| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Windows7 - Weisser BildschirmWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
11.04.2013, 23:38
| #1 |
| |  Windows7 - Weisser Bildschirm Hallo, habe an meinem Windows 7 Rechner seit heute nur noch einen weissen Bildschirm. Dasa Problem ist hier ja in anderen Beiträgen schon ausreichend beschrieben. Ich habe die Anleitung aus anderen Beiträgen ausgeführt und auch die FRST Log Datei erstellt. Kann mir jemand bei der AUswertung helfen? Vielen Dank im voraus! Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 11-04-2013 Ran by SYSTEM at 11-04-2013 16:44:51 Running from E:\ Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard The current controlset is ControlSet001 ==================== Registry (Whitelisted) =================== HKLM\...\Run: [erisui] "C:\Windows\system32\Empirum\eris_ui" /hide [x] HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [843712 2012-04-04] (Adobe Systems Incorporated) HKLM-x32\...\Run: [McAfeeUpdaterUI] "C:\Program Files (x86)\McAfee\Common Framework\udaterui.exe" /StartedFromRunKey [161088 2011-05-19] (McAfee, Inc.) HKLM-x32\...\Run: [ShStatEXE] "C:\Program Files (x86)\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE [215360 2011-01-12] (McAfee, Inc.) HKLM-x32\...\Run: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin [611712 2008-08-14] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [38768 2009-10-03] (Adobe Systems Incorporated) HKLM-x32\...\Run: [] [x] HKLM-x32\...\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [640376 2009-10-03] (Adobe Systems Inc.) HKLM-x32\...\Run: [Adobe_ID0ENQBO] C:\PROGRA~2\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE [378224 2008-08-15] (Adobe Systems Incorporated) HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-01-28] (Apple Inc.) HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152392 2013-02-20] (Apple Inc.) HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-10-25] (Apple Inc.) HKU\admindse\...\Run: [Greenshot] C:\Program Files (x86)\Greenshot\Greenshot.exe [548864 2010-07-12] () HKU\AdminWstart\...\RunOnce: [DPAPIKeyMig] %SystemRoot%\system32\dpapimig.exe -quiet [x] HKU\AdminWstart\...\RunOnce: [WAB Migrate] %ProgramFiles%\Windows Mail\wab.exe /Upgrade [x] HKU\ang\...\RunOnce: [DPAPIKeyMig] %SystemRoot%\system32\dpapimig.exe -quiet [x] HKU\ang\...\RunOnce: [WAB Migrate] %ProgramFiles%\Windows Mail\wab.exe /Upgrade [x] HKU\UserAdmin\...\Run: [Greenshot] C:\Program Files (x86)\Greenshot\Greenshot.exe [548864 2010-07-12] () HKU\UserAdmin\...\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun [x] HKU\UserAdmin\...\Run: [iCloudServices] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59872 2012-12-17] (Apple Inc.) HKU\UserAdmin\...\Run: [ApplePhotoStreams] C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59872 2012-12-17] (Apple Inc.) HKU\UserAdmin\...\Winlogon: [Shell] C:\Users\UserAdmin\AppData\Roaming\mcafee.ini,explorer.exe Tcpip\Parameters: [DhcpNameServer] 192.168.112.3 Startup: C:\ProgramData\Start Menu\Programs\Startup\Empirum Inventory.lnk ShortcutTarget: Empirum Inventory.lnk -> C:\Windows\System32\Empirum\EmpInventory.exe (Matrix42 AG) Startup: C:\Users\UserAdmin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> (No File) ==================== Services (Whitelisted) =================== 3 Adobe Version Cue CS4; "C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe" -win32service [284016 2008-08-15] (Adobe Systems Incorporated) 2 ERIS; C:\Windows\system32\Empirum\Eris.exe [211456 2011-01-14] (Matrix42 AG) 2 McAfeeFramework; "C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe" /ServiceStart [120128 2011-05-19] (McAfee, Inc.) 2 McShield; "C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe" [190256 2013-03-11] (McAfee, Inc.) 2 McTaskManager; "C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe" [209760 2011-01-12] (McAfee, Inc.) 2 mfevtp; "C:\Windows\system32\mfevtps.exe" [156248 2013-03-11] (McAfee, Inc.) 2 ST4.ClientUpdateService; "C:\Program Files (x86)\SCHEMA\ST4.Client\bin\ST4.ClientUpdateService.exe" [125672 2010-01-20] (SCHEMA GmbH) ==================== Drivers (Whitelisted) ===================== 3 BazisPortableCDBus; C:\Windows\System32\Drivers\BazisPortableCDBus.sys [268896 2013-03-11] (SysProgs.org) 3 bcbtums; C:\Windows\System32\Drivers\bcbtums.sys [134696 2012-06-27] (Broadcom Corporation.) 3 mfeapfk; C:\Windows\System32\Drivers\mfeapfk.sys [153952 2013-03-11] (McAfee, Inc.) 3 mfeavfk; C:\Windows\System32\Drivers\mfeavfk.sys [217696 2013-03-11] (McAfee, Inc.) 0 mfehidk; C:\Windows\System32\Drivers\mfehidk.sys [607152 2013-03-11] (McAfee, Inc.) 3 mferkdet; C:\Windows\System32\Drivers\mferkdet.sys [97960 2013-03-11] (McAfee, Inc.) 0 mfewfpk; C:\Windows\System32\Drivers\mfewfpk.sys [281544 2013-03-11] (McAfee, Inc.) 3 ST_ACCEL; C:\Windows\System32\Drivers\ST_ACCEL.sys [68208 2012-06-27] (STMicroelectronics) 3 mfeavfk01; [x] ==================== NetSvcs (Whitelisted) ==================== ==================== One Month Created Files and Folders ======== 2013-04-11 16:44 - 2013-04-11 16:44 - 00000000 ____D C:\FRST 2013-04-11 15:58 - 2013-04-11 15:58 - 00000000 ____D C:\ProgramData\rxlfs 2013-04-11 15:56 - 2013-04-11 15:56 - 00141592 ____A (Hilgraeve, Inc.) C:\Users\UserAdmin\Desktop\melb.tmp 2013-04-09 15:50 - 2013-04-09 15:50 - 00985967 ____A C:\Users\UserAdmin\Desktop\20130409_PM_Department_Round_Table.xlsx 2013-04-05 13:46 - 2013-04-05 13:46 - 01190607 ____A C:\Users\UserAdmin\Desktop\DCC-Internal_Ride Comfort Improvement Test_GTAA_cap.zip 2013-04-02 18:37 - 2013-04-02 18:37 - 00002021 ____A C:\Users\Public\Desktop\Adobe Acrobat 9 Pro.lnk 2013-04-02 18:37 - 2009-08-20 04:50 - 00052568 ___RA (Adobe Systems Inc) C:\Windows\System32\AdobePDF.dll 2013-04-02 18:37 - 2009-08-20 04:50 - 00024416 ___RA (Adobe Systems Inc.) C:\Windows\System32\AdobePDFUI.dll 2013-04-02 12:31 - 2013-04-02 12:31 - 00036923 ____A C:\Users\UserAdmin\Desktop\DR_ESM_03_2013_2.xlsx 2013-04-02 12:31 - 2013-04-02 12:31 - 00036888 ____A C:\Users\UserAdmin\Desktop\DR_ESM_03_2013_1.xlsx 2013-03-28 18:45 - 2013-03-28 18:45 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2013-03-28 18:45 - 2013-03-28 18:45 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight 2013-03-27 16:00 - 2013-03-27 16:00 - 00000000 ____D C:\Neuer Ordner (2) 2013-03-27 15:57 - 2013-03-27 15:57 - 00000000 ____D C:\Neuer Ordner 2013-03-26 15:30 - 2013-03-26 15:30 - 00000000 ____D C:\ProgramData\Hewlett-Packard 2013-03-26 13:20 - 2013-03-26 13:20 - 00000000 ____D C:\Users\UserAdmin\AppData\Roaming\SkypePM 2013-03-25 21:59 - 2013-03-25 21:59 - 00000000 ____D C:\Users\UserAdmin\AppData\Roaming\SkypePM-BackupBySkypePortable 2013-03-25 21:59 - 2013-03-25 21:59 - 00000000 ____D C:\Users\UserAdmin\AppData\Roaming\Skype 2013-03-25 17:34 - 2013-03-25 21:59 - 00000000 ____D C:\SkypePortable 2013-03-25 16:11 - 2013-03-25 16:11 - 00000000 ____D C:\Users\UserAdmin\Desktop\Einbaulage Kompressor OAC 2013-03-25 16:10 - 2013-03-25 16:10 - 00067709 ____A C:\Users\UserAdmin\Desktop\Einbaulage Kompressor OAC.zip 2013-03-25 01:55 - 2013-03-25 01:55 - 00001845 ____A C:\Users\Public\Desktop\QuickTime Player.lnk 2013-03-25 01:55 - 2013-03-25 01:55 - 00000000 ____D C:\Program Files (x86)\QuickTime 2013-03-25 00:11 - 2013-03-28 17:29 - 00000000 ____D C:\Users\UserAdmin\AppData\Roaming\Apple Computer 2013-03-25 00:11 - 2013-03-25 02:39 - 00000000 ____D C:\Users\UserAdmin\AppData\Local\Apple Computer 2013-03-25 00:11 - 2013-03-25 00:11 - 00001783 ____A C:\Users\Public\Desktop\iTunes.lnk 2013-03-25 00:11 - 2012-08-21 18:01 - 00033240 ____A (GEAR Software Inc.) C:\Windows\System32\Drivers\GEARAspiWDM.sys 2013-03-25 00:10 - 2013-03-25 01:57 - 00000000 ____D C:\Program Files\Common Files\Apple 2013-03-25 00:10 - 2013-03-25 00:11 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-03-25 00:10 - 2013-03-25 00:11 - 00000000 ____D C:\Program Files\iTunes 2013-03-25 00:10 - 2013-03-25 00:11 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-03-25 00:10 - 2013-03-25 00:10 - 00000000 ____D C:\Users\UserAdmin\AppData\Local\Apple 2013-03-25 00:10 - 2013-03-25 00:10 - 00000000 ____D C:\ProgramData\Apple Computer 2013-03-25 00:10 - 2013-03-25 00:10 - 00000000 ____D C:\ProgramData\Apple 2013-03-25 00:10 - 2013-03-25 00:10 - 00000000 ____D C:\Program Files\iPod 2013-03-25 00:10 - 2013-03-25 00:10 - 00000000 ____D C:\Program Files\Bonjour 2013-03-25 00:10 - 2013-03-25 00:10 - 00000000 ____D C:\Program Files (x86)\Bonjour 2013-03-25 00:10 - 2013-03-25 00:10 - 00000000 ____D C:\Program Files (x86)\Apple Software Update 2013-03-24 21:09 - 2013-03-24 21:09 - 00001257 ____A C:\Users\UserAdmin\Desktop\Continuar la Instalacion de UpToDown downloader - Skype.lnk 2013-03-24 21:09 - 2013-03-24 21:09 - 00000000 ____D C:\ProgramData\Skype 2013-03-21 21:20 - 2013-04-11 21:08 - 00000000 ___RD C:\Users\UserAdmin\Dropbox 2013-03-21 21:20 - 2013-04-11 16:06 - 00000991 ____A C:\Users\UserAdmin\Desktop\Dropbox.lnk 2013-03-21 21:18 - 2013-04-11 21:08 - 00000000 ____D C:\Users\UserAdmin\AppData\Roaming\Dropbox 2013-03-18 22:17 - 2013-03-18 22:17 - 00002082 ____A C:\Users\UserAdmin\Desktop\Nabokov.lnk 2013-03-18 22:17 - 2013-03-18 22:17 - 00000000 ____D C:\Users\UserAdmin\AppData\Roaming\TightVNC 2013-03-18 22:16 - 2013-03-18 22:16 - 00000000 ____D C:\Program Files\TightVNC 2013-03-18 15:57 - 2013-03-28 15:40 - 00000000 ____D C:\Signage Plan 2013-03-16 21:45 - 2013-03-16 21:45 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf 2013-03-16 16:20 - 2013-03-29 15:41 - 00000192 ____A C:\Users\UserAdmin\client.cfg 2013-03-14 14:08 - 2013-03-25 13:27 - 00000000 ____D C:\Users\UserAdmin\AppData\Roaming\ICAClient 2013-03-14 13:06 - 2013-03-14 13:06 - 00000000 ____D C:\Users\UserAdmin\AppData\Roaming\IrfanView_Doppelmayr 2013-03-14 13:05 - 2013-03-14 13:05 - 00000656 ____A C:\Users\UserAdmin\Desktop\GTAA7.lnk 2013-03-14 13:01 - 2013-04-10 21:54 - 00000000 ____D C:\GTAA7 2013-03-14 13:00 - 2013-03-14 13:00 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_User_WpdFs_01_09_00.Wdf 2013-03-14 12:34 - 2013-04-11 15:56 - 00000000 ____D C:\users\UserAdmin 2013-03-14 12:34 - 2013-04-10 19:08 - 00000000 ____D C:\Users\UserAdmin\AppData\Roaming\Adobe 2013-03-14 12:34 - 2013-04-09 13:25 - 00000000 ____D C:\Users\UserAdmin\AppData\Local\Microsoft Help 2013-03-14 12:34 - 2013-03-26 14:44 - 00000000 ____D C:\Users\UserAdmin\AppData\Local\Adobe 2013-03-14 12:34 - 2013-03-23 13:30 - 00000000 ____D C:\Users\UserAdmin\AppData\Roaming\VLC 2013-03-14 12:34 - 2013-03-17 00:18 - 00000000 ____D C:\Users\UserAdmin\AppData\Roaming\Greenshot 2013-03-14 12:34 - 2013-03-14 12:34 - 00083728 ____A C:\Users\UserAdmin\AppData\Local\GDIPFONTCACHEV1.DAT 2013-03-14 12:34 - 2013-03-14 12:34 - 00000020 ___SH C:\Users\UserAdmin\ntuser.ini 2013-03-14 12:34 - 2013-03-14 12:34 - 00000000 __SHD C:\Users\UserAdmin\Vorlagen 2013-03-14 12:34 - 2013-03-14 12:34 - 00000000 __SHD C:\Users\UserAdmin\Startmenü 2013-03-14 12:34 - 2013-03-14 12:34 - 00000000 __SHD C:\Users\UserAdmin\Netzwerkumgebung 2013-03-14 12:34 - 2013-03-14 12:34 - 00000000 __SHD C:\Users\UserAdmin\Lokale Einstellungen 2013-03-14 12:34 - 2013-03-14 12:34 - 00000000 __SHD C:\Users\UserAdmin\Eigene Dateien 2013-03-14 12:34 - 2013-03-14 12:34 - 00000000 __SHD C:\Users\UserAdmin\Druckumgebung 2013-03-14 12:34 - 2013-03-14 12:34 - 00000000 __SHD C:\Users\UserAdmin\Documents\Eigene Musik 2013-03-14 12:34 - 2013-03-14 12:34 - 00000000 __SHD C:\Users\UserAdmin\Documents\Eigene Bilder 2013-03-14 12:34 - 2013-03-14 12:34 - 00000000 __SHD C:\Users\UserAdmin\AppData\Local\Verlauf 2013-03-14 12:34 - 2013-03-14 12:34 - 00000000 __SHD C:\Users\UserAdmin\AppData\Local\Anwendungsdaten 2013-03-14 12:34 - 2013-03-14 12:34 - 00000000 __SHD C:\Users\UserAdmin\Anwendungsdaten 2013-03-14 12:34 - 2013-03-14 12:34 - 00000000 ____D C:\Users\UserAdmin\AppData\Roaming\Macromedia 2013-03-14 12:34 - 2013-03-14 12:34 - 00000000 ____D C:\Users\UserAdmin\AppData\Local\VirtualStore 2013-03-14 12:34 - 2013-03-11 11:28 - 00000000 ____D C:\Users\UserAdmin\AppData\Roaming\McAfee ==================== One Month Modified Files and Folders ======= 2013-04-11 21:36 - 2013-03-11 11:15 - 01718915 ____A C:\Windows\WindowsUpdate.log 2013-04-11 21:35 - 2009-07-14 05:51 - 00036387 ____A C:\Windows\setupact.log 2013-04-11 21:33 - 2009-07-14 05:45 - 00022928 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-04-11 21:33 - 2009-07-14 05:45 - 00022928 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-04-11 21:27 - 2011-04-12 08:43 - 00697082 ____A C:\Windows\System32\perfh007.dat 2013-04-11 21:27 - 2011-04-12 08:43 - 00148346 ____A C:\Windows\System32\perfc007.dat 2013-04-11 21:27 - 2009-07-14 06:13 - 01613340 ____A C:\Windows\System32\PerfStringBackup.INI 2013-04-11 21:08 - 2013-03-21 21:20 - 00000000 ___RD C:\Users\UserAdmin\Dropbox 2013-04-11 21:08 - 2013-03-21 21:18 - 00000000 ____D C:\Users\UserAdmin\AppData\Roaming\Dropbox 2013-04-11 21:07 - 2009-07-14 06:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT 2013-04-11 16:56 - 2010-11-21 04:47 - 00009106 ____A C:\Windows\PFRO.log 2013-04-11 16:44 - 2013-04-11 16:44 - 00000000 ____D C:\FRST 2013-04-11 16:06 - 2013-03-21 21:20 - 00000991 ____A C:\Users\UserAdmin\Desktop\Dropbox.lnk 2013-04-11 15:58 - 2013-04-11 15:58 - 00000000 ____D C:\ProgramData\rxlfs 2013-04-11 15:56 - 2013-04-11 15:56 - 00141592 ____A (Hilgraeve, Inc.) C:\Users\UserAdmin\Desktop\melb.tmp 2013-04-11 15:56 - 2013-03-14 12:34 - 00000000 ____D C:\users\UserAdmin 2013-04-10 21:54 - 2013-03-14 13:01 - 00000000 ____D C:\GTAA7 2013-04-10 19:08 - 2013-03-14 12:34 - 00000000 ____D C:\Users\UserAdmin\AppData\Roaming\Adobe 2013-04-09 16:26 - 2013-03-11 14:07 - 00000000 ____D C:\ProgramData\FLEXnet 2013-04-09 15:50 - 2013-04-09 15:50 - 00985967 ____A C:\Users\UserAdmin\Desktop\20130409_PM_Department_Round_Table.xlsx 2013-04-09 13:25 - 2013-03-14 12:34 - 00000000 ____D C:\Users\UserAdmin\AppData\Local\Microsoft Help 2013-04-05 13:46 - 2013-04-05 13:46 - 01190607 ____A C:\Users\UserAdmin\Desktop\DCC-Internal_Ride Comfort Improvement Test_GTAA_cap.zip 2013-04-02 18:56 - 2013-03-11 13:47 - 00000000 ____D C:\Program Files\Adobe 2013-04-02 18:55 - 2013-03-11 11:24 - 00000000 ____D C:\Program Files (x86)\Adobe 2013-04-02 18:37 - 2013-04-02 18:37 - 00002021 ____A C:\Users\Public\Desktop\Adobe Acrobat 9 Pro.lnk 2013-04-02 12:31 - 2013-04-02 12:31 - 00036923 ____A C:\Users\UserAdmin\Desktop\DR_ESM_03_2013_2.xlsx 2013-04-02 12:31 - 2013-04-02 12:31 - 00036888 ____A C:\Users\UserAdmin\Desktop\DR_ESM_03_2013_1.xlsx 2013-03-29 15:41 - 2013-03-16 16:20 - 00000192 ____A C:\Users\UserAdmin\client.cfg 2013-03-28 18:45 - 2013-03-28 18:45 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2013-03-28 18:45 - 2013-03-28 18:45 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight 2013-03-28 17:29 - 2013-03-25 00:11 - 00000000 ____D C:\Users\UserAdmin\AppData\Roaming\Apple Computer 2013-03-28 15:40 - 2013-03-18 15:57 - 00000000 ____D C:\Signage Plan 2013-03-27 16:00 - 2013-03-27 16:00 - 00000000 ____D C:\Neuer Ordner (2) 2013-03-27 15:57 - 2013-03-27 15:57 - 00000000 ____D C:\Neuer Ordner 2013-03-26 15:30 - 2013-03-26 15:30 - 00000000 ____D C:\ProgramData\Hewlett-Packard 2013-03-26 14:44 - 2013-03-14 12:34 - 00000000 ____D C:\Users\UserAdmin\AppData\Local\Adobe 2013-03-26 13:20 - 2013-03-26 13:20 - 00000000 ____D C:\Users\UserAdmin\AppData\Roaming\SkypePM 2013-03-25 21:59 - 2013-03-25 21:59 - 00000000 ____D C:\Users\UserAdmin\AppData\Roaming\SkypePM-BackupBySkypePortable 2013-03-25 21:59 - 2013-03-25 21:59 - 00000000 ____D C:\Users\UserAdmin\AppData\Roaming\Skype 2013-03-25 21:59 - 2013-03-25 17:34 - 00000000 ____D C:\SkypePortable 2013-03-25 17:17 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\System32\NDF 2013-03-25 16:11 - 2013-03-25 16:11 - 00000000 ____D C:\Users\UserAdmin\Desktop\Einbaulage Kompressor OAC 2013-03-25 16:10 - 2013-03-25 16:10 - 00067709 ____A C:\Users\UserAdmin\Desktop\Einbaulage Kompressor OAC.zip 2013-03-25 13:27 - 2013-03-14 14:08 - 00000000 ____D C:\Users\UserAdmin\AppData\Roaming\ICAClient 2013-03-25 02:39 - 2013-03-25 00:11 - 00000000 ____D C:\Users\UserAdmin\AppData\Local\Apple Computer 2013-03-25 01:57 - 2013-03-25 00:10 - 00000000 ____D C:\Program Files\Common Files\Apple 2013-03-25 01:55 - 2013-03-25 01:55 - 00001845 ____A C:\Users\Public\Desktop\QuickTime Player.lnk 2013-03-25 01:55 - 2013-03-25 01:55 - 00000000 ____D C:\Program Files (x86)\QuickTime 2013-03-25 00:11 - 2013-03-25 00:11 - 00001783 ____A C:\Users\Public\Desktop\iTunes.lnk 2013-03-25 00:11 - 2013-03-25 00:10 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-03-25 00:11 - 2013-03-25 00:10 - 00000000 ____D C:\Program Files\iTunes 2013-03-25 00:11 - 2013-03-25 00:10 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-03-25 00:10 - 2013-03-25 00:10 - 00000000 ____D C:\Users\UserAdmin\AppData\Local\Apple 2013-03-25 00:10 - 2013-03-25 00:10 - 00000000 ____D C:\ProgramData\Apple Computer 2013-03-25 00:10 - 2013-03-25 00:10 - 00000000 ____D C:\ProgramData\Apple 2013-03-25 00:10 - 2013-03-25 00:10 - 00000000 ____D C:\Program Files\iPod 2013-03-25 00:10 - 2013-03-25 00:10 - 00000000 ____D C:\Program Files\Bonjour 2013-03-25 00:10 - 2013-03-25 00:10 - 00000000 ____D C:\Program Files (x86)\Bonjour 2013-03-25 00:10 - 2013-03-25 00:10 - 00000000 ____D C:\Program Files (x86)\Apple Software Update 2013-03-24 21:09 - 2013-03-24 21:09 - 00001257 ____A C:\Users\UserAdmin\Desktop\Continuar la Instalacion de UpToDown downloader - Skype.lnk 2013-03-24 21:09 - 2013-03-24 21:09 - 00000000 ____D C:\ProgramData\Skype 2013-03-23 13:30 - 2013-03-14 12:34 - 00000000 ____D C:\Users\UserAdmin\AppData\Roaming\VLC 2013-03-21 18:55 - 2013-03-11 11:26 - 00000000 ____D C:\ProgramData\McAfee 2013-03-18 22:17 - 2013-03-18 22:17 - 00002082 ____A C:\Users\UserAdmin\Desktop\Nabokov.lnk 2013-03-18 22:17 - 2013-03-18 22:17 - 00000000 ____D C:\Users\UserAdmin\AppData\Roaming\TightVNC 2013-03-18 22:16 - 2013-03-18 22:16 - 00000000 ____D C:\Program Files\TightVNC 2013-03-17 00:18 - 2013-03-14 12:34 - 00000000 ____D C:\Users\UserAdmin\AppData\Roaming\Greenshot 2013-03-16 21:45 - 2013-03-16 21:45 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf 2013-03-14 13:06 - 2013-03-14 13:06 - 00000000 ____D C:\Users\UserAdmin\AppData\Roaming\IrfanView_Doppelmayr 2013-03-14 13:05 - 2013-03-14 13:05 - 00000656 ____A C:\Users\UserAdmin\Desktop\GTAA7.lnk 2013-03-14 13:00 - 2013-03-14 13:00 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_User_WpdFs_01_09_00.Wdf 2013-03-14 12:34 - 2013-03-14 12:34 - 00083728 ____A C:\Users\UserAdmin\AppData\Local\GDIPFONTCACHEV1.DAT 2013-03-14 12:34 - 2013-03-14 12:34 - 00000020 ___SH C:\Users\UserAdmin\ntuser.ini 2013-03-14 12:34 - 2013-03-14 12:34 - 00000000 __SHD C:\Users\UserAdmin\Vorlagen 2013-03-14 12:34 - 2013-03-14 12:34 - 00000000 __SHD C:\Users\UserAdmin\Startmenü 2013-03-14 12:34 - 2013-03-14 12:34 - 00000000 __SHD C:\Users\UserAdmin\Netzwerkumgebung 2013-03-14 12:34 - 2013-03-14 12:34 - 00000000 __SHD C:\Users\UserAdmin\Lokale Einstellungen 2013-03-14 12:34 - 2013-03-14 12:34 - 00000000 __SHD C:\Users\UserAdmin\Eigene Dateien 2013-03-14 12:34 - 2013-03-14 12:34 - 00000000 __SHD C:\Users\UserAdmin\Druckumgebung 2013-03-14 12:34 - 2013-03-14 12:34 - 00000000 __SHD C:\Users\UserAdmin\Documents\Eigene Musik 2013-03-14 12:34 - 2013-03-14 12:34 - 00000000 __SHD C:\Users\UserAdmin\Documents\Eigene Bilder 2013-03-14 12:34 - 2013-03-14 12:34 - 00000000 __SHD C:\Users\UserAdmin\AppData\Local\Verlauf 2013-03-14 12:34 - 2013-03-14 12:34 - 00000000 __SHD C:\Users\UserAdmin\AppData\Local\Anwendungsdaten 2013-03-14 12:34 - 2013-03-14 12:34 - 00000000 __SHD C:\Users\UserAdmin\Anwendungsdaten 2013-03-14 12:34 - 2013-03-14 12:34 - 00000000 ____D C:\Users\UserAdmin\AppData\Roaming\Macromedia 2013-03-14 12:34 - 2013-03-14 12:34 - 00000000 ____D C:\Users\UserAdmin\AppData\Local\VirtualStore ==================== Known DLLs (Whitelisted) ================= ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE ASSOCIATION ===================== HKLM\...\.exe: exefile => OK HKLM\...\exefile\DefaultIcon: %1 => OK HKLM\...\exefile\open\command: "%1" %* => OK ==================== Restore Points ========================= Restore point made on: 2013-03-18 17:59:48 Restore point made on: 2013-03-18 22:16:25 Restore point made on: 2013-03-25 00:10:34 Restore point made on: 2013-04-01 17:40:00 Restore point made on: 2013-04-09 05:00:06 ==================== Memory info =========================== Percentage of memory in use: 14% Total physical RAM: 3978.62 MB Available physical RAM: 3405.94 MB Total Pagefile: 3976.82 MB Available Pagefile: 3400.74 MB Total Virtual: 8192 MB Available Virtual: 8191.89 MB ==================== Partitions ============================= 1 Drive c: () (Fixed) (Total:111.43 GB) (Free:38.58 GB) NTFS ==>[Drive with boot components (obtained from BCD)] 2 Drive d: (CDROM) (CDROM) (Total:0.08 GB) (Free:0 GB) CDFS 3 Drive e: (USB DISK) (Removable) (Total:3.73 GB) (Free:3.72 GB) FAT32 4 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS Datentr„ger ### Status Gr”áe Frei Dyn GPT --------------- ------------- ------- ------- --- --- Datentr„ger 0 Online 119 GB 7998 MB Datentr„ger 1 Online 3824 MB 0 B Partitions of Disk 0: =============== Datentr„ger-ID: 108D040D Partition ### Typ Gr”áe Offset ------------- ---------------- ------- ------- Partition 1 Prim„r 111 GB 1024 KB ================================================================================== Disk: 0 Partition 1 Typ : 07 Versteckt: Nein Aktiv : Ja Volume ### Bst Bezeichnung DS Typ Gr”áe Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 1 C NTFS Partition 111 GB Fehlerfre ========================================================= Partitions of Disk 1: =============== Datentr„ger-ID: C3072E18 Partition ### Typ Gr”áe Offset ------------- ---------------- ------- ------- Partition 1 Prim„r 3823 MB 572 KB ================================================================================== Disk: 1 Partition 1 Typ : 0B Versteckt: Nein Aktiv : Ja Volume ### Bst Bezeichnung DS Typ Gr”áe Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 2 E USB DISK FAT32 Wechselmed 3823 MB Fehlerfre ========================================================= ============================== MBR Partition Table ================== ============================== Partitions of Disk 0: =============== Disk ID: 108D040D Partition 1: ========= Hex: 8020210007FEFFFF0008000000C0ED0D Active: YES Type: 07 (NTFS) Size: 111 GB ============================== Partitions of Disk 1: =============== Disk ID: C3072E18 Partition 1: ========= Hex: 800101000B7FD6CA78040000887B7700 Active: YES Type: 0B Size: 4 GB Last Boot: 2013-04-08 13:46 ==================== End Of Log ============================= |
| Themen zu Windows7 - Weisser Bildschirm |
| adobe, association, auswertung, bildschirm, boot, cdrom, desktop, downloader, farbar, farbar recovery scan tool, free, frst log, icon, ics, internet, log, microsoft, ordner, problem, registry, server, software, svchost.exe, system, system32, usb, windows, winlogon, winlogon.exe |
Baum-Darstellung