Trojaner-Board
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Broken.OpenCommand Virus gefunden-Rechner ist extrem langsam geworden (https://www.trojaner-board.de/155467-broken-opencommand-virus-gefunden-rechner-extrem-langsam-geworden.html)

schrauber 01.07.2014 10:09
Wenn die Funde nochmal kommen NICHT LÖSCHEN, melde dich dann hier wieder mit einem FRST Logfile. Ich will mal was kontrollieren.

funcopter 02.07.2014 20:20
Hallo Schrauber,

ich hab das jetzt nochmal ausprobiert.
Gestern hab ich MWB laufen lassen, da hat es wieder den Broken.OpenCommand gefunden.
Dann die zwei Funde in Quatantäne gestellt und Auswahl anwenden geklickt.
Neustart.
Erneut MWB laufen lassen, es wurde dann kein Fund mehr festgestellt.
Ein paar Minuten ebay surfen, Rechner aus.
Heute Rechner an und MWB wieder laufen lassen.
Erneut genau das gleiche gefunden.
Jetzt wie gewünscht MWB ohne Quarantäne abgebrochen und FRST laufen lassen.
Hier das Log dazu:

Gruß
Funcopter
FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:29-06-2014
Ran by Roland (administrator) on ROLAND-469D9F2C on 02-07-2014 20:17:46
Running from C:\Dokumente und Einstellungen\Roland\Desktop
Platform: Microsoft Windows XP Home Edition Service Pack 3 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\sched.exe
() C:\Programme\AAVUpdateManager\aavus.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Programme\AskPartnerNetwork\Toolbar\apnmcp.exe
(iolo technologies, LLC) C:\Programme\iolo\Common\Lib\ioloServiceManager.exe
(NVIDIA Corporation) C:\WINDOWS\system32\nvsvc32.exe
(iolo technologies, LLC) C:\Programme\iolo\System Mechanic\SystemGuardAlerter.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avgnt.exe
(APN) C:\Programme\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe
(Microsoft Corporation) C:\Programme\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Programme\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [nwiz] => nwiz.exe /install
HKLM\...\Run: [avgnt] => C:\Programme\Avira\AntiVir Desktop\avgnt.exe [750160 2014-07-01] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [ApnTBMon] => C:\Programme\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1956760 2014-06-23] (APN)
HKLM\...\Runonce: [SMRequiresRestart] - [X]
HKU\S-1-5-21-1004336348-1614895754-725345543-1006-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [MSMSGS] => C:\Programme\Messenger\msmsgs.exe [1695232 2008-04-14] (Microsoft Corporation)
HKU\S-1-5-21-1004336348-1614895754-725345543-1006-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [swg] => "C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
HKU\S-1-5-21-1004336348-1614895754-725345543-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: G - G:\setup.EXE /AUTORUN
HKU\S-1-5-21-1004336348-1614895754-725345543-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: H - H:\setup.exe
BootExecute: autocheck autochk /p \??\J:autocheck autochk /p \??\K:autocheck autochk *

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://portal.spk-kg.de/portal/portal/Starten
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {E048E9E7-473E-4DA0-9D49-2392C5509B4D} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {E048E9E7-473E-4DA0-9D49-2392C5509B4D} URL = hxxp://www.google.de/search?q={searchTerms}
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Programme\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Programme\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKCU - &Adresse - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
Toolbar: HKCU - &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKCU - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Programme\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
DPF: {41564D57-9980-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/0/A/9/0A9F8B32-9F8C-4D74-A130-E4CAB36EB01F/wmvadvd.cab
DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} hxxp://express.foto.com/ImageUploader5.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_40-windows-i586.cab
DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-29-0.cab
DPF: {CAFEEFAC-0017-0000-0040-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_40-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_40-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin: @canon.com/MycameraPlugin - C:\Programme\Canon\ZoomBrowser EX\Program\NPCIG.dll (CANON INC.)
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Programme\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Programme\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: Adobe Reader - C:\Programme\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-14]

========================== Services (Whitelisted) =================

R2 AAV UpdateService; C:\Programme\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 AntiVirSchedulerService; C:\Programme\Avira\AntiVir Desktop\sched.exe [430160 2014-07-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Programme\Avira\AntiVir Desktop\avguard.exe [430160 2014-07-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE [1028688 2014-07-01] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Programme\AskPartnerNetwork\Toolbar\apnmcp.exe [165784 2014-06-23] (APN LLC.)
S4 CCALib8; C:\Programme\Canon\CAL\CALMAIN.exe [96370 2007-01-31] (Canon Inc.) [File not signed]
R2 ioloSystemService; C:\Programme\iolo\Common\Lib\ioloServiceManager.exe [1027792 2012-09-05] (iolo technologies, LLC)
S4 JavaQuickStarterService; C:\Programme\Java\jre7\bin\jqs.exe [182696 2014-05-01] (Oracle Corporation)
S4 MagicTuneEngine; C:\Programme\MagicTune Premium\MagicTuneEngine.exe [45056 2007-08-23] () [File not signed]
S4 MDM; C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE [322120 2003-06-19] (Microsoft Corporation)
S3 ose; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [89136 2003-07-28] (Microsoft Corporation)
S4 WMPNetworkSvc; C:\Programme\Windows Media Player\WMPNetwk.exe [920576 2006-11-03] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R3 ALCXWDM; C:\WINDOWS\System32\drivers\ALCXWDM.SYS [3964352 2006-04-21] (Realtek Semiconductor Corp.)
R2 avgntflt; C:\WINDOWS\System32\DRIVERS\avgntflt.sys [97648 2014-07-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\WINDOWS\System32\DRIVERS\avipbb.sys [136216 2014-06-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\WINDOWS\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG)
R3 DC21x4; C:\WINDOWS\System32\DRIVERS\dc21x4.sys [63208 2001-08-17] (Intel Corporation.)
R3 gameenum; C:\WINDOWS\System32\DRIVERS\gameenum.sys [10624 2008-04-13] (Microsoft Corporation)
S3 giveio; C:\WINDOWS\system32\giveio.sys [5248 2010-08-18] () [File not signed]
S3 hidgame; C:\WINDOWS\System32\DRIVERS\hidgame.sys [8576 2001-08-17] (Microsoft Corporation)
S3 MagicTune; C:\WINDOWS\System32\drivers\MTiCtwl.sys [14080 2009-06-04] (Samsung Electronics, Inc. ) [File not signed]
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [110296 2014-07-02] (Malwarebytes Corporation)
R2 PDFsFilter; C:\WINDOWS\System32\DRIVERS\PDFsFilter.sys [68464 2012-09-05] (Raxco Software, Inc.)
R1 ssmdrv; C:\WINDOWS\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
S3 wceusbsh; C:\WINDOWS\System32\DRIVERS\wceusbsh.sys [28672 2006-11-06] (Microsoft Corporation)
S3 catchme; \??\C:\DOKUME~1\Roland\LOKALE~1\Temp\catchme.sys [X]
S4 IntelIde; No ImagePath
U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation)
S3 SymIM; system32\DRIVERS\SymIM.sys [X]
U3 TlntSvr;

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-07-02 20:17 - 2014-07-02 20:18 - 00010599 _____ () C:\Dokumente und Einstellungen\Roland\Desktop\FRST.txt
2014-07-01 18:05 - 2014-07-01 18:05 - 00001456 _____ () C:\Dokumente und Einstellungen\Roland\Desktop\mwb.txt
2014-07-01 15:48 - 2014-07-02 15:25 - 00110296 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-07-01 15:48 - 2014-07-01 15:48 - 00000749 _____ () C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
2014-07-01 15:48 - 2014-07-01 15:48 - 00000000 ____D () C:\Programme\Malwarebytes Anti-Malware
2014-07-01 15:48 - 2014-07-01 15:48 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes Anti-Malware
2014-07-01 15:48 - 2014-05-12 07:26 - 00053208 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-07-01 15:48 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-07-01 15:47 - 2014-07-01 15:47 - 17292760 _____ (Malwarebytes Corporation ) C:\Dokumente und Einstellungen\Roland\Desktop\mbam-setup-2.0.2.1012.exe
2014-07-01 15:46 - 2014-07-01 15:46 - 01073664 _____ (Farbar) C:\Dokumente und Einstellungen\Roland\Desktop\FRST.exe
2014-06-24 20:07 - 2014-06-24 20:07 - 00000000 ____D () C:\Dokumente und Einstellungen\Roland\Desktop\FRST-OlderVersion
2014-06-22 21:26 - 2014-06-22 21:37 - 00000000 ____D () C:\AdwCleaner
2014-06-21 13:53 - 2014-06-21 17:13 - 00000000 ___SD () C:\ComboFix
2014-06-21 10:01 - 2014-06-21 10:01 - 00000000 ____D () C:\Qoobox
2014-06-21 10:01 - 2011-06-26 08:45 - 00256000 _____ () C:\WINDOWS\PEV.exe
2014-06-21 10:01 - 2010-11-07 19:20 - 00208896 _____ () C:\WINDOWS\MBR.exe
2014-06-21 10:01 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe
2014-06-21 10:01 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe
2014-06-21 10:01 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe
2014-06-21 10:01 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe
2014-06-21 10:01 - 2000-08-31 02:00 - 00098816 _____ () C:\WINDOWS\sed.exe
2014-06-21 10:01 - 2000-08-31 02:00 - 00080412 _____ () C:\WINDOWS\grep.exe
2014-06-21 10:01 - 2000-08-31 02:00 - 00068096 _____ () C:\WINDOWS\zip.exe
2014-06-19 21:03 - 2014-07-02 20:17 - 00000000 ____D () C:\FRST
2014-06-17 20:39 - 2014-06-17 20:39 - 00000000 ____D () C:\Programme\ESET
2014-06-05 19:40 - 2014-06-05 20:17 - 00035328 _____ () C:\Dokumente und Einstellungen\Roland\Eigene Dateien\BG Unfall Valentin.xls

==================== One Month Modified Files and Folders =======

2014-07-02 20:18 - 2014-07-02 20:17 - 00010599 _____ () C:\Dokumente und Einstellungen\Roland\Desktop\FRST.txt
2014-07-02 20:18 - 2013-10-11 21:54 - 00000000 ____D () C:\Dokumente und Einstellungen\Roland\Lokale Einstellungen\temp
2014-07-02 20:18 - 2010-01-15 19:58 - 00000418 ____H () C:\WINDOWS\Tasks\User_Feed_Synchronization-{7ECA2FDA-3924-46EF-86A0-4D266F44C228}.job
2014-07-02 20:17 - 2014-06-19 21:03 - 00000000 ____D () C:\FRST
2014-07-02 19:32 - 2014-03-22 09:26 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-07-02 18:03 - 2008-04-26 11:09 - 00032544 _____ () C:\WINDOWS\SchedLgU.Txt
2014-07-02 16:00 - 2008-04-26 11:04 - 01952399 _____ () C:\WINDOWS\WindowsUpdate.log
2014-07-02 15:25 - 2014-07-01 15:48 - 00110296 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-07-02 15:14 - 2014-03-30 18:37 - 00000224 _____ () C:\WINDOWS\Tasks\Ende des Supports für Microsoft Windows XP –  Benachrichtigung – Anmeldung.job
2014-07-02 15:13 - 2008-04-26 11:58 - 00000159 _____ () C:\WINDOWS\wiadebug.log
2014-07-02 15:13 - 2008-04-26 11:58 - 00000050 _____ () C:\WINDOWS\wiaservc.log
2014-07-02 15:13 - 2008-04-26 11:09 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-07-01 21:53 - 2008-04-26 11:11 - 00000300 ___SH () C:\Dokumente und Einstellungen\Roland\ntuser.ini
2014-07-01 21:53 - 2008-04-26 11:11 - 00000000 ____D () C:\Dokumente und Einstellungen\Roland
2014-07-01 18:05 - 2014-07-01 18:05 - 00001456 _____ () C:\Dokumente und Einstellungen\Roland\Desktop\mwb.txt
2014-07-01 15:48 - 2014-07-01 15:48 - 00000749 _____ () C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
2014-07-01 15:48 - 2014-07-01 15:48 - 00000000 ____D () C:\Programme\Malwarebytes Anti-Malware
2014-07-01 15:48 - 2014-07-01 15:48 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes Anti-Malware
2014-07-01 15:48 - 2008-04-26 11:55 - 00000000 ___RD () C:\Programme
2014-07-01 15:48 - 2008-04-26 11:55 - 00000000 ___RD () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme
2014-07-01 15:47 - 2014-07-01 15:47 - 17292760 _____ (Malwarebytes Corporation ) C:\Dokumente und Einstellungen\Roland\Desktop\mbam-setup-2.0.2.1012.exe
2014-07-01 15:46 - 2014-07-01 15:46 - 01073664 _____ (Farbar) C:\Dokumente und Einstellungen\Roland\Desktop\FRST.exe
2014-07-01 15:36 - 2013-08-22 17:15 - 00097648 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2014-06-29 15:30 - 2013-08-22 17:19 - 00000000 ____D () C:\Programme\AskPartnerNetwork
2014-06-29 15:28 - 2004-08-04 14:00 - 00013646 _____ () C:\WINDOWS\system32\wpa.dbl
2014-06-25 15:40 - 2013-08-14 08:38 - 00184641 _____ () C:\WINDOWS\setupapi.log
2014-06-24 20:07 - 2014-06-24 20:07 - 00000000 ____D () C:\Dokumente und Einstellungen\Roland\Desktop\FRST-OlderVersion
2014-06-22 21:37 - 2014-06-22 21:26 - 00000000 ____D () C:\AdwCleaner
2014-06-21 17:13 - 2014-06-21 13:53 - 00000000 ___SD () C:\ComboFix
2014-06-21 10:01 - 2014-06-21 10:01 - 00000000 ____D () C:\Qoobox
2014-06-17 20:39 - 2014-06-17 20:39 - 00000000 ____D () C:\Programme\ESET
2014-06-13 21:41 - 2014-05-02 19:50 - 00000000 ____D () C:\Dokumente und Einstellungen\Roland\Eigene Dateien\SigmaDataCenter3
2014-06-13 14:38 - 2013-10-12 14:12 - 00001780 _____ () C:\DelFix.txt
2014-06-12 11:50 - 2011-01-02 15:02 - 00000000 ____D () C:\WINDOWS\system32\NtmsData
2014-06-12 09:58 - 2008-04-26 11:02 - 00000000 ____D () C:\WINDOWS\Registration
2014-06-11 12:49 - 2013-07-19 16:01 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-06-11 12:42 - 2008-04-26 13:10 - 92708840 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-06-09 17:43 - 2014-03-30 18:37 - 00000218 _____ () C:\WINDOWS\Tasks\Ende des Supports für Microsoft Windows XP – Monatliche Benachrichtigung.job
2014-06-05 20:17 - 2014-06-05 19:40 - 00035328 _____ () C:\Dokumente und Einstellungen\Roland\Eigene Dateien\BG Unfall Valentin.xls
2014-06-05 09:53 - 2008-04-28 20:17 - 00000190 ___SH () C:\Dokumente und Einstellungen\Vonni\ntuser.ini
2014-06-05 09:53 - 2008-04-28 20:17 - 00000000 ____D () C:\Dokumente und Einstellungen\Vonni
2014-06-05 08:41 - 2013-08-22 17:15 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys
2014-06-05 08:28 - 2008-04-28 20:17 - 00000000 ____D () C:\Dokumente und Einstellungen\Vonni\Lokale Einstellungen\Temp

Some content of TEMP:
====================
C:\Dokumente und Einstellungen\Roland\Lokale Einstellungen\temp\avgnt.exe
C:\Dokumente und Einstellungen\Vonni\Lokale Einstellungen\temp\AskSLib.dll
C:\Dokumente und Einstellungen\Vonni\Lokale Einstellungen\temp\avgnt.exe
C:\Dokumente und Einstellungen\Vonni\Lokale Einstellungen\temp\wiz99.exe


==================== Bamital & volsnap Check =================

C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================
--- --- ---

schrauber 03.07.2014 12:09
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
HKLM\...\Run: [nwiz] => nwiz.exe /install
HKLM\...\Run: [ApnTBMon] => C:\Programme\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1956760 2014-06-23] (APN)
HKLM\...\Runonce: [SMRequiresRestart] - [X]
BootExecute: autocheck autochk /p \??\J:autocheck autochk /p \??\K:autocheck autochk *
R2 AAV UpdateService; C:\Programme\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
C:\Programme\AAVUpdateManager

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.




Nochmal testen.

funcopter 03.07.2014 15:19
Hallo Schrauber,

erledigt.

Gruß

Funcopter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:29-06-2014
Ran by Roland at 2014-07-03 16:18:30 Run:1
Running from C:\Dokumente und Einstellungen\Roland\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
HKLM\...\Run: [nwiz] => nwiz.exe /install
HKLM\...\Run: [ApnTBMon] => C:\Programme\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1956760 2014-06-23] (APN)
HKLM\...\Runonce: [SMRequiresRestart] - [X]
BootExecute: autocheck autochk /p \??\J:autocheck autochk /p \??\K:autocheck autochk *
R2 AAV UpdateService; C:\Programme\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
C:\Programme\AAVUpdateManager


*****************

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\nwiz => value deleted successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\ApnTBMon => value deleted successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SMRequiresRestart => Value not found.
HKLM\System\CurrentControlSet\Control\Session Manager\\BootExecute => Value was restored successfully.
AAV UpdateService => Service stopped successfully.
AAV UpdateService => Service deleted successfully.
C:\Programme\AAVUpdateManager => Moved successfully.

==== End of Fixlog ====

schrauber 04.07.2014 13:06
Noch Probleme?

funcopter 06.07.2014 11:40
Hallo Schrauber,

Problem unverändert noch da.
Ich habe heute einen MWB Suchlauf gemacht mit dem Ergebniss wie immer.

Gruß
Funcopter

schrauber 06.07.2014 17:44
Ich glaub da ja eher an einen Fehlalarm von MBAM. Poste mal bitte en frisches FRST log.

funcopter 06.07.2014 19:03
Hallo Schrauber,

hier das Log:
FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:05-07-2014 01
Ran by Roland (administrator) on ROLAND-469D9F2C on 06-07-2014 19:55:12
Running from C:\Dokumente und Einstellungen\Roland\Desktop
Platform: Microsoft Windows XP Home Edition Service Pack 3 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Programme\AskPartnerNetwork\Toolbar\apnmcp.exe
(iolo technologies, LLC) C:\Programme\iolo\Common\Lib\ioloServiceManager.exe
(NVIDIA Corporation) C:\WINDOWS\system32\nvsvc32.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe
(iolo technologies, LLC) C:\Programme\iolo\System Mechanic\SystemGuardAlerter.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avgnt.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [avgnt] => C:\Programme\Avira\AntiVir Desktop\avgnt.exe [750160 2014-07-01] (Avira Operations GmbH & Co. KG)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://portal.spk-kg.de/portal/portal/Starten
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {E048E9E7-473E-4DA0-9D49-2392C5509B4D} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {E048E9E7-473E-4DA0-9D49-2392C5509B4D} URL = hxxp://www.google.de/search?q={searchTerms}
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Programme\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Programme\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKCU - &Adresse - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
Toolbar: HKCU - &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKCU - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Programme\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
DPF: {41564D57-9980-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/0/A/9/0A9F8B32-9F8C-4D74-A130-E4CAB36EB01F/wmvadvd.cab
DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} hxxp://express.foto.com/ImageUploader5.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_40-windows-i586.cab
DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-29-0.cab
DPF: {CAFEEFAC-0017-0000-0040-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_40-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_40-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin: @canon.com/MycameraPlugin - C:\Programme\Canon\ZoomBrowser EX\Program\NPCIG.dll (CANON INC.)
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Programme\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Programme\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: Adobe Reader - C:\Programme\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-14]

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Programme\Avira\AntiVir Desktop\sched.exe [430160 2014-07-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Programme\Avira\AntiVir Desktop\avguard.exe [430160 2014-07-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE [1028688 2014-07-01] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Programme\AskPartnerNetwork\Toolbar\apnmcp.exe [165784 2014-06-23] (APN LLC.)
S4 CCALib8; C:\Programme\Canon\CAL\CALMAIN.exe [96370 2007-01-31] (Canon Inc.) [File not signed]
R2 ioloSystemService; C:\Programme\iolo\Common\Lib\ioloServiceManager.exe [1027792 2012-09-05] (iolo technologies, LLC)
S4 JavaQuickStarterService; C:\Programme\Java\jre7\bin\jqs.exe [182696 2014-05-01] (Oracle Corporation)
S4 MagicTuneEngine; C:\Programme\MagicTune Premium\MagicTuneEngine.exe [45056 2007-08-23] () [File not signed]
S4 MDM; C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE [322120 2003-06-19] (Microsoft Corporation)
S3 ose; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [89136 2003-07-28] (Microsoft Corporation)
S4 WMPNetworkSvc; C:\Programme\Windows Media Player\WMPNetwk.exe [920576 2006-11-03] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R3 ALCXWDM; C:\WINDOWS\System32\drivers\ALCXWDM.SYS [3964352 2006-04-21] (Realtek Semiconductor Corp.)
R2 avgntflt; C:\WINDOWS\System32\DRIVERS\avgntflt.sys [97648 2014-07-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\WINDOWS\System32\DRIVERS\avipbb.sys [136216 2014-06-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\WINDOWS\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG)
R3 DC21x4; C:\WINDOWS\System32\DRIVERS\dc21x4.sys [63208 2001-08-17] (Intel Corporation.)
R3 gameenum; C:\WINDOWS\System32\DRIVERS\gameenum.sys [10624 2008-04-13] (Microsoft Corporation)
S3 giveio; C:\WINDOWS\system32\giveio.sys [5248 2010-08-18] () [File not signed]
S3 hidgame; C:\WINDOWS\System32\DRIVERS\hidgame.sys [8576 2001-08-17] (Microsoft Corporation)
S3 MagicTune; C:\WINDOWS\System32\drivers\MTiCtwl.sys [14080 2009-06-04] (Samsung Electronics, Inc. ) [File not signed]
R2 PDFsFilter; C:\WINDOWS\System32\DRIVERS\PDFsFilter.sys [68464 2012-09-05] (Raxco Software, Inc.)
R1 ssmdrv; C:\WINDOWS\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
S3 wceusbsh; C:\WINDOWS\System32\DRIVERS\wceusbsh.sys [28672 2006-11-06] (Microsoft Corporation)
S3 catchme; \??\C:\DOKUME~1\Roland\LOKALE~1\Temp\catchme.sys [X]
S4 IntelIde; No ImagePath
U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation)
S3 SymIM; system32\DRIVERS\SymIM.sys [X]
U3 TlntSvr;

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-07-02 21:14 - 2014-07-02 21:14 - 00018742 _____ () C:\Dokumente und Einstellungen\Roland\Desktop\FRST.txt.2.txt
2014-07-02 20:17 - 2014-07-06 19:55 - 00009225 _____ () C:\Dokumente und Einstellungen\Roland\Desktop\FRST.txt
2014-07-01 18:05 - 2014-07-01 18:05 - 00001456 _____ () C:\Dokumente und Einstellungen\Roland\Desktop\mwb.txt
2014-07-01 15:48 - 2014-07-06 09:01 - 00110296 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-07-01 15:48 - 2014-07-01 15:48 - 00000749 _____ () C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
2014-07-01 15:48 - 2014-07-01 15:48 - 00000000 ____D () C:\Programme\Malwarebytes Anti-Malware
2014-07-01 15:48 - 2014-07-01 15:48 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes Anti-Malware
2014-07-01 15:48 - 2014-05-12 07:26 - 00053208 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-07-01 15:48 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-07-01 15:47 - 2014-07-01 15:47 - 17292760 _____ (Malwarebytes Corporation ) C:\Dokumente und Einstellungen\Roland\Desktop\mbam-setup-2.0.2.1012.exe
2014-07-01 15:46 - 2014-07-06 19:45 - 01074688 _____ (Farbar) C:\Dokumente und Einstellungen\Roland\Desktop\FRST.exe
2014-06-24 20:07 - 2014-07-06 19:45 - 00000000 ____D () C:\Dokumente und Einstellungen\Roland\Desktop\FRST-OlderVersion
2014-06-22 21:26 - 2014-06-22 21:37 - 00000000 ____D () C:\AdwCleaner
2014-06-21 13:53 - 2014-06-21 17:13 - 00000000 ___SD () C:\ComboFix
2014-06-21 10:01 - 2014-06-21 10:01 - 00000000 ____D () C:\Qoobox
2014-06-21 10:01 - 2011-06-26 08:45 - 00256000 _____ () C:\WINDOWS\PEV.exe
2014-06-21 10:01 - 2010-11-07 19:20 - 00208896 _____ () C:\WINDOWS\MBR.exe
2014-06-21 10:01 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe
2014-06-21 10:01 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe
2014-06-21 10:01 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe
2014-06-21 10:01 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe
2014-06-21 10:01 - 2000-08-31 02:00 - 00098816 _____ () C:\WINDOWS\sed.exe
2014-06-21 10:01 - 2000-08-31 02:00 - 00080412 _____ () C:\WINDOWS\grep.exe
2014-06-21 10:01 - 2000-08-31 02:00 - 00068096 _____ () C:\WINDOWS\zip.exe
2014-06-19 21:03 - 2014-07-06 19:55 - 00000000 ____D () C:\FRST
2014-06-17 20:39 - 2014-06-17 20:39 - 00000000 ____D () C:\Programme\ESET

==================== One Month Modified Files and Folders =======

2014-07-06 19:55 - 2014-07-02 20:17 - 00009225 _____ () C:\Dokumente und Einstellungen\Roland\Desktop\FRST.txt
2014-07-06 19:55 - 2014-06-19 21:03 - 00000000 ____D () C:\FRST
2014-07-06 19:55 - 2013-10-11 21:54 - 00000000 ____D () C:\Dokumente und Einstellungen\Roland\Lokale Einstellungen\temp
2014-07-06 19:53 - 2010-01-15 19:58 - 00000418 ____H () C:\WINDOWS\Tasks\User_Feed_Synchronization-{7ECA2FDA-3924-46EF-86A0-4D266F44C228}.job
2014-07-06 19:45 - 2014-07-01 15:46 - 01074688 _____ (Farbar) C:\Dokumente und Einstellungen\Roland\Desktop\FRST.exe
2014-07-06 19:45 - 2014-06-24 20:07 - 00000000 ____D () C:\Dokumente und Einstellungen\Roland\Desktop\FRST-OlderVersion
2014-07-06 19:32 - 2014-03-22 09:26 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-07-06 19:31 - 2008-04-26 11:04 - 02001319 _____ () C:\WINDOWS\WindowsUpdate.log
2014-07-06 19:30 - 2014-03-30 18:37 - 00000224 _____ () C:\WINDOWS\Tasks\Ende des Supports für Microsoft Windows XP –  Benachrichtigung – Anmeldung.job
2014-07-06 19:27 - 2008-04-26 11:58 - 00000159 _____ () C:\WINDOWS\wiadebug.log
2014-07-06 19:27 - 2008-04-26 11:58 - 00000050 _____ () C:\WINDOWS\wiaservc.log
2014-07-06 19:27 - 2008-04-26 11:09 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-07-06 12:43 - 2008-04-26 11:11 - 00000300 ___SH () C:\Dokumente und Einstellungen\Roland\ntuser.ini
2014-07-06 12:43 - 2008-04-26 11:09 - 00032218 _____ () C:\WINDOWS\SchedLgU.Txt
2014-07-06 12:42 - 2008-04-26 11:11 - 00000000 ____D () C:\Dokumente und Einstellungen\Roland
2014-07-06 09:01 - 2014-07-01 15:48 - 00110296 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-07-05 20:23 - 2004-08-04 14:00 - 00013646 _____ () C:\WINDOWS\system32\wpa.dbl
2014-07-03 16:18 - 2008-04-26 11:55 - 00000000 ___RD () C:\Programme
2014-07-02 21:14 - 2014-07-02 21:14 - 00018742 _____ () C:\Dokumente und Einstellungen\Roland\Desktop\FRST.txt.2.txt
2014-07-01 18:05 - 2014-07-01 18:05 - 00001456 _____ () C:\Dokumente und Einstellungen\Roland\Desktop\mwb.txt
2014-07-01 15:48 - 2014-07-01 15:48 - 00000749 _____ () C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
2014-07-01 15:48 - 2014-07-01 15:48 - 00000000 ____D () C:\Programme\Malwarebytes Anti-Malware
2014-07-01 15:48 - 2014-07-01 15:48 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes Anti-Malware
2014-07-01 15:48 - 2008-04-26 11:55 - 00000000 ___RD () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme
2014-07-01 15:47 - 2014-07-01 15:47 - 17292760 _____ (Malwarebytes Corporation ) C:\Dokumente und Einstellungen\Roland\Desktop\mbam-setup-2.0.2.1012.exe
2014-07-01 15:36 - 2013-08-22 17:15 - 00097648 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2014-06-29 15:30 - 2013-08-22 17:19 - 00000000 ____D () C:\Programme\AskPartnerNetwork
2014-06-25 15:40 - 2013-08-14 08:38 - 00184641 _____ () C:\WINDOWS\setupapi.log
2014-06-22 21:37 - 2014-06-22 21:26 - 00000000 ____D () C:\AdwCleaner
2014-06-21 17:13 - 2014-06-21 13:53 - 00000000 ___SD () C:\ComboFix
2014-06-21 10:01 - 2014-06-21 10:01 - 00000000 ____D () C:\Qoobox
2014-06-17 20:39 - 2014-06-17 20:39 - 00000000 ____D () C:\Programme\ESET
2014-06-13 21:41 - 2014-05-02 19:50 - 00000000 ____D () C:\Dokumente und Einstellungen\Roland\Eigene Dateien\SigmaDataCenter3
2014-06-13 14:38 - 2013-10-12 14:12 - 00001780 _____ () C:\DelFix.txt
2014-06-12 11:50 - 2011-01-02 15:02 - 00000000 ____D () C:\WINDOWS\system32\NtmsData
2014-06-12 09:58 - 2008-04-26 11:02 - 00000000 ____D () C:\WINDOWS\Registration
2014-06-11 12:49 - 2013-07-19 16:01 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-06-11 12:42 - 2008-04-26 13:10 - 92708840 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-06-09 17:43 - 2014-03-30 18:37 - 00000218 _____ () C:\WINDOWS\Tasks\Ende des Supports für Microsoft Windows XP – Monatliche Benachrichtigung.job

Some content of TEMP:
====================
C:\Dokumente und Einstellungen\Roland\Lokale Einstellungen\temp\avgnt.exe
C:\Dokumente und Einstellungen\Vonni\Lokale Einstellungen\temp\AskSLib.dll
C:\Dokumente und Einstellungen\Vonni\Lokale Einstellungen\temp\avgnt.exe
C:\Dokumente und Einstellungen\Vonni\Lokale Einstellungen\temp\wiz99.exe


==================== Bamital & volsnap Check =================

C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================
--- --- ---

Gruß
Funcopter

schrauber 07.07.2014 12:48
Was macht die Geschwindigkeit des Rechners?

funcopter 08.07.2014 09:10
Hallo Schrauber,

ist unverändert langsam. Die rote LED leuchtet nahezu ununterbrochen und er "rattert" permanent.

Gruß
Funcopter

schrauber 09.07.2014 08:09
Festplatte schon auf Hardwaredefekt geprüft?

funcopter 09.07.2014 11:25
Hallo Schrauber,

verrätst Du mir auch wie ich die überprüfen kann?:killpc:

Gruß
Funcopter

schrauber 10.07.2014 11:33
Versuch mal das Tool von Seatools :)

funcopter 11.07.2014 17:21
Hallo Schrauber,

das Seatool hat nicht funktioniert.
Ich habe mir das GSmartControl runtergeladen und drüber laufen lassen.
Ich hoffe das war jetzt nicht falsch.
Die erste Festplatte hat 1760 Fehler im Laufe von 12244 Betriebsstunden gezählt und die zweite 61246 im Laufe von 54096 Stunden.
Ob ein aktueller Fehler da drauf ist kann ich aus derm Log nicht sehen.
Vielleicht siehst Du da ja was.
Hier die zugehörigen Logs:

Gruß
Funcopter
Complete error log:

SMART Error Log Version: 1
ATA Error Count: 1760 (device log contains only the most recent five errors)
CR = Command Register [HEX]
FR = Features Register [HEX]
SC = Sector Count Register [HEX]
SN = Sector Number Register [HEX]
CL = Cylinder Low Register [HEX]
CH = Cylinder High Register [HEX]
DH = Device/Head Register [HEX]
DC = Device Command Register [HEX]
ER = Error register [HEX]
ST = Status register [HEX]
Powered_Up_Time is measured from power on, and printed as
DDd+hh:mm:SS.sss where DD=days, hh=hours, mm=minutes,
SS=sec, and sss=millisec. It "wraps" after 49.710 days.

Error 1760 occurred at disk power-on lifetime: 12244 hours (510 days + 4 hours)
When the command that caused the error occurred, the device was active or idle.

After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
84 51 00 5f 00 00 e0 Error: ICRC, ABRT at LBA = 0x0000005f = 95

Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
c8 00 7f 5f 00 00 e0 00 00:01:34.647 READ DMA
c8 00 7f 5f 00 00 e0 00 00:01:34.194 READ DMA
10 00 ff 00 00 00 e0 00 00:01:34.194 RECALIBRATE [OBS-4]
c8 00 7f 5f 00 00 e0 00 00:01:33.759 READ DMA
c8 00 7f 5f 00 00 e0 00 00:01:33.264 READ DMA

Error 1759 occurred at disk power-on lifetime: 12244 hours (510 days + 4 hours)
When the command that caused the error occurred, the device was active or idle.

After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
84 51 00 5f 00 00 e0 Error: ICRC, ABRT at LBA = 0x0000005f = 95

Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
c8 00 7f 5f 00 00 e0 00 00:01:34.194 READ DMA
10 00 ff 00 00 00 e0 00 00:01:34.194 RECALIBRATE [OBS-4]
c8 00 7f 5f 00 00 e0 00 00:01:33.759 READ DMA
c8 00 7f 5f 00 00 e0 00 00:01:33.264 READ DMA
c8 00 01 3f 00 00 e0 00 00:01:33.263 READ DMA

Error 1758 occurred at disk power-on lifetime: 12244 hours (510 days + 4 hours)
When the command that caused the error occurred, the device was active or idle.

After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
84 51 00 5f 00 00 e0 Error: ICRC, ABRT at LBA = 0x0000005f = 95

Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
c8 00 7f 5f 00 00 e0 00 00:01:33.759 READ DMA
c8 00 7f 5f 00 00 e0 00 00:01:33.264 READ DMA
c8 00 01 3f 00 00 e0 00 00:01:33.263 READ DMA
c8 00 01 25 0d cb e2 00 00:01:32.545 READ DMA
c8 00 01 00 00 00 e0 00 00:01:32.545 READ DMA

Error 1757 occurred at disk power-on lifetime: 12244 hours (510 days + 4 hours)
When the command that caused the error occurred, the device was active or idle.

After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
84 51 00 5f 00 00 e0 Error: ICRC, ABRT at LBA = 0x0000005f = 95

Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
c8 00 7f 5f 00 00 e0 00 00:01:33.264 READ DMA
c8 00 01 3f 00 00 e0 00 00:01:33.263 READ DMA
c8 00 01 25 0d cb e2 00 00:01:32.545 READ DMA
c8 00 01 00 00 00 e0 00 00:01:32.545 READ DMA
c8 00 01 00 00 00 e0 00 00:01:32.545 READ DMA

Error 1756 occurred at disk power-on lifetime: 7622 hours (317 days + 14 hours)
When the command that caused the error occurred, the device was active or idle.

After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
84 51 00 c7 00 00 e0 Error: ICRC, ABRT at LBA = 0x000000c7 = 199

Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
c8 00 08 c7 00 00 e0 00 00:00:32.113 READ DMA
c8 00 08 bf 00 00 e0 00 00:00:32.113 READ DMA
c8 00 08 b7 00 00 e0 00 00:00:32.113 READ DMA
c8 00 08 af 00 00 e0 00 00:00:32.112 READ DMA
c8 00 08 a7 00 00 e0 00 00:00:32.112 READ DMA


Complete error log:

SMART Error Log Version: 1
Warning: ATA error count 61246 inconsistent with error log pointer 5
ATA Error Count: 61246 (device log contains only the most recent five errors)
CR = Command Register [HEX]
FR = Features Register [HEX]
SC = Sector Count Register [HEX]
SN = Sector Number Register [HEX]
CL = Cylinder Low Register [HEX]
CH = Cylinder High Register [HEX]
DH = Device/Head Register [HEX]
DC = Device Command Register [HEX]
ER = Error register [HEX]
ST = Status register [HEX]
Powered_Up_Time is measured from power on, and printed as
DDd+hh:mm:SS.sss where DD=days, hh=hours, mm=minutes,
SS=sec, and sss=millisec. It "wraps" after 49.710 days.

Error 61246 occurred at disk power-on lifetime: 54096 hours (2254 days + 0 hours)
When the command that caused the error occurred, the device was active or idle.

After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
04 51 01 01 00 00 a0 Error: ABRT

Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
a1 00 01 01 00 00 a0 00 35d+17:42:08.640 IDENTIFY PACKET DEVICE
c8 00 08 77 a5 34 e1 00 29d+16:53:44.320 READ DMA
08 00 01 01 00 00 a0 00 35d+17:42:08.640 DEVICE RESET
00 00 01 01 00 00 00 00 40d+09:28:39.680 NOP [Abort queued commands]
e0 00 00 00 00 00 a0 00 29d+16:53:44.320 STANDBY IMMEDIATE

Error 61245 occurred at disk power-on lifetime: 54096 hours (2254 days + 0 hours)
When the command that caused the error occurred, the device was active or idle.

After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
04 51 01 01 00 00 a0

Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
08 00 01 01 00 00 a0 00 35d+17:42:08.640 DEVICE RESET
00 00 01 01 00 00 00 00 40d+09:28:39.680 NOP [Abort queued commands]
e0 00 00 00 00 00 a0 00 29d+16:53:44.320 STANDBY IMMEDIATE
c8 00 40 91 a7 2c e1 00 29d+16:53:44.320 READ DMA
c8 00 08 77 a5 34 e1 00 29d+16:53:44.320 READ DMA

Error 61244 occurred at disk power-on lifetime: 53584 hours (2232 days + 16 hours)
When the command that caused the error occurred, the device was active or idle.

After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
04 51 01 01 00 00 a0 Error: ABRT

Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
a1 00 01 01 00 00 a0 00 35d+17:42:08.640 IDENTIFY PACKET DEVICE
c8 00 08 47 31 e3 e0 00 34d+08:01:57.760 READ DMA
08 00 01 01 00 00 a0 00 35d+17:42:08.640 DEVICE RESET
00 00 01 01 00 00 00 00 40d+09:28:39.680 NOP [Abort queued commands]
e0 00 00 00 00 00 a0 00 34d+08:01:57.760 STANDBY IMMEDIATE

Error 61243 occurred at disk power-on lifetime: 53584 hours (2232 days + 16 hours)
When the command that caused the error occurred, the device was active or idle.

After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
04 51 01 01 00 00 a0

Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
08 00 01 01 00 00 a0 00 35d+17:42:08.640 DEVICE RESET
00 00 01 01 00 00 00 00 40d+09:28:39.680 NOP [Abort queued commands]
e0 00 00 00 00 00 a0 00 34d+08:01:57.760 STANDBY IMMEDIATE
c8 00 08 97 36 8f e0 00 34d+08:01:57.760 READ DMA
c8 00 08 47 31 e3 e0 00 34d+08:01:57.760 READ DMA

Error 61242 occurred at disk power-on lifetime: 53072 hours (2211 days + 8 hours)
When the command that caused the error occurred, the device was active or idle.

After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
04 51 01 01 00 00 a0 Error: ABRT

Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
a1 00 01 01 00 00 a0 00 35d+17:42:08.640 IDENTIFY PACKET DEVICE
08 00 01 01 00 00 a0 00 35d+17:42:08.640 DEVICE RESET
00 00 01 01 00 00 00 00 40d+09:28:39.680 NOP [Abort queued commands]
e0 00 00 00 00 00 a0 00 48d+03:54:28.480 STANDBY IMMEDIATE
c8 00 08 af 40 00 e1 00 48d+03:54:28.480 READ DMA

schrauber 12.07.2014 15:46
Welcher Hersteller ist die Platte? Vielleicht gibt es ein Hersteller Tool zum Testen.


Alle Zeitangaben in WEZ +1. Es ist jetzt 07:25 Uhr.
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131