| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Win 7 (64): GVU/BKA Trojaner - nur abgesicherter Modus mit Eingabeaufforderung möglichWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
29.07.2013, 12:21
| #1 |
| |  Win 7 (64): GVU/BKA Trojaner - nur abgesicherter Modus mit Eingabeaufforderung möglich Hallo liebes Trojaner Board! Heute morgen habe ich mir leider beim surfen im Internet einen GUV/BKA Trojaner eingefangen. Diesen hatte ich mir erstmals vor etwa 2-3 Monaten eingefangen, konnte diesen aber durch entfernen verdächtiger Daten im abgesicherten Modus beseitigen. Nun ist er allerdings wieder aufgetaucht. Allerdings blockiert er diesmal den Abgesicherten Modus, der Abgesicherte Modus mit Eingabeaufforderung ist allerdings verfügbar! Ich hab jetzt schonmal Farbar's Recovery Scan Tool drüber laufen lassen und folgenden Log erhalten: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-07-2013
Ran by SYSTEM on 29-07-2013 13:10:14
Running from E:\
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery
The current controlset is ControlSet002
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1425408 2012-02-14] (IDT, Inc.)
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()
HKLM\...\Run: [IntelMyWiFiDashboard] - C:\Program Files\Intel\WiFi\bin\CCDashServer.exe [4966912 2012-03-30] (Intel® Corporation)
HKLM\...\Run: [DellStage] - C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj [483424 2012-02-01] ()
HKLM\...\Run: [BLEServicesCtrl] - C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [120592 2012-01-10] ()
HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [626552 2012-04-09] (Alps Electric Co., Ltd.)
HKLM-x32\...\Winlogon: [Shell] C:\PROGRA~3\oldodl.bat [x ] () <=== ATTENTION
HKLM-x32\...\Run: [mcui_exe] - C:\Program Files\McAfee.com\Agent\mcagent.exe [1532992 2013-03-13] (McAfee, Inc.)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-27] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)
HKU\Markus\...\Run: [DellSystemDetect] - C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dell\Dell System Detect.appref-ms [370 2013-07-27] ()
HKU\Markus\...\Winlogon: [Shell] explorer.exe,C:\Users\Markus\AppData\Roaming\cache.dat [84992 2012-09-04] () <==== ATTENTION
AppInit_DLLs: C:\Windows\system32\nvinitx.dll [247144 2012-10-08] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\progra~3\browse~1\261040~1.25\{c16c1~1\browse~1.dll c:\windows\syswow64\nvinit.dll [247144 2012-10-08] ()
Startup: C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\net.lnk
ShortcutTarget: net.lnk -> C:\Users\Markus\AppData\Roaming\Windows Net Data\net.exe (Windows Net)
==================== Services (Whitelisted) =================
S3 McAWFwk; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [224704 2011-03-08] (McAfee, Inc.)
S2 McMPFSvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 mcmscsvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McNaiAnn; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McNASvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [383608 2012-11-16] (McAfee, Inc.)
S4 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McProxy; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [241456 2013-02-19] (McAfee, Inc.)
S2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [218760 2013-02-19] (McAfee, Inc.)
S2 mfevtp; C:\Windows\system32\mfevtps.exe [182752 2013-02-19] (McAfee, Inc.)
S2 MSK80Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2012-03-29] ()
S3 OpenVPNService; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [36352 2009-12-12] ()
S2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2669840 2012-03-29] (Intel® Corporation)
==================== Drivers (Whitelisted) ====================
S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70112 2013-02-19] (McAfee, Inc.)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.)
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [179280 2013-02-19] (McAfee, Inc.)
S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [309840 2013-02-19] (McAfee, Inc.)
S3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [515968 2013-02-19] (McAfee, Inc.)
S0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [771536 2013-02-19] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [106552 2013-02-19] (McAfee, Inc.)
S0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [340216 2013-02-19] (McAfee, Inc.)
S3 NETwNs64; C:\Windows\System32\DRIVERS\Netwsw00.sys [11471872 2012-04-27] (Intel Corporation)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-07-29 13:09 - 2013-07-29 13:09 - 00000000 ____D C:\FRST
2013-07-29 07:27 - 2013-07-29 11:22 - 00000004 _____ C:\Users\Markus\AppData\Roaming\cache.ini
2013-07-27 11:45 - 2013-07-27 12:05 - 00003440 _____ C:\Windows\System32\Tasks\PCDEventLauncherTask
2013-07-27 11:45 - 2013-07-27 11:45 - 00000000 ____D C:\ProgramData\PC-Doctor for Windows
2013-07-27 11:45 - 2013-07-27 11:45 - 00000000 ____D C:\Program Files\My Dell
2013-07-27 09:12 - 2013-07-27 09:12 - 00010699 _____ C:\Users\Markus\Downloads\dellsystemdetect.bootstrapper.application
2013-07-15 14:33 - 2013-07-15 14:33 - 00016356 _____ C:\Users\Markus\Downloads\InfoVorlesung 11Mai.odt
2013-07-12 23:58 - 2013-07-12 23:58 - 00000000 ____D C:\Users\Markus\AppData\Roaming\Bildverkleinerer
2013-07-12 20:08 - 2013-07-12 20:08 - 00289792 _____ (Dr. Wuro Industries) C:\Users\Markus\Downloads\verkleinerer17b.exe
2013-07-12 02:07 - 2013-06-12 00:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-12 02:07 - 2013-06-12 00:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-12 02:07 - 2013-06-12 00:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-12 02:07 - 2013-06-12 00:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-12 02:07 - 2013-06-12 00:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-12 02:07 - 2013-06-12 00:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-12 02:07 - 2013-06-12 00:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-12 02:07 - 2013-06-12 00:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-12 02:07 - 2013-06-12 00:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-12 02:07 - 2013-06-12 00:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-12 02:07 - 2013-06-12 00:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-12 02:07 - 2013-06-12 00:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-12 02:07 - 2013-06-12 00:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-12 02:07 - 2013-06-12 00:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-07-12 02:07 - 2013-06-12 00:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-07-12 02:07 - 2013-06-12 00:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-07-12 02:07 - 2013-06-12 00:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-07-12 02:07 - 2013-06-12 00:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-07-12 02:07 - 2013-06-12 00:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-07-12 02:07 - 2013-06-12 00:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-07-12 02:07 - 2013-06-12 00:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-07-12 02:07 - 2013-06-12 00:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-07-12 02:07 - 2013-06-12 00:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-07-12 02:07 - 2013-06-12 00:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-07-12 02:07 - 2013-06-12 00:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-07-12 02:07 - 2013-06-12 00:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-07-12 02:07 - 2013-06-12 00:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-07-12 02:07 - 2013-06-11 23:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-12 02:07 - 2013-06-11 23:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-07-12 02:07 - 2013-06-07 04:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-07-12 02:07 - 2013-06-07 03:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-11 20:48 - 2013-07-11 21:12 - 72833304 _____ C:\Users\Markus\Downloads\OneRepublic - Dreaming out load (2007).rar.part
2013-07-11 20:48 - 2013-07-11 20:48 - 00000000 _____ C:\Users\Markus\Downloads\OneRepublic - Dreaming out load (2007).rar
2013-07-11 15:06 - 2013-06-04 07:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\System32\qedit.dll
2013-07-11 15:06 - 2013-06-04 05:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-11 15:06 - 2013-05-06 07:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL
2013-07-11 15:06 - 2013-05-06 05:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-11 15:05 - 2013-06-05 04:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-07-11 15:04 - 2013-04-10 00:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-11 15:04 - 2013-04-02 23:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\System32\DWrite.dll
2013-07-09 14:41 - 2013-07-09 14:41 - 00001097 _____ C:\Users\Markus\Desktop\BayDesigner.lnk
2013-07-09 14:41 - 2013-07-09 14:41 - 00000000 ____D C:\Users\Markus\AppData\Roaming\aborange
2013-07-09 14:41 - 2013-07-09 14:41 - 00000000 ____D C:\Program Files (x86)\BayDesigner
2013-07-09 14:40 - 2013-07-12 15:03 - 00000000 ____D C:\Users\Markus\AppData\Roaming\Windows Net Data
2013-07-09 14:40 - 2013-07-09 14:40 - 00000188 _____ C:\Users\Markus\Desktop\Amazon.de.url
2013-07-09 14:40 - 2013-07-09 14:40 - 00000000 ____D C:\Users\Markus\ChromeExtensions
2013-07-09 14:40 - 2013-07-09 14:40 - 00000000 ____D C:\Users\Markus\AppData\Local\Temp29e26ae873fff61476ba43fbb3358532
2013-07-09 14:40 - 2013-07-09 14:40 - 00000000 ____D C:\Users\Markus\AppData\Local\Temp26474e5889f25a5ecfaf0c919f3df3bc
2013-07-09 14:40 - 2013-07-09 14:40 - 00000000 ____D C:\Users\Markus\AppData\Local\Temp177d65fb88146994dc78c5e18a8d72e1
2013-07-09 14:38 - 2013-07-15 11:41 - 00000714 _____ C:\Users\Markus\Desktop\Bescheibung.txt
2013-07-05 06:37 - 2013-07-05 06:37 - 00000000 ____D C:\Users\Markus\Desktop\Drucken
2013-07-04 14:20 - 2013-07-04 14:20 - 00012604 _____ C:\Users\Markus\Downloads\Auswertung PH Schallwellen hinter beugenden Hindernissen.xlsx
2013-07-04 14:19 - 2013-07-04 14:19 - 00334461 _____ C:\Users\Markus\Downloads\physik interferenz.odt
2013-07-04 14:19 - 2013-07-04 14:19 - 00015032 _____ C:\Users\Markus\Downloads\Auswertung Physik(beugende hindernisse).ods
2013-07-04 14:18 - 2013-07-04 14:18 - 00043535 _____ C:\Users\Markus\Downloads\Interferenz - Tabelle mit Formeln.ods
2013-07-04 13:30 - 2013-07-04 13:30 - 00000000 ____D C:\Users\Markus\Desktop\Studium
2013-07-03 08:59 - 2013-07-03 08:59 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-01 15:11 - 2013-07-01 21:08 - 00023552 _____ C:\Users\Markus\Desktop\Tabelle.xls
==================== One Month Modified Files and Folders =======
2013-07-29 13:09 - 2013-07-29 13:09 - 00000000 ____D C:\FRST
2013-07-29 11:27 - 2012-09-04 15:35 - 01068911 _____ C:\Windows\WindowsUpdate.log
2013-07-29 11:23 - 2012-09-19 17:34 - 00000000 ____D C:\users\Markus
2013-07-29 11:22 - 2013-07-29 07:27 - 00000004 _____ C:\Users\Markus\AppData\Roaming\cache.ini
2013-07-29 11:22 - 2013-04-26 18:06 - 00005728 _____ C:\Windows\setupact.log
2013-07-29 11:22 - 2012-09-04 16:12 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup
2013-07-29 11:22 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-29 08:26 - 2009-07-14 05:45 - 00021072 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-29 08:26 - 2009-07-14 05:45 - 00021072 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-29 08:24 - 2012-10-06 10:21 - 00000000 ____D C:\Users\Markus\AppData\Local\Deployment
2013-07-29 08:22 - 2012-09-04 16:20 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks
2013-07-29 08:22 - 2012-09-04 16:20 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks
2013-07-29 07:54 - 2012-09-04 15:38 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-29 06:42 - 2010-11-21 07:50 - 00696870 _____ C:\Windows\System32\perfh007.dat
2013-07-29 06:42 - 2010-11-21 07:50 - 00148134 _____ C:\Windows\System32\perfc007.dat
2013-07-29 06:42 - 2009-07-14 06:13 - 01612484 _____ C:\Windows\System32\PerfStringBackup.INI
2013-07-27 12:28 - 2012-11-21 15:52 - 00000000 ____D C:\Windows\System32\Tasks\Games
2013-07-27 12:05 - 2013-07-27 11:45 - 00003440 _____ C:\Windows\System32\Tasks\PCDEventLauncherTask
2013-07-27 11:45 - 2013-07-27 11:45 - 00000000 ____D C:\ProgramData\PC-Doctor for Windows
2013-07-27 11:45 - 2013-07-27 11:45 - 00000000 ____D C:\Program Files\My Dell
2013-07-27 11:45 - 2012-09-04 16:29 - 00000000 ____D C:\Program Files\Dell Support Center
2013-07-27 11:44 - 2013-02-14 15:37 - 00000000 ____D C:\ProgramData\PCDr
2013-07-27 11:43 - 2013-02-14 15:36 - 00000000 ____D C:\Users\Markus\AppData\Roaming\PCDr
2013-07-27 09:12 - 2013-07-27 09:12 - 00010699 _____ C:\Users\Markus\Downloads\dellsystemdetect.bootstrapper.application
2013-07-25 18:42 - 2012-12-19 22:12 - 00000000 ____D C:\Program Files (x86)\World of Warcraft Public Test
2013-07-21 11:35 - 2012-09-04 16:31 - 00000000 ____D C:\Program Files (x86)\McAfee
2013-07-21 11:34 - 2010-11-21 04:47 - 00038296 _____ C:\Windows\PFRO.log
2013-07-15 14:33 - 2013-07-15 14:33 - 00016356 _____ C:\Users\Markus\Downloads\InfoVorlesung 11Mai.odt
2013-07-15 11:41 - 2013-07-09 14:38 - 00000714 _____ C:\Users\Markus\Desktop\Bescheibung.txt
2013-07-14 03:24 - 2012-09-19 17:38 - 00000000 ____D C:\Users\Markus\AppData\Local\Adobe
2013-07-14 03:23 - 2012-09-04 15:38 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-14 03:23 - 2012-09-04 15:38 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-07-12 23:58 - 2013-07-12 23:58 - 00000000 ____D C:\Users\Markus\AppData\Roaming\Bildverkleinerer
2013-07-12 20:08 - 2013-07-12 20:08 - 00289792 _____ (Dr. Wuro Industries) C:\Users\Markus\Downloads\verkleinerer17b.exe
2013-07-12 15:03 - 2013-07-09 14:40 - 00000000 ____D C:\Users\Markus\AppData\Roaming\Windows Net Data
2013-07-12 02:32 - 2013-03-14 03:02 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-12 02:32 - 2013-03-14 03:02 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-12 02:32 - 2009-07-14 05:45 - 00372344 _____ C:\Windows\System32\FNTCACHE.DAT
2013-07-12 02:31 - 2010-11-21 08:00 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-12 02:31 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-12 02:31 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-12 02:08 - 2012-09-25 06:51 - 78185248 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-07-11 21:12 - 2013-07-11 20:48 - 72833304 _____ C:\Users\Markus\Downloads\OneRepublic - Dreaming out load (2007).rar.part
2013-07-11 20:48 - 2013-07-11 20:48 - 00000000 _____ C:\Users\Markus\Downloads\OneRepublic - Dreaming out load (2007).rar
2013-07-09 14:41 - 2013-07-09 14:41 - 00001097 _____ C:\Users\Markus\Desktop\BayDesigner.lnk
2013-07-09 14:41 - 2013-07-09 14:41 - 00000000 ____D C:\Users\Markus\AppData\Roaming\aborange
2013-07-09 14:41 - 2013-07-09 14:41 - 00000000 ____D C:\Program Files (x86)\BayDesigner
2013-07-09 14:40 - 2013-07-09 14:40 - 00000188 _____ C:\Users\Markus\Desktop\Amazon.de.url
2013-07-09 14:40 - 2013-07-09 14:40 - 00000000 ____D C:\Users\Markus\ChromeExtensions
2013-07-09 14:40 - 2013-07-09 14:40 - 00000000 ____D C:\Users\Markus\AppData\Local\Temp29e26ae873fff61476ba43fbb3358532
2013-07-09 14:40 - 2013-07-09 14:40 - 00000000 ____D C:\Users\Markus\AppData\Local\Temp26474e5889f25a5ecfaf0c919f3df3bc
2013-07-09 14:40 - 2013-07-09 14:40 - 00000000 ____D C:\Users\Markus\AppData\Local\Temp177d65fb88146994dc78c5e18a8d72e1
2013-07-05 13:17 - 2012-09-19 17:51 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-05 06:37 - 2013-07-05 06:37 - 00000000 ____D C:\Users\Markus\Desktop\Drucken
2013-07-04 14:20 - 2013-07-04 14:20 - 00012604 _____ C:\Users\Markus\Downloads\Auswertung PH Schallwellen hinter beugenden Hindernissen.xlsx
2013-07-04 14:19 - 2013-07-04 14:19 - 00334461 _____ C:\Users\Markus\Downloads\physik interferenz.odt
2013-07-04 14:19 - 2013-07-04 14:19 - 00015032 _____ C:\Users\Markus\Downloads\Auswertung Physik(beugende hindernisse).ods
2013-07-04 14:18 - 2013-07-04 14:18 - 00043535 _____ C:\Users\Markus\Downloads\Interferenz - Tabelle mit Formeln.ods
2013-07-04 13:30 - 2013-07-04 13:30 - 00000000 ____D C:\Users\Markus\Desktop\Studium
2013-07-03 08:59 - 2013-07-03 08:59 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-01 21:08 - 2013-07-01 15:11 - 00023552 _____ C:\Users\Markus\Desktop\Tabelle.xls
Files to move or delete:
====================
C:\ProgramData\oldodl.bat
C:\ProgramData\oldodl.pad
C:\ProgramData\oldodl.reg
C:\ProgramData\rundll32.exe
C:\Users\Markus\AppData\Roaming\cache.dat
C:\Users\Markus\AppData\Roaming\cache.ini
==================== Known DLLs (Whitelisted) ================
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
==================== Restore Points =========================
==================== Memory info ===========================
Percentage of memory in use: 13%
Total physical RAM: 6015.41 MB
Available physical RAM: 5230.1 MB
Total Pagefile: 6013.61 MB
Available Pagefile: 5231.31 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:911.66 GB) (Free:779.22 GB) NTFS (Disk=0 Partition=3)
Drive e: (USB-STICK) (Removable) (Total:7.91 GB) (Free:7.82 GB) FAT32 (Disk=1 Partition=1)
Drive f: (RECOVERY) (Fixed) (Total:19.81 GB) (Free:6.09 GB) NTFS (Disk=0 Partition=2) ==>[System with boot components (obtained from reading drive)]
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 932 GB) (Disk ID: EC5A292C)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=20 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=912 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (Size: 8 GB) (Disk ID: C194809C)
Partition 1: (Not Active) - (Size=8 GB) - (Type=0B)
LastRegBack: 2013-07-25 18:26
==================== End Of Log ============================
Grüße Nessless |
| Themen zu Win 7 (64): GVU/BKA Trojaner - nur abgesicherter Modus mit Eingabeaufforderung möglich |
| adobe, association, blockiert, desktop, entfernen, explorer, farbar, farbar recovery scan tool, flash player, frst.txt, gvu/bka, home, internet, log, mozilla, nur abgesicherter modus, nvidia, registry, rundll, scan, services.exe, surfen, svchost.exe, system, temp, trojaner, trojaner board, usb, vista, winlogon.exe |
Baum-Darstellung