Trojaner-Board - Laptop mit Win 7, 32 Bit bootet und arbeitet extrem langsam

FRST.txt

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015

Ran by hardy (administrator) on HARDY-PC on 03-04-2015 19:48:16

Running from C:\Users\hardy\Desktop

Loaded Profiles: hardy (Available profiles: hardy & Gast)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser: IE)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(AMD) C:\Windows\System32\atiesrxx.exe

(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

() C:\Program Files (x86)\Mobile Partner Manager\AssistantServices.exe

(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe

(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9643552 2009-12-11] (Realtek Semiconductor)

HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [860192 2010-02-05] (Acer Incorporated)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5512912 2015-03-27] (Avast Software s.r.o.)

HKU\S-1-5-21-2271405061-675543758-3622770059-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30877280 2014-12-11] (Skype Technologies S.A.)

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (Avast Software s.r.o.)

ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec MyWinLocker\x64\psdprotect.dll (Egis Technology Inc.)

ShellIconOverlayIdentifiers-x32: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec MyWinLocker\x86\psdprotect.dll (Egis Technology Inc.)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\S-1-5-21-2271405061-675543758-3622770059-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

AutoConfigURL: [.DEFAULT] => 4913522262749519

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

HKU\S-1-5-21-2271405061-675543758-3622770059-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/?pc=UP21&ocid=UP21DHP&dt=050913

HKU\S-1-5-21-2271405061-675543758-3622770059-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-2271405061-675543758-3622770059-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE396

SearchScopes: HKU\S-1-5-21-2271405061-675543758-3622770059-1000 -> {74F210F1-1B34-40A6-905E-6F56D7CC7751} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE396

SearchScopes: HKU\S-1-5-21-2271405061-675543758-3622770059-1000 -> {AF951302-5F3D-4B2E-8C32-840D6BF7B6EA} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=685749&p={searchTerms}

BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-03-27] (Avast Software s.r.o.)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)

BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27] (Adobe Systems Incorporated)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2015-03-29] (Oracle Corporation)

BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-03-27] (Avast Software s.r.o.)

BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-29] (Oracle Corporation)

Toolbar: HKU\S-1-5-21-2271405061-675543758-3622770059-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File

DPF: HKLM-x32 {20A60F0D-9AFA-4515-A0FD-83BD84642501} hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

DPF: HKLM-x32 {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} -  No File

Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} -  No File

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\hardy\AppData\Roaming\Mozilla\Firefox\Profiles\xr818ppx.default

FF SearchEngineOrder.3: Bing 

FF SelectedSearchEngine: Bing 

FF Homepage: www.google.de

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll [2015-03-29] ()

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll [2015-03-29] ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2012-08-08] ()

FF Plugin-x32: @java.com/DTPlugin,version=10.10.2 -> C:\Windows\SysWOW64\npDeployJava1.dll [2013-01-13] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-29] (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)

FF Extension: Adblock Edge - C:\Users\hardy\AppData\Roaming\Mozilla\Firefox\Profiles\xr818ppx.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2013-08-09]

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-03-27]

FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]
 

Chrome: 

=======

CHR HomePage: Profile 1 -> hxxp://de.msn.com/?pc=UP21&ocid=UP21DHP&dt=050913

CHR StartupUrls: Profile 1 -> "hxxp://www.google.de/"

CHR DefaultSuggestURL: Profile 1 -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}

CHR Plugin: (Remoting Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\ppGoogleNaClPluginChrome.dll No File

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\pdf.dll ()

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\gcswf32.dll No File

CHR Plugin: (Shockwave Flash) - C:\Users\hardy\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll No File

CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File

CHR Plugin: (Adobe Acrobat) - c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File

CHR Plugin: (Java(TM) Platform SE 7 U4) - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)

CHR Plugin: (Java Deployment Toolkit 7.0.40.255) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

CHR Plugin: (Windows LiveÂ™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File

CHR Profile: C:\Users\hardy\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (YouTube) - C:\Users\hardy\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-03-02]

CHR Extension: (Google Search) - C:\Users\hardy\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-03-02]

CHR Extension: (Gmail) - C:\Users\hardy\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-03-02]

CHR Profile: C:\Users\hardy\AppData\Local\Google\Chrome\User Data\Profile 1

CHR Extension: (AdBlock) - C:\Users\hardy\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-04-01]

CHR Extension: (Avast Online Security) - C:\Users\hardy\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-03-27]

CHR Extension: (Chrome Hotword Shared Module) - C:\Users\hardy\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-15]

CHR Extension: (Google Wallet) - C:\Users\hardy\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]

CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx [2015-03-27]

CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-03-27]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

ATTENTION: => Could not perform signature verification. Cryptographic Service is not running.
 

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-03-27] (Avast Software s.r.o.)

R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4030800 2015-03-27] (Avast Software)

S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)

S3 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305448 2009-12-02] (Egis Technology Inc.)

R2 UI Assistant Service; C:\Program Files (x86)\Mobile Partner Manager\AssistantServices.exe [247296 2010-01-13] ()

S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-03-27] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [88408 2015-03-27] (Avast Software s.r.o.)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-03-27] (Avast Software s.r.o.)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-03-27] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-03-27] (Avast Software s.r.o.)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-03-27] (Avast Software s.r.o.)

R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [136752 2015-03-27] (Avast Software s.r.o.)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [271200 2015-03-27] ()

S3 HabuFltr; C:\Windows\System32\drivers\habu.sys [13696 2006-10-26] (Razer (Asia-Pacific) Pte Ltd)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)

S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-03-17] (Malwarebytes Corporation)

S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [102600 2009-06-18] (McAfee, Inc.)

R1 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [307400 2009-06-18] (McAfee, Inc.)

S3 mferkdk; C:\Windows\System32\drivers\mferkdk.sys [40904 2009-06-18] (McAfee, Inc.)

S3 mfesmfk; C:\Windows\System32\drivers\mfesmfk.sys [49480 2009-06-18] (McAfee, Inc.)

R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [273824 2015-03-27] (Avast Software)

R2 {B154377D-700F-42cc-9474-23858FBDF4BD}; c:\Program Files (x86)\CyberLink\PowerDVD9\000.fcl [146928 2010-01-22] (CyberLink Corp.)

S3 catchme; \??\C:\ComboFix\catchme.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-04-02 22:51 - 2015-04-02 22:51 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-HARDY-PC-Windows-7-Home-Premium-(64-bit).dat

2015-04-02 22:51 - 2015-04-02 22:51 - 00000000 ____D () C:\RegBackup

2015-04-02 10:46 - 2015-04-02 10:46 - 12840520 _____ () C:\Users\hardy\Downloads\tweaking.com_windows_repair_aio_setup (1).exe

2015-04-01 20:55 - 2015-04-02 10:47 - 00002163 _____ () C:\Users\hardy\Desktop\Tweaking.com - Windows Repair (All in One).lnk

2015-04-01 20:54 - 2015-04-01 20:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com

2015-04-01 20:54 - 2015-04-01 20:54 - 00000000 ____D () C:\Program Files (x86)\Tweaking.com

2015-04-01 20:53 - 2015-04-01 20:53 - 12840520 _____ () C:\Users\hardy\Downloads\tweaking.com_windows_repair_aio_setup.exe

2015-04-01 00:33 - 2015-04-01 00:34 - 40710624 _____ () C:\Users\hardy\Downloads\firefox_setup_37.0.exe

2015-04-01 00:31 - 2015-04-01 00:31 - 00243576 _____ () C:\Users\hardy\Downloads\Firefox Setup Stub 37.0.exe

2015-03-31 23:58 - 2015-03-31 23:58 - 00000987 _____ () C:\Users\hardy\Desktop\checkup.txt

2015-03-31 23:53 - 2015-03-31 23:53 - 00852607 _____ () C:\Users\hardy\Desktop\SecurityCheck.exe

2015-03-31 19:32 - 2015-03-31 19:32 - 02347384 _____ (ESET) C:\Users\hardy\Downloads\esetsmartinstaller_deu.exe

2015-03-30 22:36 - 2015-03-30 22:36 - 00078685 _____ () C:\Users\hardy\Desktop\JRT.txt

2015-03-30 22:30 - 2015-03-30 22:30 - 01389097 _____ (Thisisu) C:\Users\hardy\Desktop\JRT.exe

2015-03-30 21:29 - 2015-03-30 21:29 - 518674973 _____ () C:\Windows\MEMORY.DMP

2015-03-30 21:29 - 2015-03-30 21:29 - 00274872 _____ () C:\Windows\Minidump\033015-60731-01.dmp

2015-03-30 21:24 - 2015-03-30 22:26 - 00001232 _____ () C:\Users\hardy\Desktop\AdwCleaner[S2].txt

2015-03-30 21:07 - 2015-03-30 21:07 - 02208768 _____ () C:\Users\hardy\Downloads\AdwCleaner_4.200.exe

2015-03-30 21:02 - 2015-03-30 21:02 - 00001208 _____ () C:\Users\hardy\Desktop\mbam.txt

2015-03-30 20:09 - 2015-03-30 20:09 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\hardy\Downloads\mbam-setup-2.1.4.1018.exe

2015-03-30 14:23 - 2015-03-30 14:23 - 00107072 _____ () C:\ComboFix.txt

2015-03-30 11:02 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2015-03-30 11:02 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2015-03-30 11:02 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2015-03-30 11:02 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2015-03-30 11:02 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2015-03-30 11:02 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2015-03-30 11:02 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2015-03-30 11:02 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2015-03-30 11:01 - 2015-03-30 14:24 - 00000000 ____D () C:\Qoobox

2015-03-30 11:00 - 2015-03-30 11:58 - 00000000 ____D () C:\Windows\erdnt

2015-03-30 10:58 - 2015-03-30 10:59 - 05617067 ____R (Swearware) C:\Users\hardy\Desktop\ComboFix.exe

2015-03-30 10:49 - 2015-03-30 10:49 - 00001268 _____ () C:\Users\hardy\Desktop\Revo Uninstaller.lnk

2015-03-30 10:49 - 2015-03-30 10:49 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2015-03-30 10:48 - 2015-03-30 10:48 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\hardy\Downloads\revosetup95.exe

2015-03-29 20:56 - 2015-03-29 20:57 - 00039609 _____ () C:\Users\hardy\Desktop\Addition.txt

2015-03-29 20:55 - 2015-04-03 19:48 - 00018203 _____ () C:\Users\hardy\Desktop\FRST.txt

2015-03-29 20:54 - 2015-03-29 20:52 - 02095616 _____ (Farbar) C:\Users\hardy\Desktop\FRST64.exe

2015-03-29 20:52 - 2015-04-03 19:48 - 00000000 ____D () C:\FRST

2015-03-29 20:52 - 2015-03-29 20:52 - 02095616 _____ (Farbar) C:\Users\hardy\Downloads\FRST64.exe

2015-03-29 20:52 - 2015-03-29 20:52 - 00014506 _____ () C:\Users\hardy\Downloads\FRST.txt

2015-03-29 20:51 - 2015-03-29 20:51 - 01135104 _____ (Farbar) C:\Users\hardy\Downloads\FRST.exe

2015-03-29 18:27 - 2011-02-19 12:09 - 2527395840 _____ () C:\Users\hardy\Desktop\win7x86sp1.iso

2015-03-29 17:49 - 2015-04-02 23:13 - 00002034 _____ () C:\Windows\PFRO.log

2015-03-29 16:45 - 2015-03-29 16:45 - 02168320 _____ () C:\Users\hardy\Downloads\AdwCleaner_4.113 (1).exe

2015-03-29 16:34 - 2015-03-29 17:35 - 1300000000 _____ () C:\Users\hardy\Downloads\win7x86sp1.part1.exe

2015-03-29 16:34 - 2015-03-29 17:28 - 1011950210 _____ () C:\Users\hardy\Downloads\win7x86sp1.part2.rar

2015-03-29 16:28 - 2015-03-29 16:28 - 00243648 _____ () C:\Users\hardy\Downloads\Firefox Setup Stub 36.0.4.exe

2015-03-29 15:01 - 2015-04-03 19:30 - 00983386 _____ () C:\Windows\WindowsUpdate.log

2015-03-29 14:44 - 2015-04-03 19:07 - 00001064 _____ () C:\Windows\setupact.log

2015-03-29 14:44 - 2015-03-29 14:44 - 00000000 _____ () C:\Windows\setuperr.log

2015-03-29 13:35 - 2015-03-29 13:35 - 00020170 _____ () C:\Users\hardy\Documents\cc_20150329_133502.reg

2015-03-29 12:30 - 2013-01-13 12:49 - 00859072 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll

2015-03-29 12:30 - 2013-01-13 12:49 - 00779704 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll

2015-03-29 12:28 - 2015-03-29 12:49 - 00000000 ____D () C:\ProgramData\Oracle

2015-03-29 12:28 - 2015-03-29 12:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2015-03-28 01:34 - 2015-03-28 01:34 - 00183844 _____ () C:\Users\hardy\Documents\cc_20150328_003421.reg

2015-03-27 23:40 - 2015-03-27 23:40 - 00013380 _____ () C:\Users\hardy\Desktop\Minecraft (2).lnk

2015-03-27 16:19 - 2015-03-29 16:27 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2015-03-27 03:11 - 2015-03-27 03:11 - 00000000 ____D () C:\Users\hardy\AppData\Roaming\AVAST Software

2015-03-27 03:07 - 2015-04-02 10:22 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2015-03-27 03:07 - 2015-03-27 03:15 - 00000000 ____D () C:\Windows\SysWOW64\vbox

2015-03-27 03:07 - 2015-03-27 03:15 - 00000000 ____D () C:\Windows\system32\vbox

2015-03-27 03:07 - 2015-03-27 03:07 - 00001926 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk

2015-03-27 03:07 - 2015-03-27 03:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software

2015-03-27 03:06 - 2015-03-27 03:06 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys

2015-03-27 03:06 - 2015-03-27 03:06 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys

2015-03-27 03:06 - 2015-03-27 03:06 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe

2015-03-27 03:06 - 2015-03-27 03:06 - 00271200 _____ () C:\Windows\system32\Drivers\aswVmm.sys

2015-03-27 03:06 - 2015-03-27 03:06 - 00136752 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswStm.sys

2015-03-27 03:06 - 2015-03-27 03:06 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr2.sys

2015-03-27 03:06 - 2015-03-27 03:06 - 00088408 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys

2015-03-27 03:06 - 2015-03-27 03:06 - 00065736 _____ () C:\Windows\system32\Drivers\aswRvrt.sys

2015-03-27 03:06 - 2015-03-27 03:06 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr

2015-03-27 03:06 - 2015-03-27 03:06 - 00029168 _____ () C:\Windows\system32\Drivers\aswHwid.sys

2015-03-27 03:05 - 2015-03-27 03:05 - 00000000 ____D () C:\ProgramData\AVAST Software

2015-03-27 03:05 - 2015-03-27 03:05 - 00000000 ____D () C:\Program Files\AVAST Software

2015-03-27 02:58 - 2015-03-27 03:02 - 150062624 _____ (Avast Software s.r.o.) C:\Users\hardy\Downloads\avast_free_antivirus_setup_10.2.2215.exe

2015-03-27 02:30 - 2015-03-27 02:30 - 00000000 ____D () C:\OETemp

2015-03-27 01:54 - 2015-03-30 21:14 - 00000000 ____D () C:\AdwCleaner

2015-03-27 01:10 - 2015-03-27 01:11 - 02168320 _____ () C:\Users\hardy\Downloads\AdwCleaner_4.113.exe

2015-03-27 01:00 - 2015-03-27 01:00 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\73A42603.sys
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-04-03 19:45 - 2012-07-27 13:16 - 00000000 ____D () C:\Users\hardy\AppData\Roaming\Skype

2015-04-03 19:40 - 2013-03-12 20:12 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-04-03 19:19 - 2009-07-14 06:45 - 00025840 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-04-03 19:19 - 2009-07-14 06:45 - 00025840 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-04-03 19:16 - 2010-09-06 22:06 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-04-03 19:13 - 2011-12-25 22:47 - 01925120 ___SH () C:\Users\hardy\Desktop\Thumbs.db

2015-04-03 19:13 - 2010-08-09 19:08 - 00079608 _____ () C:\Users\hardy\AppData\Local\GDIPFONTCACHEV1.DAT

2015-04-03 19:08 - 2010-09-06 22:06 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-04-03 19:07 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-04-02 23:18 - 2010-04-08 18:55 - 00645354 _____ () C:\Windows\system32\perfh007.dat

2015-04-02 23:18 - 2010-04-08 18:55 - 00130892 _____ () C:\Windows\system32\perfc007.dat

2015-04-02 23:18 - 2009-07-14 07:13 - 01516610 _____ () C:\Windows\system32\PerfStringBackup.INI

2015-04-02 23:13 - 2009-07-14 06:45 - 00334792 _____ () C:\Windows\system32\FNTCACHE.DAT

2015-04-02 23:08 - 2009-07-14 04:34 - 00000546 _____ () C:\Windows\win.ini

2015-03-30 23:51 - 2013-12-30 13:24 - 01594964 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI

2015-03-30 21:29 - 2013-09-20 10:14 - 00000000 ____D () C:\Windows\Minidump

2015-03-30 20:13 - 2014-09-10 12:05 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-03-30 20:12 - 2014-09-10 12:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-03-30 20:12 - 2014-09-10 12:02 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-03-30 20:12 - 2012-08-05 09:24 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-03-30 14:23 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default

2015-03-30 11:45 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini

2015-03-30 11:45 - 2009-07-14 04:34 - 00000027 _____ () C:\Windows\system32\Drivers\etc\hosts_bak_781

2015-03-30 11:33 - 2010-08-09 19:08 - 00000000 ____D () C:\Users\hardy

2015-03-29 13:33 - 2012-03-02 23:53 - 00000979 _____ () C:\Users\Public\Desktop\CCleaner.lnk

2015-03-29 12:28 - 2013-01-13 12:49 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2015-03-29 12:28 - 2012-03-02 20:59 - 00000000 ____D () C:\Program Files (x86)\Java

2015-03-29 12:19 - 2013-03-12 20:12 - 00778928 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-03-29 12:19 - 2013-03-12 20:12 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2015-03-29 12:19 - 2011-08-24 13:21 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-03-28 17:30 - 2014-09-10 12:14 - 00000000 ____D () C:\Users\hardy\AppData\Roaming\.minecraft

2015-03-28 01:12 - 2014-09-11 09:03 - 00000000 ____D () C:\Program Files (x86)\Steam

2015-03-28 01:12 - 2009-07-27 22:41 - 00000000 ____D () C:\Windows\Panther

2015-03-27 02:40 - 2014-05-29 13:55 - 00000000 ____D () C:\Program Files (x86)\Avira

2015-03-27 02:32 - 2010-02-11 04:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer GameZone

2015-03-27 02:32 - 2010-02-11 04:42 - 00000000 ____D () C:\Program Files (x86)\Acer GameZone

2015-03-27 02:31 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2015-03-27 02:30 - 2014-05-29 13:55 - 00000000 ____D () C:\ProgramData\Package Cache

2015-03-27 02:30 - 2012-07-13 16:43 - 00000000 ____D () C:\ProgramData\Avira

2015-03-27 01:54 - 2012-01-27 22:24 - 00425472 ___SH () C:\Users\hardy\Documents\Thumbs.db

2015-03-24 16:52 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2015-03-17 06:15 - 2014-09-10 12:02 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-03-17 06:15 - 2014-09-10 12:02 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2015-03-17 06:15 - 2012-02-10 17:18 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2015-03-12 10:01 - 2010-02-11 04:19 - 00000000 ____D () C:\ProgramData\Microsoft Help

2015-03-12 09:59 - 2013-08-02 00:18 - 00000000 ____D () C:\Windows\system32\MRT

2015-03-12 01:54 - 2010-09-07 19:35 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
 

==================== Files in the root of some directories =======
 

2010-09-07 16:49 - 2014-02-14 16:48 - 0000092 _____ () C:\Users\hardy\AppData\Roaming\wklnhst.dat

2013-04-14 14:16 - 2015-02-28 12:07 - 0010240 _____ () C:\Users\hardy\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2010-02-11 04:43 - 2009-07-18 04:57 - 0036136 _____ (Oberon Media) C:\ProgramData\FullRemove.exe
 

Some content of TEMP:

====================

C:\Users\hardy\AppData\Local\Temp\Quarantine.exe

C:\Users\hardy\AppData\Local\Temp\sqlite3.dll
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2015-03-25 12:44
 

==================== End Of Log ============================
--- --- ---

Ab und zu braucht der Laptop immer noch einige Anlaufzeit. Beim letzten Reboot
war es leider wieder sehr schlimm. Wobei ich gestehen muss, dass es manchmal
schwer auszumachen ist, ob der Laptop jetzt aufgrund von Viren/Trojanern länger
braucht, oder einfach, weil der Laptop schon 5 Jahre alt ist.

Der Balken unten ist übrigens immer noch in diesem merkwürdigen weißgrau, wie
im von mir verlinkten Bild zu sehen ist. Muss ich das noch manuell ändern?