| |
| |||||||
Log-Analyse und Auswertung: Nach Trojaner-Entfernung hängt PC beim Start bei cmd.exeWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
20.08.2013, 10:51
| #1 |
 |  Nach Trojaner-Entfernung hängt PC beim Start bei cmd.exe Hallo zusammen, ich habe vermutlich genau das gleiche Problem wie "norre" in folgendem Thread: http://www.trojaner-board.de/136734-...t-cmd-exe.html Bei meinem Win7 64bit-Sytsem hat AVG irgendetwas erkannt und automatisch entfernt. Nach der Entfernung startet mein PC nicht mehr: Nach dem Anmeldung erscheint ein DOS-Fenster mit CMD.EXE und er bleibt stehen (auch im Abgesicherten Modus). Im CMD-Fenster konnte eine exe-Datei mit kryptischem Namen nicht geöffnet werden. Diese Datei wurde vermutlich von AVG gelöscht. Den Eintrag habe ich in der Systemregistrierung gefunden und entfernt. Seit dem erscheint die "blanko"-CMD.exe bei Neustart und wartet auf neue Eingaben! Starte ich nun den Taskamanger und gebe als Task explorer.exe ein startet mein Desktop. In dem oben aufgeführten Thread habe ich ja bereits lesen können, wie hier vorgegangen wird. Also habe ich das gleich mal ausprobiert. Also poster ich folgend den Inhalt der FRST.txt Vielleicht kann mir hier jemand, evtl. "schrauber" entsprechenden Inhalt für die Fixlog.txt zukommen lassen? Herzlichen Dank vorab für die Hilfe! Gruß Leo Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-08-2013 03
Ran by SYSTEM on 20-08-2013 11:17:49
Running from H:\
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery
The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2012-04-06] (Realtek Semiconductor)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-06-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AVG_UI] - C:\Program Files (x86)\AVG\AVG2013\avgui.exe [4411440 2013-07-01] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1075296 2013-04-25] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [Adobe Creative Cloud] - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2236816 2013-07-12] (Adobe Systems Incorporated)
HKU\LeoDesign\...\Run: [1&1_1&1 Upload-Manager] - "d:\Programme\1&1 Upload-Manager\DAVSRV.EXE" /hide [x]
HKU\LeoDesign\...\Run: [Haufe.TimeManagement] - D:\Programme\zeitmanagement\Haufe.TimeManagement.exe [x]
HKU\LeoDesign\...\Run: [BackupSF] - D:\Programme\BackupSF\BackupSF.exe -h [x]
HKU\LeoDesign\...\Run: [Wunderlist] - C:\Program Files (x86)\Wunderlist2\Wunderlist.exe [12995168 2013-08-09] (6 Wunderkinder GmbH)
HKU\LeoDesign\...\Run: [SecretFolder] - C:\Program Files (x86)\SecretFolder\SecretFolder.exe [4143616 2013-07-11] (oh!soft)
HKU\LeoDesign\...\Run: [Volume2] - D:\Portable\Volume2\Volume2.exe [x]
HKU\LeoDesign\...\Winlogon: [Shell] cmd.exe [345088 2010-11-21] (Microsoft Corporation) <==== ATTENTION
Startup: C:\Users\LeoDesign\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> D:\Portable\DropboxPortableAHK\DropboxPortableAHK.exe (No File)
Startup: C:\Users\LeoDesign\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk
ShortcutTarget: EvernoteClipper.lnk -> D:\Programme\Evernote\EvernoteClipper.exe (No File)
Startup: C:\Users\LeoDesign\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TrayIt!.lnk
ShortcutTarget: TrayIt!.lnk -> D:\Portable\TrayIt\TrayIt!.exe (No File)
==================== Services (Whitelisted) =================
S2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.00.14\atkexComSvc.exe [922240 2011-06-13] ()
S2 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe [915584 2010-12-02] ()
S2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe [586880 2010-10-21] ()
S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [4939312 2013-07-04] (AVG Technologies CZ, s.r.o.)
S2 avgwd; C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [283136 2013-07-23] (AVG Technologies CZ, s.r.o.)
S4 DBService; C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe [189776 2010-10-28] (DATA BECKER GmbH & Co KG)
S2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [98576 2012-06-17] (SANDBOXIE L.T.D)
S2 WTService; C:\Windows\system32\atwtusb.exe [897536 2011-07-19] ()
S2 StarMoney 9.0 OnlineUpdate; d:\Programme\StarMoney\ouservice\StarMoneyOnlineUpdate.exe [x]
S2 TuneUp.UtilitiesSvc; "D:\Programme\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe" [x]
==================== Drivers (Whitelisted) ====================
S1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-24] ()
S1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-24] ()
S1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [14464 2010-08-03] ()
S1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [14464 2010-08-03] ()
S1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [246072 2013-07-20] (AVG Technologies CZ, s.r.o.)
S0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [71480 2013-07-20] (AVG Technologies CZ, s.r.o.)
S1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [206648 2013-07-20] (AVG Technologies CZ, s.r.o.)
S0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [311608 2013-07-20] (AVG Technologies CZ, s.r.o.)
S0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [116536 2013-07-01] (AVG Technologies CZ, s.r.o.)
S0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [45880 2013-07-10] (AVG Technologies CZ, s.r.o.)
S1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [240952 2013-03-21] (AVG Technologies CZ, s.r.o.)
S2 hfFilter; C:\Windows\System32\drivers\hfFilter.sys [30600 2013-06-20] (oh!soft)
S3 moufiltr; C:\Windows\System32\DRIVERS\moufiltr.sys [7680 2009-03-08] (Windows (R) Codename Longhorn DDK provider)
S3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [166576 2012-06-17] (SANDBOXIE L.T.D)
S3 Sftfs; C:\Windows\System32\DRIVERS\Sftfswin7.sys [765288 2011-10-01] (Microsoft Corporation)
S3 Sftplay; C:\Windows\System32\DRIVERS\Sftplaywin7.sys [268648 2011-10-01] (Microsoft Corporation)
S3 Sftredir; C:\Windows\System32\DRIVERS\Sftredirwin7.sys [25960 2011-10-01] (Microsoft Corporation)
S3 Sftvol; C:\Windows\System32\DRIVERS\Sftvolwin7.sys [22376 2011-10-01] (Microsoft Corporation)
S1 ui11rdr; C:\Windows\System32\DRIVERS\ui11rdr.sys [199752 2011-11-21] (1&1 Internet AG)
S3 vhidmini; C:\Windows\System32\DRIVERS\walvhid.sys [7552 2009-08-26] (Windows (R) Win 7 DDK provider)
S3 DfSdkS;
S3 TuneUpUtilitiesDrv; \??\D:\Programme\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-16 10:08 - 2013-08-16 19:52 - 00000000 ____D C:\Users\LeoDesign\AppData\Roaming\Yrkedi
2013-08-16 10:08 - 2013-08-16 11:00 - 00000000 ____D C:\Users\LeoDesign\AppData\Roaming\Ifap
2013-08-16 10:08 - 2013-08-16 10:08 - 00000000 ____D C:\Users\LeoDesign\AppData\Roaming\Yfilcy
2013-08-14 10:26 - 2013-07-26 06:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-08-14 10:26 - 2013-07-26 06:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-08-14 10:26 - 2013-07-26 06:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-08-14 10:26 - 2013-07-26 06:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-08-14 10:26 - 2013-07-26 06:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-08-14 10:26 - 2013-07-26 06:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-08-14 10:26 - 2013-07-26 06:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-08-14 10:26 - 2013-07-26 06:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-08-14 10:26 - 2013-07-26 06:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-08-14 10:26 - 2013-07-26 06:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-08-14 10:26 - 2013-07-26 06:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-08-14 10:26 - 2013-07-26 06:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-08-14 10:26 - 2013-07-26 06:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-08-14 10:26 - 2013-07-26 06:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-08-14 10:26 - 2013-07-26 04:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-08-14 10:26 - 2013-07-26 04:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-14 10:26 - 2013-07-26 04:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-14 10:26 - 2013-07-26 04:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-14 10:26 - 2013-07-26 04:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-14 10:26 - 2013-07-26 04:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-14 10:26 - 2013-07-26 04:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-14 10:26 - 2013-07-26 04:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-14 10:26 - 2013-07-26 04:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-14 10:26 - 2013-07-26 04:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-14 10:26 - 2013-07-26 04:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-14 10:26 - 2013-07-26 04:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-14 10:26 - 2013-07-26 04:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-14 10:26 - 2013-07-26 04:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-14 10:26 - 2013-07-26 03:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-14 10:26 - 2013-07-26 03:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-08-14 10:26 - 2013-07-26 02:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-14 10:23 - 2013-08-14 10:25 - 00000000 ____D C:\Windows\System32\MRT
2013-08-14 07:13 - 2013-07-25 10:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL
2013-08-14 07:13 - 2013-07-25 09:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-14 07:13 - 2013-07-19 02:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\tzres.dll
2013-08-14 07:13 - 2013-07-19 02:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-14 07:13 - 2013-07-09 07:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-08-14 07:13 - 2013-07-09 06:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\System32\ntdll.dll
2013-08-14 07:13 - 2013-07-09 06:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\System32\wow64.dll
2013-08-14 07:13 - 2013-07-09 06:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\System32\wintrust.dll
2013-08-14 07:13 - 2013-07-09 06:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\System32\rpcrt4.dll
2013-08-14 07:13 - 2013-07-09 06:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-08-14 07:13 - 2013-07-09 06:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-08-14 07:13 - 2013-07-09 06:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-08-14 07:13 - 2013-07-09 06:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-14 07:13 - 2013-07-09 06:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-14 07:13 - 2013-07-09 05:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-14 07:13 - 2013-07-09 05:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-14 07:13 - 2013-07-09 05:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-14 07:13 - 2013-07-09 05:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-14 07:13 - 2013-07-09 05:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-14 07:13 - 2013-07-09 05:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-14 07:13 - 2013-07-09 05:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-14 07:13 - 2013-07-09 03:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-14 07:13 - 2013-07-09 03:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-14 07:13 - 2013-07-09 03:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-14 07:13 - 2013-07-09 03:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-14 07:13 - 2013-07-06 07:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-08-14 07:13 - 2013-06-15 05:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tssecsrv.sys
2013-08-11 19:08 - 2013-08-11 19:08 - 00000000 ____D C:\Users\LeoDesign\AppData\Local\DATA BECKER
2013-08-11 19:08 - 2013-08-11 19:08 - 00000000 ____D C:\Users\LeoDesign\AppData\Local\Chromium
2013-08-11 19:02 - 2013-08-11 19:08 - 00004096 _____ C:\Users\Public\Documents\0000476D.LCS
2013-08-11 19:02 - 2013-08-11 19:03 - 00000000 ____D C:\Users\LeoDesign\AppData\Roaming\ProtectDisc
2013-08-09 18:13 - 2013-08-09 18:13 - 00000000 ____D C:\Program Files (x86)\Wunderlist2
2013-08-08 21:22 - 2013-08-08 21:22 - 00000000 ____D C:\Users\LeoDesign\AppData\Roaming\chc
2013-08-01 17:23 - 2013-08-01 17:23 - 00000000 ____D C:\Users\Public\Documents\CrashDump
2013-07-31 13:23 - 2013-07-31 13:23 - 00000000 ____D C:\Program Files (x86)\Samsung
2013-07-31 13:23 - 2013-06-21 01:07 - 00203672 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\System32\Drivers\ssudmdm.sys
2013-07-31 13:23 - 2013-06-21 01:07 - 00103448 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\System32\Drivers\ssudbus.sys
2013-07-30 12:06 - 2013-07-30 12:06 - 00000440 _____ C:\Desktop.lnk
2013-07-22 09:55 - 2013-07-22 09:55 - 00000000 ____D C:\Users\LeoDesign\AppData\Roaming\HDRsoft
==================== One Month Modified Files and Folders =======
2013-08-20 10:11 - 2013-07-09 17:36 - 00019307 _____ C:\Windows\setupact.log
2013-08-20 10:11 - 2012-04-06 02:34 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-20 10:11 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-20 10:11 - 2009-07-14 03:34 - 00000514 _____ C:\Windows\win.ini
2013-08-20 10:10 - 2012-04-06 01:20 - 01501476 _____ C:\Windows\WindowsUpdate.log
2013-08-20 10:04 - 2009-07-14 05:45 - 00021680 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-20 10:04 - 2009-07-14 05:45 - 00021680 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-20 10:03 - 2011-04-12 08:43 - 00699860 _____ C:\Windows\System32\perfh007.dat
2013-08-20 10:03 - 2011-04-12 08:43 - 00149742 _____ C:\Windows\System32\perfc007.dat
2013-08-20 10:03 - 2009-07-14 06:13 - 01622188 _____ C:\Windows\System32\PerfStringBackup.INI
2013-08-20 09:26 - 2012-04-06 01:38 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-20 08:41 - 2012-04-06 01:20 - 00000000 ____D C:\users\LeoDesign
2013-08-20 08:40 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2013-08-20 07:48 - 2012-06-12 23:36 - 00000000 ____D C:\ProgramData\MFAData
2013-08-20 01:00 - 2012-05-04 20:36 - 00000000 ____D C:\Users\LeoDesign\AppData\Local\Adobe
2013-08-19 22:23 - 2013-04-11 22:02 - 00003934 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{0801BCE7-DFEA-4B4A-BC33-A638DCEC01FC}
2013-08-19 18:39 - 2013-04-16 01:02 - 00000228 _____ C:\Windows\HFIT.hff
2013-08-19 18:14 - 2013-04-16 01:02 - 00000000 ____D C:\Program Files (x86)\SecretFolder
2013-08-18 18:18 - 2012-10-16 17:27 - 00000000 ____D C:\ProgramData\firebird
2013-08-18 13:07 - 2009-07-14 05:45 - 05317320 _____ C:\Windows\System32\FNTCACHE.DAT
2013-08-17 17:19 - 2012-06-11 01:19 - 00000000 ____D C:\Users\LeoDesign\AppData\Roaming\vlc
2013-08-16 21:45 - 2013-04-12 13:25 - 00001456 _____ C:\Users\LeoDesign\AppData\Local\Adobe Für Web speichern 13.0 Prefs
2013-08-16 19:52 - 2013-08-16 10:08 - 00000000 ____D C:\Users\LeoDesign\AppData\Roaming\Yrkedi
2013-08-16 11:03 - 2012-05-05 00:19 - 00000000 ____D C:\Users\LeoDesign\AppData\Roaming\SoftGrid Client
2013-08-16 11:00 - 2013-08-16 10:08 - 00000000 ____D C:\Users\LeoDesign\AppData\Roaming\Ifap
2013-08-16 10:08 - 2013-08-16 10:08 - 00000000 ____D C:\Users\LeoDesign\AppData\Roaming\Yfilcy
2013-08-15 20:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-08-15 19:30 - 2012-04-06 01:36 - 00152224 _____ C:\Users\LeoDesign\AppData\Local\GDIPFONTCACHEV1.DAT
2013-08-14 10:25 - 2013-08-14 10:23 - 00000000 ____D C:\Windows\System32\MRT
2013-08-14 10:23 - 2012-05-04 21:36 - 78161360 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-08-11 22:36 - 2012-05-07 23:55 - 00000000 ____D C:\Users\LeoDesign\AppData\Roaming\Mozilla
2013-08-11 19:08 - 2013-08-11 19:08 - 00000000 ____D C:\Users\LeoDesign\AppData\Local\DATA BECKER
2013-08-11 19:08 - 2013-08-11 19:08 - 00000000 ____D C:\Users\LeoDesign\AppData\Local\Chromium
2013-08-11 19:08 - 2013-08-11 19:02 - 00004096 _____ C:\Users\Public\Documents\0000476D.LCS
2013-08-11 19:03 - 2013-08-11 19:02 - 00000000 ____D C:\Users\LeoDesign\AppData\Roaming\ProtectDisc
2013-08-09 18:13 - 2013-08-09 18:13 - 00000000 ____D C:\Program Files (x86)\Wunderlist2
2013-08-09 18:13 - 2013-07-11 23:12 - 00002495 _____ C:\Users\Public\Desktop\Wunderlist.lnk
2013-08-09 18:13 - 2013-07-11 23:09 - 00000000 ____D C:\ProgramData\Package Cache
2013-08-08 21:41 - 2012-04-06 01:38 - 00000000 ____D C:\Users\LeoDesign\AppData\Roaming\Adobe
2013-08-08 21:22 - 2013-08-08 21:22 - 00000000 ____D C:\Users\LeoDesign\AppData\Roaming\chc
2013-08-08 18:54 - 2012-10-10 23:51 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-08 07:36 - 2012-05-07 23:55 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-01 17:23 - 2013-08-01 17:23 - 00000000 ____D C:\Users\Public\Documents\CrashDump
2013-07-31 13:23 - 2013-07-31 13:23 - 00000000 ____D C:\Program Files (x86)\Samsung
2013-07-31 13:23 - 2012-05-04 22:55 - 00000000 ____D C:\Users\LeoDesign\AppData\Local\Downloaded Installations
2013-07-30 12:06 - 2013-07-30 12:06 - 00000440 _____ C:\Desktop.lnk
2013-07-27 13:16 - 2012-09-11 17:32 - 00000000 ____D C:\Users\LeoDesign\AppData\Roaming\Simfy
2013-07-26 06:13 - 2013-08-14 10:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-07-26 06:13 - 2013-08-14 10:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-07-26 06:13 - 2013-08-14 10:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-07-26 06:12 - 2013-08-14 10:26 - 19239424 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-07-26 06:12 - 2013-08-14 10:26 - 15405056 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-07-26 06:12 - 2013-08-14 10:26 - 03958784 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-07-26 06:12 - 2013-08-14 10:26 - 02647040 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-07-26 06:12 - 2013-08-14 10:26 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-07-26 06:12 - 2013-08-14 10:26 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-07-26 06:12 - 2013-08-14 10:26 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-07-26 06:12 - 2013-08-14 10:26 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-07-26 06:12 - 2013-08-14 10:26 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-07-26 06:12 - 2013-08-14 10:26 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-07-26 06:12 - 2013-08-14 10:26 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-07-26 04:35 - 2013-08-14 10:26 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-07-26 04:13 - 2013-08-14 10:26 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-26 04:13 - 2013-08-14 10:26 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-26 04:12 - 2013-08-14 10:26 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-26 04:12 - 2013-08-14 10:26 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-26 04:12 - 2013-08-14 10:26 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-26 04:12 - 2013-08-14 10:26 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-26 04:12 - 2013-08-14 10:26 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-26 04:12 - 2013-08-14 10:26 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-26 04:12 - 2013-08-14 10:26 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-26 04:12 - 2013-08-14 10:26 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-26 04:12 - 2013-08-14 10:26 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-26 04:11 - 2013-08-14 10:26 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-26 04:11 - 2013-08-14 10:26 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-26 03:49 - 2013-08-14 10:26 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-26 03:39 - 2013-08-14 10:26 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-07-26 02:59 - 2013-08-14 10:26 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-25 10:25 - 2013-08-14 07:13 - 01888768 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL
2013-07-25 09:57 - 2013-08-14 07:13 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-23 16:31 - 2012-09-26 17:39 - 00000000 ____D C:\Users\LeoDesign\AppData\Local\Deployment
2013-07-22 09:55 - 2013-07-22 09:55 - 00000000 ____D C:\Users\LeoDesign\AppData\Roaming\HDRsoft
Files to move or delete:
====================
C:\Users\LeoDesign\ntuserdirect_MSManager.dat
==================== Known DLLs (Whitelisted) ================
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
==================== Restore Points =========================
Restore point made on: 2013-08-14 10:23:28
Restore point made on: 2013-08-20 02:00:21
Restore point made on: 2013-08-20 08:37:41
==================== Memory info ===========================
Percentage of memory in use: 7%
Total physical RAM: 16348.88 MB
Available physical RAM: 15152.37 MB
Total Pagefile: 16347.08 MB
Available Pagefile: 15157.13 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB
==================== Drives ================================
Drive c: (System) (Fixed) (Total:111.79 GB) (Free:47.28 GB) NTFS
Drive e: (Programme) (Fixed) (Total:465.76 GB) (Free:118.46 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive h: () (Removable) (Total:1.92 GB) (Free:1.92 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (Backup) (Fixed) (Total:115.04 GB) (Free:49.16 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 115 GB) (Disk ID: D832D832)
Partition 1: (Not Active) - (Size=115 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: 6659D3CF)
Partition 1: (Active) - (Size=112 GB) - (Type=07 NTFS)
========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: F841F85C)
Partition 1: (Active) - (Size=466 GB) - (Type=07 NTFS)
========================================================
Disk: 4 (Size: 2 GB) (Disk ID: CB6E2416)
Partition 1: (Active) - (Size=2 GB) - (Type=0B)
LastRegBack: 2013-08-12 10:34
==================== End Of Log ============================
|
| Themen zu Nach Trojaner-Entfernung hängt PC beim Start bei cmd.exe |
| adobe flash player, association, asus, audio, avg, becker, check, crypt, explorer.exe, farbar, farbar recovery scan tool, flash player, folge, free, hängt, microsoft, namen, neue, neustart, problem, programme, realtek, registry, scan, services.exe, starmoney, svchost.exe, system32, winlogon, winlogon.exe |
Baum-Darstellung