Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Windows 7 startet zum wiederholten Male nichtmehr ( Toshiba Notebook ) (https://www.trojaner-board.de/159920-windows-7-startet-wiederholten-male-nichtmehr-toshiba-notebook.html)

Tobinho09 20.10.2014 12:51
Windows 7 startet zum wiederholten Male nichtmehr ( Toshiba Notebook )
 
Auf anraten eines Users sollte ich ein neues Thema besser hier eröffnen:

Hallo,

ich hoffe ihr könnt mir helfen, ist ziemlich wichtig. Vorneweg: Ich bin kein PC-Fachmann von daher nehmt es mir bitte nicht übel falls ich mich mal nicht präzise genuge ausdrücke oder dumme Fragen stelle.

Jetzt zu meinem Problem. Der Text wird leider etwas länger, da ich alle Sachverhalte schildern muss.
Vor ca 11 Monaten habe ich mir einen Toshiba Laptop gekauft. Vor zwei Monaten konnte man plötzlich nichtmehr Windows starten. Daraufhin habe ich den Laptop eingeschickt und der Defekt wurde laut dem Hersteller behoben ( meine Daten waren aber leider alle verloren ). Ich benutze AntiVir und war eigentlich auch vorsichtig.
Heute morgen dann leider wieder das gleiche Problem. Windows konnte man nicht starten, es erschien folgende Fehlermeldung: hxxp://www.directupload.net/file/d/3780/8pgyzi2s_jpg.htm
Ich habe beides mal versucht. Bei "Windows normal starten" hat sich nichts getan und ich habe die Systemreperatur über 7 Stunden laufen lassen, aber da hat sich auch nichts getan.

Im Verlaufe des Abends kam dann folgende Meldung: hxxp://www.directupload.net/file/d/3780/uddpweik_jpg.htm
Jetzt wird es etwas komplizierter da ich zu allen Auswahlmöglichkeiten etwas schreiben muss.
1) Klicke ich auf Windows normal starten, kommt ein schwarzes Fenster wo nur die Maus zu sehen ist, es sich allerdings nichts weiter tut.
2) Wenn ich auf "Abgesicherten Modus" klicke kann ich mich mit meinem Passwort einloggen, allerdings habe ich dann ein sehr schlechte Bildqualität. Es kamen dann zwei Bilder: 1. hxxp://www.directupload.net/file/d/3781/8moizrqf_jpg.htm und dieses 2.hxxp://www.directupload.net/file/d/3781/22xnsz3t_jpg.htm
3) Wähle ich "Abgesicherter Modus mit Netzwerktreibern" aus, erscheint auch nur ein schwarzer Bildschirm mit der Maus.
4) Wähle ich "Abgesicherter Modus mit Eingabeaufforderung aus" kann ich mich auch mit meinem Passwort unter der sehr schlechten Bildqualität einloggen. Dann erscheint dieses Bild: hxxp://www.directupload.net/file/d/3781/y9n3mfot_jpg.htm

Bei allen Varianten fährt der Computer sich dann automatisch herunter, geht aber nicht komplett aus sondern es erscheint wieder der schwarze Bildschirm mit der Maus.

Es ist sehr sehr ärgerlich, da ich den Laptop für mein Studium unbedingt brauche.
Auch wenn der Text sehr lang und wohl verwirrend ist, hoffe ich, dass der ein oder andere sich die Mühe macht und mir helfen kann.

Mit freundlichen Grüßen

schrauber 20.10.2014 14:16
hi,

Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)
Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)
  • Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST Download FRST 32-Bit | FRST 64-Bit
  • Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.
  • Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:
Über den Boot Manager:
  • Starte den Rechner neu.
  • Während dem Hochfahren drücke mehrmals die F8 Taste
  • Wähle nun Computer reparieren.
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Mit Windows CD/DVD (auch bei Windows 8 möglich):
  • Lege die Windows CD in dein Laufwerk.
  • Starte den Rechner neu und starte von der CD.
  • Wähle die Spracheinstellungen und klicke "Weiter".
  • Klicke auf Computerreparaturoptionen !
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Wähle in den Reparaturoptionen: Eingabeaufforderung
  • Gib nun bitte notepad ein und drücke Enter.
  • Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
    Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.
  • Schließe Notepad wieder
  • Gib nun bitte folgenden Befehl ein.
    e:\frst.exe bzw. e:\frst64.exe
    Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.
  • Akzeptiere den Disclaimer mit Ja und klicke Untersuchen
Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).


Tobinho09 20.10.2014 21:24
So ich hoffe ich habe das richtig gemacht. Danke schonmal für deine/eure Hilfe.

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-10-2014 01
Ran by SYSTEM on MININT-SOSB27B on 20-10-2014 22:17:16
Running from g:\
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Englisch (USA)
Internet Explorer Version 9
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [] => [X]
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12459112 2012-03-15] (Realtek Semiconductor)
HKLM\...\Run: [SRS Premium Sound HD] => C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2165120 2012-03-22] (SRS Labs, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2866960 2011-12-19] (Synaptics Incorporated)
HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [590256 2011-09-22] (TOSHIBA Corporation)
HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [989056 2011-12-13] (TOSHIBA Corporation)
HKLM\...\Run: [Teco] => C:\Program Files\TOSHIBA\TECO\Teco.exe [1548208 2011-11-24] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [712096 2011-12-14] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710560 2011-11-25] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] => C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba TEMPRO] => C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1546720 2011-02-09] (Toshiba Europe GmbH)
HKLM\...\Run: [Toshiba Registration] => C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe [150992 2012-07-18] (Toshiba Europe GmbH)
HKLM-x32\...\Run: [NBAgent] => C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe [1492264 2011-11-18] (Nero AG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-06-06] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [mcui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [1675160 2011-11-22] (McAfee, Inc.)
HKLM-x32\...\Run: [ITSecMng] => C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [80840 2011-04-01] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-01-05] (Intel Corporation)
HKLM-x32\...\Run: [ToshibaServiceStation] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1298816 2011-07-11] (TOSHIBA Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-09] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [165168 2014-09-23] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\Tobias\...\Run: [Steam] => C:\Program Files (x86)\Steam\Steam.exe [1938112 2014-09-22] (Valve Corporation)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\Toshiba\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\Toshiba\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\Toshiba\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-10-09] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-10-09] (Avira Operations GmbH & Co. KG)
S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160560 2014-09-23] (Avira Operations GmbH & Co. KG)
S2 EpsonScanSvc; C:\windows\system32\EscSvc64.exe [144560 2012-05-16] (Seiko Epson Corporation)
S2 GFNEXSrv; C:\Windows\System32\GFNEXSrv.exe [162824 2010-09-09] ()
S2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128280 2012-02-21] ()
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-21] (Intel Corporation)
S3 McAWFwk; c:\Program Files\mcafee\msc\McAWFwk.exe [225216 2011-01-28] (McAfee, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S2 McMPFSvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)
S2 mcmscsvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)
S2 McNaiAnn; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)
S2 McNASvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [502032 2011-10-18] (McAfee, Inc.)
S4 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)
S2 McProxy; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)
S2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [199272 2011-12-06] (McAfee, Inc.)
S2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [208536 2011-12-06] (McAfee, Inc.)
S2 mfevtp; C:\Windows\system32\mfevtps.exe [161168 2011-12-06] (McAfee, Inc.)
S2 MSK80Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-09] (Toshiba Europe GmbH)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-09] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-09] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-07-23] (Avira Operations GmbH & Co. KG)
S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [65264 2011-10-15] (McAfee, Inc.)
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [160280 2011-10-15] (McAfee, Inc.)
S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [229528 2011-10-15] (McAfee, Inc.)
S3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [481768 2011-10-15] (McAfee, Inc.)
S0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [647080 2011-10-15] (McAfee, Inc.)
S1 mfenlfk; C:\Windows\System32\DRIVERS\mfenlfk.sys [75808 2011-10-15] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [100912 2011-10-15] (McAfee, Inc.)
S0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [284648 2011-10-15] (McAfee, Inc.)
S3 RtkBtFilter; C:\Windows\System32\DRIVERS\RtkBtfilter.sys [21096 2012-01-05] (Realtek Microelectronics)
S3 RTL8192Ce; C:\Windows\System32\DRIVERS\rtwlane.sys [1082472 2012-01-16] (Realtek Semiconductor Corporation                          )
S3 Tosrfcom; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-20 22:17 - 2014-10-20 22:17 - 00000000 ____D () C:\FRST
2014-10-15 04:47 - 2014-10-15 04:47 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-10-15 03:56 - 2014-09-28 16:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2014-10-15 03:56 - 2014-08-18 19:11 - 00693176 _____ (Microsoft Corporation) C:\Windows\System32\winload.efi
2014-10-15 03:56 - 2014-08-18 19:10 - 00616352 _____ (Microsoft Corporation) C:\Windows\System32\winresume.efi
2014-10-15 03:56 - 2014-08-18 19:08 - 00503808 _____ (Microsoft Corporation) C:\Windows\System32\srcore.dll
2014-10-15 03:56 - 2014-07-06 18:07 - 14632960 _____ (Microsoft Corporation) C:\Windows\System32\wmp.dll
2014-10-15 03:56 - 2014-07-06 18:07 - 00782848 _____ (Microsoft Corporation) C:\Windows\System32\wmdrmsdk.dll
2014-10-15 03:56 - 2014-07-06 18:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\System32\wintrust.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 05551032 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2014-10-15 03:56 - 2014-07-06 18:06 - 04120576 _____ (Microsoft Corporation) C:\Windows\System32\mf.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 02644992 _____ (Microsoft Corporation) C:\Windows\System32\msmpeg2vdec.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 01574400 _____ (Microsoft Corporation) C:\Windows\System32\quartz.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 01480192 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 01202176 _____ (Microsoft Corporation) C:\Windows\System32\drmv2clt.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 01069056 _____ (Microsoft Corporation) C:\Windows\System32\cryptui.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 00842240 _____ (Microsoft Corporation) C:\Windows\System32\blackbox.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 00679424 _____ (Microsoft Corporation) C:\Windows\System32\audiosrv.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 00641024 _____ (Microsoft Corporation) C:\Windows\System32\msscp.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 00631808 _____ (Microsoft Corporation) C:\Windows\System32\evr.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 00500224 _____ (Microsoft Corporation) C:\Windows\System32\AUDIOKSE.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 00497664 _____ (Microsoft Corporation) C:\Windows\System32\drmmgrtn.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 00440832 _____ (Microsoft Corporation) C:\Windows\System32\AudioEng.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 00432128 _____ (Microsoft Corporation) C:\Windows\System32\mfplat.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 00296448 _____ (Microsoft Corporation) C:\Windows\System32\AudioSes.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 00284672 _____ (Microsoft Corporation) C:\Windows\System32\EncDump.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 00188416 _____ (Microsoft Corporation) C:\Windows\System32\pcasvc.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 00082432 _____ (Microsoft Corporation) C:\Windows\System32\cryptsp.dll
2014-10-15 03:56 - 2014-07-06 17:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\PEAuth.sys
2014-10-15 03:56 - 2014-07-06 17:40 - 11411456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 03208704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 02135040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
2014-10-15 03:56 - 2014-07-06 17:39 - 03970488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-10-15 03:56 - 2014-07-06 17:39 - 03914680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-10-15 03:56 - 2014-06-27 16:21 - 00619056 _____ (Microsoft Corporation) C:\Windows\System32\winload.exe
2014-10-15 03:56 - 2014-06-27 16:21 - 00532176 _____ (Microsoft Corporation) C:\Windows\System32\winresume.exe
2014-10-15 03:56 - 2014-06-27 16:21 - 00457400 _____ (Microsoft Corporation) C:\Windows\System32\ci.dll
2014-10-15 03:56 - 2014-06-18 14:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\System32\dfshim.dll
2014-10-15 03:56 - 2014-06-18 14:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2014-10-15 03:56 - 2014-06-18 14:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2014-10-15 03:56 - 2014-06-18 14:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\System32\mscorier.dll
2014-10-15 03:56 - 2014-06-18 14:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2014-10-15 03:56 - 2014-06-18 14:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\System32\mscories.dll
2014-10-15 03:55 - 2014-10-09 18:05 - 00507392 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2014-10-15 03:55 - 2014-10-09 18:05 - 00276480 _____ (Microsoft Corporation) C:\Windows\System32\generaltel.dll
2014-10-15 03:55 - 2014-10-09 18:00 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2014-10-15 03:55 - 2014-08-18 19:08 - 00063488 _____ (Microsoft Corporation) C:\Windows\System32\setbcdlocale.dll
2014-10-15 03:55 - 2014-08-18 19:08 - 00050176 _____ (Microsoft Corporation) C:\Windows\System32\srclient.dll
2014-10-15 03:55 - 2014-08-18 19:07 - 00296960 _____ (Microsoft Corporation) C:\Windows\System32\rstrui.exe
2014-10-15 03:55 - 2014-08-18 19:07 - 00146944 _____ (Microsoft Corporation) C:\Windows\System32\appidpolicyconverter.exe
2014-10-15 03:55 - 2014-08-18 19:07 - 00058880 _____ (Microsoft Corporation) C:\Windows\System32\appidapi.dll
2014-10-15 03:55 - 2014-08-18 19:07 - 00032256 _____ (Microsoft Corporation) C:\Windows\System32\appidsvc.dll
2014-10-15 03:55 - 2014-08-18 19:07 - 00017920 _____ (Microsoft Corporation) C:\Windows\System32\appidcertstorecheck.exe
2014-10-15 03:55 - 2014-08-18 18:41 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2014-10-15 03:55 - 2014-08-18 18:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2014-10-15 03:55 - 2014-08-18 18:06 - 00061440 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\appid.sys
2014-10-15 03:55 - 2014-07-06 18:06 - 00325632 _____ (Microsoft Corporation) C:\Windows\System32\msnetobj.dll
2014-10-15 03:55 - 2014-07-06 18:06 - 00206848 _____ (Microsoft Corporation) C:\Windows\System32\mfps.dll
2014-10-15 03:55 - 2014-07-06 18:06 - 00055808 _____ (Microsoft Corporation) C:\Windows\System32\rrinstaller.exe
2014-10-15 03:55 - 2014-07-06 18:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\System32\mfpmp.exe
2014-10-15 03:55 - 2014-07-06 18:06 - 00009728 _____ (Microsoft Corporation) C:\Windows\System32\spwmp.dll
2014-10-15 03:55 - 2014-07-06 18:06 - 00005120 _____ (Microsoft Corporation) C:\Windows\System32\msdxm.ocx
2014-10-15 03:55 - 2014-07-06 18:06 - 00005120 _____ (Microsoft Corporation) C:\Windows\System32\dxmasf.dll
2014-10-15 03:55 - 2014-07-06 18:05 - 12625920 _____ (Microsoft Corporation) C:\Windows\System32\wmploc.DLL
2014-10-15 03:55 - 2014-07-06 18:05 - 00126464 _____ (Microsoft Corporation) C:\Windows\System32\audiodg.exe
2014-10-15 03:55 - 2014-07-06 18:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\mferror.dll
2014-10-15 03:55 - 2014-07-06 17:40 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2014-10-15 03:55 - 2014-07-06 17:40 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2014-10-15 03:55 - 2014-07-06 17:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2014-10-15 03:55 - 2014-07-06 17:40 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2014-10-15 03:55 - 2014-07-06 17:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2014-10-15 03:55 - 2014-07-06 17:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2014-10-15 03:55 - 2014-07-06 17:39 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2014-10-15 03:55 - 2014-07-06 17:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2014-10-15 03:55 - 2014-07-06 17:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2014-10-15 03:55 - 2014-07-06 17:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2014-10-15 03:53 - 2014-09-17 18:00 - 03241472 _____ (Microsoft Corporation) C:\Windows\System32\msi.dll
2014-10-15 03:53 - 2014-09-17 17:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-15 03:53 - 2014-09-03 21:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\rastls.dll
2014-10-15 03:53 - 2014-09-03 21:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-15 03:53 - 2014-07-16 18:07 - 03722240 _____ (Microsoft Corporation) C:\Windows\System32\mstscax.dll
2014-10-15 03:53 - 2014-07-16 18:07 - 01118720 _____ (Microsoft Corporation) C:\Windows\System32\mstsc.exe
2014-10-15 03:53 - 2014-07-16 18:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\System32\termsrv.dll
2014-10-15 03:53 - 2014-07-16 18:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\System32\winlogon.exe
2014-10-15 03:53 - 2014-07-16 18:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\System32\winsta.dll
2014-10-15 03:53 - 2014-07-16 18:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2014-10-15 03:53 - 2014-07-16 18:07 - 00086528 _____ (Microsoft Corporation) C:\Windows\System32\TSpkg.dll
2014-10-15 03:53 - 2014-07-16 18:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\System32\credssp.dll
2014-10-15 03:53 - 2014-07-16 17:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2014-10-15 03:53 - 2014-07-16 17:39 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-15 03:53 - 2014-07-16 17:39 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-10-15 03:53 - 2014-07-16 17:39 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2014-10-15 03:53 - 2014-07-16 17:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-10-15 03:53 - 2014-07-16 17:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-10-15 03:53 - 2014-07-16 17:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2014-10-15 03:53 - 2014-07-16 17:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tssecsrv.sys
2014-10-15 03:52 - 2014-09-12 17:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\System32\packager.dll
2014-10-15 03:52 - 2014-09-12 17:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-14 04:27 - 2014-10-14 04:27 - 00001148 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-10-02 05:54 - 2014-10-02 05:54 - 00000000 ____D () C:\Users\Tobias\AppData\Local\Adobe
2014-09-30 16:16 - 2014-09-24 18:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\System32\qdvd.dll
2014-09-30 16:15 - 2014-09-24 17:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2014-09-24 03:37 - 2014-09-09 14:11 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\tzres.dll
2014-09-24 03:37 - 2014-09-09 13:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-20 05:10 - 2009-07-13 21:08 - 00029838 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-10-20 05:08 - 2009-07-13 21:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-20 05:08 - 2009-07-13 20:51 - 00042493 _____ () C:\Windows\setupact.log
2014-10-18 15:50 - 2014-08-07 12:09 - 01470611 _____ () C:\Windows\WindowsUpdate.log
2014-10-18 15:23 - 2014-08-14 11:29 - 00000000 ____D () C:\Users\Tobias\Desktop\FM 13
2014-10-18 03:29 - 2009-07-13 20:45 - 00027344 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-18 03:29 - 2009-07-13 20:45 - 00027344 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-18 03:26 - 2012-07-18 12:31 - 00001839 _____ () C:\Users\Public\Desktop\McAfee Internet Security.lnk
2014-10-18 03:20 - 2014-09-04 08:43 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-10-18 03:20 - 2014-08-07 12:13 - 00000828 _____ () C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
2014-10-17 08:38 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\rescache
2014-10-17 07:07 - 2014-08-07 12:13 - 00000830 _____ () C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
2014-10-17 02:34 - 2014-08-08 06:45 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-10-16 03:46 - 2009-07-13 21:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-10-16 03:37 - 2009-07-13 20:45 - 00267816 _____ () C:\Windows\System32\FNTCACHE.DAT
2014-10-16 03:35 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-10-16 03:35 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\System32\Dism
2014-10-16 03:34 - 2014-08-14 16:27 - 00000000 ___SD () C:\Windows\System32\CompatTel
2014-10-14 04:27 - 2014-08-08 06:49 - 00000000 ____D () C:\ProgramData\Package Cache
2014-10-14 04:27 - 2014-08-08 06:49 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-10-09 03:35 - 2014-08-14 05:33 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avnetflt.sys
2014-10-09 03:35 - 2014-08-08 06:52 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avipbb.sys
2014-10-09 03:35 - 2014-08-08 06:52 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avgntflt.sys
2014-10-03 03:45 - 2012-07-18 12:22 - 00000000 ____D () C:\ProgramData\Adobe
2014-10-02 05:54 - 2014-08-08 06:42 - 00000000 ____D () C:\Users\Tobias\AppData\Roaming\Adobe
2014-09-21 09:29 - 2014-09-04 03:45 - 00000000 ____D () C:\Users\Tobias\AppData\Roaming\Skype

Some content of TEMP:
====================
C:\Users\Tobias\AppData\Local\Temp\AutoEdManager14.exe
C:\Users\Tobias\AppData\Local\Temp\avgnt.exe


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe
[2014-10-15 03:53] - [2014-07-16 18:07] - 0455168 ____A (Microsoft Corporation) 8CEBD9D0A0A879CDE9F36F4383B7CAEA

C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe
[2012-07-18 11:25] - [2011-02-24 21:30] - 2616320 ____A (Microsoft Corporation) D3C99E3246526F5C6FE3F24140417FCC

C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE Association (whitelisted) =============


==================== Restore Points  =========================

Restore point made on: 2014-09-25 14:22:53
Restore point made on: 2014-09-30 16:44:36
Restore point made on: 2014-10-15 15:44:54
Restore point made on: 2014-10-17 08:27:32

==================== Memory info ===========================

Percentage of memory in use: 12%
Total physical RAM: 6027.3 MB
Available physical RAM: 5299.96 MB
Total Pagefile: 6025.5 MB
Available Pagefile: 5291.47 MB
Total Virtual: 8192 MB
Available Virtual: 8191.88 MB

==================== Drives ================================

Drive c: (TI30946800B) (Fixed) (Total:685.21 GB) (Free:609.56 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (System) (Fixed) (Total:1.46 GB) (Free:1.22 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive g: () (Removable) (Total:0.49 GB) (Free:0.49 GB) FAT
Drive x: (Boot) (Fixed) (Total:0.12 GB) (Free:0.12 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 698.6 GB) (Disk ID: 6D52EFE7)
Partition 1: (Active) - (Size=1.5 GB) - (Type=27)
Partition 2: (Not Active) - (Size=685.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=12 GB) - (Type=17)

========================================================
Disk: 2 (Size: 504.1 MB) (Disk ID: 0020CECD)
Partition 1: (Active) - (Size=504 MB) - (Type=06)


LastRegBack: 2014-10-17 08:19

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

schrauber 21.10.2014 18:18
FRST in der Recovery starten. In das Search Feld das schreiben:

winlogon.exe;explorer.*

und auf Search Files klicken. Dann Haken bei BCD setzen und nochmal scannen.

Poste bitte die Search.txt und das neue Scanlog.

Tobinho09 22.10.2014 13:18
Search.txt:

Code:
Farbar Recovery Scan Tool (x64) Version: 20-10-2014 01
Ran by SYSTEM at 2014-10-22 12:59:54
Running from f:\
Boot Mode: Recovery

================== Search Files: "winlogon.exe;explorer.*" =============

C:\Windows\explorer.exe
[2012-07-18 11:25][2011-02-24 22:19] 2871808 ____A (Microsoft Corporation) 332FEAB1435662FC6C672E25BEB37BE3

C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2012-07-18 11:25][2011-02-25 21:19] 2616320 ____A (Microsoft Corporation) 0FB9C74046656D1579A64660AD67B746

C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2012-07-18 11:25][2011-02-24 21:30] 2616320 ____A (Microsoft Corporation) D3C99E3246526F5C6FE3F24140417FCC

C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2010-11-20 19:24][2010-11-20 19:24] 2616320 ____A (Microsoft Corporation) 40D777B7A95E00593EB1568C68514493

C:\Windows\winsxs\wow64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_nl-nl_254814754abb8f9d\explorer.exe.mui
[2011-02-11 02:21][2011-02-11 02:21] 0025088 ____A (Microsoft Corporation) AA2F908679A4F377A5E099B8554D1EE8

C:\Windows\winsxs\wow64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f8e6ec408bde811b\explorer.exe.mui
[2011-02-11 02:12][2011-02-11 02:12] 0025088 ____A (Microsoft Corporation) D871BB5958AEF9F493B330FCB533DE6B

C:\Windows\winsxs\wow64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0ebef5f9b4ac9b9d\explorer.exe.mui
[2011-02-11 02:03][2011-02-11 02:03] 0026624 ____A (Microsoft Corporation) FD173730E78468962F9AF98C274B723B

C:\Windows\winsxs\wow64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6c3c2316c1b39396\explorer.exe.mui
[2010-11-20 23:06][2010-11-20 23:06] 0022016 ____A (Microsoft Corporation) B9F4B1CA23D60775736059D72BA48526

C:\Windows\winsxs\wow64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_de-de_c34b4d1dd2d587d1\explorer.exe.mui
[2011-02-11 01:53][2011-02-11 01:53] 0025600 ____A (Microsoft Corporation) EB67605F636687E5F3C988B0059A8C46

C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.22750_none_ce434d9704d2c730\winlogon.exe
[2014-10-15 03:53][2014-07-15 19:23] 0455680 ____A (Microsoft Corporation) 98AA0BFEE089C7E5DADB94190D93456C

C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.22616_none_ce748d1d04acf24f\winlogon.exe
[2014-08-09 05:23][2014-03-04 03:08] 0455680 ____A (Microsoft Corporation) 6CE2AE073BD21C542FC2C707CAE944CC

C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.18540_none_cdc47ed1ebad0e4e\winlogon.exe
[2014-10-15 03:53][2014-07-16 18:07] 0455168 ____A (Microsoft Corporation) 8CEBD9D0A0A879CDE9F36F4383B7CAEA

C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.18409_none_cdf8bf35eb848572\winlogon.exe
[2014-08-09 05:23][2014-03-04 01:43] 0455168 ____A (Microsoft Corporation) 88AB9B72B4BF3963A0DE0820B4B0B06C

C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2010-11-20 19:24][2010-11-20 19:24] 0390656 ____A (Microsoft Corporation) 1151B1BAA6F350B1DB6598E0FEA7C457

C:\Windows\winsxs\amd64_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.1.7600.16385_none_71af9b5b0a86e6b7\Explorer.admx
[2009-07-13 13:48][2009-06-10 12:53] 0003836 ____A () AD131A834808E6AFF4A3918DE05BFCF6

C:\Windows\winsxs\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.1.7600.16385_nl-nl_380162980d0e750b\Explorer.adml
[2011-02-11 02:23][2011-02-11 02:23] 0004166 ____A () 3459B32788B144A8C393AA9D8A4457AD

C:\Windows\winsxs\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.1.7600.16385_it-it_0ba03a634e316689\Explorer.adml
[2011-02-11 02:14][2011-02-11 02:14] 0004183 ____A () 4CF10EA9BAB7750F41A7E154AECAF977

C:\Windows\winsxs\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2178441c76ff810b\Explorer.adml
[2011-02-11 02:04][2011-02-11 02:04] 0004366 ____A () 08B7C46F43CAF60319B5DE61EDCCA056

C:\Windows\winsxs\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7ef5713984067904\Explorer.adml
[2010-11-20 23:06][2010-11-20 23:06] 0003695 ____A () 7A4C7F3CB156543113596988479CAFCE

C:\Windows\winsxs\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.1.7600.16385_de-de_d6049b4095286d3f\Explorer.adml
[2011-02-11 01:54][2011-02-11 01:54] 0004226 ____A () EE23420A7C0E74A9D316221F8BFB2477

C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2012-07-18 11:25][2011-02-25 22:14] 2871808 ____A (Microsoft Corporation) 3B69712041F3D63605529BD66DC00C48

C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2012-07-18 11:25][2011-02-24 22:19] 2871808 ____A (Microsoft Corporation) 332FEAB1435662FC6C672E25BEB37BE3

C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2010-11-20 19:24][2010-11-20 19:24] 2872320 ____A (Microsoft Corporation) AC4C51EB24AA95B77F705AB159189E24

C:\Windows\winsxs\amd64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_nl-nl_1af36a23165acda2\explorer.exe.mui
[2011-02-11 02:21][2011-02-11 02:21] 0025088 ____A (Microsoft Corporation) E0FFFA2CEEB9427A422F74727CFCA09B

C:\Windows\winsxs\amd64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ee9241ee577dbf20\explorer.exe.mui
[2011-02-11 02:12][2011-02-11 02:12] 0025088 ____A (Microsoft Corporation) 23D5A51BD481152EEF04E2F1125B4C1B

C:\Windows\winsxs\amd64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_046a4ba7804bd9a2\explorer.exe.mui
[2011-02-11 02:02][2011-02-11 02:02] 0026624 ____A (Microsoft Corporation) BE31703AC133F7C80896D7898687BEF0

C:\Windows\winsxs\amd64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_61e778c48d52d19b\explorer.exe.mui
[2010-11-20 23:06][2010-11-20 23:06] 0022016 ____A (Microsoft Corporation) 4B87EEFDC8E253F846A7DFB49A8E6C70

C:\Windows\winsxs\amd64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b8f6a2cb9e74c5d6\explorer.exe.mui
[2011-02-11 01:53][2011-02-11 01:53] 0025600 ____A (Microsoft Corporation) 64E8A52EA68A8C36D0152F3108DA02D0

C:\Windows\SysWOW64\explorer.exe
[2012-07-18 11:25][2011-02-24 21:30] 2616320 ____A (Microsoft Corporation) D3C99E3246526F5C6FE3F24140417FCC

C:\Windows\SysWOW64\nl-NL\explorer.exe.mui
[2011-02-11 02:21][2011-02-11 02:21] 0025088 ____A (Microsoft Corporation) AA2F908679A4F377A5E099B8554D1EE8

C:\Windows\SysWOW64\it-IT\explorer.exe.mui
[2011-02-11 02:12][2011-02-11 02:12] 0025088 ____A (Microsoft Corporation) D871BB5958AEF9F493B330FCB533DE6B

C:\Windows\SysWOW64\fr-FR\explorer.exe.mui
[2011-02-11 02:03][2011-02-11 02:03] 0026624 ____A (Microsoft Corporation) FD173730E78468962F9AF98C274B723B

C:\Windows\SysWOW64\en-US\explorer.exe.mui
[2010-11-20 23:06][2010-11-20 23:06] 0022016 ____A (Microsoft Corporation) B9F4B1CA23D60775736059D72BA48526

C:\Windows\SysWOW64\de-DE\explorer.exe.mui
[2011-02-11 01:53][2011-02-11 01:53] 0025600 ____A (Microsoft Corporation) EB67605F636687E5F3C988B0059A8C46

C:\Windows\System32\winlogon.exe
[2014-10-15 03:53][2014-07-16 18:07] 0455168 ____A (Microsoft Corporation) 8CEBD9D0A0A879CDE9F36F4383B7CAEA

C:\Windows\PolicyDefinitions\Explorer.admx
[2009-07-13 13:48][2009-06-10 12:53] 0003836 ____A () AD131A834808E6AFF4A3918DE05BFCF6

C:\Windows\PolicyDefinitions\nl-NL\Explorer.adml
[2011-02-11 02:23][2011-02-11 02:23] 0004166 ____A () 3459B32788B144A8C393AA9D8A4457AD

C:\Windows\PolicyDefinitions\it-IT\Explorer.adml
[2011-02-11 02:14][2011-02-11 02:14] 0004183 ____A () 4CF10EA9BAB7750F41A7E154AECAF977

C:\Windows\PolicyDefinitions\fr-FR\Explorer.adml
[2011-02-11 02:04][2011-02-11 02:04] 0004366 ____A () 08B7C46F43CAF60319B5DE61EDCCA056

C:\Windows\PolicyDefinitions\en-US\Explorer.adml
[2010-11-20 23:06][2010-11-20 23:06] 0003695 ____A () 7A4C7F3CB156543113596988479CAFCE

C:\Windows\PolicyDefinitions\de-DE\Explorer.adml
[2011-02-11 01:54][2011-02-11 01:54] 0004226 ____A () EE23420A7C0E74A9D316221F8BFB2477

C:\Windows\nl-NL\explorer.exe.mui
[2011-02-11 02:21][2011-02-11 02:21] 0025088 ____A (Microsoft Corporation) E0FFFA2CEEB9427A422F74727CFCA09B

C:\Windows\it-IT\explorer.exe.mui
[2011-02-11 02:12][2011-02-11 02:12] 0025088 ____A (Microsoft Corporation) 23D5A51BD481152EEF04E2F1125B4C1B

C:\Windows\fr-FR\explorer.exe.mui
[2011-02-11 02:02][2011-02-11 02:02] 0026624 ____A (Microsoft Corporation) BE31703AC133F7C80896D7898687BEF0

C:\Windows\en-US\explorer.exe.mui
[2010-11-20 23:06][2010-11-20 23:06] 0022016 ____A (Microsoft Corporation) 4B87EEFDC8E253F846A7DFB49A8E6C70

C:\Windows\de-DE\explorer.exe.mui
[2011-02-11 01:53][2011-02-11 01:53] 0025600 ____A (Microsoft Corporation) 64E8A52EA68A8C36D0152F3108DA02D0

X:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2010-11-20 02:15][2010-11-20 05:25] 0390656 ____A (Microsoft Corporation) 1151B1BAA6F350B1DB6598E0FEA7C457

X:\Windows\System32\winlogon.exe
[2010-11-20 02:15][2010-11-20 05:25] 0390656 ____A (Microsoft Corporation) 1151B1BAA6F350B1DB6598E0FEA7C457

====== End Of Search ======
Scanlog:


FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-10-2014 01
Ran by SYSTEM on MININT-BTRN8G8 on 22-10-2014 13:08:17
Running from f:\
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Englisch (USA)
Internet Explorer Version 9
Boot Mode: Recovery

The current controlset is ControlSet002
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [] => [X]
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12459112 2012-03-15] (Realtek Semiconductor)
HKLM\...\Run: [SRS Premium Sound HD] => C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2165120 2012-03-22] (SRS Labs, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2866960 2011-12-19] (Synaptics Incorporated)
HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [590256 2011-09-22] (TOSHIBA Corporation)
HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [989056 2011-12-13] (TOSHIBA Corporation)
HKLM\...\Run: [Teco] => C:\Program Files\TOSHIBA\TECO\Teco.exe [1548208 2011-11-24] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [712096 2011-12-14] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710560 2011-11-25] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] => C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba TEMPRO] => C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1546720 2011-02-09] (Toshiba Europe GmbH)
HKLM\...\Run: [Toshiba Registration] => C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe [150992 2012-07-18] (Toshiba Europe GmbH)
HKLM-x32\...\Run: [NBAgent] => C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe [1492264 2011-11-18] (Nero AG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-06-06] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [mcui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [1675160 2011-11-22] (McAfee, Inc.)
HKLM-x32\...\Run: [ITSecMng] => C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [80840 2011-04-01] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-01-05] (Intel Corporation)
HKLM-x32\...\Run: [ToshibaServiceStation] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1298816 2011-07-11] (TOSHIBA Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-09] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [165168 2014-09-23] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\Tobias\...\Run: [Steam] => C:\Program Files (x86)\Steam\Steam.exe [1938112 2014-09-22] (Valve Corporation)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\Toshiba\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\Toshiba\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\Toshiba\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-10-09] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-10-09] (Avira Operations GmbH & Co. KG)
S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160560 2014-09-23] (Avira Operations GmbH & Co. KG)
S2 EpsonScanSvc; C:\windows\system32\EscSvc64.exe [144560 2012-05-16] (Seiko Epson Corporation)
S2 GFNEXSrv; C:\Windows\System32\GFNEXSrv.exe [162824 2010-09-09] ()
S2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128280 2012-02-21] ()
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-21] (Intel Corporation)
S3 McAWFwk; c:\Program Files\mcafee\msc\McAWFwk.exe [225216 2011-01-28] (McAfee, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S2 McMPFSvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)
S2 mcmscsvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)
S2 McNaiAnn; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)
S2 McNASvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [502032 2011-10-18] (McAfee, Inc.)
S4 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)
S2 McProxy; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)
S2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [199272 2011-12-06] (McAfee, Inc.)
S2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [208536 2011-12-06] (McAfee, Inc.)
S2 mfevtp; C:\Windows\system32\mfevtps.exe [161168 2011-12-06] (McAfee, Inc.)
S2 MSK80Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-09] (Toshiba Europe GmbH)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-09] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-09] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-07-23] (Avira Operations GmbH & Co. KG)
S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [65264 2011-10-15] (McAfee, Inc.)
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [160280 2011-10-15] (McAfee, Inc.)
S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [229528 2011-10-15] (McAfee, Inc.)
S3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [481768 2011-10-15] (McAfee, Inc.)
S0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [647080 2011-10-15] (McAfee, Inc.)
S1 mfenlfk; C:\Windows\System32\DRIVERS\mfenlfk.sys [75808 2011-10-15] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [100912 2011-10-15] (McAfee, Inc.)
S0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [284648 2011-10-15] (McAfee, Inc.)
S3 RtkBtFilter; C:\Windows\System32\DRIVERS\RtkBtfilter.sys [21096 2012-01-05] (Realtek Microelectronics)
S3 RTL8192Ce; C:\Windows\System32\DRIVERS\rtwlane.sys [1082472 2012-01-16] (Realtek Semiconductor Corporation                          )
S3 Tosrfcom; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-20 22:17 - 2014-10-22 13:08 - 00000000 ____D () C:\FRST
2014-10-15 04:47 - 2014-10-15 04:47 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-10-15 03:56 - 2014-09-28 16:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2014-10-15 03:56 - 2014-08-18 19:11 - 00693176 _____ (Microsoft Corporation) C:\Windows\System32\winload.efi
2014-10-15 03:56 - 2014-08-18 19:10 - 00616352 _____ (Microsoft Corporation) C:\Windows\System32\winresume.efi
2014-10-15 03:56 - 2014-08-18 19:08 - 00503808 _____ (Microsoft Corporation) C:\Windows\System32\srcore.dll
2014-10-15 03:56 - 2014-07-06 18:07 - 14632960 _____ (Microsoft Corporation) C:\Windows\System32\wmp.dll
2014-10-15 03:56 - 2014-07-06 18:07 - 00782848 _____ (Microsoft Corporation) C:\Windows\System32\wmdrmsdk.dll
2014-10-15 03:56 - 2014-07-06 18:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\System32\wintrust.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 05551032 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2014-10-15 03:56 - 2014-07-06 18:06 - 04120576 _____ (Microsoft Corporation) C:\Windows\System32\mf.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 02644992 _____ (Microsoft Corporation) C:\Windows\System32\msmpeg2vdec.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 01574400 _____ (Microsoft Corporation) C:\Windows\System32\quartz.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 01480192 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 01202176 _____ (Microsoft Corporation) C:\Windows\System32\drmv2clt.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 01069056 _____ (Microsoft Corporation) C:\Windows\System32\cryptui.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 00842240 _____ (Microsoft Corporation) C:\Windows\System32\blackbox.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 00679424 _____ (Microsoft Corporation) C:\Windows\System32\audiosrv.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 00641024 _____ (Microsoft Corporation) C:\Windows\System32\msscp.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 00631808 _____ (Microsoft Corporation) C:\Windows\System32\evr.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 00500224 _____ (Microsoft Corporation) C:\Windows\System32\AUDIOKSE.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 00497664 _____ (Microsoft Corporation) C:\Windows\System32\drmmgrtn.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 00440832 _____ (Microsoft Corporation) C:\Windows\System32\AudioEng.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 00432128 _____ (Microsoft Corporation) C:\Windows\System32\mfplat.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 00296448 _____ (Microsoft Corporation) C:\Windows\System32\AudioSes.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 00284672 _____ (Microsoft Corporation) C:\Windows\System32\EncDump.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 00188416 _____ (Microsoft Corporation) C:\Windows\System32\pcasvc.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2014-10-15 03:56 - 2014-07-06 18:06 - 00082432 _____ (Microsoft Corporation) C:\Windows\System32\cryptsp.dll
2014-10-15 03:56 - 2014-07-06 17:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\PEAuth.sys
2014-10-15 03:56 - 2014-07-06 17:40 - 11411456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 03208704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 02135040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2014-10-15 03:56 - 2014-07-06 17:40 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
2014-10-15 03:56 - 2014-07-06 17:39 - 03970488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-10-15 03:56 - 2014-07-06 17:39 - 03914680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-10-15 03:56 - 2014-06-27 16:21 - 00619056 _____ (Microsoft Corporation) C:\Windows\System32\winload.exe
2014-10-15 03:56 - 2014-06-27 16:21 - 00532176 _____ (Microsoft Corporation) C:\Windows\System32\winresume.exe
2014-10-15 03:56 - 2014-06-27 16:21 - 00457400 _____ (Microsoft Corporation) C:\Windows\System32\ci.dll
2014-10-15 03:56 - 2014-06-18 14:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\System32\dfshim.dll
2014-10-15 03:56 - 2014-06-18 14:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2014-10-15 03:56 - 2014-06-18 14:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2014-10-15 03:56 - 2014-06-18 14:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\System32\mscorier.dll
2014-10-15 03:56 - 2014-06-18 14:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2014-10-15 03:56 - 2014-06-18 14:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\System32\mscories.dll
2014-10-15 03:55 - 2014-10-09 18:05 - 00507392 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2014-10-15 03:55 - 2014-10-09 18:05 - 00276480 _____ (Microsoft Corporation) C:\Windows\System32\generaltel.dll
2014-10-15 03:55 - 2014-10-09 18:00 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2014-10-15 03:55 - 2014-08-18 19:08 - 00063488 _____ (Microsoft Corporation) C:\Windows\System32\setbcdlocale.dll
2014-10-15 03:55 - 2014-08-18 19:08 - 00050176 _____ (Microsoft Corporation) C:\Windows\System32\srclient.dll
2014-10-15 03:55 - 2014-08-18 19:07 - 00296960 _____ (Microsoft Corporation) C:\Windows\System32\rstrui.exe
2014-10-15 03:55 - 2014-08-18 19:07 - 00146944 _____ (Microsoft Corporation) C:\Windows\System32\appidpolicyconverter.exe
2014-10-15 03:55 - 2014-08-18 19:07 - 00058880 _____ (Microsoft Corporation) C:\Windows\System32\appidapi.dll
2014-10-15 03:55 - 2014-08-18 19:07 - 00032256 _____ (Microsoft Corporation) C:\Windows\System32\appidsvc.dll
2014-10-15 03:55 - 2014-08-18 19:07 - 00017920 _____ (Microsoft Corporation) C:\Windows\System32\appidcertstorecheck.exe
2014-10-15 03:55 - 2014-08-18 18:41 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2014-10-15 03:55 - 2014-08-18 18:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2014-10-15 03:55 - 2014-08-18 18:06 - 00061440 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\appid.sys
2014-10-15 03:55 - 2014-07-06 18:06 - 00325632 _____ (Microsoft Corporation) C:\Windows\System32\msnetobj.dll
2014-10-15 03:55 - 2014-07-06 18:06 - 00206848 _____ (Microsoft Corporation) C:\Windows\System32\mfps.dll
2014-10-15 03:55 - 2014-07-06 18:06 - 00055808 _____ (Microsoft Corporation) C:\Windows\System32\rrinstaller.exe
2014-10-15 03:55 - 2014-07-06 18:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\System32\mfpmp.exe
2014-10-15 03:55 - 2014-07-06 18:06 - 00009728 _____ (Microsoft Corporation) C:\Windows\System32\spwmp.dll
2014-10-15 03:55 - 2014-07-06 18:06 - 00005120 _____ (Microsoft Corporation) C:\Windows\System32\msdxm.ocx
2014-10-15 03:55 - 2014-07-06 18:06 - 00005120 _____ (Microsoft Corporation) C:\Windows\System32\dxmasf.dll
2014-10-15 03:55 - 2014-07-06 18:05 - 12625920 _____ (Microsoft Corporation) C:\Windows\System32\wmploc.DLL
2014-10-15 03:55 - 2014-07-06 18:05 - 00126464 _____ (Microsoft Corporation) C:\Windows\System32\audiodg.exe
2014-10-15 03:55 - 2014-07-06 18:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\mferror.dll
2014-10-15 03:55 - 2014-07-06 17:40 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2014-10-15 03:55 - 2014-07-06 17:40 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2014-10-15 03:55 - 2014-07-06 17:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2014-10-15 03:55 - 2014-07-06 17:40 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2014-10-15 03:55 - 2014-07-06 17:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2014-10-15 03:55 - 2014-07-06 17:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2014-10-15 03:55 - 2014-07-06 17:39 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2014-10-15 03:55 - 2014-07-06 17:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2014-10-15 03:55 - 2014-07-06 17:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2014-10-15 03:55 - 2014-07-06 17:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2014-10-15 03:53 - 2014-09-17 18:00 - 03241472 _____ (Microsoft Corporation) C:\Windows\System32\msi.dll
2014-10-15 03:53 - 2014-09-17 17:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-15 03:53 - 2014-09-03 21:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\rastls.dll
2014-10-15 03:53 - 2014-09-03 21:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-15 03:53 - 2014-07-16 18:07 - 03722240 _____ (Microsoft Corporation) C:\Windows\System32\mstscax.dll
2014-10-15 03:53 - 2014-07-16 18:07 - 01118720 _____ (Microsoft Corporation) C:\Windows\System32\mstsc.exe
2014-10-15 03:53 - 2014-07-16 18:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\System32\termsrv.dll
2014-10-15 03:53 - 2014-07-16 18:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\System32\winlogon.exe
2014-10-15 03:53 - 2014-07-16 18:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\System32\winsta.dll
2014-10-15 03:53 - 2014-07-16 18:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2014-10-15 03:53 - 2014-07-16 18:07 - 00086528 _____ (Microsoft Corporation) C:\Windows\System32\TSpkg.dll
2014-10-15 03:53 - 2014-07-16 18:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\System32\credssp.dll
2014-10-15 03:53 - 2014-07-16 17:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2014-10-15 03:53 - 2014-07-16 17:39 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-15 03:53 - 2014-07-16 17:39 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-10-15 03:53 - 2014-07-16 17:39 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2014-10-15 03:53 - 2014-07-16 17:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-10-15 03:53 - 2014-07-16 17:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-10-15 03:53 - 2014-07-16 17:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2014-10-15 03:53 - 2014-07-16 17:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tssecsrv.sys
2014-10-15 03:52 - 2014-09-12 17:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\System32\packager.dll
2014-10-15 03:52 - 2014-09-12 17:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-14 04:27 - 2014-10-14 04:27 - 00001148 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-10-02 05:54 - 2014-10-02 05:54 - 00000000 ____D () C:\Users\Tobias\AppData\Local\Adobe
2014-09-30 16:16 - 2014-09-24 18:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\System32\qdvd.dll
2014-09-30 16:15 - 2014-09-24 17:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2014-09-24 03:37 - 2014-09-09 14:11 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\tzres.dll
2014-09-24 03:37 - 2014-09-09 13:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-21 16:17 - 2009-07-13 21:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-21 16:17 - 2009-07-13 20:51 - 00042549 _____ () C:\Windows\setupact.log
2014-10-20 05:10 - 2009-07-13 21:08 - 00030090 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-10-18 15:50 - 2014-08-07 12:09 - 01470611 _____ () C:\Windows\WindowsUpdate.log
2014-10-18 15:23 - 2014-08-14 11:29 - 00000000 ____D () C:\Users\Tobias\Desktop\FM 13
2014-10-18 03:29 - 2009-07-13 20:45 - 00027344 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-18 03:29 - 2009-07-13 20:45 - 00027344 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-18 03:26 - 2012-07-18 12:31 - 00001839 _____ () C:\Users\Public\Desktop\McAfee Internet Security.lnk
2014-10-18 03:20 - 2014-09-04 08:43 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-10-18 03:20 - 2014-08-07 12:13 - 00000828 _____ () C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
2014-10-17 08:38 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\rescache
2014-10-17 07:07 - 2014-08-07 12:13 - 00000830 _____ () C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
2014-10-17 02:34 - 2014-08-08 06:45 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-10-16 03:46 - 2009-07-13 21:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-10-16 03:37 - 2009-07-13 20:45 - 00267816 _____ () C:\Windows\System32\FNTCACHE.DAT
2014-10-16 03:35 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-10-16 03:35 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\System32\Dism
2014-10-16 03:34 - 2014-08-14 16:27 - 00000000 ___SD () C:\Windows\System32\CompatTel
2014-10-14 04:27 - 2014-08-08 06:49 - 00000000 ____D () C:\ProgramData\Package Cache
2014-10-14 04:27 - 2014-08-08 06:49 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-10-09 03:35 - 2014-08-14 05:33 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avnetflt.sys
2014-10-09 03:35 - 2014-08-08 06:52 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avipbb.sys
2014-10-09 03:35 - 2014-08-08 06:52 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avgntflt.sys
2014-10-03 03:45 - 2012-07-18 12:22 - 00000000 ____D () C:\ProgramData\Adobe
2014-10-02 05:54 - 2014-08-08 06:42 - 00000000 ____D () C:\Users\Tobias\AppData\Roaming\Adobe

Some content of TEMP:
====================
C:\Users\Tobias\AppData\Local\Temp\AutoEdManager14.exe
C:\Users\Tobias\AppData\Local\Temp\avgnt.exe


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe
[2014-10-15 03:53] - [2014-07-16 18:07] - 0455168 ____A (Microsoft Corporation) 8CEBD9D0A0A879CDE9F36F4383B7CAEA

C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe
[2012-07-18 11:25] - [2011-02-24 21:30] - 2616320 ____A (Microsoft Corporation) D3C99E3246526F5C6FE3F24140417FCC

C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE Association (whitelisted) =============


==================== Restore Points  =========================

Restore point made on: 2014-09-25 14:22:53
Restore point made on: 2014-09-30 16:44:36
Restore point made on: 2014-10-15 15:44:54
Restore point made on: 2014-10-17 08:27:32

==================== BCD ================================

Windows-Start-Manager
---------------------
Bezeichner              {bootmgr}
device                  partition=D:
description            Windows Boot Manager
locale                  de-DE
inherit                {globalsettings}
default                {default}
resumeobject            {820d687d-1e76-11e4-bbdd-de2d040e4fc4}
displayorder            {default}
toolsdisplayorder      {memdiag}
timeout                30

Windows-Startladeprogramm
-------------------------
Bezeichner              {default}
device                  partition=C:
path                    \windows\system32\winload.exe
description            Windows 7
locale                  de-DE
inherit                {bootloadersettings}
recoverysequence        {current}
recoveryenabled        Yes
osdevice                partition=C:
systemroot              \windows
resumeobject            {820d687d-1e76-11e4-bbdd-de2d040e4fc4}
nx                      OptIn

Windows-Startladeprogramm
-------------------------
Bezeichner              {current}
device                  ramdisk=[D:]\Recovery\WindowsRE\Winre.wim,{bd26526c-1f08-11e4-821b-7c05078e5918}
path                    \windows\system32\winload.exe
description            Windows Recovery Environment
inherit                {bootloadersettings}
osdevice                ramdisk=[D:]\Recovery\WindowsRE\Winre.wim,{bd26526c-1f08-11e4-821b-7c05078e5918}
systemroot              \windows
nx                      OptIn
winpe                  Yes

Wiederaufnahme aus dem Ruhezustand
----------------------------------
Bezeichner              {820d687d-1e76-11e4-bbdd-de2d040e4fc4}
device                  partition=C:
path                    \windows\system32\winresume.exe
description            Windows Resume Application
locale                  de-DE
inherit                {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
debugoptionenabled      No

Windows-Speichertestprogramm
----------------------------
Bezeichner              {memdiag}
device                  partition=D:
path                    \boot\memtest.exe
description            Windows Memory Diagnostic
locale                  de-DE
inherit                {globalsettings}
badmemoryaccess        Yes

EMS-Einstellungen
-----------------
Bezeichner              {emssettings}
bootems                Yes

Debuggereinstellungen
---------------------
Bezeichner              {dbgsettings}
debugtype              Serial
debugport              1
baudrate                115200

RAM-Defekte
-----------
Bezeichner              {badmemory}

Globale Einstellungen
---------------------
Bezeichner              {globalsettings}
inherit                {dbgsettings}
                        {emssettings}
                        {badmemory}

Startladeprogramm-Einstellungen
-------------------------------
Bezeichner              {bootloadersettings}
inherit                {globalsettings}
                        {hypervisorsettings}

Hypervisoreinstellungen
-------------------
Bezeichner              {hypervisorsettings}
hypervisordebugtype    Serial
hypervisordebugport    1
hypervisorbaudrate      115200

Einstellungen zur Ladeprogrammfortsetzung
-----------------------------------------
Bezeichner              {resumeloadersettings}
inherit                {globalsettings}

Ger„teoptionen
--------------
Bezeichner              {bd26526c-1f08-11e4-821b-7c05078e5918}
description            Ramdisk Options
ramdisksdidevice        partition=D:
ramdisksdipath          \Recovery\WindowsRE\boot.sdi


==================== Memory info ===========================

Percentage of memory in use: 14%
Total physical RAM: 6027.3 MB
Available physical RAM: 5130.45 MB
Total Pagefile: 6025.5 MB
Available Pagefile: 5215.25 MB
Total Virtual: 8192 MB
Available Virtual: 8191.87 MB

==================== Drives ================================

Drive c: (TI30946800B) (Fixed) (Total:685.21 GB) (Free:609.57 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (System) (Fixed) (Total:1.46 GB) (Free:1.22 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: () (Removable) (Total:0.49 GB) (Free:0.49 GB) FAT
Drive x: (Boot) (Fixed) (Total:0.12 GB) (Free:0.12 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 698.6 GB) (Disk ID: 6D52EFE7)
Partition 1: (Active) - (Size=1.5 GB) - (Type=27)
Partition 2: (Not Active) - (Size=685.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=12 GB) - (Type=17)

========================================================
Disk: 1 (Size: 504.1 MB) (Disk ID: 0020CECD)
Partition 1: (Active) - (Size=504 MB) - (Type=06)


LastRegBack: 2014-10-17 08:19

==================== End Of Log ============================
--- --- ---

--- --- ---


Zudem erschienen diese drei Bilder während des ersten durchlaufes, da diese Datein beschädigt sind laut dem Scan.

hxxp://www.directupload.net/file/d/3783/khrsab69_jpg.htm
hxxp://www.directupload.net/file/d/3783/34ilixow_jpg.htm
hxxp://www.directupload.net/file/d/3783/c9v5ndsa_jpg.htm

schrauber 22.10.2014 19:27
Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
cmd: ren C:\Windows\SysWOW64\explorer.exe explorer.exe.vir
cmd: copy C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe C:\Windows\SysWOW64 /f
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Tobinho09 22.10.2014 23:02
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 20-10-2014 01
Ran by SYSTEM at 2014-10-22 23:54:30 Run:1
Running from g:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
cmd: ren C:\Windows\SysWOW64\explorer.exe explorer.exe.vir
cmd: copy C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe C:\Windows\SysWOW64 /f
*****************


=========  ren C:\Windows\SysWOW64\explorer.exe explorer.exe.vir =========


========= End of CMD: =========


=========  copy C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe C:\Windows\SysWOW64 /f =========

Syntaxfehler.

========= End of CMD: =========


==== End of Fixlog ====

schrauber 23.10.2014 19:40
Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
cmd: copy C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe C:\Windows\SysWOW64
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Tobinho09 23.10.2014 20:36
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 20-10-2014 01
Ran by SYSTEM at 2014-10-23 21:35:06 Run:2
Running from g:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
cmd: copy C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe C:\Windows\SysWOW64
       
*****************


=========  copy C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe C:\Windows\SysWOW64 =========

        1 Datei(en) kopiert.

========= End of CMD: =========


==== End of Fixlog ====

schrauber 24.10.2014 16:27
Startet der Rechner normal?

Tobinho09 24.10.2014 17:56
Zitat:
Zitat von schrauber (Beitrag 1375759)
Startet der Rechner normal?
Nein. Nachdem ich den Laptop anmache kommt der Bildschirm auf dem ich entweder "Windows normal starten" oder einen der abgesicherten Modi anklicken muss.

Wenn ich auf "Windows normal starten" klicke, dauert alles länger als normal, ich kann mein PW eingeben und nach extrem langer Ladezeit erscheint erst "Willkommen" und danach " Desktop wird vorbereitet.." aber es lädt extrem lange und dann kommt einfach ein schwarzer Bildschirm
Wähle ich einen der abgesicherten Modi, passiert das was ich im ersten Post dieses Themas schon beschrieben habe.
Also z.b. bei "abgesicherter Modus" kann ich mich anmelden unter allerdings schlechterer Bildqualität aber es kommt dann die Meldung auf meinem Desktop " Windows muss beendet werden da der Dienst Stromversorung unerwaret beendet wurde". Danach fährt sich Windows selber runter, allerdings bleibt der Bildschirm danach schwarz und man sieht nur die Maus, also der Laptop läuft noch.

Wenn du bei der ein oder anderen Sachen nicht genau weißt was ich meine kann ich auch Bilder hochladen.
Oder was meintest du mit startet der Rechner normal ?

schrauber 25.10.2014 14:26
Dann bitte ein frisches FRST Log aus der Recovery.


Alle Zeitangaben in WEZ +1. Es ist jetzt 21:23 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131