Trojaner-Board - Win 7 : Kein Speicherplatz mehr auf C und nach Loeschen von Dateien wird C schnell gefuellt

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Win 7 : Kein Speicherplatz mehr auf C und nach Loeschen von Dateien wird C schnell gefuellt - aber wovon? (https://www.trojaner-board.de/149455-win-7-kein-speicherplatz-mehr-c-loeschen-dateien-c-schnell-gefuellt-wovon.html)

Win 7 : Kein Speicherplatz mehr auf C und nach Loeschen von Dateien wird C schnell gefuellt - aber wovon?

Win 7 32 bit: Trotz Loeschen, Deinstallieren und Speichern auf USB-Stick wird der frei gewordene Speicherplatz schnell wieder gefuellt - aber wovon?

Laptop faehrt noch hoch, aber Kaspersky Updatedateien sind beschaedigt und Neuinstallation der software wird empfohlen.

Drucken, speichern, downloaden nicht mehr moeglich, LOESCHEN NICHT MEHR MOEGLICH ...

Auf D sind unveraendert 27GB von 40 GB frei!

:confused: Wir brauchen Eure Hilfe!!!

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Ich geh zum download ins Internetcafé, hab die 32 er Version auf den Stick geladen, aber ich kann sie nicht starten, weder ueber "Oeffnen", noch ueber "als administrator ausfuehren" - es geht eben nicht mehr.:headbang:

hi,

Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)

Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)

Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST 32-Bit | FRST 64-Bit

Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.

Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:

Über den Boot Manager:

Starte den Rechner neu.

Während dem Hochfahren drücke mehrmals die F8 Taste

Wähle nun Computer reparieren.

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD (auch bei Windows 8 möglich):

Lege die Windows CD in dein Laufwerk.

Starte den Rechner neu und starte von der CD.

Wähle die Spracheinstellungen und klicke "Weiter".

Klicke auf Computerreparaturoptionen !

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Wähle in den Reparaturoptionen: Eingabeaufforderung

Gib nun bitte notepad ein und drücke Enter.

Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.

Schließe Notepad wieder

Gib nun bitte folgenden Befehl ein.
e:\frst.exe bzw. e:\frst64.exe
Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.

Akzeptiere den Disclaimer mit Ja und klicke Untersuchen

Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 10-02-2014

Ran by SYSTEM on MININT-JHHLHDN on 12-02-2014 14:33:21

Running from G:\

Windows 7 Home Premium (X86) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Recovery
 

The current controlset is ControlSet001
 ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.
 
 
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-09-13] (Advanced Micro Devices, Inc.)

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [12013272 2013-10-18] (Realtek Semiconductor)

HKLM\...\Run: [MGSysCtrl] - C:\Program Files\System Control Manager\MGSysCtrl.exe [2478080 2010-06-22] (Micro-Star International Co., Ltd.)

HKLM\...\Run: [MailCheck IE Broker] - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe [1766464 2013-10-16] (1und1 Mail und Media GmbH)

HKLM\...\Run: [EvtMgr6] - C:\Program Files\Logitech\SetPointP\SetPoint.exe [1851192 2012-11-04] (Logitech, Inc.)

HKLM\...\Run: [AMD AVT] - C:\Program Files\AMD AVT\bin\kdbsync.exe [20992 2012-03-19] ()

Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)

HKU\Default\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs

HKU\Default User\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs

HKU\pc\...\Run: [NTRedirect] - C:\Windows\system32\rundll32.exe  "C:\Users\pc\AppData\Roaming\BabSolution\Shared\enhancedNT.dll",Run

HKU\pc\...\Run: [Mobile Partner] - C:\Program Files\Wi-Fi Modem\Wi-Fi Modem

IFEO\taskmgr.exe: [Debugger] C:\Program Files\TuneUp Utilities 2012\PMLauncher.exe
 

========================== Services (Whitelisted) =================
 

S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [291840 2012-09-13] (Advanced Micro Devices, Inc.)

S2 AVP; C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2013-10-17] (Kaspersky Lab ZAO)

S2 HWDeviceService.exe; C:\ProgramData\DatacardService\HWDeviceService.exe [271712 2011-03-14] ()

S2 Micro Star SCM; C:\Program Files\System Control Manager\MSIService.exe [160768 2009-07-09] (Micro-Star International Co., Ltd.)

S2 TuneUp.UtilitiesSvc; C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe [1529656 2013-12-11] (TuneUp Software)

S4 NMIndexingService; "C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe" [X]
 

==================== Drivers (Whitelisted) ====================
 

S0 amd_sata; C:\Windows\System32\DRIVERS\amd_sata.sys [70784 2012-04-11] (Advanced Micro Devices)

S0 amd_xata; C:\Windows\System32\DRIVERS\amd_xata.sys [34944 2012-04-11] (Advanced Micro Devices)

S2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [48256 2012-04-09] (Advanced Micro Devices)

S3 huawei_cdcacm; C:\Windows\System32\DRIVERS\ew_jucdcacm.sys [90368 2011-02-25] (Huawei Technologies Co., Ltd.)

S3 huawei_cdcecm; C:\Windows\System32\DRIVERS\ew_jucdcecm.sys [64384 2011-01-30] (Huawei Technologies Co., Ltd.)

S3 huawei_ext_ctrl; C:\Windows\System32\DRIVERS\ew_juextctrl.sys [26624 2011-01-30] (Huawei Technologies Co., Ltd.)

S0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [135776 2013-11-28] (Kaspersky Lab ZAO)

S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [94304 2013-06-08] (Kaspersky Lab ZAO)

S1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [574560 2013-12-19] (Kaspersky Lab ZAO)

S1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [25696 2013-10-17] (Kaspersky Lab ZAO)

S3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [25696 2013-10-17] (Kaspersky Lab ZAO)

S3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [25696 2013-10-17] (Kaspersky Lab ZAO)

S1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [14432 2013-04-12] (Kaspersky Lab ZAO)

S1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [45024 2013-05-14] (Kaspersky Lab ZAO)

S1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [144992 2013-12-19] (Kaspersky Lab ZAO)

S3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [168480 2009-12-02] (Realtek Semiconductor Corp.)

S3 TuneUpUtilitiesDrv; C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys [10064 2012-02-09] (TuneUp Software)

S3 amdiox86; system32\DRIVERS\amdiox86.sys [X]

S5 Tosrfcom; C:\Windows\System32\Drivers\Tosrfcom.sys [64896 2005-08-01] (TOSHIBA Corporation)

S3 usbbus; system32\DRIVERS\lgusbbus.sys [X]

S3 UsbDiag; system32\DRIVERS\lgusbdiag.sys [X]

S3 USBModem; system32\DRIVERS\lgusbmodem.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-02-12 13:20 - 2014-02-12 14:33 - 00000000 ____D () C:\FRST

2014-02-07 19:24 - 2014-02-07 19:24 - 00000000 ____D () C:\Users\pc\Documents\Fax

2014-02-07 19:18 - 2014-02-12 14:22 - 00000784 _____ () C:\Windows\setupact.log

2014-02-05 08:15 - 2014-02-05 08:15 - 00000000 ____D () C:\Users\pc\Documents\Audible

2014-02-01 08:32 - 2014-02-01 08:32 - 00000000 _____ () C:\Windows\System32\꟪ꎞ닩ꚷ黮覞韫ꆚ鋪ꚗ髮궲럨ꆚ苫ꞷ黮ꖮ菫ꂚ蛪ꚗ黮膚菩놎뫪ꎃ髮醲蟩ꆖ蛪ꚷ黮閒韩겖軫ꚧ髮閚蟩꺞뻪ꊧ髮薒

2014-01-28 20:55 - 2014-01-28 20:55 - 00000000 ____H () C:\Windows\MEMORY.DMP

2014-01-27 21:25 - 2014-01-27 21:25 - 00000000 ____D () C:\Windows\pss

2014-01-27 21:17 - 2014-01-27 21:17 - 00000017 _____ () C:\Users\pc\AppData\Local\resmon.resmoncfg

2014-01-26 23:17 - 2014-01-26 23:17 - 00000000 ____D () C:\Users\Public\Documents\Logishrd

2014-01-26 22:18 - 2014-01-26 22:18 - 00000000 ____D () C:\Program Files\Adblock Plus for IE

2014-01-24 18:42 - 2014-01-24 18:42 - 00000000 _____ () C:\Windows\System32\ꧣ鲁뷦꞉뗦ꒅ藦鲭跧낕跧ꮥ냦ꆉ藦뚁郣꺀胣鲑釧ꆱ뷦꒕闦뎽맦뚕釧꾉맢ꒅ

2014-01-17 10:31 - 2014-01-31 19:17 - 00147456 _____ () C:\Windows\System32\㩣灜潲牧浡慤慴歜獡数獲祫氠扡慜灶㐱〮〮摜瑡屡潭畤敬彳湩敶瑮牯⹹慤

2014-01-15 13:40 - 2014-01-15 13:40 - 00264616 _____ (Oracle Corporation) C:\Windows\System32\javaws.exe

2014-01-15 13:40 - 2014-01-15 13:40 - 00175016 _____ (Oracle Corporation) C:\Windows\System32\javaw.exe

2014-01-15 13:40 - 2014-01-15 13:40 - 00174504 _____ (Oracle Corporation) C:\Windows\System32\java.exe

2014-01-15 13:40 - 2014-01-15 13:40 - 00094632 _____ (Oracle Corporation) C:\Windows\System32\WindowsAccessBridge.dll

2014-01-15 13:40 - 2014-01-15 13:40 - 00000000 ____D () C:\Program Files\Java

2014-01-15 08:22 - 2013-11-27 02:14 - 00258560 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbhub.sys

2014-01-15 08:22 - 2013-11-27 02:13 - 00284672 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbport.sys

2014-01-15 08:22 - 2013-11-27 02:13 - 00076288 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbccgp.sys

2014-01-15 08:22 - 2013-11-27 02:13 - 00043520 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbehci.sys

2014-01-15 08:22 - 2013-11-27 02:13 - 00024064 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbuhci.sys

2014-01-15 08:22 - 2013-11-27 02:13 - 00020480 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbohci.sys

2014-01-15 08:22 - 2013-11-27 02:13 - 00006016 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbd.sys

2014-01-15 08:22 - 2013-11-26 12:11 - 00240576 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\netio.sys

2014-01-15 08:22 - 2013-11-26 11:10 - 02349056 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys

2014-01-13 22:04 - 2014-01-13 22:04 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia

2014-01-13 22:04 - 2014-01-13 22:04 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia

2014-01-13 21:55 - 2014-01-13 21:55 - 00000000 ____D () C:\Users\pc\AppData\Local\Secunia PSI
 

==================== One Month Modified Files and Folders =======
 

2014-02-12 14:33 - 2014-02-12 13:20 - 00000000 ____D () C:\FRST

2014-02-12 14:23 - 2013-11-28 08:26 - 00000000 ____D () C:\ProgramData\Kaspersky Lab

2014-02-12 14:22 - 2014-02-07 19:18 - 00000784 _____ () C:\Windows\setupact.log

2014-02-12 13:41 - 2009-07-14 05:34 - 00009920 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-02-12 13:41 - 2009-07-14 05:34 - 00009920 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-02-11 21:53 - 2013-01-24 14:13 - 00000000 ____D () C:\Program Files\TuneUp Utilities 2012

2014-02-07 22:22 - 2013-01-19 14:05 - 00000000 ____D () C:\users\pc

2014-02-07 19:24 - 2014-02-07 19:24 - 00000000 ____D () C:\Users\pc\Documents\Fax

2014-02-05 17:28 - 2013-01-19 13:56 - 01540095 _____ () C:\Windows\WindowsUpdate.log

2014-02-05 08:15 - 2014-02-05 08:15 - 00000000 ____D () C:\Users\pc\Documents\Audible

2014-02-05 08:12 - 2013-09-11 07:45 - 00000000 ____D () C:\Program Files\MyPC Backup

2014-02-05 07:57 - 2010-06-22 11:24 - 01622904 _____ () C:\Windows\System32\PerfStringBackup.INI

2014-02-05 07:48 - 2013-10-15 09:46 - 00000000 ____D () C:\Program Files\Canon

2014-02-05 07:47 - 2009-07-14 05:52 - 00000000 ____D () C:\Windows\twain_32

2014-02-03 09:08 - 2009-07-14 03:37 - 00000000 ___RD () C:\users\Public

2014-02-01 10:30 - 2013-02-20 20:51 - 00000000 ____D () C:\Users\pc\AppData\Roaming\Skype

2014-02-01 10:30 - 2013-02-20 20:50 - 00000000 ____D () C:\ProgramData\Skype

2014-02-01 10:27 - 2013-04-27 20:51 - 01231360 ___SH () C:\Users\pc\Desktop\Thumbs.db

2014-02-01 08:56 - 2013-03-14 15:29 - 00221184 ___SH () C:\Users\pc\Documents\Thumbs.db

2014-02-01 08:46 - 2013-03-29 09:16 - 00000000 ____D () C:\ProgramData\boost_interprocess

2014-02-01 08:32 - 2014-02-01 08:32 - 00000000 _____ () C:\Windows\System32\꟪ꎞ닩ꚷ黮覞韫ꆚ鋪ꚗ髮궲럨ꆚ苫ꞷ黮ꖮ菫ꂚ蛪ꚗ黮膚菩놎뫪ꎃ髮醲蟩ꆖ蛪ꚷ黮閒韩겖軫ꚧ髮閚蟩꺞뻪ꊧ髮薒

2014-01-31 19:17 - 2014-01-17 10:31 - 00147456 _____ () C:\Windows\System32\㩣灜潲牧浡慤慴歜獡数獲祫氠扡慜灶㐱〮〮摜瑡屡潭畤敬彳湩敶瑮牯⹹慤

2014-01-30 22:07 - 2013-01-21 12:37 - 00000000 ____D () C:\Users\pc\AppData\Local\Adobe

2014-01-30 22:04 - 2013-03-11 10:15 - 00000000 ____D () C:\Program Files\SigelLabelBarcode

2014-01-30 19:45 - 2013-05-09 14:42 - 00000000 ____D () C:\Program Files\Common Files\AVSMedia

2014-01-29 22:26 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\registration

2014-01-29 20:53 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\System32\LogFiles

2014-01-28 20:55 - 2014-01-28 20:55 - 00000000 ____H () C:\Windows\MEMORY.DMP

2014-01-27 21:25 - 2014-01-27 21:25 - 00000000 ____D () C:\Windows\pss

2014-01-27 21:17 - 2014-01-27 21:17 - 00000017 _____ () C:\Users\pc\AppData\Local\resmon.resmoncfg

2014-01-26 23:17 - 2014-01-26 23:17 - 00000000 ____D () C:\Users\Public\Documents\Logishrd

2014-01-26 22:18 - 2014-01-26 22:18 - 00000000 ____D () C:\Program Files\Adblock Plus for IE

2014-01-26 22:18 - 2013-12-25 18:57 - 00000000 ____D () C:\ProgramData\Package Cache

2014-01-26 19:49 - 2013-09-10 20:26 - 00000000 ____D () C:\Users\pc\AppData\Roaming\player

2014-01-24 22:04 - 2009-07-14 03:03 - 50593792 _____ () C:\Windows\System32\config\SOFTWARE_tureg_old

2014-01-24 22:04 - 2009-07-14 03:03 - 21495808 _____ () C:\Windows\System32\config\SYSTEM_tureg_old

2014-01-24 22:04 - 2009-07-14 03:03 - 00024576 _____ () C:\Windows\System32\config\SECURITY_tureg_old

2014-01-24 22:01 - 2009-07-14 03:03 - 00815104 _____ () C:\Windows\System32\config\DEFAULT_tureg_old

2014-01-24 22:01 - 2009-07-14 03:03 - 00024576 _____ () C:\Windows\System32\config\SAM_tureg_old

2014-01-24 21:16 - 2009-07-14 09:47 - 00000000 ____D () C:\Windows\System32\Drivers\de-DE

2014-01-24 21:16 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\System32\de-DE

2014-01-24 18:42 - 2014-01-24 18:42 - 00000000 _____ () C:\Windows\System32\ꧣ鲁뷦꞉뗦ꒅ藦鲭跧낕跧ꮥ냦ꆉ藦뚁郣꺀胣鲑釧ꆱ뷦꒕闦뎽맦뚕釧꾉맢ꒅ

2014-01-22 09:05 - 2013-08-30 12:46 - 00000000 ____D () C:\Users\pc\AppData\Roaming\vlc

2014-01-18 10:26 - 2013-04-14 20:56 - 00000000 ____D () C:\Program Files\Samsung

2014-01-18 10:05 - 2013-04-14 21:33 - 00000000 ____D () C:\Users\pc\AppData\Roaming\Samsung

2014-01-18 10:05 - 2013-04-14 21:33 - 00000000 ____D () C:\Users\pc\AppData\Local\Samsung

2014-01-18 10:05 - 2013-04-14 20:56 - 00000000 ____D () C:\ProgramData\Samsung

2014-01-18 10:05 - 2010-06-22 12:01 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information

2014-01-18 10:03 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Microsoft.NET

2014-01-18 09:53 - 2013-09-11 10:56 - 00000000 ____D () C:\Windows\Minidump

2014-01-15 13:43 - 2010-06-22 12:35 - 00000000 ____D () C:\Program Files\Common Files\Adobe AIR

2014-01-15 13:40 - 2014-01-15 13:40 - 00264616 _____ (Oracle Corporation) C:\Windows\System32\javaws.exe

2014-01-15 13:40 - 2014-01-15 13:40 - 00175016 _____ (Oracle Corporation) C:\Windows\System32\javaw.exe

2014-01-15 13:40 - 2014-01-15 13:40 - 00174504 _____ (Oracle Corporation) C:\Windows\System32\java.exe

2014-01-15 13:40 - 2014-01-15 13:40 - 00094632 _____ (Oracle Corporation) C:\Windows\System32\WindowsAccessBridge.dll

2014-01-15 13:40 - 2014-01-15 13:40 - 00000000 ____D () C:\Program Files\Java

2014-01-15 13:39 - 2013-11-03 20:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox

2014-01-15 13:36 - 2013-07-11 10:24 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe

2014-01-15 13:36 - 2013-07-11 10:24 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl

2014-01-15 13:34 - 2009-07-14 05:33 - 00306872 _____ () C:\Windows\System32\FNTCACHE.DAT

2014-01-15 13:29 - 2013-07-11 19:34 - 00000000 ____D () C:\Windows\System32\MRT

2014-01-15 13:25 - 2010-06-22 11:24 - 83425928 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe

2014-01-13 22:09 - 2010-06-22 11:24 - 00000000 ____D () C:\Program Files\MSXML 4.0

2014-01-13 22:04 - 2014-01-13 22:04 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia

2014-01-13 22:04 - 2014-01-13 22:04 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia

2014-01-13 22:04 - 2010-06-22 12:29 - 00000000 ____D () C:\Program Files\Adobe

2014-01-13 21:55 - 2014-01-13 21:55 - 00000000 ____D () C:\Users\pc\AppData\Local\Secunia PSI

2014-01-13 15:35 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\System32\NDF
 

==================== Known DLLs (Whitelisted) ============
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 

==================== EXE ASSOCIATION =====================
 

HKLM\...\.exe: exefile => OK

HKLM\...\exefile\DefaultIcon: %1 => OK

HKLM\...\exefile\open\command: "%1" %* => OK
 

==================== Restore Points  =========================
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 12%

Total physical RAM: 3839.24 MB

Available physical RAM: 3344.71 MB

Total Pagefile: 3837.52 MB

Available Pagefile: 3348.29 MB

Total Virtual: 2047.88 MB

Available Virtual: 1951.01 MB
 

==================== Drives ================================
 

Drive c: (BOOT) (Fixed) (Total:256.99 GB) (Free:0 GB) NTFS

Drive e: (Recover) (Fixed) (Total:40 GB) (Free:26.74 GB) NTFS

Drive g: (HP V165W) (Removable) (Total:7.52 GB) (Free:7.52 GB) FAT32

Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Drive y: () (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 298 GB) (Disk ID: F22BA34D)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=257 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=40 GB) - (Type=07 NTFS)

Partition 4: (Not Active) - (Size=1 GB) - (Type=12)
 

========================================================

Disk: 1 (MBR Code: Windows XP) (Size: 8 GB) (Disk ID: C3072E18)

Partition 1: (Active) - (Size=8 GB) - (Type=0B)
 
 

LastRegBack: 2014-01-30 12:28
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Salut Schrauber,

hier der/die/das logfile; addition finde ich hier nicht, wurde das erstellt? Haette ich das Kaestchen anklicken sollen?

Was bedeuten diese Zeichen in system32?

Gruss

"Kerr"

Das is Unicode China Krempel.

Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

2014-02-01 08:32 - 2014-02-01 08:32 - 00000000 _____ () C:\Windows\System32\꟪ꎞ닩ꚷ黮覞韫ꆚ鋪ꚗ髮궲럨ꆚ苫ꞷ黮ꖮ菫ꂚ蛪ꚗ黮膚菩놎뫪ꎃ髮醲蟩ꆖ蛪ꚷ黮閒韩겖軫ꚧ髮閚蟩꺞뻪ꊧ髮薒

2014-01-24 18:42 - 2014-01-24 18:42 - 00000000 _____ () C:\Windows\System32\ꧣ鲁뷦꞉뗦ꒅ藦鲭跧낕跧ꮥ냦ꆉ藦뚁郣꺀胣鲑釧ꆱ뷦꒕闦뎽맦뚕釧꾉맢ꒅ

2014-01-17 10:31 - 2014-01-31 19:17 - 00147456 _____ () C:\Windows\System32\㩣灜潲牧浡慤慴歜獡数獲祫氠扡慜灶㐱〮〮摜瑡屡潭畤敬彳湩敶瑮牯⹹慤

HKU\pc\...\Run: [NTRedirect] - C:\Windows\system32\rundll32.exe  "C:\Users\pc\AppData\Roaming\BabSolution\Shared\enhancedNT.dll",Run

HKU\pc\...\Run: [Mobile Partner] - C:\Program Files\Wi-Fi Modem\Wi-Fi Modem

IFEO\taskmgr.exe: [Debugger] C:\Program Files\TuneUp Utilities 2012\PMLauncher.exe

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

Starte deinen Rechner erneut in die Reparaturoptionen
Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Hallo:

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 12-02-2014 01

Ran by SYSTEM at 2014-02-13 21:44:05 Run:1

Running from G:\

Boot Mode: Recovery
 

==============================================
 

Content of fixlist:

*****************

2014-02-01 08:32 - 2014-02-01 08:32 - 00000000 _____ () C:\Windows\System32\????????????????????????????????????????????????????????????????????????

2014-01-24 18:42 - 2014-01-24 18:42 - 00000000 _____ () C:\Windows\System32\????????????????????????????????????????????????

2014-01-17 10:31 - 2014-01-31 19:17 - 00147456 _____ () C:\Windows\System32\????????????????????????????????

HKU\pc\...\Run: [NTRedirect] - C:\Windows\system32\rundll32.exe  "C:\Users\pc\AppData\Roaming\BabSolution\Shared\enhancedNT.dll",Run

HKU\pc\...\Run: [Mobile Partner] - C:\Program Files\Wi-Fi Modem\Wi-Fi Modem

IFEO\taskmgr.exe: [Debugger] C:\Program Files\TuneUp Utilities 2012\PMLauncher.exe

*****************
 

C:\Windows\System32\???????????????????????????????????????????????????????????????????????? => Moved successfully.

C:\Windows\System32\???????????????????????????????????????????????? => Moved successfully.

C:\Windows\System32\???????????????????????????????? => Moved successfully.

HKU\pc\Software\Microsoft\Windows\CurrentVersion\Run\\NTRedirect => Value deleted successfully.

HKU\pc\Software\Microsoft\Windows\CurrentVersion\Run\\Mobile Partner => Value deleted successfully.

HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe => Key deleted successfully.
 

==== End of Fixlog ====

Gruss, Kerr

Kannste jetzt einigermaßen im normalen Modus arbeiten?

Danke für Deine Nachricht!

Nein.

Ich hab als erstes versucht, Kaspersky zu updaten: Fehlermeldung; dann versucht, es neu zu installieren, aber die Meldung "Fehler 1711, überprüfen Sie, ob genügend Speicherplatz ..."; dann auf das Icon der Meldung geklickt: "Datenträgerbereinigung: Scanvorgang: Systemfehler - Speicherabbilddateien".

Und die Funktionen "zurück" und "drucken" gehen noch nicht.

Gruß

Kerr

Aber FRST solte im normalen MOdus laufen, bitte von da scannen.

Ja, das geht,

zuerst die Meldung "C:\Windows\ERUNT.exe ist keine zulässige Win32-Anwendung"

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-02-2014 01

Ran by pc (administrator) on PC-PC on 16-02-2014 08:17:52

Running from F:\

Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (All) =========================
 

(Microsoft Corporation) C:\Windows\System32\smss.exe

(Microsoft Corporation) C:\Windows\system32\csrss.exe

(Microsoft Corporation) C:\Windows\system32\csrss.exe

(Microsoft Corporation) C:\Windows\system32\wininit.exe

(Microsoft Corporation) C:\Windows\system32\services.exe

(Microsoft Corporation) C:\Windows\system32\winlogon.exe

(Microsoft Corporation) C:\Windows\system32\lsass.exe

(Microsoft Corporation) C:\Windows\system32\lsm.exe

(Microsoft Corporation) C:\Windows\system32\svchost.exe

(Microsoft Corporation) C:\Windows\system32\svchost.exe

(AMD) C:\Windows\system32\atiesrxx.exe

(Microsoft Corporation) C:\Windows\System32\svchost.exe

(Microsoft Corporation) C:\Windows\System32\svchost.exe

(Microsoft Corporation) C:\Windows\system32\svchost.exe

(Microsoft Corporation) C:\Windows\system32\svchost.exe

(Microsoft Corporation) C:\Windows\system32\svchost.exe

(Microsoft Corporation) C:\Windows\system32\svchost.exe

(AMD) C:\Windows\system32\atieclxx.exe

(Microsoft Corporation) C:\Windows\System32\spoolsv.exe

(Microsoft Corporation) C:\Windows\system32\svchost.exe

(Microsoft Corporation) C:\Windows\system32\taskhost.exe

(Microsoft Corporation) C:\Windows\system32\Dwm.exe

(Microsoft Corporation) C:\Windows\Explorer.EXE

(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe

(Microsoft Corporation) C:\Windows\system32\svchost.exe

() C:\ProgramData\DatacardService\HWDeviceService.exe

(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe

(Micro-Star International Co., Ltd.) C:\Program Files\System Control Manager\MSIService.exe

(Microsoft Corporation) C:\Windows\System32\svchost.exe

(Microsoft Corporation) C:\Windows\System32\svchost.exe

(Protexis Inc.) c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

(TuneUp Software) C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

(Micro-Star International Co., Ltd.) C:\Program Files\System Control Manager\MGSysCtrl.exe

(1und1 Mail und Media GmbH) C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe

(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe

(TuneUp Software) C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesApp32.exe

(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe

(Microsoft Corporation) C:\Windows\system32\wbem\wmiprvse.exe

(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe

(Microsoft Corporation) C:\Windows\system32\svchost.exe

(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnetwk.exe

(Microsoft Corporation) C:\Windows\System32\svchost.exe

(Microsoft Corporation) C:\Windows\System32\svchost.exe

(Farbar) F:\FRST.exe

(Microsoft Corporation) C:\Windows\system32\wbem\wmiprvse.exe

(Microsoft Corporation) C:\Windows\system32\notepad.exe
 

==================== Registry (All) ===========================
 

HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-09-13] (Advanced Micro Devices, Inc.)

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [12013272 2013-10-18] (Realtek Semiconductor)

HKLM\...\Run: [MGSysCtrl] - C:\Program Files\System Control Manager\MGSysCtrl.exe [2478080 2010-06-22] (Micro-Star International Co., Ltd.)

HKLM\...\Run: [MailCheck IE Broker] - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe [1766464 2013-10-16] (1und1 Mail und Media GmbH)

HKLM\...\Run: [AMD AVT] - C:\Program Files\AMD AVT\bin\kdbsync.exe [20992 2012-03-19] ()
 

==================== Internet (All) ===========================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blanc

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://medion.msn.com

HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/p/?LinkId=255141

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/p/?LinkId=255141

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896

URLSearchHook: HKCU - Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)

StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe

SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

SearchScopes: HKCU - DefaultScope {D993264D-458A-4119-9E95-EB4523067B63} URL = hxxp://ixquick.com/do/search?query={searchTerms}&nossl=1&cat=web&pl=ie&language=deutsch

SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR

SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://isearch.babylon.com/?q={searchTerms}&babsrc=SP_ss_Btisdt3&mntrId=CEB01C4BD6EADE3D&affID=121151&tsp=4976

SearchScopes: HKCU - {12B89402-4FA3-42AB-BFD7-6048BEF9D21F} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8

SearchScopes: HKCU - {1A22B65F-0660-4873-9094-00C140BB9FD8} URL = https://ixquick.com/do/search?query={searchTerms}&cat=web&pl=ie&language=deutsch

SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = 

SearchScopes: HKCU - {4F70B032-328B-498F-82EF-62042710840C} URL = hxxp://go.mail.com/tb/en-us/ie_searchplugin/?q={searchTerms}&enc=UTF-8

SearchScopes: HKCU - {803953F3-D6B6-42FF-875E-44817E584102} URL = hxxp://go.gmx.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8

SearchScopes: HKCU - {9FC971E5-98E8-4972-9920-2CA072D5CC19} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8

SearchScopes: HKCU - {BD0E08C6-BAD1-4516-BAB2-B80C3AE7B10C} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie

SearchScopes: HKCU - {D993264D-458A-4119-9E95-EB4523067B63} URL = hxxp://ixquick.com/do/search?query={searchTerms}&nossl=1&cat=web&pl=ie&language=deutsch

BHO: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)

BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)

BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)

BHO: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll (Logitech, Inc.)

BHO: WEB.DE MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)

BHO: Adblock Plus for IE Browser Helper Object - {FFCB3198-32F3-4E8B-9539-4324694ED664} - C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll (Adblock Plus)

Toolbar: HKLM - WEB.DE MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)

Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File

Toolbar: HKCU - WEB.DE MailCheck - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)

Toolbar: HKCU - No Name - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} -  No File

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab

DPF: {CAFEEFAC-0017-0000-0045-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab

Handler: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

Handler: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\system32\urlmon.dll (Microsoft Corporation)

Handler: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\System32\msvidctl.dll (Microsoft Corporation)

Handler: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\system32\urlmon.dll (Microsoft Corporation)

Handler: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\system32\urlmon.dll (Microsoft Corporation)

Handler: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\system32\urlmon.dll (Microsoft Corporation)

Filter: application/octet-stream - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)

Filter: application/x-complus - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)

Filter: application/x-msdownload - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)

Winsock: Catalog5 01 %SystemRoot%\system32\NLAapi.dll [52224] (Microsoft Corporation)

Winsock: Catalog5 02 %SystemRoot%\system32\napinsp.dll [52224] (Microsoft Corporation)

Winsock: Catalog5 03 %SystemRoot%\system32\pnrpnsp.dll [65024] (Microsoft Corporation)

Winsock: Catalog5 04 %SystemRoot%\system32\pnrpnsp.dll [65024] (Microsoft Corporation)

Winsock: Catalog5 05 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [134528] (Microsoft Corporation)

Winsock: Catalog5 06 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [134528] (Microsoft Corporation)

Winsock: Catalog5 07 %SystemRoot%\System32\mswsock.dll [231424] (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.254
 

FireFox:

========

FF ProfilePath: C:\Users\pc\AppData\Roaming\Mozilla\Firefox\C:\ProgramData\Kaspersky Lab\SafeBrowser\S-1-5-21-3615099305-1883970940-2120810231-1000\FireFox

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_43.dll ()

FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin: @videolan.org/vlc,version=2.1.1 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\bing.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\google.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\wikipedia-de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2013-11-03]

FF HKLM\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5

FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013-02-01]

FF HKLM\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt

FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2013-02-25]

FF HKLM\...\Firefox\Extensions: [ocr@babylon.com] - C:\Program Files\Babylon\Babylon-Pro\Utils\ocr@babylon.com

FF HKLM\...\Firefox\Extensions:  - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com

FF Extension: Kaspersky URL Advisor - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2013-11-28]

FF HKLM\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com

FF Extension: Virtual Keyboard - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2013-11-28]

FF HKLM\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com

FF Extension: Dangerous Websites Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2013-11-28]

FF HKLM\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com

FF Extension: Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2013-11-28]

FF HKLM\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com

FF Extension: Safe Money - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2013-11-28]

FF HKCU\...\Firefox\Extensions: [{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}] - C:\Program Files\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi

FF StartMenuInternet: FIREFOX.EXE - "C:\Program Files\Mozilla Firefox\firefox.exe"
 

==================== Services (All) ========================
 

R2 AdobeARMservice; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [65432 2013-12-21] (Adobe Systems Incorporated)

S3 AdobeFlashPlayerUpdateSvc; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [257928 2014-01-15] (Adobe Systems Incorporated)

S3 AeLookupSvc; C:\Windows\System32\aelupsvc.dll [62464 2009-07-14] (Microsoft Corporation)

S3 ALG; C:\Windows\System32\alg.exe [59392 2009-07-14] (Microsoft Corporation)

R2 AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [176128 2010-06-08] (AMD)

S3 AppIDSvc; C:\Windows\System32\appidsvc.dll [27648 2009-07-14] (Microsoft Corporation)
 

==================== Drivers (All) ==========================
 

S3 1394ohci; C:\Windows\system32\drivers\1394ohci.sys [164864 2010-11-20] (Microsoft Corporation)

R0 ACPI; C:\Windows\System32\drivers\ACPI.sys [274304 2010-11-20] (Microsoft Corporation)

S3 AcpiPmi; C:\Windows\system32\drivers\acpipmi.sys [10240 2010-11-20] (Microsoft Corporation)

S3 adp94xx; C:\Windows\system32\DRIVERS\adp94xx.sys [422976 2009-07-14] (Adaptec, Inc.)

S3 adpahci; C:\Windows\system32\DRIVERS\adpahci.sys [297552 2009-07-14] (Adaptec, Inc.)

S3 adpu320; C:\Windows\system32\DRIVERS\adpu320.sys [146512 2009-07-14] (Adaptec, Inc.)

R1 AFD; C:\Windows\system32\drivers\afd.sys [338944 2013-09-14] (Microsoft Corporation)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-02-14 20:02 - 2014-02-14 20:02 - 00000000 _____ () C:\Windows\system32\㩣灜潲牧浡慤慴歜獡数獲祫氠扡慜灶㐱〮〮摜瑡屡潭畤敬彳湩敶瑮牯⹹慤

2014-02-12 13:20 - 2014-02-16 08:17 - 00000000 ____D () C:\FRST

2014-02-07 19:18 - 2014-02-16 07:54 - 00001456 _____ () C:\Windows\setupact.log

2014-01-28 20:55 - 2014-01-28 20:55 - 00000000 ____H () C:\Windows\MEMORY.DMP

2014-01-27 21:25 - 2014-01-27 21:25 - 00000000 ____D () C:\Windows\pss

2014-01-26 22:18 - 2014-01-26 22:18 - 00000000 ____D () C:\Program Files\Adblock Plus for IE
 

==================== One Month Modified Files and Folders =======
 

2014-02-16 08:17 - 2014-02-12 13:20 - 00000000 ____D () C:\FRST

2014-02-14 20:02 - 2014-02-14 20:02 - 00000000 _____ () C:\Windows\system32\㩣灜潲牧浡慤慴歜獡数獲祫氠扡慜灶㐱〮〮摜瑡屡潭畤敬彳湩敶瑮牯⹹慤

2014-02-05 07:57 - 2010-06-22 11:24 - 01622904 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-02-05 07:48 - 2013-10-15 09:46 - 00000000 ____D () C:\Program Files\Canon

2014-01-29 20:53 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\LogFiles

2014-01-26 22:18 - 2014-01-26 22:18 - 00000000 ____D () C:\Program Files\Adblock Plus for IE
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\system32\winlogon.exe => MD5 is legit

C:\Windows\system32\wininit.exe => MD5 is legit

C:\Windows\system32\svchost.exe => MD5 is legit

C:\Windows\system32\services.exe => MD5 is legit

C:\Windows\system32\User32.dll => MD5 is legit

C:\Windows\system32\userinit.exe => MD5 is legit

C:\Windows\system32\rpcss.dll => MD5 is legit

C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-01-30 12:28
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

[/CODE]

FRST Additions Logfile:

Code:

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 12-02-2014 01

Ran by pc at 2014-02-16 08:18:14

Running from F:\

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Kaspersky Internet Security (Enabled - Out of date) {179979E8-273D-D14E-0543-2861940E4886}

AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
 

==================== Installed Programs ======================
 

Adobe AIR (Version: 4.0.0.1390 - Adobe Systems Incorporated)

Adobe Flash Player 12 ActiveX (Version: 12.0.0.39 - Adobe Systems Incorporated)

Adobe Flash Player 12 Plugin (Version: 12.0.0.43 - Adobe Systems Incorporated)

Ashampoo Burning Studio (Version: 9.23.0 - ashampoo GmbH & Co. KG)

Ashampoo Photo Commander (Version: 8.1.0 - ashampoo GmbH & Co. KG)

Ashampoo Snap (Version: 3.4.0 - ashampoo GmbH & Co. KG)

AudioCoder 0.8.18 (Version: 0.8.18 - Broad Intelligence)

WEB.DE Desktop Icons (Version: 3.0.3.0 - 1&1 Mail & Media GmbH)

WEB.DE MailCheck für Internet Explorer (Version: 2.4.0.0 - 1&1 Mail & Media GmbH)

WEB.DE Softwareaktualisierung (Version: 3.0.0.55 - 1&1 Mail & Media GmbH)
 

==================== Restore Points  =========================
 
 

==================== Hosts content: ==========================
 

2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\TuneUpUtilities_Task_BkGndMaintenance2012.job => C:\Program Files\TuneUp Utilities 2012\OneClick.exe
 

==================== Loaded Modules (whitelisted) =============
 
 

==================== Alternate Data Streams (whitelisted) =========
 
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== Disabled items from MSCONFIG ==============
 
 

==================== Faulty Device Manager Devices =============
 

Name: Microsoft-Adapter für Miniports virtueller WiFis

Description: Microsoft-Adapter für Miniports virtueller WiFis

Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: vwifimp

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 
 

==================== Event log errors: =========================
 

Could not start eventlog service, could not read events.
 

Windows-Ereignisprotokoll wird gestartet.

Windows-Ereignisprotokoll konnte nicht gestartet werden.
 

Ein Systemfehler ist aufgetreten.
 

Das System hat keinen Meldungstext f�r die Meldungsnummer 0x1069 in der Meldungsdatei (null) gefunden.
 

Sie erhalten weitere Hilfe, wenn Sie NET HELPMSG 4201 eingeben.
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 32%

Total physical RAM: 3071.24 MB

Available physical RAM: 2066.71 MB

Total Pagefile: 6140.77 MB

Available Pagefile: 5125.14 MB

Total Virtual: 2047.88 MB

Available Virtual: 1933.89 MB
 

==================== Drives ================================
 

Drive c: (BOOT) (Fixed) (Total:256.99 GB) (Free:0 GB) NTFS

Drive d: (Recover) (Fixed) (Total:40 GB) (Free:26.74 GB) NTFS

Drive f: (HP V165W) (Removable) (Total:7.52 GB) (Free:7.52 GB) FAT32
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 298 GB) (Disk ID: F22BA34D)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=257 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=40 GB) - (Type=07 NTFS)

Partition 4: (Not Active) - (Size=1 GB) - (Type=12)
 

========================================================

Disk: 1 (MBR Code: Windows XP) (Size: 8 GB) (Disk ID: C3072E18)

Partition 1: (Active) - (Size=8 GB) - (Type=0B)
 

==================== End Of Log ============================

--- --- ---

Gruß

Kerr

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Leider kann ich Combofix nicht auf mein System downloaden, "zu wenig Speicherplatz", daher bei der Arbeit auf den Stick geladen; von da aus kann ich sie nicht starten, sondern bekomme zwei Meldungen: "Öffnen von Combofix.exe: nicht genug Speicherplatz ..." und "download incomplete and media damaged" - das glaube ich also nicht ...

Gruß
Kerr

Dann von aussen:

Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)

Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)

Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST 32-Bit | FRST 64-Bit

Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.

Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:

Über den Boot Manager:

Starte den Rechner neu.

Während dem Hochfahren drücke mehrmals die F8 Taste

Wähle nun Computer reparieren.

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD (auch bei Windows 8 möglich):

Lege die Windows CD in dein Laufwerk.

Starte den Rechner neu und starte von der CD.

Wähle die Spracheinstellungen und klicke "Weiter".

Klicke auf Computerreparaturoptionen !

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Wähle in den Reparaturoptionen: Eingabeaufforderung

Gib nun bitte notepad ein und drücke Enter.

Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.

Schließe Notepad wieder

Gib nun bitte folgenden Befehl ein.
e:\frst.exe bzw. e:\frst64.exe
Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.

Akzeptiere den Disclaimer mit Ja und klicke Untersuchen

Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).

ok:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 16-02-2014

Ran by SYSTEM on MININT-DTM25QR on 18-02-2014 18:42:22

Running from G:\

Windows 7 Home Premium (X86) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Recovery
 

The current controlset is ControlSet001
 ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.
 
 
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-09-13] (Advanced Micro Devices, Inc.)

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [12013272 2013-10-18] (Realtek Semiconductor)

HKLM\...\Run: [MGSysCtrl] - C:\Program Files\System Control Manager\MGSysCtrl.exe [2478080 2010-06-22] (Micro-Star International Co., Ltd.)

HKLM\...\Run: [MailCheck IE Broker] - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe [1766464 2013-10-16] (1und1 Mail und Media GmbH)

HKLM\...\Run: [EvtMgr6] - C:\Program Files\Logitech\SetPointP\SetPoint.exe [1851192 2012-11-04] (Logitech, Inc.)

HKLM\...\Run: [AMD AVT] - C:\Program Files\AMD AVT\bin\kdbsync.exe [20992 2012-03-19] ()

Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)

HKU\Default\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs

HKU\Default User\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs
 

========================== Services (Whitelisted) =================
 

S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [291840 2012-09-13] (Advanced Micro Devices, Inc.)

S2 AVP; C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2013-10-17] (Kaspersky Lab ZAO)

S2 HWDeviceService.exe; C:\ProgramData\DatacardService\HWDeviceService.exe [271712 2011-03-14] ()

S2 Micro Star SCM; C:\Program Files\System Control Manager\MSIService.exe [160768 2009-07-09] (Micro-Star International Co., Ltd.)

S2 TuneUp.UtilitiesSvc; C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe [1529656 2013-12-11] (TuneUp Software)

S4 NMIndexingService; "C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe" [X]
 

==================== Drivers (Whitelisted) ====================
 

S0 amd_sata; C:\Windows\System32\DRIVERS\amd_sata.sys [70784 2012-04-11] (Advanced Micro Devices)

S0 amd_xata; C:\Windows\System32\DRIVERS\amd_xata.sys [34944 2012-04-11] (Advanced Micro Devices)

S2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [48256 2012-04-09] (Advanced Micro Devices)

S3 huawei_cdcacm; C:\Windows\System32\DRIVERS\ew_jucdcacm.sys [90368 2011-02-25] (Huawei Technologies Co., Ltd.)

S3 huawei_cdcecm; C:\Windows\System32\DRIVERS\ew_jucdcecm.sys [64384 2011-01-30] (Huawei Technologies Co., Ltd.)

S3 huawei_ext_ctrl; C:\Windows\System32\DRIVERS\ew_juextctrl.sys [26624 2011-01-30] (Huawei Technologies Co., Ltd.)

S0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [135776 2013-11-28] (Kaspersky Lab ZAO)

S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [94304 2013-06-08] (Kaspersky Lab ZAO)

S1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [574560 2013-12-19] (Kaspersky Lab ZAO)

S1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [25696 2013-10-17] (Kaspersky Lab ZAO)

S3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [25696 2013-10-17] (Kaspersky Lab ZAO)

S3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [25696 2013-10-17] (Kaspersky Lab ZAO)

S1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [14432 2013-04-12] (Kaspersky Lab ZAO)

S1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [45024 2013-05-14] (Kaspersky Lab ZAO)

S1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [144992 2013-12-19] (Kaspersky Lab ZAO)

S3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [168480 2009-12-02] (Realtek Semiconductor Corp.)

S3 TuneUpUtilitiesDrv; C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys [10064 2012-02-09] (TuneUp Software)

S3 amdiox86; system32\DRIVERS\amdiox86.sys [X]

S5 Tosrfcom; C:\Windows\System32\Drivers\Tosrfcom.sys [64896 2005-08-01] (TOSHIBA Corporation)

S3 usbbus; system32\DRIVERS\lgusbbus.sys [X]

S3 UsbDiag; system32\DRIVERS\lgusbdiag.sys [X]

S3 USBModem; system32\DRIVERS\lgusbmodem.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-02-18 07:15 - 2014-02-18 18:21 - 00000112 _____ () C:\Windows\setupact.log

2014-02-14 20:02 - 2014-02-14 20:02 - 00000000 _____ () C:\Windows\System32\㩣灜潲牧浡慤慴歜獡数獲祫氠扡慜灶㐱〮〮摜瑡屡潭畤敬彳湩敶瑮牯⹹慤

2014-02-12 13:20 - 2014-02-18 18:42 - 00000000 ____D () C:\FRST

2014-02-07 19:24 - 2014-02-07 19:24 - 00000000 ____D () C:\Users\pc\Documents\Fax

2014-02-05 08:15 - 2014-02-05 08:15 - 00000000 ____D () C:\Users\pc\Documents\Audible

2014-01-28 20:55 - 2014-01-28 20:55 - 00000000 ____H () C:\Windows\MEMORY.DMP

2014-01-27 21:25 - 2014-01-27 21:25 - 00000000 ____D () C:\Windows\pss

2014-01-27 21:17 - 2014-01-27 21:17 - 00000017 _____ () C:\Users\pc\AppData\Local\resmon.resmoncfg

2014-01-26 23:17 - 2014-01-26 23:17 - 00000000 ____D () C:\Users\Public\Documents\Logishrd

2014-01-26 22:18 - 2014-01-26 22:18 - 00000000 ____D () C:\Program Files\Adblock Plus for IE
 

==================== One Month Modified Files and Folders =======
 

2014-02-18 18:42 - 2014-02-12 13:20 - 00000000 ____D () C:\FRST

2014-02-18 18:23 - 2009-07-14 05:34 - 00009920 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-02-18 18:23 - 2009-07-14 05:34 - 00009920 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-02-18 18:21 - 2014-02-18 07:15 - 00000112 _____ () C:\Windows\setupact.log

2014-02-18 18:21 - 2013-11-28 08:26 - 00000000 ____D () C:\ProgramData\Kaspersky Lab

2014-02-17 08:30 - 2013-01-19 13:56 - 01544187 _____ () C:\Windows\WindowsUpdate.log

2014-02-14 20:02 - 2014-02-14 20:02 - 00000000 _____ () C:\Windows\System32\㩣灜潲牧浡慤慴歜獡数獲祫氠扡慜灶㐱〮〮摜瑡屡潭畤敬彳湩敶瑮牯⹹慤

2014-02-11 21:53 - 2013-01-24 14:13 - 00000000 ____D () C:\Program Files\TuneUp Utilities 2012

2014-02-07 22:22 - 2013-01-19 14:05 - 00000000 ____D () C:\users\pc

2014-02-07 19:24 - 2014-02-07 19:24 - 00000000 ____D () C:\Users\pc\Documents\Fax

2014-02-05 08:15 - 2014-02-05 08:15 - 00000000 ____D () C:\Users\pc\Documents\Audible

2014-02-05 08:12 - 2013-09-11 07:45 - 00000000 ____D () C:\Program Files\MyPC Backup

2014-02-05 07:57 - 2010-06-22 11:24 - 01622904 _____ () C:\Windows\System32\PerfStringBackup.INI

2014-02-05 07:48 - 2013-10-15 09:46 - 00000000 ____D () C:\Program Files\Canon

2014-02-05 07:47 - 2009-07-14 05:52 - 00000000 ____D () C:\Windows\twain_32

2014-02-03 09:08 - 2009-07-14 03:37 - 00000000 ___RD () C:\users\Public

2014-02-01 10:30 - 2013-02-20 20:51 - 00000000 ____D () C:\Users\pc\AppData\Roaming\Skype

2014-02-01 10:30 - 2013-02-20 20:50 - 00000000 ____D () C:\ProgramData\Skype

2014-02-01 10:27 - 2013-04-27 20:51 - 01231360 ___SH () C:\Users\pc\Desktop\Thumbs.db

2014-02-01 08:56 - 2013-03-14 15:29 - 00221184 ___SH () C:\Users\pc\Documents\Thumbs.db

2014-02-01 08:46 - 2013-03-29 09:16 - 00000000 ____D () C:\ProgramData\boost_interprocess

2014-01-30 22:07 - 2013-01-21 12:37 - 00000000 ____D () C:\Users\pc\AppData\Local\Adobe

2014-01-30 22:04 - 2013-03-11 10:15 - 00000000 ____D () C:\Program Files\SigelLabelBarcode

2014-01-30 19:45 - 2013-05-09 14:42 - 00000000 ____D () C:\Program Files\Common Files\AVSMedia

2014-01-29 22:26 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\registration

2014-01-29 20:53 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\System32\LogFiles

2014-01-28 20:55 - 2014-01-28 20:55 - 00000000 ____H () C:\Windows\MEMORY.DMP

2014-01-27 21:25 - 2014-01-27 21:25 - 00000000 ____D () C:\Windows\pss

2014-01-27 21:17 - 2014-01-27 21:17 - 00000017 _____ () C:\Users\pc\AppData\Local\resmon.resmoncfg

2014-01-26 23:17 - 2014-01-26 23:17 - 00000000 ____D () C:\Users\Public\Documents\Logishrd

2014-01-26 22:18 - 2014-01-26 22:18 - 00000000 ____D () C:\Program Files\Adblock Plus for IE

2014-01-26 22:18 - 2013-12-25 18:57 - 00000000 ____D () C:\ProgramData\Package Cache

2014-01-26 19:49 - 2013-09-10 20:26 - 00000000 ____D () C:\Users\pc\AppData\Roaming\player

2014-01-24 22:04 - 2009-07-14 03:03 - 50593792 _____ () C:\Windows\System32\config\SOFTWARE_tureg_old

2014-01-24 22:04 - 2009-07-14 03:03 - 21495808 _____ () C:\Windows\System32\config\SYSTEM_tureg_old

2014-01-24 22:04 - 2009-07-14 03:03 - 00024576 _____ () C:\Windows\System32\config\SECURITY_tureg_old

2014-01-24 22:01 - 2009-07-14 03:03 - 00815104 _____ () C:\Windows\System32\config\DEFAULT_tureg_old

2014-01-24 22:01 - 2009-07-14 03:03 - 00024576 _____ () C:\Windows\System32\config\SAM_tureg_old

2014-01-24 21:16 - 2009-07-14 09:47 - 00000000 ____D () C:\Windows\System32\Drivers\de-DE

2014-01-24 21:16 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\System32\de-DE

2014-01-22 09:05 - 2013-08-30 12:46 - 00000000 ____D () C:\Users\pc\AppData\Roaming\vlc
 

==================== Known DLLs (Whitelisted) ============
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 

==================== EXE ASSOCIATION =====================
 

HKLM\...\.exe: exefile => OK

HKLM\...\exefile\DefaultIcon: %1 => OK

HKLM\...\exefile\open\command: "%1" %* => OK
 

==================== Restore Points  =========================
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 12%

Total physical RAM: 3839.24 MB

Available physical RAM: 3348.27 MB

Total Pagefile: 3837.52 MB

Available Pagefile: 3343.47 MB

Total Virtual: 2047.88 MB

Available Virtual: 1951.41 MB
 

==================== Drives ================================
 

Drive c: (BOOT) (Fixed) (Total:256.99 GB) (Free:0 GB) NTFS

Drive e: (Recover) (Fixed) (Total:40 GB) (Free:26.74 GB) NTFS

Drive g: (HP V165W) (Removable) (Total:7.52 GB) (Free:7.52 GB) FAT32

Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Drive y: () (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 298 GB) (Disk ID: F22BA34D)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=257 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=40 GB) - (Type=07 NTFS)

Partition 4: (Not Active) - (Size=1 GB) - (Type=12)
 

========================================================

Disk: 1 (MBR Code: Windows XP) (Size: 8 GB) (Disk ID: C3072E18)

Partition 1: (Active) - (Size=8 GB) - (Type=0B)
 
 

LastRegBack: 2014-01-30 12:28
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Gruß
Kerr