Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-02-2015 01
Ran by SYSTEM on MININT-D24MQFS on 04-02-2015 23:10:31
Running from f:\
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Recovery

The current controlset is ControlSet002
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2588968 2010-11-12] (ELAN Microelectronics Corp.)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [615584 2011-01-20] (Atheros Communications)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [379552 2011-01-20] (Atheros Commnucations)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11860072 2011-06-09] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2226280 2011-06-03] (Realtek Semiconductor)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-02-18] (Intel Corporation)
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [976320 2009-12-03] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-09-15] (AVAST Software)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-05-26] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\sakir\...\Run: [EPSON18D166 (Epson Stylus SX420W)] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGCE.EXE [224768 2009-09-14] (SEIKO EPSON CORPORATION)
HKU\sakir\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKU\UpdatusUser\...\Run: [EPSON18D166 (Epson Stylus SX420W)] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGCE.EXE [224768 2009-09-14] (SEIKO EPSON CORPORATION)
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll File Not Found
AppInit_DLLs:  C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [260416 2012-02-10] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\progra~2\searchprotect\searchprotect\bin\spvc32loader.dll => "c:\progra~2\searchprotect\searchprotect\bin\spvc32loader.dll" File Not Found
AppInit_DLLs-x32:  c:\windows\syswow64\nvinit.dll => c:\windows\syswow64\nvinit.dll [215360 2012-02-10] (NVIDIA Corporation)

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-09-15] (AVAST Software)
S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 Util MossNet; "C:\Program Files (x86)\MossNet\bin\utilMossNet.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-09-15] ()
S1 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [22600 2013-03-07] (AVAST Software)
S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-09-15] (AVAST Software)
S1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-09-15] (AVAST Software)
S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-09-15] ()
S1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-11-21] (AVAST Software)
S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-09-15] (AVAST Software)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-09-15] (AVAST Software)
S1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-12-19] (AVAST Software)
S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-09-15] ()
S3 Andbus; system32\DRIVERS\lgandbus64.sys [X]
S3 AndDiag; system32\DRIVERS\lganddiag64.sys [X]
S3 AndGps; system32\DRIVERS\lgandgps64.sys [X]
S3 ANDModem; system32\DRIVERS\lgandmodem64.sys [X]
S3 AndNetDiag; system32\DRIVERS\lgandnetdiag64.sys [X]
S3 ANDNetModem; system32\DRIVERS\lgandnetmodem64.sys [X]
S3 andnetndis; system32\DRIVERS\lgandnetndis64.sys [X]
S3 usbbus; system32\DRIVERS\lgx64bus.sys [X]
S3 UsbDiag; system32\DRIVERS\lgx64diag.sys [X]
S3 USBModem; system32\DRIVERS\lgx64modem.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-04 23:10 - 2015-02-04 23:10 - 00000000 ____D () C:\FRST
2015-02-04 15:40 - 2015-02-04 15:40 - 00003224 ____N () C:\bootsqm.dat
2015-02-04 07:28 - 2015-02-04 07:28 - 00000000 __SHD () C:\found.000
2015-01-26 21:05 - 2015-01-26 21:07 - 00000000 ____D () C:\Users\sakir\Desktop\Muhammet USB
2015-01-26 19:34 - 2015-01-26 19:34 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-22 09:04 - 2015-01-22 09:05 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\Mozilla
2015-01-22 09:04 - 2015-01-22 09:05 - 00000000 ____D () C:\Users\Gast\AppData\Local\Mozilla
2015-01-22 09:04 - 2015-01-22 09:04 - 00001189 _____ () C:\Users\Gast\Desktop\Mozilla Firefox.lnk
2015-01-22 09:04 - 2015-01-22 09:04 - 00000000 ____D () C:\Users\Gast\AppData\Local\Mozilla Firefox
2015-01-22 08:57 - 2015-01-22 08:57 - 00000000 __SHD () C:\Users\Gast\AppData\Local\EmieBrowserModeList
2015-01-14 08:06 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\System32\profsvc.dll
2015-01-14 08:06 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\mrxdav.sys
2015-01-14 08:06 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2015-01-14 08:06 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\System32\srcore.dll
2015-01-14 08:06 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\System32\rstrui.exe
2015-01-14 08:06 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\System32\srclient.dll
2015-01-14 08:06 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 08:06 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 08:06 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-14 08:06 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\System32\TSWbPrxy.exe
2015-01-14 08:06 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\System32\nlasvc.dll
2015-01-14 08:06 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-14 08:06 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-04 06:49 - 2013-02-15 23:26 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-04 06:49 - 2012-03-05 16:10 - 01161396 _____ () C:\Windows\WindowsUpdate.log
2015-02-04 02:03 - 2012-03-07 13:29 - 00000000 ____D () C:\Users\sakir\AppData\Local\CrashDumps
2015-02-03 22:55 - 2012-03-06 00:31 - 00000035 _____ () C:\Users\Public\Documents\AtherosServiceConfig.ini
2015-02-03 22:55 - 2012-03-06 00:31 - 00000035 _____ () C:\ProgramData\Documents\AtherosServiceConfig.ini
2015-02-03 19:49 - 2009-07-14 05:45 - 00028944 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-03 19:49 - 2009-07-14 05:45 - 00028944 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-03 19:40 - 2014-05-11 21:01 - 00022344 _____ () C:\Windows\setupact.log
2015-02-03 19:40 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-29 09:30 - 2011-04-12 08:43 - 00701122 _____ () C:\Windows\System32\perfh007.dat
2015-01-29 09:30 - 2011-04-12 08:43 - 00150590 _____ () C:\Windows\System32\perfc007.dat
2015-01-29 09:30 - 2009-07-14 06:13 - 01625696 _____ () C:\Windows\System32\PerfStringBackup.INI
2015-01-28 23:03 - 2014-09-13 19:28 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-28 07:00 - 2012-07-13 05:38 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-01-24 22:15 - 2013-02-15 23:26 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-24 22:15 - 2013-02-15 23:26 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-24 22:15 - 2013-02-15 23:26 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-15 03:04 - 2013-08-15 11:42 - 00000000 ____D () C:\Windows\System32\MRT
2015-01-15 03:00 - 2012-03-06 00:17 - 113365784 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2015-01-06 04:36 - 2010-11-21 04:27 - 00298120 ____N (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe

Some content of TEMP:
====================
C:\Users\sakir\AppData\Local\Temp\nst9239.tmp.exe
C:\Users\sakir\AppData\Local\Temp\oi_{4BEAD2B9-38CB-4D53-BF21-7A8CAE9DE849}.exe
C:\Users\sakir\AppData\Local\Temp\pcspeedup.exe
C:\Users\sakir\AppData\Local\Temp\safeguard.exe
C:\Users\sakir\AppData\Local\Temp\SHSetup.exe
C:\Users\sakir\AppData\Local\Temp\SpOrder.dll
C:\Users\sakir\AppData\Local\Temp\tmp126A.exe
C:\Users\sakir\AppData\Local\Temp\UNINSTALL.EXE
C:\Users\sakir\AppData\Local\Temp\VOPackage.exe


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points  =========================

Restore point made on: 2015-01-15 03:00:33
Restore point made on: 2015-01-20 06:53:55
Restore point made on: 2015-01-23 21:15:13
Restore point made on: 2015-01-27 18:05:59
Restore point made on: 2015-02-03 13:44:57

==================== Memory info =========================== 

Percentage of memory in use: 10%
Total physical RAM: 8043.86 MB
Available physical RAM: 7190.97 MB
Total Pagefile: 8042.06 MB
Available Pagefile: 7182.87 MB
Total Virtual: 8192 MB
Available Virtual: 8191.89 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:596.07 GB) (Free:487.89 GB) NTFS
Drive f: () (Removable) (Total:7.45 GB) (Free:7.45 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596.2 GB) (Disk ID: 099EA0F8)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=596.1 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 7.5 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.


LastRegBack: 2015-01-24 14:58

==================== End Of Log ============================
         

hi,

Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

LastRegBack: 2015-01-24 14:58
         

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

• Starte deinen Rechner erneut in die Reparaturoptionen
• Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

windows fährt nicht einmal hoch wie soll ich windowstaste und R drücken ???

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 04-02-2015 01
Ran by SYSTEM at 2015-02-05 08:32:14 Run:1
Running from f:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
LastRegBack: 2015-01-24 14:58
*****************

DEFAULT hive was successfully copied to System32\config\HiveBackup
DEFAULT hive was successfully restored from registry back up.
SAM hive was successfully copied to System32\config\HiveBackup
SAM hive was successfully restored from registry back up.
SECURITY hive was successfully copied to System32\config\HiveBackup
SECURITY hive was successfully restored from registry back up.
SOFTWARE hive was successfully copied to System32\config\HiveBackup
SOFTWARE hive was successfully restored from registry back up.
SYSTEM hive was successfully copied to System32\config\HiveBackup
SYSTEM hive was successfully restored from registry back up.

==== End of Fixlog 08:32:21 ====
         

wie geht es jetzt weiter???

Starte den Rechner normal, geht das? Wenn nein, kommst Du in einen der abgesicherten Modi?