| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Win7: Bundespolizei-Trojaner, abgesicherter Modus funktioniert nicht.Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
03.08.2013, 03:29
| #1 |
| |  Win7: Bundespolizei-Trojaner, abgesicherter Modus funktioniert nicht. Hallo Jungs, Ich hab mir den Bundespolizei Virus eingefangen, über den abgesicherten Modus komme ich auch nicht mehr rein (fährt dann sofort runter und startet wieder im normalen Modus, wo dann die Zahlungsaufforderung kommt). Habe daher die Schritte aus diesem Thread ( http://www.trojaner-board.de/131258-...ktioniert.html ) befolgt bis zu dem Punkt, wo das Tool eine FRST.txt auf meinem USB-Stick erstellt hat. Im Folgenden der Inhalt. Hoffe, ihr könnt mir ab diesem Punkt weiterhelfen! Grüße, Christoph FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 01-08-2013 01
Ran by SYSTEM on 04-08-2013 03:52:41
Running from F:\
Windows 7 Home Premium (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery
The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and Addition.txt log.
ATTENTION!:=====> THE OPERATING SYSTEM IS A X64 SYSTEM BUT THE BOOT DISK THAT IS USED TO BOOT TO RECOVERY ENVIRONMENT IS A X86 SYSTEM DISK.
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [EeeStorageBackup] - C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe [1732608 2009-11-26] ()
HKLM\...\Run: [ETDWare] - C:\Program Files\Elantech\ETDCtrl.exe [621440 2009-09-30] (ELAN Microelectronic Corp.)
HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323584 2009-09-01] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [UfSeAgnt.exe] - C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe [1022904 2010-02-23] (Trend Micro Inc.)
HKU\Chr\...\Run: [HdRO-Launcher] - C:\Program Files (x86)\Codemasters\Der Herr der Ringe Online\TurbineInvoker.exe [ 2013-05-17] ()
HKU\Chr\...\Run: [msnmsgr] - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [ 2010-04-16] (Microsoft Corporation)
HKU\Chr\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\Chr\AppData\Local\Temp\snsdaobjcmwwwjick.exe [ 2013-08-02] () <===== ATTENTION
HKU\Chr\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_2_202_235_ActiveX.exe [ 2012-05-14] (Adobe Systems Incorporated)
HKU\Chr\...\Winlogon: [Shell] cmd.exe [ 2010-11-20] (Microsoft Corporation) <==== ATTENTION
HKU\Chr\...\Command Processor: "C:\Users\Chr\AppData\Local\Temp\snsdaobjcmwwwjick.exe" <===== ATTENTION!
Startup: C:\Users\Chr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe (No File)
========================== Services (Whitelisted) =================
S3 ADSMService; C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe [225280 2008-03-31] (ASUSTek Computer Inc.)
S2 AFBAgent; C:\Windows\system32\FBAgent.exe [359552 2009-09-17] (ASUSTeK Computer Inc.)
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [136360 2011-04-21] (Avira GmbH)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [269480 2011-07-04] (Avira GmbH)
S2 Apple Mobile Device; C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [55144 2012-02-26] (Apple Inc.)
S2 ASLDRService; C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe [84536 2009-06-16] (ASUS)
S3 aspnet_state; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [44376 2010-03-18] (Microsoft Corporation)
S2 ATKGFNEXSrv; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [94208 2007-08-08] ()
S2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [40384 2010-05-06] (ALWIL Software)
S3 avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [40384 2010-05-06] (ALWIL Software)
S3 avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [40384 2010-05-06] (ALWIL Software)
S2 BBSvc; C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [196176 2011-10-21] (Microsoft Corporation.)
S2 BBUpdate; C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE [249648 2011-10-13] (Microsoft Corporation)
S4 clr_optimization_v2.0.50727_64; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [89920 2009-06-10] (Microsoft Corporation)
S2 clr_optimization_v4.0.30319_64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [138576 2010-03-18] (Microsoft Corporation)
S3 FontCache3.0.0.0; C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [42856 2010-11-05] (Microsoft Corporation)
S3 fsssvc; C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [704872 2010-04-28] (Microsoft Corporation)
S2 gupdate; C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [135664 2010-02-28] (Google Inc.)
S3 gupdatem; C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [135664 2010-02-28] (Google Inc.)
S3 gusvc; C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe [182768 2010-02-28] (Google)
S2 ICQ Service; C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe [246520 2010-03-28] ()
S3 idsvc; C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe [856400 2010-11-05] (Microsoft Corporation)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [398184 2012-12-14] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [682344 2012-12-14] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
S3 MozillaMaintenance; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [117144 2013-06-26] (Mozilla Foundation)
S2 NAUpdate; C:\Program Files (x86)\Nero\Update\NASvc.exe [503080 2010-05-04] (Nero AG)
S4 NetMsmqActivator; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [124240 2010-03-18] (Microsoft Corporation)
S4 NetPipeActivator; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [124240 2010-03-18] (Microsoft Corporation)
S4 NetTcpActivator; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [124240 2010-03-18] (Microsoft Corporation)
S4 NetTcpPortSharing; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [124240 2010-03-18] (Microsoft Corporation)
S2 OberonGameConsoleService; C:\Program Files (x86)\Asus\Game Park\GameConsole\OberonGameConsoleService.exe [44312 2009-09-15] ()
S3 odserv; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [440696 2011-07-20] (Microsoft Corporation)
S3 ose; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [145184 2006-10-26] (Microsoft Corporation)
S3 PerfHost; C:\Windows\SysWow64\perfhost.exe [20992 2009-07-14] (Microsoft Corporation)
S2 SfCtlCom; C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe [859712 2010-10-09] (Trend Micro Inc.)
S3 spmgr; C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe [125496 2007-08-03] ()
S3 TMBMServer; C:\Program Files\Trend Micro\BM\TMBMSRV.exe [570632 2009-08-22] (Trend Micro Inc.)
S3 TmProxy; C:\Program Files\Trend Micro\Internet Security\TmProxy.exe [917768 2009-08-22] (Trend Micro Inc.)
==================== Drivers (Whitelisted) ====================
S0 AsDsm; C:\Windows\System32\Drivers\AsDsm.sys [35384 2011-06-14] (ASUSTek Computer Inc)
S2 ASMMAP64; C:\Program Files\ATKGFNEX\ASMMAP64.sys [14904 2007-07-24] ()
S2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [22096 2010-05-06] (ALWIL Software)
S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [63568 2010-05-06] (ALWIL Software)
S1 aswRdr; C:\Windows\System32\Drivers\aswRdr.sys [28752 2010-05-06] (ALWIL Software)
S1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [121936 2010-05-06] (ALWIL Software)
S1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [51280 2010-05-06] (ALWIL Software)
S3 athr; C:\Windows\System32\DRIVERS\athrx.sys [1542656 2009-10-05] (Atheros Communications, Inc.)
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88288 2011-07-04] (Avira GmbH)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [123784 2011-07-04] (Avira GmbH)
S3 b06bdrv; C:\Windows\system32\DRIVERS\bxvbda.sys [468480 2009-06-10] (Broadcom Corporation)
S3 b57nd60a; C:\Windows\System32\DRIVERS\b57nd60a.sys [270848 2009-06-10] (Broadcom Corporation)
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S3 ETD; C:\Windows\System32\DRIVERS\ETD.sys [117760 2009-10-15] (ELAN Microelectronic Corp.)
S2 ghaio; C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys [17464 2007-08-03] ()
S3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
S3 ksthunk; C:\Windows\system32\drivers\ksthunk.sys [20992 2009-07-14] (Microsoft Corporation)
S0 lullaby; C:\Windows\System32\DRIVERS\lullaby.sys [15928 2009-06-18] (Windows (R) Win 7 DDK provider)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [24176 2012-12-14] (Malwarebytes Corporation)
S3 MTsensor; C:\Windows\System32\DRIVERS\ATK64AMD.sys [15928 2009-05-13] (ASUS)
S3 RTL8167; C:\Windows\System32\DRIVERS\Rt64win7.sys [215040 2009-05-22] (Realtek )
S3 SiSGbeLH; C:\Windows\System32\DRIVERS\SiSG664.sys [56832 2009-06-10] (Silicon Integrated Systems Corp.)
S3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1799680 2009-08-12] ()
S2 tmpreflt; C:\Windows\System32\DRIVERS\tmpreflt.sys [42576 2010-07-30] (Trend Micro Inc.)
S1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [107536 2009-08-22] (Trend Micro Inc.)
S2 tmxpflt; C:\Windows\System32\DRIVERS\tmxpflt.sys [309840 2010-07-30] (Trend Micro Inc.)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [52736 2012-02-15] (Apple, Inc.)
S3 VIAHdAudAddService; C:\Windows\System32\drivers\viahduaa.sys [1222144 2009-07-09] (VIA Technologies, Inc.)
S2 vsapint; C:\Windows\System32\DRIVERS\vsapint.sys [1988176 2010-07-30] (Trend Micro Inc.)
S3 ipswuio; System32\DRIVERS\ipswuio.sys [x]
S1 StarOpen; No ImagePath
S3 tmlwf;
S3 tmwfp;
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-04 03:51 - 2013-08-04 03:51 - 00000000 ____D C:\FRST
2013-08-02 02:47 - 2013-08-02 02:47 - 01084668 _____ C:\ProgramData\2433f433
2013-08-02 02:47 - 2013-08-02 02:47 - 01084656 _____ C:\Users\Chr\AppData\Roaming\2433f433
2013-08-02 02:47 - 2013-08-02 02:47 - 01084654 _____ C:\Users\Chr\AppData\Local\2433f433
2013-08-01 19:07 - 2013-08-01 19:07 - 00000108 ____H C:\Users\Chr\Documents\.~lock.Unbenannt 2.odt#
2013-08-01 16:00 - 2013-08-03 17:05 - 00000824 _____ C:\Windows\System32\Drivers\etc\tmvsthfud.bin
2013-07-22 12:46 - 2013-07-22 12:48 - 11258647 _____ C:\Users\Chr\Downloads\Ãœbung Verwaltungsrecht.zip
2013-07-16 02:02 - 2013-07-16 02:08 - 00000000 ____D C:\Windows\System32\MRT
2013-07-12 02:44 - 2013-06-12 00:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-12 02:44 - 2013-06-12 00:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-12 02:44 - 2013-06-12 00:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-12 02:44 - 2013-06-12 00:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-12 02:44 - 2013-06-12 00:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-12 02:44 - 2013-06-12 00:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-12 02:44 - 2013-06-12 00:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-12 02:44 - 2013-06-12 00:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-12 02:44 - 2013-06-12 00:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-12 02:44 - 2013-06-12 00:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-12 02:44 - 2013-06-12 00:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-12 02:44 - 2013-06-12 00:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-12 02:44 - 2013-06-12 00:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-12 02:44 - 2013-06-12 00:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-07-12 02:44 - 2013-06-12 00:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-07-12 02:44 - 2013-06-12 00:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-07-12 02:44 - 2013-06-12 00:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-07-12 02:44 - 2013-06-12 00:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-07-12 02:44 - 2013-06-12 00:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-07-12 02:44 - 2013-06-12 00:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-07-12 02:44 - 2013-06-12 00:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-07-12 02:44 - 2013-06-12 00:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-07-12 02:44 - 2013-06-12 00:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-07-12 02:44 - 2013-06-12 00:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-07-12 02:44 - 2013-06-12 00:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-07-12 02:44 - 2013-06-12 00:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-07-12 02:44 - 2013-06-12 00:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-07-12 02:44 - 2013-06-11 23:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-12 02:44 - 2013-06-11 23:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-07-12 02:44 - 2013-06-07 04:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-07-12 02:44 - 2013-06-07 03:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-11 13:37 - 2013-06-04 07:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\System32\qedit.dll
2013-07-11 13:37 - 2013-06-04 05:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-11 13:37 - 2013-05-06 07:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL
2013-07-11 13:37 - 2013-05-06 05:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-11 13:31 - 2013-06-05 04:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-07-11 13:18 - 2013-04-10 00:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-11 13:18 - 2013-04-02 23:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\System32\DWrite.dll
2013-07-07 14:25 - 2013-08-03 17:04 - 00000824 _____ C:\Windows\System32\Drivers\etc\tmvsthfss.bin
==================== One Month Modified Files and Folders =======
2013-08-04 03:51 - 2013-08-04 03:51 - 00000000 ____D C:\FRST
2013-08-03 20:21 - 2009-07-14 05:51 - 00049713 _____ C:\Windows\setupact.log
2013-08-03 17:05 - 2013-08-01 16:00 - 00000824 _____ C:\Windows\System32\Drivers\etc\tmvsthfud.bin
2013-08-03 17:05 - 2010-02-28 16:06 - 01694153 _____ C:\Windows\WindowsUpdate.log
2013-08-03 17:04 - 2013-07-07 14:25 - 00000824 _____ C:\Windows\System32\Drivers\etc\tmvsthfss.bin
2013-08-02 03:44 - 2009-07-14 05:45 - 00010304 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-02 03:44 - 2009-07-14 05:45 - 00010304 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-02 02:58 - 2010-02-28 17:17 - 00002114 _____ C:\Windows\System32\AutoRunFilter.ini
2013-08-02 02:47 - 2013-08-02 02:47 - 01084668 _____ C:\ProgramData\2433f433
2013-08-02 02:47 - 2013-08-02 02:47 - 01084656 _____ C:\Users\Chr\AppData\Roaming\2433f433
2013-08-02 02:47 - 2013-08-02 02:47 - 01084654 _____ C:\Users\Chr\AppData\Local\2433f433
2013-08-01 19:07 - 2013-08-01 19:07 - 00000108 ____H C:\Users\Chr\Documents\.~lock.Unbenannt 2.odt#
2013-08-01 18:09 - 2010-07-24 01:26 - 00102398 _____ C:\Users\Chr\Documents\Unbenannt 2.odt
2013-07-27 15:59 - 2011-09-21 02:27 - 00000000 ____D C:\Users\Chr\Tracing
2013-07-23 21:03 - 2010-02-28 17:09 - 00072716 _____ C:\Windows\PFRO.log
2013-07-22 12:48 - 2013-07-22 12:46 - 11258647 _____ C:\Users\Chr\Downloads\Ãœbung Verwaltungsrecht.zip
2013-07-16 02:09 - 2013-06-03 22:17 - 00000000 ____D C:\Users\Chr\AppData\Roaming\noc
2013-07-16 02:08 - 2013-07-16 02:02 - 00000000 ____D C:\Windows\System32\MRT
2013-07-15 20:40 - 2012-01-06 23:00 - 00000000 ____D C:\bwinPoker JPC
2013-07-15 18:02 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Microsoft.NET
2013-07-14 00:18 - 2009-07-14 04:20 - 00000000 ___RD C:\Program Files (x86)
2013-07-12 23:10 - 2009-07-14 05:45 - 00473880 _____ C:\Windows\System32\FNTCACHE.DAT
2013-07-12 23:07 - 2012-05-12 02:03 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-12 23:05 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-12 23:05 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64
2013-07-12 23:04 - 2009-07-14 08:45 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-12 03:08 - 2009-07-14 06:13 - 01672900 _____ C:\Windows\System32\PerfStringBackup.INI
2013-07-12 02:48 - 2010-02-28 16:17 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-08 04:07 - 2011-03-02 15:19 - 31127552 ____H C:\Users\Chr\Downloads\photothumb.db
2013-07-05 20:30 - 2011-03-29 02:07 - 00000000 ____D C:\Users\Chr\Downloads\Originals
Files to move or delete:
====================
C:\Users\Chr\AppData\Local\Temp\snsdaobjcmwwwjick.exe
C:\Users\Chr\erdy4zgnosrno.exe
C:\Users\Chr\ifwh7gj0qyhsb.exe
==================== Known DLLs (Whitelisted) ============
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe
[2011-04-28 09:53] - [2011-02-25 07:19] - 2871808 ____A (Microsoft Corporation) 332FEAB1435662FC6C672E25BEB37BE3
C:\Windows\System32\winlogon.exe
[2011-06-25 06:07] - [2010-11-20 14:25] - 0390656 ____A (Microsoft Corporation) 1151B1BAA6F350B1DB6598E0FEA7C457
C:\Windows\System32\wininit.exe
[2009-07-14 00:52] - [2009-07-14 02:39] - 0129024 ____A (Microsoft Corporation) 94355C28C1970635A31B3FE52EB7CEBA
C:\Windows\System32\svchost.exe
[2009-07-14 00:31] - [2009-07-14 02:39] - 0027136 ____A (Microsoft Corporation) C78655BC80301D76ED4FEF1C1EA40A7D
C:\Windows\System32\services.exe
[2009-07-14 00:19] - [2009-07-14 02:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB
C:\Windows\System32\User32.dll
[2011-06-25 06:07] - [2010-11-20 14:27] - 1008128 ____A (Microsoft Corporation) FE70103391A64039A921DBFFF9C7AB1B
C:\Windows\System32\userinit.exe
[2011-06-25 06:05] - [2010-11-20 14:25] - 0030720 ____A (Microsoft Corporation) BAFE84E637BF7388C96EF48D4D3FDD53
C:\Windows\System32\Drivers\volsnap.sys
[2011-06-25 06:07] - [2010-11-20 14:34] - 0295808 ____A (Microsoft Corporation) 0D08D2F3B3FF84E433346669B5E0F639
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
==================== Restore Points =========================
Restore point made on: 2013-07-16 02:01:17
Restore point made on: 2013-07-20 17:01:25
Restore point made on: 2013-07-25 12:17:41
Restore point made on: 2013-07-28 12:58:04
Restore point made on: 2013-07-31 13:18:11
==================== Memory info ===========================
Percentage of memory in use: 13%
Total physical RAM: 4095.12 MB
Available physical RAM: 3540.08 MB
Total Pagefile: 4093.39 MB
Available Pagefile: 3558.49 MB
Total Virtual: 2047.88 MB
Available Virtual: 1921.06 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:116.44 GB) (Free:15.57 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATA) (Fixed) (Total:334.67 GB) (Free:334.18 GB) NTFS
Drive e: (Reparaturdatenträger Windows 7 3) (CDROM) (Total:0.14 GB) (Free:0 GB) UDF
Drive f: () (Removable) (Total:7.31 GB) (Free:6.81 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: 76692CA8)
Partition 1: (Not Active) - (Size=15 GB) - (Type=1C)
Partition 2: (Active) - (Size=116 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=335 GB) - (Type=OF Extended)
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 8 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=7 GB) - (Type=0B)
LastRegBack: 2012-03-02 10:01
==================== End Of Log ============================
|
| Themen zu Win7: Bundespolizei-Trojaner, abgesicherter Modus funktioniert nicht. |
| adobe, antivirus, association, asus, avast, avira, bingbar, computer, desktop, explorer, farbar, farbar recovery scan tool, fontcache, google, home, hotkey, icq, log, microsoft, opera, realtek, registry, security, software, system, temp, virus, vista, windows, windows xp |
Baum-Darstellung