000000 ____D C:\ProgramData\Adobe

2013-08-25 12:09 - 2010-05-09 15:08 - 00000000 ____D C:\Users\xxx\AppData\Local\Google

2013-08-25 12:08 - 2012-07-11 14:35 - 00000000 ____D C:\BigFishGamesCache

2013-08-25 12:08 - 2010-05-09 15:07 - 00000000 ____D C:\Program Files (x86)\Google

2013-08-10 18:31 - 2013-08-10 18:31 - 00003240 ____N C:\bootsqm.dat

2013-08-07 21:45 - 2013-08-07 21:45 - 00000000 ____D C:\ProgramData\AVAST Software

2013-08-07 21:45 - 2013-08-07 21:45 - 00000000 ____D C:\Program Files\AVAST Software

2013-08-07 21:41 - 2013-08-07 21:41 - 00000002 _____ C:\AvastSetup.log

2013-08-07 12:29 - 2013-08-07 12:29 - 00000000 ____D C:\Program Files\Symantec

2013-08-07 12:28 - 2013-05-12 23:13 - 00000000 ____D C:\Program Files (x86)\Norton Internet Security CBE

2013-08-04 15:13 - 2013-08-04 15:13 - 00000000 ____D C:\Users\xxx\AppData\Local\.elfohilfe

2013-08-04 13:58 - 2013-05-27 23:38 - 00000000 ____D C:\Program Files (x86)\Supermarket Management 2

2013-08-03 19:54 - 2013-05-03 11:45 - 00000000 ____D C:\MainMovie

2013-08-03 10:15 - 2010-05-06 21:08 - 00068264 _____ C:\Users\xxx\AppData\Local\GDIPFONTCACHEV1.DAT

2013-08-02 01:03 - 2013-05-28 19:32 - 00000000 ____D C:\Program Files (x86)\Campgrounds

2013-08-02 01:03 - 2013-05-28 18:53 - 00000000 ____D C:\Program Files (x86)\Toy Defense

2013-08-02 01:03 - 2013-05-27 23:42 - 00000000 ____D C:\Program Files (x86)\Garden Rescue - Weihnachtsedition

2013-08-02 01:03 - 2013-05-25 01:17 - 00000000 ____D C:\Program Files (x86)\Garden Rescue

2013-08-02 01:03 - 2013-05-12 23:46 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2013-08-01 19:59 - 2010-06-27 14:05 - 00000000 ____D C:\Users\xxx\Documents\TubeBox!
 

Files to move or delete:

====================

C:\Users\xxx\AppData\Local\Temp\pylA91D.tmp.exe
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-08-08 00:57
 

==================== End Of Log ============================

--- --- ---

Jetzt sehe ich erst, wie viele unsinnige Programme man auf dem Rechner hat.

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Hallo, bin nun endlich dazu gekommen, den Combofix durchzuführen. Hier das Ergebnis:

Code:

ComboFix 13-08-27.02 - xxx 27.08.2013  19:38:11.1.4 - x64 NETWORK

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3070.2332 [GMT 2:00]

ausgeführt von:: c:\users\xxx\Desktop\ComboFix.exe

AV: Kaspersky Security Suite CBE 11 *Disabled/Updated* {2EAA32A5-1EE1-1B22-95DA-337730C6E984}

FW: Kaspersky Security Suite CBE 11 *Disabled* {1691B380-548E-1A7A-BE85-9A42CE15AEFF}

SP: Kaspersky Security Suite CBE 11 *Disabled/Updated* {95CBD341-38DB-14AC-AF6A-08054B41A339}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 * Neuer Wiederherstellungspunkt wurde erstellt

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\install.exe

c:\program files (x86)\PriceGong

c:\program files (x86)\PriceGong\2.1.0\FF\components\PriceGong.xpt

c:\program files (x86)\PriceGong\2.1.0\FF\content\options.xul

c:\program files (x86)\PriceGong\2.1.0\FF\content\PriceGong.png

c:\program files (x86)\PriceGong\2.1.0\FF\install.rdf

c:\programdata\ntuser.dat

c:\users\Kopp\AppData\Local\assembly\tmp

c:\users\Kopp\AppData\Local\bloson.bmp

c:\users\Kopp\AppData\Local\datos.txt

c:\users\Kopp\AppData\Local\dealply.bmp

c:\users\Kopp\AppData\Local\facemoods.bmp

c:\users\Kopp\AppData\Local\lame_enc.dll

c:\users\Kopp\AppData\Local\lateral1.bmp

c:\users\Kopp\AppData\Local\lateral2.bmp

c:\users\Kopp\AppData\Local\lateral3.bmp

c:\users\Kopp\AppData\Local\no23xwrapper.dll

c:\users\Kopp\AppData\Local\ogg.dll

c:\users\Kopp\AppData\Local\save_en.bmp

c:\users\Kopp\AppData\Local\save_es.bmp

c:\users\Kopp\AppData\Local\vorbis.dll

c:\users\Kopp\AppData\Local\vorbisenc.dll

c:\users\Kopp\AppData\Local\vorbisfile.dll

c:\users\Kopp\AppData\Roaming\.#

c:\users\Kopp\AppData\Roaming\inst.exe

c:\users\Public\sdelevURL.tmp

c:\windows\IsUn0407.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-07-27 bis 2013-08-27  ))))))))))))))))))))))))))))))

.

.

2013-08-27 17:45 . 2013-08-27 17:45        --------        d-----w-        c:\users\Default\AppData\Local\temp

2013-08-26 11:17 . 2013-08-26 11:17        --------        d-----w-        C:\FRST

2013-08-25 10:40 . 2013-08-19 22:46        9515512        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{2DFF9170-7363-4634-A90A-A2FD070321CF}\mpengine.dll

2013-08-07 19:45 . 2013-08-07 19:45        --------        d-----w-        c:\program files\AVAST Software

2013-08-07 19:45 . 2013-08-07 19:45        --------        d-----w-        c:\programdata\AVAST Software

2013-08-07 10:29 . 2013-08-25 10:15        --------        d-----w-        c:\program files\Common Files\Symantec Shared

2013-08-07 10:29 . 2013-08-07 10:29        --------        d-----w-        c:\program files\Symantec

2013-08-07 10:10 . 2013-08-25 10:15        --------        d-----w-        c:\program files (x86)\Norton Bootable Recovery Tool Wizard

2013-08-07 09:52 . 2013-08-08 05:37        --------        d-----w-        c:\program files (x86)\Common Files\Symantec Shared

2013-08-04 13:13 . 2013-08-04 13:13        --------        d-----w-        c:\users\Kopp\AppData\Local\.elfohilfe

2013-08-04 11:37 . 2013-08-04 11:37        --------        d-----w-        C:\Temp

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-08-25 11:07 . 2012-06-22 17:57        692104        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2013-08-25 11:07 . 2011-06-29 17:17        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]

2012-06-06 19:33        1519304        ----a-w-        c:\program files (x86)\Ask.com\GenericAskToolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2012-06-06 1519304]

.

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"AVP"="c:\program files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\avp.exe" [2011-04-13 387696]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

"AppInit_DLLs"=c:\progra~2\KASPER~1\KASPER~1\mzvkbd3.dll c:\progra~2\KASPER~1\KASPER~1\sbhook.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe"

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"

"vspdfprsrv.exe"=c:\program files (x86)\Visagesoft\eXPert PDF 5\vspdfprsrv.exe --background

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime

"AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin

"SwitchBoard"=c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"

"HP Software Update"=c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"Family Tree Builder Update"=c:\program files (x86)\MyHeritage\Bin\FTBCheckUpdates.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001

.

R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]

R2 FreemiumSelfUpdateService;Freemium Self Update Service;c:\program files (x86)\Freetec\SystemStore\Freemium.SelfUpdate.exe;c:\program files (x86)\Freetec\SystemStore\Freemium.SelfUpdate.exe [x]

R2 HP LaserJet Service;HP LaserJet Service;c:\program files (x86)\HP\HPLaserJetService\HPLaserJetService.exe;c:\program files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [x]

R2 SelfUpdateService;Self Update Service;c:\program files (x86)\Freetec\SystemStore\SelfUpdate.exe  -displayname Self Update Service -servicename SelfUpdateService;c:\program files (x86)\Freetec\SystemStore\SelfUpdate.exe  -displayname Self Update Service -servicename SelfUpdateService [x]

R2 SystemStoreService;System Store Service;c:\program files (x86)\Freetec\SystemStore\SystemStore.exe  -displayname System Store Service -servicename:SystemStoreService;c:\program files (x86)\Freetec\SystemStore\SystemStore.exe  -displayname System Store Service -servicename:SystemStoreService [x]

R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe;c:\program files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [x]

R3 HPFXBULKLEDM;HPFXBULKLEDM;c:\windows\system32\drivers\hppdbulkio.sys;c:\windows\SYSNATIVE\drivers\hppdbulkio.sys [x]

R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys;c:\windows\SYSNATIVE\DRIVERS\klmouflt.sys [x]

R3 Ltn_stk7070P_64;PCTV based TV tuner device;c:\windows\system32\DRIVERS\Ltn_stk7070P_64.sys;c:\windows\SYSNATIVE\DRIVERS\Ltn_stk7070P_64.sys [x]

R3 Ltn_stkrc_64;PCTV Infrared Receiver;c:\windows\system32\DRIVERS\Ltn_stkrc_64.sys;c:\windows\SYSNATIVE\DRIVERS\Ltn_stkrc_64.sys [x]

R3 nmwcdnsux64;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsux64.sys;c:\windows\SYSNATIVE\drivers\nmwcdnsux64.sys [x]

R3 nmwcdx64;Nokia USB Phone Parent;c:\windows\system32\drivers\nmwcdx64.sys;c:\windows\SYSNATIVE\drivers\nmwcdx64.sys [x]

R3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys;c:\windows\SYSNATIVE\Drivers\pcouffin.sys [x]

R3 RRNetCap;RRNetCap Service;c:\windows\system32\DRIVERS\rrnetcap.sys;c:\windows\SYSNATIVE\DRIVERS\rrnetcap.sys [x]

R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys;c:\program files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]

S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys;c:\windows\SYSNATIVE\DRIVERS\kl2.sys [x]

S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys;c:\windows\SYSNATIVE\DRIVERS\klim6.sys [x]

S3 azvusb;Virtual USB Hub;c:\windows\system32\DRIVERS\azvusb.sys;c:\windows\SYSNATIVE\DRIVERS\azvusb.sys [x]

S3 RRNetCapMP;RRNetCapMP;c:\windows\system32\DRIVERS\rrnetcap.sys;c:\windows\SYSNATIVE\DRIVERS\rrnetcap.sys [x]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2}]

2010-02-16 17:02        114688        ----a-w-        c:\program files (x86)\PixiePack Codec Pack\InstallerHelper.exe

.

Inhalt des "geplante Tasks" Ordners

.

2013-08-25 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-22 11:07]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLs"=c:\progra~2\KASPER~1\KASPER~1\x64\kloehk.dll c:\progra~2\KASPER~1\KASPER~1\x64\sbhook64.dll

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

UxTuneUp

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.de/

uDefault_Search_URL = hxxp://www.google.com/ie

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

uInternet Settings,ProxyServer = http=216.115.8.130:80

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Hinzufügen zu Anti-Banner - c:\program files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\ie_banner_deny.htm

IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.178.1

FF - ProfilePath - c:\users\Kopp\AppData\Roaming\Mozilla\Firefox\Profiles\2x4gnuuh.default\

FF - user.js: yahoo.homepage.dontask - true

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: nglayout.initialpaint.delay - 600

FF - user.js: content.notify.interval - 600000

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.switch.threshold - 600000

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

AddRemove-FRITZ! 2.0 - c:\windows\IsUn0407.exe

.

.

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\SystemStoreService]

"ImagePath"="\"c:\program files (x86)\Freetec\SystemStore\SystemStore.exe\"  -displayname \"System Store Service\" -servicename:SystemStoreService"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2013-08-27  19:47:50

ComboFix-quarantined-files.txt  2013-08-27 17:47

.

Vor Suchlauf: 19 Verzeichnis(se), 147.549.114.368 Bytes frei

Nach Suchlauf: 25 Verzeichnis(se), 147.398.225.920 Bytes frei

.

- - End Of File - - 6CF316E7B906D90FF1F03F53802147BD

A36C5E4F47E84449FF07ED3517B43A31

Schönen Abend noch - Gruß pemiko

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Hallo, ich werde mich heute abend deinen Tipps widmen und die entsprechenden Programme installieren. Vorab habe ich aber noch eine Frage und bitte um ehrliche Antwort: Hast du Viren, Trojaner, Malware o. ä. auf meinem Computer gefunden? Wenn ja, auf welcher Partition (C oder D)? Gibt es Hoffnung diese sicher zu entfernen? Oder ist es besser, Windows neu aufzuspielen? Ich würde gerne mein System retten, zumal hier einige (legale) Programme installiert sind, bei denen ich Schwierigkeiten bei der Installation hatte. Außerdem sind dann meine E-Mails weg. Und mit der Wiederherstellung habe ich immer so meine Probleme. Aber ich möchte mein System nicht um jeden Preis retten! Wenn es irgendwelche Zweifel gibt, spiele ich lieber neu auf.

Ich habe mir auch schon überlegt D auszubauen und als externe Festplatte über meinen Laptop auf Viren zu prüfen. Möchte mir allerdings auf dem LAptop keinen Virus einfangen. D liegt mir besonders am Herzen, da hier meine Bilder etc. gespeichert sind.
Also wenn möglich bitte ehrliche Einschätzung über den Stand meines Computers.

Du siehst doch was Combofix schon alles gelöscht hat, und auch die anderen oben genannten Programme werden jede Menge löschen.

Aber alles nur Adware und Kram. Wenn da was kritisches dabei wäre hätte ich das schon gesagt :)

Malwarebytes Anti Malware:

Code:

Malwarebytes Anti-Malware (Test) 1.75.0.1300

www.malwarebytes.org

Datenbank Version: v2013.08.29.07

Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)

Internet Explorer 9.0.8112.16421

Kopp :: xxx-PC [Administrator]

Schutz: Deaktiviert

29.08.2013 18:01:25

mbam-log-2013-08-29 (18-01-25).txt

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 223547

Laufzeit: 3 Minute(n), 57 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 3

C:\Users\xxx\AppData\Roaming\OpenCandy (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt.

C:\Users\xxx\AppData\Roaming\OpenCandy\50A205F98E8648F4836E876290185BE6 (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt.

C:\Users\xxx\AppData\Roaming\OpenCandy\A3F93EF13CD64903B5573DFF28DA9973 (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt.
 

Infizierte Dateien: 2

C:\Users\xxx\AppData\Roaming\OpenCandy\50A205F98E8648F4836E876290185BE6\TuneUp_PC_2.4.6.4_CPMID_347.exe (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt.

C:\Users\xxx\AppData\Roaming\OpenCandy\A3F93EF13CD64903B5573DFF28DA9973\HSS-2.67-install-p76-335-conduit.exe (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt.

(Ende)

Adw Cleaner:

Code:

# AdwCleaner v3.001 - Report created 29/08/2013 at 18:10:47

# Updated 24/08/2013 by Xplode

# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

# Username : xxx-PC

# Running from : F:\Rettung Computer Büro\AdwCleaner 3.001\adwcleaner.exe

# Option : Scan
 

***** [ Services ] *****
 

Service Found : SystemStoreService
 

***** [ Files / Folders ] *****
 

File Found : C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\2x4gnuuh.default\user.js

File Found : C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar

File Found : C:\Windows\System32\Tasks\Software Updater

File Found : C:\Windows\System32\Tasks\Software Updater Ui

Folder Found C:\Program Files (x86)\Ask.com

Folder Found C:\Program Files (x86)\Common Files\DVDVideoSoft\TB

Folder Found C:\Program Files (x86)\Freemium

Folder Found C:\Program Files (x86)\pdfforge Toolbar

Folder Found C:\Program Files (x86)\softonic-de3

Folder Found C:\Program Files (x86)\SoftwareUpdater

Folder Found C:\Program Files (x86)\Wondershare

Folder Found C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare

Folder Found C:\Users\xxx\AppData\LocalLow\AskToolbar

Folder Found C:\Users\xxx\AppData\LocalLow\Conduit

Folder Found C:\Users\xxx\AppData\LocalLow\pdfforge

Folder Found C:\Users\xxx\AppData\LocalLow\PriceGong

Folder Found C:\Users\xxx\AppData\LocalLow\Search Settings

Folder Found C:\Users\xxx\AppData\LocalLow\softonic-de3

Folder Found C:\Users\xxx\AppData\Roaming\dvdvideosoftiehelpers

Folder Found C:\Users\xxxAppData\Roaming\Freemium

Folder Found C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\2x4gnuuh.default\Conduit

Folder Found C:\Users\xxx\AppData\Roaming\OpenCandy
 

***** [ Shortcuts ] *****

Junkware Tool:

Code:

Junkware Removal Tool (JRT) by Thisisu

Version: 5.5.5 (08.28.2013:1)

OS: Windows 7 Home Premium x64

Ran by xxx on 29.08.2013 at 18:22:08,35

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

~~~ Services
 

~~~ Registry Values
 

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\wondershare

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\wondershare

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\features\a28b4d68debaa244eb686953b7074fef

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\products\a28b4d68debaa244eb686953b7074fef

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\msntask_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\msntask_RASMANCS

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\msntask_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\msntask_RASMANCS

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{E9CB6E06-4EF7-4FCE-A1AF-199DA5164AB0}

Successfully deleted: [Registry Key] "hkey_current_user\software\microsoft\internet explorer\low rights\elevationpolicy\{a5aa24ea-11b8-4113-95ae-9ed71deaf12a}"
 

~~~ Files

FRST Log:
FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-08-2013

Ran by xxx (administrator) on 29-08-2013 18:35:06

Running from F:\Rettung Computer Büro

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 9

Boot Mode: Safe Mode (with Networking)
 

==================== Processes (Whitelisted) =================
 
 

==================== Registry (Whitelisted) ==================
 

HKLM-x32\...\RunOnce: [Malwarebytes Anti-Malware] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)

Winlogon\Notify\klogon: %SystemRoot%\System32\klogon.dll (Kaspersky Lab ZAO)

HKCU\...\RunOnce: [Report] - C:\AdwCleaner\AdwCleaner[S0].txt [4458 2013-08-29] ()

HKLM-x32\...\Run: [] -  [x]

HKLM-x32\...\Run: [AVP] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\avp.exe [387696 2011-04-13] (Kaspersky Lab ZAO)

AppInit_DLLs: C:\PROGRA~2\KASPER~1\KASPER~1\x64\kloehk.dll C:\PROGRA~2\KASPER~1\KASPER~1\x64\sbhook64.dll [19344 2011-04-13] (Kaspersky Lab ZAO)

AppInit_DLLs-x32: C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd3.dll C:\PROGRA~2\KASPER~1\KASPER~1\sbhook.dll [110992 2011-04-13] (Kaspersky Lab ZAO)
 

==================== Internet (Whitelisted) ====================
 

ProxyServer: http=216.115.8.130:80

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Sign In

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Upgrade to Google Chrome

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKCU - {B3667A8A-A364-4EC9-A85C-4DF0DA96D38F} URL = hxxp://www.google.de/search?q={searchTerms}

BHO: IEVkbdBHO Class - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\x64\ievkbd.dll (Kaspersky Lab ZAO)

BHO: FilterBHO Class - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\x64\klwtbbho.dll (Kaspersky Lab ZAO)

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: IEVkbdBHO Class - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\ievkbd.dll (Kaspersky Lab ZAO)

BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN\Toolbar\3.0.0744.0\msneshellx.dll (Microsoft Corp.)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

BHO-x32: FilterBHO Class - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\klwtbbho.dll (Kaspersky Lab ZAO)

Toolbar: HKLM-x32 - MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files (x86)\MSN\Toolbar\3.0.0744.0\msneshellx.dll (Microsoft Corp.)

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\2x4gnuuh.default

FF NetworkProxy: "no_proxies_on", "*.local"

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_146.dll ()

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\wikipedia-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: No Name - C:\Users\xxx\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

FF Extension: WOT - C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\2x4gnuuh.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

FF Extension: DownloadHelper - C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\2x4gnuuh.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

FF Extension: Evernote Web Clipper - C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\2x4gnuuh.default\Extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}

FF Extension: youtube2mp3 - C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\2x4gnuuh.default\Extensions\youtube2mp3@mondayx.de.xpi

FF Extension: No Name - C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\2x4gnuuh.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

FF Extension: No Name - C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\2x4gnuuh.default\Extensions\{E6C1199F-E687-42da-8C24-E7770CC3AE66}.xpi

FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@Kaspersky.ru

FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru

FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.com

CHR RestoreOnStartup: "hxxp://www.google.com"

CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}

CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}

CHR Extension: (Docs) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0

CHR Extension: (Google Drive) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0

CHR Extension: (YouTube) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0

CHR Extension: (Google Search) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0

CHR Extension: (Norton Identity Protection) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2013.1.1.4_0

CHR Extension: (Gmail) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
 

==================== Services (Whitelisted) =================
 

S2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\avp.exe [387696 2011-04-13] (Kaspersky Lab ZAO)

S2 FreemiumSelfUpdateService; C:\Program Files (x86)\Freetec\SystemStore\Freemium.SelfUpdate.exe [5686272 2012-09-26] ()

S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

S2 SelfUpdateService; C:\Program Files (x86)\Freetec\SystemStore\SelfUpdate.exe [5663232 2012-11-14] ()

S3 TuneUp.Defrag; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe [607040 2012-07-01] (TuneUp Software)

S2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [1403200 2011-11-21] (TuneUp Software)
 

==================== Drivers (Whitelisted) ====================
 

R3 azvusb; C:\Windows\System32\DRIVERS\azvusb.sys [54784 2009-08-24] (AzureWave Technologies, Inc.)

R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [460888 2010-06-09] (Kaspersky Lab ZAO)

R1 kl2; C:\Windows\System32\DRIVERS\kl2.sys [11864 2010-06-09] (Kaspersky Lab ZAO)

S1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [556120 2012-08-26] (Kaspersky Lab)

R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [27736 2010-04-22] (Kaspersky Lab ZAO)

S3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [22544 2009-11-02] (Kaspersky Lab)

S3 Ltn_stk7070P_64; C:\Windows\System32\DRIVERS\Ltn_stk7070P_64.sys [543232 2007-10-19] (LITEON)

S3 Ltn_stkrc_64; C:\Windows\System32\DRIVERS\Ltn_stkrc_64.sys [16256 2007-10-19] (LITEON)

S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

S3 nmwcdx64; C:\Windows\System32\drivers\nmwcdx64.sys [173056 2007-06-28] (Nokia)

S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2010-03-30] (RapidSolution Software AG)

R3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2010-03-30] (RapidSolution Software AG)

S3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [11856 2010-02-25] (TuneUp Software)

S3 catchme; \??\C:\ComboFix\catchme.sys [x]
 

========================== Drivers MD5 =======================
 

C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit

C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit

C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\adp94xx.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\adpahci.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\adpu320.sys ==> MD5 is legit

C:\Windows\system32\drivers\afd.sys 1C7857B62DE5994A75B054A9FD4C3825

C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit

C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit

C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\amdk8.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\amdppm.sys ==> MD5 is legit

C:\Windows\system32\drivers\amdsata.sys D4121AE6D0C0E7E13AA221AA57EF2D49

C:\Windows\system32\DRIVERS\amdsbs.sys ==> MD5 is legit

C:\Windows\System32\drivers\amdxata.sys 540DAF1CEA6094886D72126FD7C33048

C:\Windows\system32\drivers\appid.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\arc.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\arcsas.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit

C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\atikmdag.sys 77E980EB1CC596FB6073C5C540E85F62

C:\Windows\System32\DRIVERS\azvusb.sys 9F4320BA8E7CE2342517B182A2F2C0E6

C:\Windows\system32\DRIVERS\bxvbda.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\b57nd60a.sys ==> MD5 is legit

C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\BrFiltLo.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\BrFiltUp.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\bridge.sys 5C2F352A4E961D72518261257AAE204B

C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit

C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit

C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit

C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\bthmodem.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\circlass.sys ==> MD5 is legit

C:\Windows\System32\CLFS.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\CmBatt.sys ==> MD5 is legit

C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit

C:\Windows\System32\Drivers\cng.sys 9AC4F97C2D3E93367E2148EA940CD2CD

C:\Windows\system32\DRIVERS\compbatt.sys ==> MD5 is legit

C:\Windows\system32\drivers\CompositeBus.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\crcdisk.sys ==> MD5 is legit

C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit

C:\Windows\System32\drivers\discache.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\disk.sys ==> MD5 is legit

C:\Windows\System32\drivers\drmkaud.sys ==> MD5 is legit

C:\Windows\System32\drivers\dxgkrnl.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\e1e6032e.sys 416A2007878ED1D6FC5DDDB9E1F6DB3E

C:\Windows\system32\DRIVERS\evbda.sys ==> MD5 is legit

C:\Windows\System32\Drivers\ElbyCDIO.sys 9A47AC3DFCF81D30922CDAAF1C2D579F

C:\Windows\system32\DRIVERS\elxstor.sys ==> MD5 is legit

C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit

C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit

C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\fdc.sys ==> MD5 is legit

C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit

C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\flpydisk.sys ==> MD5 is legit

C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit

C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit

C:\Windows\System32\Drivers\Fs_Rec.sys 6BD9295CC032DD3077C671FCCF579A7B

C:\Windows\System32\DRIVERS\fvevol.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\gagp30kx.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\GEARAspiWDM.sys ==> MD5 is legit

C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit

C:\Windows\system32\drivers\HdAudio.sys 975761C778E33CD22498059B91E7373A

C:\Windows\system32\drivers\HDAudBus.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\HidBatt.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\hidbth.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\hidir.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit

C:\Windows\System32\drivers\hppdbulkio.sys E325F85012E793CEE74B73C4F22AE311

C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit

C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit

C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit

C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit

C:\Windows\system32\drivers\iaStorV.sys AAAF44DB3BD0B9D1FB6969B23ECC8366

C:\Windows\system32\DRIVERS\iirsp.sys ==> MD5 is legit

C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit

C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit

C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit

C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit

C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit

C:\Windows\system32\drivers\msiscsi.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\kbdhid.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\kl1.sys 8D7120743A0973CEAB548B475C9D4289

C:\Windows\System32\DRIVERS\kl2.sys CD146D8E525D6EEBDCAF24120A8AB9CE

C:\Windows\System32\DRIVERS\klif.sys C1786C2F8DE0F62E076F7EF8DEA4E87A

C:\Windows\System32\DRIVERS\klim6.sys 2A64B3A9EED93A2E96537B67C079FC96

C:\Windows\System32\DRIVERS\klmouflt.sys 9468D07E91BA136D82415F5DFC1FE168

C:\Windows\System32\Drivers\ksecdd.sys 97A7070AEA4C058B6418519E869A63B4

C:\Windows\System32\Drivers\ksecpkg.sys 26C43A7C2862447EC59DEDA188D1DA07

C:\Windows\system32\drivers\ksthunk.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\lsi_fc.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\lsi_sas.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\lsi_sas2.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\lsi_scsi.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\Ltn_stk7070P_64.sys 639D24E769BDBEC6145E4C1921669B73

C:\Windows\System32\DRIVERS\Ltn_stkrc_64.sys E028DF5A96827A87898D4D7EB768E3AB

C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit

C:\Windows\system32\drivers\mbam.sys 0BB97D43299910CBFBA59C461B99B910

C:\Windows\system32\drivers\mbam.sys 0BB97D43299910CBFBA59C461B99B910

C:\Windows\system32\DRIVERS\megasas.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\MegaSR.sys ==> MD5 is legit

C:\Windows\System32\drivers\modem.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit

C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit

C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit

C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit

C:\Windows\system32\drivers\mrxdav.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\mrxsmb.sys A5D9106A73DC88564C825D317CAC68AC

C:\Windows\System32\DRIVERS\mrxsmb10.sys D711B3C1D5F42C0C2415687BE09FC163

C:\Windows\System32\DRIVERS\mrxsmb20.sys 9423E9D355C8D303E76B8CFBD8A5C30C

C:\Windows\system32\drivers\msahci.sys ==> MD5 is legit

C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit

C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit

C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit

C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit

C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit

C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit

C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit

C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit

C:\Windows\system32\drivers\mssmbios.sys ==> MD5 is legit

C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\MTConfig.sys ==> MD5 is legit

C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit

C:\Windows\System32\drivers\ndis.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit

C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\nfrd960.sys ==> MD5 is legit

C:\Windows\System32\drivers\ccdcmbx64.sys 903681BAB213D5F84717C0FC42AFB28A

C:\Windows\System32\drivers\ccdcmbox64.sys EC4C5EBD003E0395BF4EA5A2EFD13CE6

C:\Windows\System32\drivers\nmwcdnsux64.sys 7983D9201788407C4D1FC4D0BAA04E32

C:\Windows\System32\drivers\nmwcdx64.sys AD8C3895155EE8D057F073856B2D5851

C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit

C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit

C:\Windows\System32\Drivers\Ntfs.sys E453ACF4E7D44E5530B5D5F2B9CA8563

C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit

C:\Windows\system32\drivers\nvraid.sys 0A92CB65770442ED0DC44834632F66AD

C:\Windows\system32\drivers\nvstor.sys DAB0E87525C10052BF65F06152F37E4A

C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit

C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\parport.sys ==> MD5 is legit

C:\Windows\System32\drivers\partmgr.sys E9766131EEADE40A27DC27D2D68FBA9C

C:\Windows\System32\drivers\pci.sys ==> MD5 is legit

C:\Windows\System32\drivers\pciide.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\pcmcia.sys ==> MD5 is legit

C:\Windows\System32\Drivers\pcouffin.sys AF7CE12C4F3DC8CB2B07685C916BBCFE

C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit

C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\processr.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\ql2300.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\ql40xx.sys ==> MD5 is legit

C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\rdpbus.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit

C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit

C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit

C:\Windows\System32\Drivers\RDPWD.sys E61608AA35E98999AF9AAEEEA6114B0A

C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rrnetcap.sys 2ABD2B3BA2EF0C3BA82284C2A5E28675

C:\Windows\System32\DRIVERS\rrnetcap.sys 2ABD2B3BA2EF0C3BA82284C2A5E28675

C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit

C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit

C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\serenum.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\serial.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\sermouse.sys ==> MD5 is legit

C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit

C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit

C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\sfloppy.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\SiSRaid2.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\sisraid4.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit

C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\srv.sys 441FBA48BFF01FDB9D5969EBC1838F0B

C:\Windows\System32\DRIVERS\srv2.sys B4ADEBBF5E3677CCE9651E0F01F7CC28

C:\Windows\System32\DRIVERS\srvnet.sys 27E461F0BE5BFF5FC737328F749538C3

C:\Windows\system32\DRIVERS\stexstor.sys ==> MD5 is legit

C:\Windows\system32\drivers\swenum.sys ==> MD5 is legit

C:\Windows\System32\drivers\tbhsd.sys 93F0F5EF8A4CA261372DF98B31B2BD05

C:\Windows\System32\drivers\tcpip.sys ACB82BDA8F46C84F465C1AFA517DC4B9

C:\Windows\System32\DRIVERS\tcpip.sys ACB82BDA8F46C84F465C1AFA517DC4B9

C:\Windows\System32\drivers\tcpipreg.sys ==> MD5 is legit

C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit

C:\Windows\System32\drivers\tdtcp.sys 51C5ECEB1CDEE2468A1748BE550CFBC8

C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit

C:\Windows\system32\drivers\termdd.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\tssecsrv.sys ==> MD5 is legit

C:\Windows\System32\drivers\tsusbflt.sys ==> MD5 is legit

C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys DCC94C51D27C7EC0DADECA8F64C94FCF

C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\uagp35.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit

C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit

C:\Windows\system32\drivers\umbus.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\umpass.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\usbser_lowerfltx64.sys 4E93C8496359E97830C75AC36393654D

C:\Windows\System32\Drivers\usbaapl64.sys CD03479F2DA26500B203ED075C146A7A

C:\Windows\System32\DRIVERS\usbccgp.sys 6F1A3157A1C89435352CEB543CDB359C

C:\Windows\system32\drivers\usbcir.sys ==> MD5 is legit

C:\Windows\system32\drivers\usbehci.sys C025055FE7B87701EB042095DF1A2D7B

C:\Windows\System32\DRIVERS\usbhub.sys 287C6C9410B111B68B52CA298F7B8C24

C:\Windows\system32\drivers\usbohci.sys 9840FC418B4CBD632D3D0A667A725C31

C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\usbscan.sys ==> MD5 is legit

C:\Windows\system32\drivers\usbser.sys 4ACEE387FA8FD39F83564FCD2FC234F2

C:\Windows\System32\DRIVERS\usbser_lowerfltjx64.sys 66C25CB20B2974E0C0CFDAB49FB72A02

C:\Windows\System32\DRIVERS\USBSTOR.SYS FED648B01349A3C8395A5169DB5FB7D6

C:\Windows\system32\drivers\usbuhci.sys 62069A34518BCF9C1FD9E74B3F6DB7CD

C:\Windows\System32\DRIVERS\usb8023x.sys 70D05EE263568A742D14E1876DF80532

C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit

C:\Windows\System32\drivers\vga.sys ==> MD5 is legit

C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit

C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit

C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit

C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit

C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\vsmraid.sys ==> MD5 is legit

C:\Windows\System32\drivers\vwifibus.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\wacompen.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\wd.sys ==> MD5 is legit

C:\Windows\System32\drivers\Wdf01000.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit

C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit

C:\Windows\SysWow64\drivers\wimmount.sys ==> MD5 is legit

C:\Windows\system32\drivers\WinUSB.SYS FE88B288356E7B47B74B13372ADD906D

C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit

C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit

C:\Windows\System32\drivers\WudfPf.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\WUDFRd.sys ==> MD5 is legit
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-08-29 18:20 - 2013-08-29 18:20 - 00000000 ____D C:\Windows\ERUNT

2013-08-29 18:10 - 2013-08-29 18:15 - 00000000 ____D C:\AdwCleaner

2013-08-29 17:57 - 2013-08-29 17:57 - 00001119 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-08-29 17:57 - 2013-08-29 17:57 - 00000000 ____D C:\Users\xxx\AppData\Roaming\Malwarebytes

2013-08-29 17:57 - 2013-08-29 17:57 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-08-29 17:57 - 2013-08-29 17:57 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-08-29 17:57 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2013-08-27 20:59 - 2013-08-29 18:17 - 00000112 _____ C:\Windows\setupact.log

2013-08-27 20:59 - 2013-08-29 16:08 - 00002502 _____ C:\Windows\PFRO.log

2013-08-27 20:59 - 2013-08-27 20:59 - 00000000 _____ C:\Windows\setuperr.log

2013-08-27 19:47 - 2013-08-27 19:47 - 00016957 _____ C:\ComboFix.txt

2013-08-27 19:36 - 2013-08-27 19:47 - 00000000 ____D C:\Qoobox

2013-08-27 19:36 - 2013-08-27 19:46 - 00000000 ____D C:\Windows\erdnt

2013-08-27 19:36 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe

2013-08-27 19:36 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe

2013-08-27 19:36 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2013-08-27 19:36 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2013-08-27 19:36 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2013-08-27 19:36 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe

2013-08-27 19:36 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe

2013-08-27 19:36 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe

2013-08-27 19:32 - 2013-08-27 19:32 - 00000000 _____ C:\Windows\WindowsUpdate.log

2013-08-27 19:28 - 2013-08-27 19:28 - 00061854 _____ C:\Users\xxx\Documents\cc_20130827_192800.reg

2013-08-27 19:22 - 2013-08-27 19:22 - 05114158 ____R (Swearware) C:\Users\xxx\Desktop\ComboFix.exe

2013-08-27 19:16 - 2013-08-27 19:16 - 01527314 _____ C:\Windows\SysWOW64\PerfStringBackup.INI

2013-08-26 13:17 - 2013-08-26 13:17 - 00000000 ____D C:\FRST

2013-08-10 18:31 - 2013-08-10 18:31 - 00003240 ____N C:\bootsqm.dat

2013-08-08 07:35 - 2013-08-25 12:15 - 00000000 ____D C:\Windows\System32\Tasks\Norton Internet Security CBE

2013-08-07 21:45 - 2013-08-07 21:45 - 00000000 ____D C:\ProgramData\AVAST Software

2013-08-07 21:45 - 2013-08-07 21:45 - 00000000 ____D C:\Program Files\AVAST Software

2013-08-07 21:41 - 2013-08-07 21:41 - 00000002 _____ C:\AvastSetup.log

2013-08-07 12:29 - 2013-08-25 12:15 - 00000000 ____D C:\Program Files\Common Files\Symantec Shared

2013-08-07 12:29 - 2013-08-07 12:29 - 00000000 ____D C:\Program Files\Symantec

2013-08-07 12:10 - 2013-08-25 12:15 - 00000000 ____D C:\Program Files (x86)\Norton Bootable Recovery Tool Wizard

2013-08-04 15:13 - 2013-08-04 15:13 - 00000000 ____D C:\Users\xxx\AppData\Local\.elfohilfe
 

==================== One Month Modified Files and Folders =======
 

2013-08-29 18:31 - 2010-05-08 15:51 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-08-29 18:24 - 2013-08-29 18:24 - 00002247 _____ C:\Users\xxx\Desktop\JRT.txt

2013-08-29 18:24 - 2009-07-14 19:58 - 00656814 _____ C:\Windows\system32\perfh007.dat

2013-08-29 18:24 - 2009-07-14 19:58 - 00132270 _____ C:\Windows\system32\perfc007.dat

2013-08-29 18:24 - 2009-07-14 07:13 - 01508360 _____ C:\Windows\system32\PerfStringBackup.INI

2013-08-29 18:20 - 2013-08-29 18:20 - 00000000 ____D C:\Windows\ERUNT

2013-08-29 18:18 - 2010-05-15 11:47 - 00065536 _____ C:\Windows\system32\Ikeext.etl

2013-08-29 18:17 - 2013-08-27 20:59 - 00000112 _____ C:\Windows\setupact.log

2013-08-29 18:17 - 2010-05-07 08:53 - 00000000 ____D C:\ProgramData\Kaspersky Lab

2013-08-29 18:17 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-08-29 18:17 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\tracing

2013-08-29 18:15 - 2013-08-29 18:10 - 00000000 ____D C:\AdwCleaner

2013-08-29 17:57 - 2013-08-29 17:57 - 00001119 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-08-29 17:57 - 2013-08-29 17:57 - 00000000 ____D C:\Users\xxx\AppData\Roaming\Malwarebytes

2013-08-29 17:57 - 2013-08-29 17:57 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-08-29 17:57 - 2013-08-29 17:57 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-08-29 16:08 - 2013-08-27 20:59 - 00002502 _____ C:\Windows\PFRO.log

2013-08-27 20:59 - 2013-08-27 20:59 - 00000000 _____ C:\Windows\setuperr.log

2013-08-27 19:47 - 2013-08-27 19:47 - 00016957 _____ C:\ComboFix.txt

2013-08-27 19:47 - 2013-08-27 19:36 - 00000000 ____D C:\Qoobox

2013-08-27 19:46 - 2013-08-27 19:36 - 00000000 ____D C:\Windows\erdnt

2013-08-27 19:45 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini

2013-08-27 19:32 - 2013-08-27 19:32 - 00000000 _____ C:\Windows\WindowsUpdate.log

2013-08-27 19:28 - 2013-08-27 19:28 - 00061854 _____ C:\Users\xxx\Documents\cc_20130827_192800.reg

2013-08-27 19:22 - 2013-08-27 19:22 - 05114158 ____R (Swearware) C:\Users\xxx\Desktop\ComboFix.exe

2013-08-27 19:16 - 2013-08-27 19:16 - 01527314 _____ C:\Windows\SysWOW64\PerfStringBackup.INI

2013-08-26 13:17 - 2013-08-26 13:17 - 00000000 ____D C:\FRST

2013-08-25 13:17 - 2010-12-16 18:59 - 00000000 ____D C:\Program Files (x86)\DVDFab 8

2013-08-25 13:14 - 2010-05-06 20:51 - 00000000 ____D C:\Users\xxx

2013-08-25 13:13 - 2012-06-22 19:58 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-08-25 13:07 - 2012-06-22 19:58 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2013-08-25 13:07 - 2012-06-22 19:57 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-08-25 13:07 - 2011-06-29 19:17 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-08-25 12:27 - 2009-07-14 06:45 - 00013216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-08-25 12:27 - 2009-07-14 06:45 - 00013216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-08-25 12:16 - 2012-11-15 20:48 - 00000000 ____D C:\Users\xxx\Desktop\Stick

2013-08-25 12:16 - 2012-08-26 12:13 - 00000000 ____D C:\Users\xxx\Desktop\Spiele

2013-08-25 12:16 - 2012-06-22 19:57 - 00000000 ____D C:\Windows\system32\Macromed

2013-08-25 12:16 - 2012-04-12 16:50 - 00000000 ____D C:\Users\xxx\Desktop\alle-kalenderwochen-2012.php-Dateien

2013-08-25 12:16 - 2012-01-15 13:23 - 00000000 ____D C:\Users\xxx\Desktop\Drucker, Scanner

2013-08-25 12:16 - 2010-09-06 18:41 - 00000000 ____D C:\Users\xxx\AppData\Roaming\mp3DirectCut

2013-08-25 12:16 - 2010-06-10 17:35 - 00000000 ____D C:\Users\xxx\AppData\Roaming\Audacity

2013-08-25 12:16 - 2010-05-25 17:34 - 00000000 ____D C:\Users\xxx\AppData\Roaming\dvdcss

2013-08-25 12:16 - 2010-05-13 16:51 - 00000000 ____D C:\Users\xxx\AppData\Roaming\Mp3tag

2013-08-25 12:16 - 2010-05-08 19:04 - 00000000 ____D C:\Users\xxx\AppData\Roaming\vlc

2013-08-25 12:16 - 2009-07-14 05:20 - 00000000 __RSD C:\Windows\Media

2013-08-25 12:16 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF

2013-08-25 12:16 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\servicing

2013-08-25 12:16 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache

2013-08-25 12:15 - 2013-08-08 07:35 - 00000000 ____D C:\Windows\System32\Tasks\Norton Internet Security CBE

2013-08-25 12:15 - 2013-08-07 12:29 - 00000000 ____D C:\Program Files\Common Files\Symantec Shared

2013-08-25 12:15 - 2013-08-07 12:10 - 00000000 ____D C:\Program Files (x86)\Norton Bootable Recovery Tool Wizard

2013-08-25 12:15 - 2013-06-01 17:37 - 00000000 ____D C:\Program Files (x86)\Turtle Odyssey 2

2013-08-25 12:15 - 2013-05-25 18:43 - 00000000 ____D C:\Program Files (x86)\DVDFab 9

2013-08-25 12:15 - 2013-05-12 23:13 - 00000000 ____D C:\ProgramData\Norton

2013-08-25 12:15 - 2013-02-10 20:04 - 00000000 ____D C:\Program Files (x86)\streamWriter

2013-08-25 12:15 - 2013-02-01 12:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-08-25 12:15 - 2012-11-09 01:14 - 00000000 ____D C:\Users\Kopp\AppData\Local\Freetec

2013-08-25 12:15 - 2012-11-09 01:13 - 00000000 ____D C:\Program Files (x86)\Freetec

2013-08-25 12:15 - 2012-10-27 11:49 - 00000000 ____D C:\Program Files (x86)\PDF24

2013-08-25 12:15 - 2012-08-26 11:37 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab

2013-08-25 12:15 - 2012-01-14 16:34 - 00000000 ___HD C:\ProgramData\CanonIJScan

2013-08-25 12:15 - 2010-05-12 18:27 - 00000000 ____D C:\Program Files (x86)\Adobe

2013-08-25 12:15 - 2010-05-08 18:34 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2013-08-25 12:15 - 2010-05-07 15:25 - 00000000 ____D C:\Program Files (x86)\DVDFab 7

2013-08-25 12:15 - 2010-05-07 14:46 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-08-25 12:15 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration

2013-08-25 12:15 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared

2013-08-25 12:10 - 2012-12-06 18:00 - 00000000 ____D C:\Users\xxx\Desktop\Spiele gesichert

2013-08-25 12:10 - 2012-07-01 23:37 - 00000000 ____D C:\Users\xxx\Documents\MyHeritage

2013-08-25 12:10 - 2012-07-01 23:37 - 00000000 ____D C:\Users\xxx\AppData\Roaming\MyHeritage

2013-08-25 12:10 - 2012-06-03 15:13 - 00000000 ____D C:\Users\xxx\Documents\Fax

2013-08-25 12:10 - 2011-05-01 10:50 - 00000000 ____D C:\Users\xxx\AppData\Roaming\Lasersoft Imaging

2013-08-25 12:10 - 2010-05-07 15:26 - 00000000 ____D C:\Users\xxx\Documents\DVDFab

2013-08-25 12:09 - 2010-05-12 18:27 - 00000000 ____D C:\ProgramData\Adobe

2013-08-25 12:09 - 2010-05-09 15:08 - 00000000 ____D C:\Users\xxxAppData\Local\Google

2013-08-25 12:08 - 2012-07-11 14:35 - 00000000 ____D C:\BigFishGamesCache

2013-08-25 12:08 - 2010-05-09 15:07 - 00000000 ____D C:\Program Files (x86)\Google

2013-08-10 18:31 - 2013-08-10 18:31 - 00003240 ____N C:\bootsqm.dat

2013-08-07 21:45 - 2013-08-07 21:45 - 00000000 ____D C:\ProgramData\AVAST Software

2013-08-07 21:45 - 2013-08-07 21:45 - 00000000 ____D C:\Program Files\AVAST Software

2013-08-07 21:41 - 2013-08-07 21:41 - 00000002 _____ C:\AvastSetup.log

2013-08-07 12:29 - 2013-08-07 12:29 - 00000000 ____D C:\Program Files\Symantec

2013-08-07 12:28 - 2013-05-12 23:13 - 00000000 ____D C:\Program Files (x86)\Norton Internet Security CBE

2013-08-04 15:13 - 2013-08-04 15:13 - 00000000 ____D C:\Users\xxx\AppData\Local\.elfohilfe

2013-08-04 13:58 - 2013-05-27 23:38 - 00000000 ____D C:\Program Files (x86)\Supermarket Management 2

2013-08-03 19:54 - 2013-05-03 11:45 - 00000000 ____D C:\MainMovie

2013-08-03 10:15 - 2010-05-06 21:08 - 00068264 _____ C:\Users\xxx\AppData\Local\GDIPFONTCACHEV1.DAT

2013-08-02 01:03 - 2013-05-28 19:32 - 00000000 ____D C:\Program Files (x86)\Campgrounds

2013-08-02 01:03 - 2013-05-28 18:53 - 00000000 ____D C:\Program Files (x86)\Toy Defense

2013-08-02 01:03 - 2013-05-27 23:42 - 00000000 ____D C:\Program Files (x86)\Garden Rescue - Weihnachtsedition

2013-08-02 01:03 - 2013-05-25 01:17 - 00000000 ____D C:\Program Files (x86)\Garden Rescue

2013-08-02 01:03 - 2013-05-12 23:46 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2013-08-01 19:59 - 2010-06-27 14:05 - 00000000 ____D C:\Users\xxx\Documents\TubeBox!
 

Files to move or delete:

====================

C:\Users\xxx\AppData\Local\Temp\Quarantine.exe

C:\Users\xxx\AppData\Local\Temp\jrt\erunt\ERUNT.EXE
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 

==================== BCD ================================
 

Windows-Start-Manager

---------------------

Bezeichner              {bootmgr}

device                  partition=C:

path                    \bootmgr

description             Windows Boot Manager

locale                  de-DE

inherit                 {globalsettings}

default                 {current}

resumeobject            {a7da6ec8-5946-11df-a617-e249ef136fc8}

displayorder            {current}

toolsdisplayorder       {memdiag}

timeout                 30
 

Windows-Startladeprogramm

-------------------------

Bezeichner              {current}

device                  partition=C:

path                    \Windows\system32\winload.exe

description             Windows 7

locale                  de-DE

inherit                 {bootloadersettings}

recoverysequence        {a7da6eca-5946-11df-a617-e249ef136fc8}

recoveryenabled         Yes

osdevice                partition=C:

systemroot              \Windows

resumeobject            {a7da6ec8-5946-11df-a617-e249ef136fc8}

nx                      OptIn
 

Windows-Startladeprogramm

-------------------------

Bezeichner              {a7da6eca-5946-11df-a617-e249ef136fc8}

device                  ramdisk=[C:]\Recovery\a7da6eca-5946-11df-a617-e249ef136fc8\Winre.wim,{a7da6ecb-5946-11df-a617-e249ef136fc8}

path                    \windows\system32\winload.exe

description             Windows Recovery Environment

inherit                 {bootloadersettings}

osdevice                ramdisk=[C:]\Recovery\a7da6eca-5946-11df-a617-e249ef136fc8\Winre.wim,{a7da6ecb-5946-11df-a617-e249ef136fc8}

systemroot              \windows

nx                      OptIn

winpe                   Yes
 

Wiederaufnahme aus dem Ruhezustand

----------------------------------

Bezeichner              {a7da6ec8-5946-11df-a617-e249ef136fc8}

device                  partition=C:

path                    \Windows\system32\winresume.exe

description             Windows Resume Application

locale                  de-DE

inherit                 {resumeloadersettings}

filedevice              partition=C:

filepath                \hiberfil.sys

debugoptionenabled      No
 

Windows-Speichertestprogramm

----------------------------

Bezeichner              {memdiag}

device                  partition=C:

path                    \boot\memtest.exe

description             Windows-Speicherdiagnose

locale                  de-DE

inherit                 {globalsettings}

badmemoryaccess         Yes
 

Windows-Legacybetriebssystem-Ladeprogramm

-----------------------------------------

Bezeichner              {ntldr}

device                  partition=C:

path                    \ntldr

description             Frhere Windows-Version
 

EMS-Einstellungen

-----------------

Bezeichner              {emssettings}

bootems                 Yes
 

Debuggereinstellungen

---------------------

Bezeichner              {dbgsettings}

debugtype               Serial

debugport               1

baudrate                115200
 

RAM-Defekte

-----------

Bezeichner              {badmemory}
 

Globale Einstellungen

---------------------

Bezeichner              {globalsettings}

inherit                 {dbgsettings}

                        {emssettings}

                        {badmemory}
 

Startladeprogramm-Einstellungen

-------------------------------

Bezeichner              {bootloadersettings}

inherit                 {globalsettings}

                        {hypervisorsettings}
 

Hypervisoreinstellungen

-------------------

Bezeichner              {hypervisorsettings}

hypervisordebugtype     Serial

hypervisordebugport     1

hypervisorbaudrate      115200
 

Einstellungen zur Ladeprogrammfortsetzung

-----------------------------------------

Bezeichner              {resumeloadersettings}

inherit                 {globalsettings}
 

Ger„teoptionen

--------------

Bezeichner              {a7da6ecb-5946-11df-a617-e249ef136fc8}

description             Ramdisk Options

ramdisksdidevice        partition=C:

ramdisksdipath          \Recovery\a7da6eca-5946-11df-a617-e249ef136fc8\boot.sdi
 
 
 

LastRegBack: 2013-08-08 00:57
 

==================== End Of Log ============================

--- --- ---

Leider lässt sich der Compi weiterhin nur im abges. Modus speichern.

was passiert im normalen modus?

Ich meinte natürlich, dass der PC sich weiter nur im abgesicherten Modus starten lässt. Im normalen Modus kommt er bis zu dem Windows Zeichen, und dann erfolgt ganz leise im Hintergrund die Windows Musik. Bis zu meinen Anmeldedaten gelange ich jedoch nicht. Der Bildschirm wird dann einfach ganz schwarz. Der PC lässt sich dann nur noch am Gerät selber über längeres Drücken des Einschaltbuttens ausschalten. Ich habe auch schon versucht, mit der Original-Windows CD das Reparaturprogramm zu starten. Funktioniert nicht. Dann habe ich auch eine SicherheitsCD erstellt. Die wird aber auch nicht erkannt.

Beim Hochfahren F8 drücken > Computer reparieren > Startreparatur

Kannst normal booten? wenn nicht dann im safe Mode:

Downloade dir bitte Windows Repair (All In One) von hier.

Installiere das Programm. Starte es, nachdem die Installation abgeschlossen wurde.
Klicke auf Step 2 und drücke unter Check Disk auf Do It.

http://i1224.photobucket.com/albums/...3/Capture3.gif
Wenn der Vorgang abgeschlossen ist, klicke auf Step 3 und drücke unter System File Check auf Do It.

http://i1224.photobucket.com/albums/...y3/Capture.gif
Nachdem der Vorgang abgeschlossen ist, klicke auf Start Repairs, wähle den Advanced Mode und drücke Start.

http://i1224.photobucket.com/albums/...3/Capture1.gif
Gehe bitte sicher, dass die Kästchen wie unten zu sehen angehakt sind. Bitte hake zusätzlich noch Set Windows Services to Default Startup an.
Hake Restart System when Finished an.
Drücke Start.

http://i1238.photobucket.com/albums/...eakingtool.jpg

Hallo,
das Programm klappt nicht! Wenn ich es starte, dann möchte es immer vorab einen Neustart. Neustart geht aber nicht - sondern nur im abgesicherten Modus. Und wir drehen uns im Kreis. Drücke ich F8 - Computer reparieren - Startreparatur, kann ich nicht auf das Tool zugreigen

Gruß pemiko