![]() |
|
Log-Analyse und Auswertung: Habe ein Notbook meines Bekannten hier und erWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
![]() | #1 |
| ![]() Habe ein Notbook meines Bekannten hier und er Guten Abend :-) auch mein Bekannter (Win7) ist wohl opfer des GVU-Trojaners geworden. Beim Starten des PCs hat er nur einen schwarzen Bildschirm und das notepad mit cmd.exe öffnet sich (system32.), der gvu-Trojaner an sich erscheint nicht mehr, weil er ihn angeblich gelöscht hat. Doch ein Zugriff auf den Desktop ist nicht mehr . Habe frst schonmal drüber laufen lassen. Ich bitte um eure Hilfe!!! FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-07-2013 03 Ran by SYSTEM on 31-07-2013 19:59:22 Running from F:\ Windows 7 Home Premium (X64) OS Language: English(US) Internet Explorer Version 10 Boot Mode: Recovery The current controlset is ControlSet001 ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log. ==================== Registry (Whitelisted) ================== HKLM\...\Run: [ETDWare] - C:\Program Files\Elantech\ETDCtrl.exe [649608 2010-04-12] (ELAN Microelectronic Corp.) HKLM\...\Run: [ASUS WebStorage] - C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe [1754448 2010-03-15] () HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup [x] HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323584 2009-08-31] (AlcorMicro Co., Ltd.) HKLM\...\InprocServer32: [Default-cscui] <==== ATTENTION! HKLM-x32\...\Run: [UpdateLBPShortCut] - C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM-x32\...\Run: [UpdateP2GoShortCut] - C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM-x32\...\Run: [Boingo Wi-Fi] - C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo.lnk [2429 2010-10-08] () HKLM-x32\...\Run: [HControlUser] - C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS) HKLM-x32\...\Run: [ATKOSD2] - C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe [6859392 2009-08-17] (ASUS) HKLM-x32\...\Run: [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe [170624 2009-08-19] (ASUS) HKLM-x32\...\Run: [Wireless Console 3] - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [1597440 2010-04-26] () HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated) HKLM-x32\...\Run: [G Data AntiVirus Tray] - C:\Program Files (x86)\G Data\AntiVirus\AVKTray\AVKTray.exe [1444304 2013-03-21] (G Data Software AG) HKU\Detlef\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_7_700_224_ActiveX.exe [814472 2013-06-11] (Adobe Systems Incorporated) HKU\Detlef\...\Winlogon: [Shell] cmd.exe [345088 2010-11-20] (Microsoft Corporation) <==== ATTENTION ==================== Services (Whitelisted) ================= S2 ATKGFNEXSrv; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [94208 2007-08-07] () S2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [1957840 2013-03-22] (G Data Software AG) S2 AVKService; C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKService.exe [635344 2013-02-24] (G Data Software AG) S2 AVKWCtl; C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKWCtlX64.exe [2249944 2013-02-24] (G Data Software AG) S3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [696808 2013-02-25] (G Data Software AG) S2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [109352 2013-07-31] (SurfRight B.V.) S2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe [138272 2012-06-15] (Symantec Corporation) ==================== Drivers (Whitelisted) ==================== S2 ASMMAP64; C:\Program Files\ATKGFNEX\ASMMAP64.sys [14904 2007-07-24] () S2 ASMMAP64; C:\Program Files\ATKGFNEX\ASMMAP64.sys [14904 2007-07-24] () S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-05-31] (Symantec Corporation) S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-05-31] (Symantec Corporation) S1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1309010.00E\ccSetx64.sys [167072 2012-06-06] (Symantec Corporation) S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2012-08-09] (Symantec Corporation) S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2012-08-09] (Symantec Corporation) S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138912 2013-06-09] (Symantec Corporation) S3 ewsercd; C:\Windows\System32\DRIVERS\ewsercd.sys [112896 2011-12-20] (Huawei Technologies Co., Ltd.) S0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [60248 2013-06-02] (G Data Software AG) S1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [133976 2013-06-02] (G Data Software AG) S3 GdNetMon; C:\Windows\system32\drivers\GdNetMon64.sys [31448 2011-11-18] (G Data Software AG) S3 GdNetMon; C:\Windows\system32\drivers\GdNetMon64.sys [31448 2011-11-18] (G Data Software AG) S3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [62808 2013-06-02] (G Data Software AG) S1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64856 2013-06-02] (G Data Software AG) S1 GRD; C:\Windows\system32\drivers\GRD.sys [107128 2013-06-02] (G Data Software) S1 GRD; C:\Windows\system32\drivers\GRD.sys [107128 2013-06-02] (G Data Software) S3 GT72NDISIPXP; C:\Windows\System32\DRIVERS\Gt51Ip.sys [130048 2011-04-18] (Option N.V.) S3 GT72UBUS; C:\Windows\System32\DRIVERS\gt72ubus.sys [86528 2011-04-18] (Option N.V.) S3 GTPTSER; C:\Windows\System32\DRIVERS\gtptser.sys [10496 2011-04-18] (Option N.V.) S1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [64856 2013-06-02] (G Data Software AG) S1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\IPSDefs\20130726.001\IDSvia64.sys [513184 2013-06-07] (Symantec Corporation) S1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\IPSDefs\20130726.001\IDSvia64.sys [513184 2013-06-07] (Symantec Corporation) S3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( ) S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\VirusDefs\20130728.020\ENG64.SYS [126040 2013-07-20] (Symantec Corporation) S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\VirusDefs\20130728.020\ENG64.SYS [126040 2013-07-20] (Symantec Corporation) S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\VirusDefs\20130728.020\EX64.SYS [2098776 2013-07-20] (Symantec Corporation) S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\VirusDefs\20130728.020\EX64.SYS [2098776 2013-07-20] (Symantec Corporation) S3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1799680 2009-08-11] () S3 SRTSP; C:\Windows\System32\Drivers\NISx64\1309010.00E\SRTSP64.SYS [737952 2012-07-05] (Symantec Corporation) S1 SRTSPX; C:\Windows\system32\drivers\NISx64\1309010.00E\SRTSPX64.SYS [37536 2012-07-05] (Symantec Corporation) S0 SymDS; C:\Windows\System32\drivers\NISx64\1309010.00E\SYMDS64.SYS [451192 2011-07-25] (Symantec Corporation) S0 SymEFA; C:\Windows\System32\drivers\NISx64\1309010.00E\SYMEFA64.SYS [1129120 2012-05-21] (Symantec Corporation) S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [175736 2012-08-08] (Symantec Corporation) S1 SymIRON; C:\Windows\system32\drivers\NISx64\1309010.00E\Ironx64.SYS [190072 2012-04-17] (Symantec Corporation) S1 SymNetS; C:\Windows\System32\Drivers\NISx64\1309010.00E\SYMNETS.SYS [405624 2012-04-17] (Symantec Corporation) S3 tmlwf; S3 tmwfp; ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-07-31 19:58 - 2013-07-31 19:58 - 00000000 ____D C:\FRST 2013-07-31 08:34 - 2013-07-31 08:34 - 00001835 _____ C:\Users\Public\Desktop\HitmanPro.lnk 2013-07-31 08:34 - 2013-07-31 08:34 - 00000000 ____D C:\Program Files\HitmanPro 2013-07-31 04:53 - 2013-07-31 04:53 - 00000000 ____D C:\ProgramData\HitmanPro 2013-07-20 17:20 - 2013-06-11 15:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-07-20 17:20 - 2013-06-11 15:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-07-20 17:20 - 2013-06-11 15:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-07-20 17:20 - 2013-06-11 15:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-07-20 17:20 - 2013-06-11 15:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-07-20 17:20 - 2013-06-11 15:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-07-20 17:20 - 2013-06-11 15:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-07-20 17:20 - 2013-06-11 15:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-07-20 17:20 - 2013-06-11 15:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-07-20 17:20 - 2013-06-11 15:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-07-20 17:20 - 2013-06-11 15:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-07-20 17:20 - 2013-06-11 15:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-07-20 17:20 - 2013-06-11 15:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-07-20 17:20 - 2013-06-11 15:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll 2013-07-20 17:20 - 2013-06-11 15:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2013-07-20 17:20 - 2013-06-11 15:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe 2013-07-20 17:20 - 2013-06-11 15:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2013-07-20 17:20 - 2013-06-11 15:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2013-07-20 17:20 - 2013-06-11 15:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2013-07-20 17:20 - 2013-06-11 15:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2013-07-20 17:20 - 2013-06-11 15:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll 2013-07-20 17:20 - 2013-06-11 15:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2013-07-20 17:20 - 2013-06-11 15:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll 2013-07-20 17:20 - 2013-06-11 15:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll 2013-07-20 17:20 - 2013-06-11 15:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll 2013-07-20 17:20 - 2013-06-11 15:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2013-07-20 17:20 - 2013-06-11 15:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll 2013-07-20 17:20 - 2013-06-11 14:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2013-07-20 17:20 - 2013-06-11 14:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe 2013-07-20 17:20 - 2013-06-06 19:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2013-07-20 17:20 - 2013-06-06 18:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-07-20 13:36 - 2013-06-04 19:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys 2013-07-20 13:36 - 2013-06-03 22:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\System32\qedit.dll 2013-07-20 13:36 - 2013-06-03 20:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll 2013-07-20 13:36 - 2013-05-05 22:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL 2013-07-20 13:36 - 2013-05-05 20:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL 2013-07-20 13:32 - 2013-04-09 15:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll 2013-07-20 13:32 - 2013-04-02 14:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\System32\DWrite.dll 2013-07-02 12:41 - 2013-07-02 12:42 - 00000004 _____ C:\Users\Detlef\AppData\Roaming\skype.ini ==================== One Month Modified Files and Folders ======= 2013-07-31 19:58 - 2013-07-31 19:58 - 00000000 ____D C:\FRST 2013-07-31 08:42 - 2013-03-20 04:10 - 00003934 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{0067DBBD-3D30-4D90-AF99-8E0D4BD424E9} 2013-07-31 08:41 - 2009-07-13 20:45 - 00010016 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-07-31 08:41 - 2009-07-13 20:45 - 00010016 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-07-31 08:38 - 2010-10-08 11:42 - 02037906 _____ C:\Windows\WindowsUpdate.log 2013-07-31 08:34 - 2013-07-31 08:34 - 00001835 _____ C:\Users\Public\Desktop\HitmanPro.lnk 2013-07-31 08:34 - 2013-07-31 08:34 - 00000000 ____D C:\Program Files\HitmanPro 2013-07-31 08:34 - 2012-08-07 00:48 - 00065536 _____ C:\Windows\System32\Ikeext.etl 2013-07-31 08:34 - 2012-03-05 09:39 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-07-31 08:34 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-07-31 08:34 - 2009-07-13 20:51 - 00096860 _____ C:\Windows\setupact.log 2013-07-31 08:34 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\tracing 2013-07-31 04:53 - 2013-07-31 04:53 - 00000000 ____D C:\ProgramData\HitmanPro 2013-07-31 04:25 - 2013-06-20 01:46 - 00045056 _____ C:\Windows\System32\acovcnt.exe 2013-07-31 04:25 - 2012-09-01 01:14 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-07-31 04:25 - 2012-03-05 09:39 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-07-22 02:00 - 2009-08-04 01:51 - 00654400 _____ C:\Windows\System32\perfh007.dat 2013-07-22 02:00 - 2009-08-04 01:51 - 00130240 _____ C:\Windows\System32\perfc007.dat 2013-07-22 02:00 - 2009-07-13 21:13 - 01498742 _____ C:\Windows\System32\PerfStringBackup.INI 2013-07-22 01:56 - 2013-03-09 12:27 - 00000000 ____D C:\Users\Detlef\bilder 2013 2013-07-21 01:53 - 2012-08-07 00:44 - 00000000 ____D C:\ProgramData\Norton 2013-07-20 18:06 - 2009-07-13 20:45 - 00416312 _____ C:\Windows\System32\FNTCACHE.DAT 2013-07-20 18:05 - 2013-03-14 07:54 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2013-07-20 18:05 - 2013-03-14 07:54 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight 2013-07-20 18:02 - 2009-07-13 23:45 - 00000000 ____D C:\Program Files\Windows Journal 2013-07-20 18:02 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files\Windows Defender 2013-07-20 18:02 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender 2013-07-20 17:45 - 2010-12-02 09:19 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-07-20 17:23 - 2010-12-08 07:18 - 78185248 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe 2013-07-20 13:19 - 2013-06-17 06:06 - 00000000 ____D C:\Users\Public\Downloads\Norton 2013-07-20 13:15 - 2012-07-12 06:08 - 00002185 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2013-07-20 13:05 - 2012-03-05 09:39 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2013-07-20 13:04 - 2012-03-05 09:39 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2013-07-04 23:26 - 2012-09-23 06:06 - 00000000 ____D C:\Users\Detlef\Desktop\Klasse 5b 2013-07-02 12:42 - 2013-07-02 12:41 - 00000004 _____ C:\Users\Detlef\AppData\Roaming\skype.ini Files to move or delete: ==================== C:\ProgramData\iwejodb.pad C:\Users\Detlef\AppData\Roaming\skype.ini ==================== Known DLLs (Whitelisted) ================ ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE ASSOCIATION ===================== HKLM\...\.exe: exefile => OK HKLM\...\exefile\DefaultIcon: %1 => OK HKLM\...\exefile\open\command: "%1" %* => OK ==================== Restore Points ========================= ==================== Memory info =========================== Percentage of memory in use: 17% Total physical RAM: 3071.27 MB Available physical RAM: 2524.22 MB Total Pagefile: 3069.42 MB Available Pagefile: 2524.66 MB Total Virtual: 8192 MB Available Virtual: 8191.86 MB ==================== Drives ================================ Drive c: (OS) (Fixed) (Total:74.52 GB) (Free:28.53 GB) NTFS (Disk=0 Partition=2) ==>[System with boot components (obtained from reading drive)] Drive d: (DATA) (Fixed) (Total:204.03 GB) (Free:203.81 GB) NTFS (Disk=0 Partition=3) Drive e: (IMAGE_CD) (CDROM) (Total:0.06 GB) (Free:0 GB) CDFS Drive f: (HITMANPRO) (Removable) (Total:7.51 GB) (Free:7.51 GB) FAT32 (Disk=1 Partition=1) Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: E0C5913D) Partition 1: (Not Active) - (Size=20 GB) - (Type=1C) Partition 2: (Active) - (Size=75 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=204 GB) - (Type=OF Extended) ======================================================== Disk: 1 (Size: 8 GB) (Disk ID: E3535D03) Partition 1: (Active) - (Size=8 GB) - (Type=0B) LastRegBack: 2013-05-26 08:01 ==================== End Of Log ============================ --- --- --- --- --- --- |
Themen zu Habe ein Notbook meines Bekannten hier und er |
abend, angeblich, association, beim starten, bekannte, bildschirm, cmd.exe, desktop, erscheint, farbar, farbar recovery scan tool, frst.txt, gelöscht, guten, hilfe!, laufen, nicht mehr, notepad, opfer, pcs, schonmal, schwarze, starte, starten, system, win, win7, zugriff, öffnet |