Trojaner-Board - kein Programm ausführbar - von cracksbeforesoft.com Trojaner eingefangen

Hallo Rafael,
danke dass Du Dich der Sache angenommen hast.
Schritt 1 war durchführbar, Schritt 2 nur teilweise, da a) das System nicht mehr startet und b) FRST64.exe nun leider kein Feld "Addition" mehr zeigt, bei dem ich ein Häkchen setzen könnte. Ich habe das System auf zwei Wegen gestartet, um jeweils FRST64.exe aufzurufen: zum Einen über die Boot-Festplatte und .. Reparatur... und zum Anderen über einen bootfähigen USB-Stick. Der Bluescreen, der nur sehr kurz aufleuchtet, zeigt den Fehler STOP 0x0000007B (0xFFFFF880009A97E8,0xFFFFFFFFC0000032,0x00000000000000000000,0x000000000000000). "Die Starthilfe kann diesen Comouter nicht automatisch reparieren.
Prob.ergebnisname: StartupRepairOffline
Prog.signatur 01: 6.1.7600.16385
Prog.signatur 02: 6.1.7600.16385
Prog.signatur 03: unknown
Prog.signatur 04: 21199847
Prog.signatur 05: AutoFailure
Prog.signatur 06: 2
Prog.signatur 07: NoRootCause

Code:

Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version: 11-09-2017

durchgeführt von Christof (11-09-2017 11:11:12) Run:1

Gestartet von C:\

Geladene Profile: Christof (Verfügbare Profile: Christof & User Christof)

Start-Modus: Normal

==============================================
 

fixlist Inhalt:

*****************

HKLM\...\Run: [CIS_{15198508-521A-4D69-8E5B-B94A6CCFF805}] => N:\___X___privat\Users\Christof\Temp\cisE6F5.exe [4784320 2017-07-11] (COMODO) <==== ACHTUNG

HKLM\...\Run: [CIS_{81EFDD93-DBBE-415B-BE6E-49B9664E3E82}] => N:\___X___privat\Users\Christof\Temp\cisE6F5.exe [4784320 2017-07-11] (COMODO) <==== ACHTUNG

HKU\S-1-5-21-1189399255-3111976695-777185122-1000\...\Run: [AdobeBridge] => [X]

HKU\S-1-5-21-1189399255-3111976695-777185122-1000\...\Run: [5A24AF1BB6692B53B42885961B3FD56D02CCC299._service_run] => "C:\Program Files (x86)\Comodo\Dragon\dragon.exe" --type=service /prefetch:8

HKU\S-1-5-21-1189399255-3111976695-777185122-1000\...\RunOnce: [Application Restart #0] => C:\Windows\System32\ctfmon.exe ctfmon.exe

HKU\S-1-5-21-1189399255-3111976695-777185122-1000\...\RunOnce: [Application Restart #1] => C:\Program Files (x86)\Comodo\Dragon\dragon.exe --flag-switches-begin --flag-switches-end --restore-last-session

HKU\S-1-5-21-1189399255-3111976695-777185122-1000\...\MountPoints2: {23ba9b58-8b07-11e2-9e9f-60a44c37bf9c} - G:\AUTORUN.EXE

ProxyServer: [S-1-5-21-1189399255-3111976695-777185122-1000] => localhost:8080

hosts:

S4 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe [X]

S2 COSService.exe; C:\Program Files\COMODO\COMMON\COSService.exe [X]

S2 SynchronizationService.exe; C:\Program Files\COMODO\COMMON\SynchronizationService.exe [X]

R0 bdisk; C:\Windows\System32\drivers\bdisk.sys [85488 2014-10-07] (COMODO Security Solutions Inc.)

C:\Windows\System32\drivers\bdisk.sys

R0 CBUfs; C:\Windows\System32\drivers\CBUFS.sys [230712 2014-10-07] (COMODO Security Solutions Inc.)

C:\Windows\System32\drivers\CBUFS.sys

R0 cbvd; C:\Windows\System32\DRIVERS\cbvd.sys [677744 2014-10-07] (COMODO Security Solutions Inc.)

C:\Windows\System32\DRIVERS\cbvd.sys

R0 reparse; C:\Windows\System32\DRIVERS\cbreparse.sys [674160 2014-10-07] (COMODO Security Solutions Inc.)

C:\Windows\System32\DRIVERS\cbreparse.sys

R3 vdbus; C:\Windows\System32\DRIVERS\vdbus.sys [826040 2015-11-28] (COMODO Security Solutions Inc.)

C:\Windows\System32\DRIVERS\vdbus.sys

N:\___X___privat\Users\Christof\Temp\cisE6F5.exe

ShellIconOverlayIdentifiers: [COSDriveIconOverlay] -> {5FDACB62-6B7B-4116-9403-C5E0D3852A57} => C:\Program Files\COMODO\COMMON\ShellExtension.dll -> Keine Datei

ShellIconOverlayIdentifiers: [COSSyncItemInSyncIconOverlay] -> {68F287EF-DA6D-4595-AF52-90FF6CE52AFE} => C:\Program Files\COMODO\COMMON\ShellExtension.dll -> Keine Datei

ShellIconOverlayIdentifiers: [COSSyncItemModifiedIconOverlay] -> {AE67D273-7253-4236-B55E-D40055B305D6} => C:\Program Files\COMODO\COMMON\ShellExtension.dll -> Keine Datei

ShellIconOverlayIdentifiers: [COSSyncItemNewIconOverlay] -> {022F23E9-DA0F-4A86-A728-CAF6150C0B63} => C:\Program Files\COMODO\COMMON\ShellExtension.dll -> Keine Datei

ContextMenuHandlers1: [COMODOBackupUtility] -> {FA66022E-2FE4-4A29-916C-84A0D8173FBB} => C:\Program Files\COMODO\COMMON\ShellExtension.dll -> Keine Datei

ContextMenuHandlers2: [COMODOBackupUtility] -> {FA66022E-2FE4-4A29-916C-84A0D8173FBB} => C:\Program Files\COMODO\COMMON\ShellExtension.dll -> Keine Datei

ContextMenuHandlers4: [COMODOBackupUtility] -> {FA66022E-2FE4-4A29-916C-84A0D8173FBB} => C:\Program Files\COMODO\COMMON\ShellExtension.dll -> Keine Datei

Task: {0513A333-844E-475E-8E46-91CAD30B68ED} - System32\Tasks\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe

Task: {0A2492F5-37D6-44A2-8CEA-EA97C98EBC7B} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe

Task: {52D7A783-5001-472F-A8A2-88E453B9489A} - System32\Tasks\COMODO\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe

Task: {5F00A8FB-046B-4D48-9AEE-7FDC0BC25F76} - System32\Tasks\COMODO\COMODO CMC {06A09C0F-DD9C-4191-A670-71115CD78627} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe

Task: {6FCB36AB-2F31-4141-87EC-2B66E64FC454} - System32\Tasks\CBU taskID 13140619000685 2 => C:\Program Files\COMODO\COMODO BackUp\CBU.exe

Task: {98E1C0CC-24D7-4FA6-8546-7B28FA89EFF1} - System32\Tasks\COMODO\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe

Task: {E887A0E3-70BE-4DD3-9522-B1DA9FA64FAB} - System32\Tasks\COMODO\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe

Task: C:\Windows\Tasks\CBU taskID 13140619000685 2.job => C:\Program Files\COMODO\COMODO BackUp\CBU.exe

Task: C:\Windows\Tasks\CIS_{15198508-521A-4D69-8E5B-B94A6CCFF805}.job => N:\___X___privat\Users\Christof\Temp\cisE6F5.exe <==== ACHTUNG

Task: C:\Windows\Tasks\CIS_{81EFDD93-DBBE-415B-BE6E-49B9664E3E82}.job => N:\___X___privat\Users\Christof\Temp\cisE6F5.exe <==== ACHTUNG

FirewallRules: [{1ED19697-AC0A-4533-8FCC-2DCA4E2339EE}] => (Allow) C:\Program Files (x86)\Common Files\Comodo\GeekBuddyRSP.exe

FirewallRules: [{F2C3C3E7-C9E9-459F-BFA3-EDD440A26990}] => (Allow) C:\Program Files (x86)\Common Files\Comodo\GeekBuddyRSP.exe

C:\Program Files (x86)\Comodo

C:\Program Files\COMODO

C:\ProgramData\COMODO

C:\Users\Christof\AppData\Roaming\Comodo

         

*****************
 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\CIS_{15198508-521A-4D69-8E5B-B94A6CCFF805} => Wert erfolgreich entfernt

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\CIS_{81EFDD93-DBBE-415B-BE6E-49B9664E3E82} => Wert erfolgreich entfernt

HKU\S-1-5-21-1189399255-3111976695-777185122-1000\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge => Wert erfolgreich entfernt

HKU\S-1-5-21-1189399255-3111976695-777185122-1000\Software\Microsoft\Windows\CurrentVersion\Run\\5A24AF1BB6692B53B42885961B3FD56D02CCC299._service_run => Wert erfolgreich entfernt

HKU\S-1-5-21-1189399255-3111976695-777185122-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Application Restart #0 => Wert nicht gefunden.

HKU\S-1-5-21-1189399255-3111976695-777185122-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Application Restart #1 => Wert nicht gefunden.

HKU\S-1-5-21-1189399255-3111976695-777185122-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{23ba9b58-8b07-11e2-9e9f-60a44c37bf9c} => Schlüssel erfolgreich entfernt

HKLM\Software\Classes\CLSID\{23ba9b58-8b07-11e2-9e9f-60a44c37bf9c} => Schlüssel nicht gefunden. 

HKU\S-1-5-21-1189399255-3111976695-777185122-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => Wert erfolgreich entfernt

C:\Windows\System32\Drivers\etc\hosts => erfolgreich verschoben

Hosts erfolgreich wiederhergestellt.

HKLM\System\CurrentControlSet\Services\asComSvc => Schlüssel erfolgreich entfernt

asComSvc => Dienst erfolgreich entfernt

HKLM\System\CurrentControlSet\Services\COSService.exe => Schlüssel erfolgreich entfernt

COSService.exe => Dienst erfolgreich entfernt

HKLM\System\CurrentControlSet\Services\SynchronizationService.exe => Schlüssel erfolgreich entfernt

SynchronizationService.exe => Dienst erfolgreich entfernt

bdisk => Dienst konnte nicht gestoppt werden.

HKLM\System\CurrentControlSet\Services\bdisk => Schlüssel erfolgreich entfernt

bdisk => Dienst erfolgreich entfernt

C:\Windows\System32\drivers\bdisk.sys => erfolgreich verschoben

CBUfs => Dienst erfolgreich gestoppt.

HKLM\System\CurrentControlSet\Services\CBUfs => Schlüssel erfolgreich entfernt

CBUfs => Dienst erfolgreich entfernt

C:\Windows\System32\drivers\CBUFS.sys => erfolgreich verschoben

cbvd => Dienst erfolgreich gestoppt.

HKLM\System\CurrentControlSet\Services\cbvd => Schlüssel erfolgreich entfernt

cbvd => Dienst erfolgreich entfernt

C:\Windows\System32\DRIVERS\cbvd.sys => erfolgreich verschoben

reparse => Dienst erfolgreich gestoppt.

HKLM\System\CurrentControlSet\Services\reparse => Schlüssel erfolgreich entfernt

reparse => Dienst erfolgreich entfernt

C:\Windows\System32\DRIVERS\cbreparse.sys => erfolgreich verschoben

vdbus => Dienst konnte nicht gestoppt werden.

HKLM\System\CurrentControlSet\Services\vdbus => Schlüssel erfolgreich entfernt

vdbus => Dienst erfolgreich entfernt

C:\Windows\System32\DRIVERS\vdbus.sys => erfolgreich verschoben

N:\___X___privat\Users\Christof\Temp\cisE6F5.exe => erfolgreich verschoben

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\COSDriveIconOverlay => Schlüssel erfolgreich entfernt

HKLM\Software\Classes\CLSID\{5FDACB62-6B7B-4116-9403-C5E0D3852A57} => Schlüssel erfolgreich entfernt

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\COSSyncItemInSyncIconOverlay => Schlüssel erfolgreich entfernt

HKLM\Software\Classes\CLSID\{68F287EF-DA6D-4595-AF52-90FF6CE52AFE} => Schlüssel erfolgreich entfernt

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\COSSyncItemModifiedIconOverlay => Schlüssel erfolgreich entfernt

HKLM\Software\Classes\CLSID\{AE67D273-7253-4236-B55E-D40055B305D6} => Schlüssel erfolgreich entfernt

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\COSSyncItemNewIconOverlay => Schlüssel erfolgreich entfernt

HKLM\Software\Classes\CLSID\{022F23E9-DA0F-4A86-A728-CAF6150C0B63} => Schlüssel erfolgreich entfernt

HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers\COMODOBackupUtility => Schlüssel erfolgreich entfernt

HKLM\Software\Classes\CLSID\{FA66022E-2FE4-4A29-916C-84A0D8173FBB} => Schlüssel erfolgreich entfernt

HKLM\Software\Classes\Drive\ShellEx\ContextMenuHandlers\COMODOBackupUtility => Schlüssel erfolgreich entfernt

HKLM\Software\Classes\CLSID\{FA66022E-2FE4-4A29-916C-84A0D8173FBB} => Schlüssel nicht gefunden. 

HKLM\Software\Classes\Directory\ShellEx\ContextMenuHandlers\COMODOBackupUtility => Schlüssel erfolgreich entfernt

HKLM\Software\Classes\CLSID\{FA66022E-2FE4-4A29-916C-84A0D8173FBB} => Schlüssel nicht gefunden. 

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{0513A333-844E-475E-8E46-91CAD30B68ED} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0513A333-844E-475E-8E46-91CAD30B68ED} => Schlüssel erfolgreich entfernt

C:\Windows\System32\Tasks\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} => erfolgreich verschoben

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{0A2492F5-37D6-44A2-8CEA-EA97C98EBC7B} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0A2492F5-37D6-44A2-8CEA-EA97C98EBC7B} => Schlüssel erfolgreich entfernt

C:\Windows\System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => erfolgreich verschoben

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{52D7A783-5001-472F-A8A2-88E453B9489A} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{52D7A783-5001-472F-A8A2-88E453B9489A} => Schlüssel erfolgreich entfernt

C:\Windows\System32\Tasks\COMODO\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} => erfolgreich verschoben

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\COMODO\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5F00A8FB-046B-4D48-9AEE-7FDC0BC25F76} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5F00A8FB-046B-4D48-9AEE-7FDC0BC25F76} => Schlüssel erfolgreich entfernt

C:\Windows\System32\Tasks\COMODO\COMODO CMC {06A09C0F-DD9C-4191-A670-71115CD78627} => erfolgreich verschoben

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\COMODO\COMODO CMC {06A09C0F-DD9C-4191-A670-71115CD78627} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{6FCB36AB-2F31-4141-87EC-2B66E64FC454} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6FCB36AB-2F31-4141-87EC-2B66E64FC454} => Schlüssel erfolgreich entfernt

C:\Windows\System32\Tasks\CBU taskID 13140619000685 2 => erfolgreich verschoben

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\CBU taskID 13140619000685 2 => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{98E1C0CC-24D7-4FA6-8546-7B28FA89EFF1} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{98E1C0CC-24D7-4FA6-8546-7B28FA89EFF1} => Schlüssel erfolgreich entfernt

C:\Windows\System32\Tasks\COMODO\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9} => erfolgreich verschoben

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\COMODO\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E887A0E3-70BE-4DD3-9522-B1DA9FA64FAB} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E887A0E3-70BE-4DD3-9522-B1DA9FA64FAB} => Schlüssel erfolgreich entfernt

C:\Windows\System32\Tasks\COMODO\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22} => erfolgreich verschoben

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\COMODO\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22} => Schlüssel erfolgreich entfernt

C:\Windows\Tasks\CBU taskID 13140619000685 2.job => erfolgreich verschoben

C:\Windows\Tasks\CIS_{15198508-521A-4D69-8E5B-B94A6CCFF805}.job => erfolgreich verschoben

C:\Windows\Tasks\CIS_{81EFDD93-DBBE-415B-BE6E-49B9664E3E82}.job => erfolgreich verschoben

HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{1ED19697-AC0A-4533-8FCC-2DCA4E2339EE} => Wert erfolgreich entfernt

HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{F2C3C3E7-C9E9-459F-BFA3-EDD440A26990} => Wert erfolgreich entfernt

"C:\Program Files (x86)\Comodo" => nicht gefunden.

"C:\Program Files\COMODO" => nicht gefunden.

C:\ProgramData\COMODO => erfolgreich verschoben

C:\Users\Christof\AppData\Roaming\Comodo => erfolgreich verschoben
 
 

Das System musste neu gestartet werden.
 

==== Ende von Fixlog 11:11:31 ====

und

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 11-09-2017

Ran by SYSTEM on MININT-IBCO2IT (11-09-2017 12:05:44)

Running from C:\

Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: Englisch (USA)

Internet Explorer Version 11

Boot Mode: Recovery

Default: ControlSet001
 ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.
 

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Registry (Whitelisted) ====================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2398776 2016-09-16] (NVIDIA Corporation)

HKLM\...\Run: [ShadowPlay] => "C:\Windows\system32\rundll32.exe" C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart

HKLM\...\Run: [CANON P150 SVC] => rundll32.exe P150SVC.dll,EntryPointUserMessage

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [303928 2017-05-08] (Apple Inc.)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2016-03-26] (Safer-Networking Ltd.)

HKLM-x32\...\Run: [P-150 CaptureOnTouch] => C:\Program Files (x86)\Canon Electronics\P150\TouchDR.exe [794624 2012-07-20] (Canon Electronics Inc.)

HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG)

HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)

HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [1053144 2017-06-06] (DivX, LLC)

HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)

HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41360 2015-10-17] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [3200 Scan2PC] => C:\Windows\twain_32\Samsung\SCX3200\Scan2Pc.exe [1989120 2010-05-18] ()

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-07-21] (Oracle Corporation)

HKLM-x32\...\Run: [ABNotify] => C:\Program Files (x86)\AOMEI Backupper\ABNotify.exe [80832 2016-12-06] ()

Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]

IFEO\taskmgr.exe: [Debugger] "S:\SOFTWARE\WINDOWS SYSINTERNALS\PROCESS EXPLORER ERSETZT TASKMANAGER\PROCEXP.EXE"

Startup: C:\Users\Christof\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2017-09-11]

ShortcutTarget: Dropbox.lnk ->  (No File)

Startup: C:\Users\Christof\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagentaCLOUD.lnk [2016-12-13]

ShortcutTarget: MagentaCLOUD.lnk ->  (No File)

BootExecute: autocheck autochk * sdnclean64.exe
 

==================== Services (Whitelisted) ====================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

S2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2246256 2017-05-17] (Adobe Systems, Incorporated)

S3 ALG; C:\Windows\System32\alg.exe [79360 2009-07-13] (Microsoft Corporation)

S2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2017-04-02] (Apple Inc.)

S2 ASDiskUnlocker; C:\Program Files (x86)\ASUS\Disk Unlocker\ASPFSVS64.exe [258688 2010-10-06] (ASUSTeK Computer Inc.)

S2 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe [951936 2013-03-12] (ASUSTeK Computer Inc.)

S2 Backupper Service; C:\Program Files (x86)\AOMEI Backupper\ABService.exe [56256 2016-12-06] (AOMEI Tech Co., Ltd.)

S2 EFS; C:\Windows\System32\lsass.exe [30720 2017-07-07] (Microsoft Corporation)

S2 EyeTV Netstream; C:\Program Files (x86)\Elgato\EyeTV Netstream\EyeTVNetstreamSvc.exe [400864 2016-11-14] (Elgato Systems GmbH)

S3 Fax; C:\Windows\system32\fxssvc.exe [689152 2010-11-20] (Microsoft Corporation)

S2 FreemakeVideoCapture; C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe [9216 2013-11-08] (Ellora Assets Corp.)

S2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1165368 2016-09-16] (NVIDIA Corporation)

S3 IEEtwCollectorService; C:\Windows\system32\IEEtwCollector.exe [116224 2017-07-13] (Microsoft Corporation)

S2 ImDskSvc; C:\Windows\system32\imdsksvc.exe [11776 2012-11-01] (Olof Lagerkvist)

S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [177376 2016-08-12] (Intel Corporation)

S3 KeyIso; C:\Windows\system32\lsass.exe [30720 2017-07-07] (Microsoft Corporation)

S2 KMService; C:\Windows\SysWOW64\srvany.exe [8192 2015-09-29] ()

S3 MSDTC; C:\Windows\System32\msdtc.exe [141824 2009-07-13] (Microsoft Corporation)

S3 msiserver; C:\Windows\System32\msiexec.exe [128512 2016-12-13] (Microsoft Corporation)

S3 msiserver; C:\Windows\SysWOW64\msiexec.exe [73216 2016-12-13] (Microsoft Corporation)

S3 Netlogon; C:\Windows\system32\lsass.exe [30720 2017-07-07] (Microsoft Corporation)

S2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1881144 2016-12-25] (NVIDIA Corporation)

S3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [3634232 2016-09-16] (NVIDIA Corporation)

S2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2522680 2016-09-16] (NVIDIA Corporation)

S2 PCloudd; C:\Program Files (x86)\LenovoEMC Storage Manager\pCloudd.exe [215040 2016-09-16] (LenovoEMC Ltd.)

S2 Privacy Content Firewall; C:\Program Files\AdTrustMedia\PrivDog\3.0.108.0\PrivDogService.exe [2059392 2015-03-05] (AdTrustMedia)

S3 ProtectedStorage; C:\Windows\system32\lsass.exe [30720 2017-07-07] (Microsoft Corporation)

S3 RpcLocator; C:\Windows\system32\locator.exe [10240 2009-07-13] (Microsoft Corporation)

S2 SamSs; C:\Windows\system32\lsass.exe [30720 2017-07-07] (Microsoft Corporation)

S2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [198792 2017-06-05] (Sandboxie Holdings, LLC)

S2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2016-03-26] (Safer-Networking Ltd.)

S2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [4088608 2016-09-21] (Safer-Networking Ltd.)

S2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2016-03-26] (Safer-Networking Ltd.)

S2 SkyFontsService; C:\Program Files\Monotype\SkyFonts\Monotype.SkyFonts.Service.exe [59856 2017-03-08] (Monotype Imaging Inc.)

S3 SNMPTRAP; C:\Windows\System32\snmptrap.exe [14336 2009-07-13] (Microsoft Corporation)

S2 Spooler; C:\Windows\System32\spoolsv.exe [559104 2012-02-10] (Microsoft Corporation)

S2 sppsvc; C:\Windows\system32\sppsvc.exe [3524608 2010-11-20] (Microsoft Corporation)

S3 UI0Detect; C:\Windows\system32\UI0Detect.exe [40960 2009-07-13] (Microsoft Corporation)

S3 VaultSvc; C:\Windows\system32\lsass.exe [30720 2017-07-07] (Microsoft Corporation)

S3 vds; C:\Windows\System32\vds.exe [533504 2010-11-20] (Microsoft Corporation)

S3 VSS; C:\Windows\system32\vssvc.exe [1600512 2010-11-20] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)

S2 WSearch; C:\Windows\system32\SearchIndexer.exe [591872 2017-07-14] (Microsoft Corporation)

S2 WSearch; C:\Windows\SysWOW64\SearchIndexer.exe [427520 2017-07-14] (Microsoft Corporation)
 

===================== Drivers (Whitelisted) ======================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

S1 admnfd; C:\Windows\system32\Drivers\admnfd.sys [49496 2014-12-04] (Windows (R) Win 7 DDK provider)

S0 ambakdrv; C:\Windows\System32\ambakdrv.sys [36024 2016-12-06] ()

S2 ammntdrv; C:\Windows\system32\ammntdrv.sys [156856 2016-12-06] ()

S2 amwrtdrv; C:\Windows\system32\amwrtdrv.sys [23224 2016-12-06] ()

S3 ASFLTDrv.sys; C:\Program Files (x86)\ASUS\Disk Unlocker\ASFLTDrv64.sys [16512 2010-09-16] (ASUSTeK Computer Inc.)

S1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2013-03-12] ()

S1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [14464 2012-09-14] ()

S3 AWEAlloc; C:\Windows\System32\DRIVERS\awealloc.sys [18456 2012-11-01] (Olof Lagerkvist)

S1 browserMon; C:\Windows\System32\DRIVERS\browserMon.sys [20728 2015-03-05] (Windows (R) Win 7 DDK provider)

S2 EkaProt6; C:\Windows\System32\DRIVERS\ekaprot6.sys [27288 2012-03-23] (Ekahau Inc.)

S2 ImDisk; C:\Windows\System32\DRIVERS\imdisk.sys [39464 2012-11-02] (Olof Lagerkvist)

S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [28216 2016-06-14] (NVIDIA Corporation)

S3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [56384 2016-12-25] (NVIDIA Corporation)

S3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [207496 2017-06-05] (Sandboxie Holdings, LLC)

S2 SSPORT; C:\Windows\SysWOW64\Drivers\SSPORT.sys [11576 2009-10-28] (Samsung Electronics)

S1 VDiskBus; C:\Windows\System32\DRIVERS\VDiskBus64.sys [43136 2010-09-21] (ASUSTeK Computer Inc.)

S3 vNICdrv; C:\Windows\System32\DRIVERS\vNICdrv.sys [20048 2016-09-16] (Iomega Corporation)

S2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [X]

S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [X]

S3 NPF; system32\drivers\NPF.sys [X]

S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]

S3 VGPU; System32\drivers\rdvgkmd.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 

==================== One Month Created files and folders ========
 

(If an entry is included in the fixlist, the file/folder will be moved.)
 

2017-09-11 01:11 - 2017-09-11 01:11 - 000015291 _____ C:\Fixlog.txt

2017-09-11 01:11 - 2017-09-11 01:11 - 000000000 ____D C:\FRST-OlderVersion

2017-09-08 19:18 - 2017-09-11 01:09 - 000000000 ____D C:\Users\Christof\AppData\LocalLow\Mozilla

2017-09-08 19:18 - 2017-09-08 19:18 - 000000930 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2017-09-08 19:18 - 2017-09-08 19:18 - 000000000 ____D C:\Program Files\Mozilla Firefox

2017-09-08 18:53 - 2017-09-08 19:09 - 000101407 _____ C:\Addition.txt

2017-09-08 18:44 - 2017-09-08 18:44 - 000113120 _____ C:\Users\Christof\AppData\Local\GDIPFONTCACHEV1.DAT

2017-09-08 18:42 - 2017-09-08 18:42 - 001700352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdiplus.dll

2017-09-08 18:09 - 2017-09-08 18:09 - 000327832 _____ C:\Windows\Minidump\090917-28173-01.dmp

2017-09-08 18:05 - 2017-09-08 18:05 - 000000000 ____D C:\ProgramData\Shared Space

2017-09-08 18:02 - 2017-09-08 18:02 - 000001095 _____ C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk

2017-09-08 18:02 - 2017-09-08 18:02 - 000000000 ____D C:\Users\Christof\AppData\Local\VS Revo Group

2017-09-08 18:02 - 2017-09-08 18:02 - 000000000 ____D C:\ProgramData\VS Revo Group

2017-09-08 18:02 - 2017-09-08 18:02 - 000000000 ____D C:\Program Files\VS Revo Group

2017-09-08 18:02 - 2016-12-21 04:52 - 000040240 _____ (VS Revo Group) C:\Windows\System32\Drivers\revoflt.sys

2017-09-07 15:47 - 2017-09-11 12:05 - 000000000 _____ C:\FRST.txt

2017-09-07 05:37 - 2017-09-11 01:11 - 002396672 _____ (Farbar) C:\FRST64.exe

2017-09-07 03:31 - 2017-09-07 05:21 - 000065016 _____ C:\Windows\System32\Drivers\fvstore.dat

2017-09-06 02:41 - 2017-09-06 02:41 - 000000000 ____D C:\Users\Christof\Documents\Blocks

2017-09-06 02:26 - 2017-09-06 02:26 - 000000218 _____ C:\Users\Christof\Desktop\The Lab.url

2017-09-06 02:18 - 2017-09-06 02:18 - 000000218 _____ C:\Users\Christof\Desktop\Blocks.url

2017-09-06 02:03 - 2017-09-06 02:03 - 000000000 ____D C:\ProgramData\TriDef 3D

2017-09-06 01:45 - 2017-09-06 02:49 - 000000000 ____D C:\Users\Christof\Documents\TrinusVR

2017-09-06 01:45 - 2017-09-06 01:45 - 000000000 ____D C:\Users\Christof\AppData\Local\Odd_Sheep_SL

2017-09-06 01:44 - 2017-09-06 01:44 - 000001007 _____ C:\Users\Public\Desktop\TrinusVR.lnk

2017-09-06 01:44 - 2017-09-06 01:44 - 000000000 ____D C:\Program Files (x86)\TrinusVR

2017-09-06 01:27 - 2017-09-06 01:27 - 000000000 __SHD C:\Users\Christof\AppData\Roaming\wyUpdate AU

2017-09-06 01:25 - 2017-09-11 01:06 - 000980452 _____ C:\Windows\ntbtlog.txt

2017-09-02 01:08 - 2017-09-02 01:08 - 000000000 ____D C:\Users\Christof\AppData\Roaming\MPC-HC

2017-08-18 08:24 - 2017-08-18 08:24 - 000000000 ____D C:\Users\Christof\Desktop\FRST-OlderVersion

2017-08-15 08:53 - 2017-08-15 08:53 - 000001294 _____ C:\Users\Christof\Desktop\Nutzungsart_Schule - Verknüpfung.lnk

2017-08-15 00:30 - 2017-08-15 00:30 - 000001119 _____ C:\Users\Public\Desktop\FastStone Image Viewer.lnk

2017-08-15 00:30 - 2017-08-15 00:30 - 000000000 ____D C:\Program Files (x86)\FastStone Image Viewer

2017-08-14 11:21 - 2017-08-14 11:21 - 000097856 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
 

==================== One Month Modified files and folders ========
 

(If an entry is included in the fixlist, the file/folder will be moved.)
 

2017-09-11 12:05 - 2016-12-13 00:31 - 000000000 ____D C:\FRST

2017-09-11 01:11 - 2016-12-06 22:11 - 000000000 ____D C:\Program Files (x86)\AOMEI Backupper

2017-09-11 01:11 - 2013-03-12 04:13 - 000000000 ____D C:\Windows\System32\Tasks\COMODO

2017-09-11 01:11 - 2009-07-13 20:45 - 000025824 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2017-09-11 01:11 - 2009-07-13 20:45 - 000025824 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2017-09-11 01:10 - 2013-03-12 10:57 - 000256736 _____ C:\Windows\System32\perfh007.dat

2017-09-11 01:10 - 2013-03-12 10:57 - 000090838 _____ C:\Windows\System32\perfc007.dat

2017-09-11 01:10 - 2009-07-13 21:13 - 000407740 _____ C:\Windows\System32\PerfStringBackup.INI

2017-09-11 01:10 - 2009-07-13 19:20 - 000000000 ____D C:\Windows\inf

2017-09-11 01:09 - 2013-03-12 09:54 - 000000000 ____D C:\Users\Christof\AppData\Roaming\Dropbox

2017-09-11 01:06 - 2013-03-12 10:27 - 000000148 _____ C:\Windows\setscan.ini

2017-09-11 01:04 - 2016-11-22 23:45 - 000003848 _____ C:\Windows\Sandboxie.ini

2017-09-11 01:04 - 2015-01-19 04:25 - 000000000 ____D C:\Users\Christof\AppData\Roaming\AdTrustMedia

2017-09-11 01:04 - 2014-10-16 10:42 - 000000000 ___RD C:\Users\Christof\iCloudDrive

2017-09-11 01:04 - 2014-04-18 01:15 - 000000000 ____D C:\ProgramData\Adtrustmedia

2017-09-11 01:02 - 2016-02-28 23:51 - 000000006 ____H C:\Windows\Tasks\SA.DAT

2017-09-11 01:02 - 2013-05-19 10:37 - 008405015 _____ C:\Windows\TmpFile1

2017-09-11 01:02 - 2013-03-12 03:12 - 000000000 ____D C:\ProgramData\NVIDIA

2017-09-08 19:18 - 2013-03-12 03:50 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2017-09-08 18:09 - 2014-08-14 05:46 - 000000000 ____D C:\Windows\Minidump

2017-09-08 14:16 - 2013-03-12 04:13 - 001474832 _____ C:\Windows\System32\Drivers\sfi.dat

2017-09-07 06:53 - 2016-11-07 05:09 - 000001236 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1189399255-3111976695-777185122-1000UA.job

2017-09-07 02:43 - 2013-06-21 02:47 - 000000000 ___HD C:\VTRoot

2017-09-07 00:21 - 2013-03-13 05:12 - 000000000 ____D C:\Users\Christof\AppData\Local\CrashDumps

2017-09-06 23:53 - 2016-11-07 05:09 - 000001184 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1189399255-3111976695-777185122-1000Core.job

2017-09-06 16:00 - 2013-03-14 15:17 - 000000000 ____D C:\Users\Christof\AppData\Local\Adobe

2017-09-06 03:20 - 2017-06-25 09:52 - 000000000 ____D C:\Program Files\SteamVR

2017-09-06 03:18 - 2013-08-21 15:15 - 000000000 ____D C:\temp

2017-09-06 03:06 - 2015-05-17 10:04 - 000271360 _____ C:\Users\Christof\Documents\loesche_archiv_CHRISTOF.pst

2017-09-06 02:41 - 2013-07-01 10:19 - 000000000 ____D C:\Users\Christof\AppData\LocalLow\Google

2017-09-06 02:06 - 2014-10-16 10:43 - 000000000 ____D C:\Users\Christof\AppData\Local\C6DF4F6E-C3DA-4166-B9A5-51734E12B06C.aplzod

2017-09-05 10:03 - 2013-03-12 07:23 - 000000000 ____D C:\Users\Christof\AppData\Local\ElevatedDiagnostics

2017-09-05 10:03 - 2009-07-13 19:20 - 000000000 ____D C:\Windows\System32\NDF

2017-09-04 22:57 - 2015-12-08 07:40 - 000000000 ____D C:\Users\Christof\AppData\Roaming\Telegram Desktop

2017-09-03 01:44 - 2013-03-12 04:32 - 000000000 ____D C:\Windows\SysWOW64\Macromed

2017-09-01 04:13 - 2013-03-12 02:03 - 000000000 ____D C:\users\Christof

2017-08-30 23:42 - 2016-02-11 01:30 - 000002089 _____ C:\Users\Christof\Desktop\MagentaCLOUD.lnk

2017-08-24 00:26 - 2014-10-29 07:11 - 000000000 ____D C:\Users\Christof\AppData\Roaming\EPM

2017-08-23 09:02 - 2013-05-23 00:47 - 000384828 _____ C:\Windows\SysWOW64\PerfStringBackup.INI

2017-08-18 08:24 - 2016-09-26 23:43 - 002395648 _____ (Farbar) C:\Users\Christof\Desktop\FRST64.exe

2017-08-16 12:55 - 2017-03-08 14:07 - 000002048 _____ C:\Users\Public\Desktop\Google Slides.lnk

2017-08-16 12:55 - 2017-03-08 14:07 - 000002046 _____ C:\Users\Public\Desktop\Google Sheets.lnk

2017-08-16 12:55 - 2017-03-08 14:07 - 000002036 _____ C:\Users\Public\Desktop\Google Docs.lnk

2017-08-15 07:27 - 2013-03-12 08:26 - 000000000 ___RD C:\Users\Christof\Virtual Machines

2017-08-14 11:22 - 2013-09-16 00:54 - 000000000 ____D C:\ProgramData\Oracle

2017-08-14 11:20 - 2014-10-21 23:29 - 000000000 ____D C:\Program Files (x86)\Java

2017-08-13 11:43 - 2016-09-17 04:37 - 000004504 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier

2017-08-13 11:43 - 2013-03-14 18:14 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2017-08-13 11:43 - 2013-03-14 18:14 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2017-08-13 11:43 - 2013-03-14 18:14 - 000000000 ____D C:\Windows\System32\Macromed
 

Some files in TEMP:

====================

2013-03-18 05:32 - 2013-03-18 05:33 - 048309376 _____ (Microsoft Corporation) C:\Users\Christof\AppData\Local\Temp\MouseKeyboardCenterx64_1031.exe

2013-03-13 07:14 - 2013-03-13 07:14 - 000001536 _____ () C:\Users\Christof\AppData\Local\Temp\NOSEventMessages.dll

2006-10-30 14:00 - 2006-10-30 14:00 - 000145184 ____R (Microsoft Corporation) C:\Users\Christof\AppData\Local\Temp\ose00000.exe
 

==================== Known DLLs (Whitelisted) =========================
 
 

==================== Bamital & volsnap ======================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll

[2017-05-11 04:45] - [2017-04-17 07:37] - 000512000 _____ (Microsoft Corporation) 5E9F8D029D9B03110D835CBFC058068B
 

C:\Windows\System32\dnsapi.dll => MD5 is legit

C:\Windows\SysWOW64\dnsapi.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 

==================== Association (Whitelisted) =============
 
 

==================== Restore Points  =========================
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 8%

Total physical RAM: 16330.09 MB

Available physical RAM: 14956.74 MB

Total Virtual: 16328.29 MB

Available Virtual: 14963.63 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:167.46 GB) (Free:15.13 GB) NTFS

Drive d: (Backup2) (Fixed) (Total:841.26 GB) (Free:747.04 GB) NTFS

Drive e: (Daten2) (Fixed) (Total:938.92 GB) (Free:886.5 GB) NTFS

Drive g: (WIN7) (Removable) (Total:7.45 GB) (Free:1.67 GB) FAT32

Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Drive y: (Backup1) (Fixed) (Total:1953.12 GB) (Free:1337.86 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 2794.5 GB) (Disk ID: 00000000)
 

Partition: GPT.
 

========================================================

Disk: 1 (MBR Code: Windows 7 or 8) (Size: 2794.5 GB) (Disk ID: 00000000)
 

Partition: GPT.
 

========================================================

Disk: 2 (Size: 167.7 GB) (Disk ID: C5AFA4BD)
 

Partition: GPT.
 

========================================================

Disk: 3 (MBR Code: Windows 7 or 8) (Size: 7.5 GB) (Disk ID: 008D13D8)

Partition 1: (Active) - (Size=7.5 GB) - (Type=0B)
 

LastRegBack: 2017-08-31 03:34
 

==================== End of FRST.txt ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Viele Grüße