| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: BlackScreenOfDeath: Trojan:Win32/Urausy.CWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
03.09.2013, 08:18
| #1 |
 |  BlackScreenOfDeath: Trojan:Win32/Urausy.C Hallo wäre super wenn ihr mir helfen könntet. Der Rechner meiner Schwester startet nur noch bis zu einem schwarzen Bildschirm. Maus ist da. Taskmanager lässt sich aber nicht starten. Ein Scan mit Avira hat og. Trojaner gefunden. Hier der Log des FRST Scans: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 02-09-2013 04
Ran by SYSTEM on MININT-26KDBV7 on 02-09-2013 10:34:43
Running from K:\
Windows 7 Home Premium (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery
The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [NcpPopup] - C:\Program Files\WatchGuard\Mobile VPN\ncppopup.exe [579072 2010-01-13] ()
HKLM\...\Run: [NcpBudgetGui] - C:\Program Files\WatchGuard\Mobile VPN\NcpBudgetGui.exe [1032192 2010-01-29] ()
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [947152 2013-01-27] (Microsoft Corporation)
HKU\Hasi\...\Run: [Exetender] - "C:\Program Files\FantastiGames\GPlayer.exe" /runonstartup [x]
IMEO\taskmgr.exe: [Debugger] "C:\PROGRAM FILES\PROCESSEXPLORER\PROCEXP.EXE"
========================== Services (Whitelisted) =================
S2 lxdu_device; C:\Windows\system32\lxducoms.exe [589824 2009-10-16] ( )
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
S2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [20456 2013-01-27] (Microsoft Corporation)
S2 ncpclcfg; C:\Program Files\WatchGuard\Mobile VPN\ncpclcfg.exe [86016 2008-06-30] (NCP engineering GmbH)
S2 ncprwsnt; C:\Program Files\WatchGuard\Mobile VPN\ncprwsnt.exe [1092104 2010-02-25] (NCP Engineering GmbH)
S2 NcpSec; C:\Program Files\WatchGuard\Mobile VPN\ncpsec.exe [97280 2010-02-05] ()
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [295232 2013-01-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
S3 ALCXWDM; C:\Windows\System32\drivers\RTKVAC.SYS [4172832 2009-06-18] (Realtek Semiconductor Corp.)
S0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [38400 2009-06-10] (Samsung Electronics Co., Ltd.)
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [195296 2013-01-20] (Microsoft Corporation)
S3 ncpfilt; C:\Windows\System32\DRIVERS\ncplelhp.sys [77128 2010-02-23] (NCP Engineering GmbH)
S3 ncplelhp; C:\Windows\System32\DRIVERS\ncplelhp.sys [77128 2010-02-23] (NCP Engineering GmbH)
S2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2007-01-12] (Samsung Electronics)
S3 cmnsusbser; system32\DRIVERS\cmnsusbser.sys [x]
S0 Lbd; system32\DRIVERS\Lbd.sys [x]
S2 X6XSEx_Pr143; \??\C:\Program Files\FantastiGames\X6XSEx_Pr143.Sys [x]
========================== Drivers MD5 =======================
C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpahci.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys 9EBBBA55060F786F0FCAA3893BFA2806
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\djsvs.sys ==> MD5 is legit
C:\Windows\System32\drivers\RTKVAC.SYS 7997B6F02CBDA0E31FA18CC85871B938
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdagp.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdk8.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdppm.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdsata.sys D320BF87125326F996D4904FE24300FC
C:\Windows\system32\DRIVERS\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys 46387FB17B086D16DEA267D5BE23A2F2
C:\Windows\system32\drivers\appid.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arcsas.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\atikmdag.sys 65E22AA757601FB497EF495B202FB1A9
C:\Windows\system32\DRIVERS\bxvbdx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60x.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys 247B4CE2DAB1160CD422D532D5241E1F
C:\Windows\system32\DRIVERS\compbatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\system32\Drivers\DgiVecp.sys 7F19DBA1A467B838CCB23124A2C55568
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\disk.sys ==> MD5 is legit
C:\Windows\System32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\drivers\dxgkrnl.sys 16498EBC04AE9DD07049A8884B205C05
C:\Windows\System32\DRIVERS\e100b325.sys 20DE769B84960606D8DBB2AEC123021A
C:\Windows\system32\DRIVERS\evbdx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\elxstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\flpydisk.sys ==> MD5 is legitB
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Fs_Rec.sys 7DAE5EBCC80E45D3253F4923DC424D05
C:\Windows\System32\DRIVERS\fvevol.sys E306A24D9694C724FA2491278BF50FDB
C:\Windows\system32\DRIVERS\gagp30kx.sys ==> MD5 is legit
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\system32\drivers\HDAudBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidbth.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit
C:\Windows\system32\drivers\iaStorV.sys 5CD5F9A5444E6CDCB0AC89BD62D8B76E
C:\Windows\system32\DRIVERS\iirsp.sys ==> MD5 is legit
C:\Windows\System32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\msiscsi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecdd.sys B7895B4182C0D16F6EFADEB8081E8D36
C:\Windows\System32\Drivers\ksecpkg.sys D30159AC9237519FBC62C6EC247D2D46
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\megasas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\MpFilter.sys CF105EE42E3F71E648CEBB3F666E1CF0
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mrxsmb.sys 5D16C921E3671636C0EBA3BBAAC5FD25
C:\Windows\System32\DRIVERS\mrxsmb10.sys 6D17A4791ACA19328C685D256349FEFC
C:\Windows\System32\DRIVERS\mrxsmb20.sys B81F204D146000BE76651A50670A5E9E
C:\Windows\system32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\system32\drivers\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ncplelhp.sys 1A622EB1944020BFB34946A97DECDB9C
C:\Windows\System32\DRIVERS\ncplelhp.sys 1A622EB1944020BFB34946A97DECDB9C
C:\Windows\System32\drivers\ndis.sys 8C9C922D71F1CD4DEF73F186416B7896
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\NisDrvWFP.sys 832E098BCA8235436FE2D8AE50AC3718
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys 5E43D2B0EE64123D4880DFA6626DEFDE
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\system32\drivers\nvraid.sys B3E25EE28883877076E0E1FF877D02E0
C:\Windows\system32\drivers\nvstor.sys 4380E59A170D88C4F1022EFF6719A8A4
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys 3F34A1B4C5F6475F320C275E63AFCE9B
C:\Windows\System32\DRIVERS\parvdm.sys ==> MD5 is legit
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\system32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql2300.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPWD.sys F031683E6D1FEA157ABB2FF260B51E61
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\serenum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\serial.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sermouse.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sfloppy.sys ==> MD5 is legit
C:\Windows\system32\drivers\sisagp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv.sys E4C2764065D66EA1D2D3EBC28FE99C46
C:\Windows\System32\DRIVERS\srv2.sys 03F0545BD8D4C77FA0AE1CEEDFCC71AB
C:\Windows\System32\DRIVERS\srvnet.sys BE6BD660CAA6F291AE06A718A4FA8ABC
C:\Windows\system32\Drivers\SSPORT.sys EF3458337D7341A05169CEFC73709264
C:\Windows\system32\DRIVERS\stexstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\swenum.sys ==> MD5 is legit
C:\Windows\System32\drivers\tcpip.sys 4E8B9BE71B807B3BAEDB7F4243F85E3C
C:\Windows\System32\DRIVERS\tcpip.sys 4E8B9BE71B807B3BAEDB7F4243F85E3C
C:\Windows\System32\drivers\tcpipreg.sys 3EEBD3BD93DA46A26E89893C7AB2FF3B
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 2C2C5AFE7EE4F620D69C23C0617651A8
C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit
C:\Windows\system32\drivers\termdd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tssecsrv.sys B37B08F2E5EEB1A37E448E09BACE1101
C:\Windows\System32\drivers\tsusbflt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\system32\drivers\umbus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\umpass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbccgp.sys BD9C55D7023C5DE374507ACC7A14E2AC
C:\Windows\system32\drivers\usbcir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbehci.sys F92DE757E4B7CE9C07C5E65423F3AE3B
C:\Windows\System32\DRIVERS\usbhub.sys 8DC94AEC6A7E644A06135AE7506DC2E9
C:\Windows\system32\drivers\usbohci.sys E185D44FAC515A18D9DEDDC23C2CDF44
C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbscan.sys 576096CCBC07E7C4EA4F5E6686D6888F
C:\Windows\System32\DRIVERS\USBSTOR.SYS F991AB9CC6B908DB552166768176896A
C:\Windows\System32\DRIVERS\usbuhci.sys 68DF884CF41CDADA664BEB01DAF67E3D
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaagp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\viac7.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\drivers\vwifibus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys A840213F1ACDCC175B4D1D5AAEAC0D7A
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WudfPf.sys 06E6F32C8D0A3F66D956F57B43A2E070
C:\Windows\System32\DRIVERS\WUDFRd.sys 867C301E8B790040AE9CF6486E8041DF
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-18 16:46 - 2013-08-18 17:01 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-08-17 21:16 - 2013-08-17 21:19 - 00000000 ____D C:\Windows\System32\MRT
2013-08-17 20:56 - 2013-07-26 04:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-08-17 20:56 - 2013-07-26 04:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-08-17 20:56 - 2013-07-26 04:13 - 00042496 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-08-17 20:56 - 2013-07-26 04:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-08-17 20:56 - 2013-07-26 04:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-08-17 20:56 - 2013-07-26 04:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-08-17 20:56 - 2013-07-26 04:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-08-17 20:56 - 2013-07-26 04:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-08-17 20:56 - 2013-07-26 04:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-08-17 20:56 - 2013-07-26 04:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-08-17 20:56 - 2013-07-26 04:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-08-17 20:56 - 2013-07-26 04:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-08-17 20:56 - 2013-07-26 04:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-08-17 20:56 - 2013-07-26 04:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-08-17 20:56 - 2013-07-26 03:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-08-17 20:56 - 2013-07-26 02:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-08-14 17:28 - 2013-07-09 05:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\System32\wintrust.dll
2013-08-14 17:28 - 2013-07-09 05:50 - 00652800 _____ (Microsoft Corporation) C:\Windows\System32\rpcrt4.dll
2013-08-14 17:28 - 2013-07-09 05:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-08-14 17:28 - 2013-07-09 05:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-08-14 17:28 - 2013-07-09 05:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-08-14 17:27 - 2013-07-25 09:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL
2013-08-14 17:27 - 2013-07-09 06:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-08-14 17:27 - 2013-07-09 06:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-08-14 17:27 - 2013-07-09 05:53 - 01289096 _____ (Microsoft Corporation) C:\Windows\System32\ntdll.dll
2013-08-14 17:27 - 2013-07-06 06:05 - 01293760 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-08-14 17:26 - 2013-07-19 02:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\tzres.dll
2013-08-14 17:26 - 2013-06-15 04:38 - 00031232 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tssecsrv.sys
2013-08-08 07:13 - 2013-08-08 07:13 - 00000375 _____ C:\Windows\System32\Drivers\etc\hosts.ics
==================== One Month Modified Files and Folders =======
2013-09-02 10:33 - 2013-09-02 10:33 - 00000000 ____D C:\FRST
2013-09-02 09:52 - 2013-03-29 14:28 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-09-02 09:52 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\wfp
2013-09-02 09:52 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\registration
2013-09-02 09:52 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\AppCompat
2013-09-02 09:28 - 2010-09-10 10:51 - 01403459 _____ C:\Windows\WindowsUpdate.log
2013-09-02 09:21 - 2012-08-27 10:09 - 00022825 _____ C:\Windows\setupact.log
2013-09-02 09:21 - 2010-09-10 10:56 - 00000000 ____D C:\users\Hasi
2013-09-02 09:19 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\LogFiles
2013-08-30 14:22 - 2009-07-14 05:34 - 00017216 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-30 14:22 - 2009-07-14 05:34 - 00017216 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-23 12:08 - 2013-03-29 14:28 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-08-23 12:08 - 2011-11-22 18:53 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-08-22 16:24 - 2010-09-10 11:05 - 00719716 _____ C:\Windows\System32\PerfStringBackup.INI
2013-08-19 15:24 - 2012-08-21 13:40 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-08-18 18:26 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-08-18 18:06 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-08-18 17:01 - 2013-08-18 16:46 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-08-17 21:19 - 2013-08-17 21:16 - 00000000 ____D C:\Windows\System32\MRT
2013-08-17 21:19 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-08-17 21:16 - 2010-09-10 16:06 - 75778376 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-08-17 21:15 - 2011-01-23 18:53 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-08 19:45 - 2009-07-14 05:52 - 00000000 ____D C:\Windows\System32\FxsTmp
2013-08-08 07:13 - 2013-08-08 07:13 - 00000375 _____ C:\Windows\System32\Drivers\etc\hosts.ics
2013-08-08 07:12 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\NDF
Files to move or delete:
====================
C:\Users\Hasi\AppData\Local\Temp\installhelper.dll
C:\Users\Hasi\AppData\Local\Temp\nsfC554.tmp\nsis7z.dll
C:\Users\Hasi\AppData\Local\Temp\nsfC554.tmp\System.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\BrowserConnection.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\DataMngr.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\DataMngrUI.exe
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\DnsBHO.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\IEBHO.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\iLividMediaBar.exe
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\InstallHelper.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\x64\BrowserConnection.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\x64\DataMngr.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\x64\DnsBHO.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\x64\IEBHO.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\SR\SRAssetsHelper.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF10.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF11.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF12.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF13.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF14.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF15.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF16.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF17.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF3.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF4.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF5.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF6.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF7.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF8.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF9.dll
C:\Users\Hasi\AppData\Local\Temp\2A8D.dir\InstallFlashPlayer.exe
==================== Known DLLs (Whitelisted) ============
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
==================== Restore Points =========================
Restore point made on: 2013-08-08 17:10:43
Restore point made on: 2013-08-12 19:25:27
Restore point made on: 2013-08-17 20:55:10
Restore point made on: 2013-08-21 16:14:59
Restore point made on: 2013-08-25 16:20:12
Restore point made on: 2013-08-30 14:26:26
==================== BCD ================================
Windows-Start-Manager
---------------------
Bezeichner {bootmgr}
device partition=Y:
description Windows Boot Manager
locale de-DE
inherit {globalsettings}
default {default}
resumeobject {e2821a24-bcc8-11df-9881-fac136a278bb}
displayorder {default}
toolsdisplayorder {memdiag}
timeout 30
Windows-Startladeprogramm
-------------------------
Bezeichner {default}
device partition=C:
path \Windows\system32\winload.exe
description Windows 7
locale de-DE
inherit {bootloadersettings}
recoverysequence {current}
recoveryenabled Yes
osdevice partition=C:
systemroot \Windows
resumeobject {e2821a24-bcc8-11df-9881-fac136a278bb}
nx OptIn
Windows-Startladeprogramm
-------------------------
Bezeichner {current}
device ramdisk=[C:]\Recovery\e2821a26-bcc8-11df-9881-fac136a278bb\Winre.wim,{e2821a27-bcc8-11df-9881-fac136a278bb}
path \windows\system32\winload.exe
description Windows Recovery Environment
inherit {bootloadersettings}
osdevice ramdisk=[C:]\Recovery\e2821a26-bcc8-11df-9881-fac136a278bb\Winre.wim,{e2821a27-bcc8-11df-9881-fac136a278bb}
systemroot \windows
nx OptIn
winpe Yes
Wiederaufnahme aus dem Ruhezustand
----------------------------------
Bezeichner {e2821a24-bcc8-11df-9881-fac136a278bb}
device partition=C:
path \Windows\system32\winresume.exe
description Windows Resume Application
locale de-DE
inherit {resumeloadersettings}
filedevice partition=C:
filepath \hiberfil.sys
pae No
debugoptionenabled No
Windows-Speichertestprogramm
----------------------------
Bezeichner {memdiag}
device partition=Y:
path \boot\memtest.exe
description Windows-Speicherdiagnose
locale de-DE
inherit {globalsettings}
badmemoryaccess Yes
EMS-Einstellungen
-----------------
Bezeichner {emssettings}
bootems Yes
Debuggereinstellungen
---------------------
Bezeichner {dbgsettings}
debugtype Serial
debugport 1
baudrate 115200
RAM-Defekte
-----------
Bezeichner {badmemory}
Globale Einstellungen
---------------------
Bezeichner {globalsettings}
inherit {dbgsettings}
{emssettings}
{badmemory}
Startladeprogramm-Einstellungen
-------------------------------
Bezeichner {bootloadersettings}
inherit {globalsettings}
{hypervisorsettings}
Hypervisoreinstellungen
-------------------
Bezeichner {hypervisorsettings}
hypervisordebugtype Serial
hypervisordebugport 1
hypervisorbaudrate 115200
Einstellungen zur Ladeprogrammfortsetzung
-----------------------------------------
Bezeichner {resumeloadersettings}
inherit {globalsettings}
Ger„teoptionen
--------------
Bezeichner {e2821a27-bcc8-11df-9881-fac136a278bb}
description Ramdisk Options
ramdisksdidevice partition=C:
ramdisksdipath \Recovery\e2821a26-bcc8-11df-9881-fac136a278bb\boot.sdi
==================== Memory info ===========================
Percentage of memory in use: 20%
Total physical RAM: 2047.55 MB
Available physical RAM: 1625.58 MB
Total Pagefile: 2047.55 MB
Available Pagefile: 1623.79 MB
Total Virtual: 2047.88 MB
Available Virtual: 1941.12 MB
==================== Drives ================================
Drive c: (WINDOWS7) (Fixed) (Total:78.03 GB) (Free:44.36 GB) NTFS
Drive d: (DATA) (Fixed) (Total:154.76 GB) (Free:145.51 GB) NTFS
Drive k: (PLATINUM) (Removable) (Total:1.95 GB) (Free:0.9 GB) FAT
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.06 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: B731081E)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=78 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=155 GB) - (Type=OF Extended)
========================================================
Disk: 5 (Size: 2 GB) (Disk ID: 0034EBB6)
Partition 1: (Not Active) - (Size=2 GB) - (Type=0E)
LastRegBack: 2013-08-26 18:38
==================== End Of Log ============================
DANKE! |
|
03.09.2013, 08:31
| #2 |
| /// the machine /// TB-Ausbilder    | BlackScreenOfDeath: Trojan:Win32/Urausy.C hi,
__________________Drücke bitte die  + R Taste und schreibe notepad in das Ausführen Fenster.Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Users\Hasi\AppData\Local\Temp\installhelper.dll
C:\Users\Hasi\AppData\Local\Temp\nsfC554.tmp\nsis7z.dll
C:\Users\Hasi\AppData\Local\Temp\nsfC554.tmp\System.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\BrowserConnection.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\DataMngr.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\DataMngrUI.exe
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\DnsBHO.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\IEBHO.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\iLividMediaBar.exe
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\InstallHelper.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\x64\BrowserConnection.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\x64\DataMngr.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\x64\DnsBHO.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\x64\IEBHO.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\SR\SRAssetsHelper.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF10.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF11.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF12.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF13.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF14.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF15.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF16.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF17.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF3.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF4.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF5.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF6.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF7.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF8.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF9.dll
C:\Users\Hasi\AppData\Local\Temp\2A8D.dir\InstallFlashPlayer.exe
Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier. Rechner normal starten.
__________________ |
|
03.09.2013, 08:53
| #3 |
| | BlackScreenOfDeath: Trojan:Win32/Urausy.C Erstmal Danke für die prompte Unterstützung!
__________________ - Nach ausführen des fix (siehe log) startete der Rechner immer noch nur bis zum schwarzen Bildschirm. - Hab dann nochmal ein Scan mit frst.exe durchgeführt - siehe unten Fixlog.txt: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 02-09-2013 04
Ran by SYSTEM at 2013-09-03 09:36:10 Run:1
Running from K:\
Boot Mode: Recovery
==============================================
Content of fixlist:
*****************
C:\Users\Hasi\AppData\Local\Temp\installhelper.dll
C:\Users\Hasi\AppData\Local\Temp\nsfC554.tmp\nsis7z.dll
C:\Users\Hasi\AppData\Local\Temp\nsfC554.tmp\System.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\BrowserConnection.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\DataMngr.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\DataMngrUI.exe
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\DnsBHO.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\IEBHO.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\iLividMediaBar.exe
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\InstallHelper.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\x64\BrowserConnection.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\x64\DataMngr.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\x64\DnsBHO.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\x64\IEBHO.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\SR\SRAssetsHelper.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF10.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF11.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF12.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF13.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF14.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF15.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF16.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF17.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF3.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF4.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF5.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF6.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF7.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF8.dll
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF9.dll
C:\Users\Hasi\AppData\Local\Temp\2A8D.dir\InstallFlashPlayer.exe
*****************
C:\Users\Hasi\AppData\Local\Temp\installhelper.dll => Moved successfully.
C:\Users\Hasi\AppData\Local\Temp\nsfC554.tmp\nsis7z.dll => Moved successfully.
C:\Users\Hasi\AppData\Local\Temp\nsfC554.tmp\System.dll => Moved successfully.
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\BrowserConnection.dll => Moved successfully.
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\DataMngr.dll => Moved successfully.
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\DataMngrUI.exe => Moved successfully.
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\DnsBHO.dll => Moved successfully.
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\IEBHO.dll => Moved successfully.
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\iLividMediaBar.exe => Moved successfully.
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\InstallHelper.dll => Moved successfully.
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\x64\BrowserConnection.dll => Moved successfully.
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\x64\DataMngr.dll => Moved successfully.
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\x64\DnsBHO.dll => Moved successfully.
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\x64\IEBHO.dll => Moved successfully.
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\SR\SRAssetsHelper.dll => Moved successfully.
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF10.dll => Moved successfully.
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF11.dll => Moved successfully.
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF12.dll => Moved successfully.
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF13.dll => Moved successfully.
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF14.dll => Moved successfully.
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF15.dll => Moved successfully.
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF16.dll => Moved successfully.
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF17.dll => Moved successfully.
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF3.dll => Moved successfully.
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF4.dll => Moved successfully.
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF5.dll => Moved successfully.
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF6.dll => Moved successfully.
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF7.dll => Moved successfully.
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF8.dll => Moved successfully.
C:\Users\Hasi\AppData\Local\Temp\iLivid_DM\ext\FirefoxExtension\components\DataMngrHlpFF9.dll => Moved successfully.
C:\Users\Hasi\AppData\Local\Temp\2A8D.dir\InstallFlashPlayer.exe => Moved successfully.
==== End of Fixlog ====
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 02-09-2013 04
Ran by SYSTEM on MININT-ITPS987 on 03-09-2013 09:41:19
Running from K:\
Windows 7 Home Premium (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery
The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [NcpPopup] - C:\Program Files\WatchGuard\Mobile VPN\ncppopup.exe [579072 2010-01-13] ()
HKLM\...\Run: [NcpBudgetGui] - C:\Program Files\WatchGuard\Mobile VPN\NcpBudgetGui.exe [1032192 2010-01-29] ()
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [947152 2013-01-27] (Microsoft Corporation)
HKU\Hasi\...\Run: [Exetender] - "C:\Program Files\FantastiGames\GPlayer.exe" /runonstartup [x]
========================== Services (Whitelisted) =================
S2 lxdu_device; C:\Windows\system32\lxducoms.exe [589824 2009-10-16] ( )
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
S2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [20456 2013-01-27] (Microsoft Corporation)
S2 ncpclcfg; C:\Program Files\WatchGuard\Mobile VPN\ncpclcfg.exe [86016 2008-06-30] (NCP engineering GmbH)
S2 ncprwsnt; C:\Program Files\WatchGuard\Mobile VPN\ncprwsnt.exe [1092104 2010-02-25] (NCP Engineering GmbH)
S2 NcpSec; C:\Program Files\WatchGuard\Mobile VPN\ncpsec.exe [97280 2010-02-05] ()
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [295232 2013-01-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
S3 ALCXWDM; C:\Windows\System32\drivers\RTKVAC.SYS [4172832 2009-06-18] (Realtek Semiconductor Corp.)
S0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [38400 2009-06-10] (Samsung Electronics Co., Ltd.)
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [195296 2013-01-20] (Microsoft Corporation)
S3 ncpfilt; C:\Windows\System32\DRIVERS\ncplelhp.sys [77128 2010-02-23] (NCP Engineering GmbH)
S3 ncplelhp; C:\Windows\System32\DRIVERS\ncplelhp.sys [77128 2010-02-23] (NCP Engineering GmbH)
S2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2007-01-12] (Samsung Electronics)
S3 cmnsusbser; system32\DRIVERS\cmnsusbser.sys [x]
S0 Lbd; system32\DRIVERS\Lbd.sys [x]
S2 X6XSEx_Pr143; \??\C:\Program Files\FantastiGames\X6XSEx_Pr143.Sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-18 16:46 - 2013-08-18 17:01 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-08-17 21:16 - 2013-08-17 21:19 - 00000000 ____D C:\Windows\System32\MRT
2013-08-17 20:56 - 2013-07-26 04:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-08-17 20:56 - 2013-07-26 04:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-08-17 20:56 - 2013-07-26 04:13 - 00042496 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-08-17 20:56 - 2013-07-26 04:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-08-17 20:56 - 2013-07-26 04:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-08-17 20:56 - 2013-07-26 04:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-08-17 20:56 - 2013-07-26 04:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-08-17 20:56 - 2013-07-26 04:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-08-17 20:56 - 2013-07-26 04:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-08-17 20:56 - 2013-07-26 04:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-08-17 20:56 - 2013-07-26 04:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-08-17 20:56 - 2013-07-26 04:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-08-17 20:56 - 2013-07-26 04:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-08-17 20:56 - 2013-07-26 04:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-08-17 20:56 - 2013-07-26 03:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-08-17 20:56 - 2013-07-26 02:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-08-14 17:28 - 2013-07-09 05:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\System32\wintrust.dll
2013-08-14 17:28 - 2013-07-09 05:50 - 00652800 _____ (Microsoft Corporation) C:\Windows\System32\rpcrt4.dll
2013-08-14 17:28 - 2013-07-09 05:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-08-14 17:28 - 2013-07-09 05:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-08-14 17:28 - 2013-07-09 05:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-08-14 17:27 - 2013-07-25 09:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL
2013-08-14 17:27 - 2013-07-09 06:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-08-14 17:27 - 2013-07-09 06:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-08-14 17:27 - 2013-07-09 05:53 - 01289096 _____ (Microsoft Corporation) C:\Windows\System32\ntdll.dll
2013-08-14 17:27 - 2013-07-06 06:05 - 01293760 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-08-14 17:26 - 2013-07-19 02:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\tzres.dll
2013-08-14 17:26 - 2013-06-15 04:38 - 00031232 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tssecsrv.sys
2013-08-08 07:13 - 2013-08-08 07:13 - 00000375 _____ C:\Windows\System32\Drivers\etc\hosts.ics
==================== One Month Modified Files and Folders =======
2013-09-03 08:37 - 2012-08-27 10:09 - 00023105 _____ C:\Windows\setupact.log
2013-09-03 08:33 - 2010-09-10 10:51 - 01353413 _____ C:\Windows\WindowsUpdate.log
2013-09-03 08:20 - 2009-07-14 05:34 - 00017216 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-03 08:20 - 2009-07-14 05:34 - 00017216 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-02 10:33 - 2013-09-02 10:33 - 00000000 ____D C:\FRST
2013-09-02 09:52 - 2013-03-29 14:28 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-09-02 09:52 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\wfp
2013-09-02 09:52 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\registration
2013-09-02 09:52 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\AppCompat
2013-09-02 09:21 - 2010-09-10 10:56 - 00000000 ____D C:\users\Hasi
2013-09-02 09:19 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\LogFiles
2013-08-23 12:08 - 2013-03-29 14:28 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-08-23 12:08 - 2011-11-22 18:53 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-08-22 16:24 - 2010-09-10 11:05 - 00719716 _____ C:\Windows\System32\PerfStringBackup.INI
2013-08-19 15:24 - 2012-08-21 13:40 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-08-18 18:26 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-08-18 18:06 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-08-18 17:01 - 2013-08-18 16:46 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-08-17 21:19 - 2013-08-17 21:16 - 00000000 ____D C:\Windows\System32\MRT
2013-08-17 21:19 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-08-17 21:16 - 2010-09-10 16:06 - 75778376 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-08-17 21:15 - 2011-01-23 18:53 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-08 19:45 - 2009-07-14 05:52 - 00000000 ____D C:\Windows\System32\FxsTmp
2013-08-08 07:13 - 2013-08-08 07:13 - 00000375 _____ C:\Windows\System32\Drivers\etc\hosts.ics
2013-08-08 07:12 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\NDF
==================== Known DLLs (Whitelisted) ============
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
==================== Restore Points =========================
Restore point made on: 2013-08-12 19:25:27
Restore point made on: 2013-08-17 20:55:10
Restore point made on: 2013-08-21 16:14:59
Restore point made on: 2013-08-25 16:20:12
Restore point made on: 2013-08-30 14:26:26
Restore point made on: 2013-09-03 08:24:15
==================== Memory info ===========================
Percentage of memory in use: 20%
Total physical RAM: 2047.55 MB
Available physical RAM: 1627.27 MB
Total Pagefile: 2047.55 MB
Available Pagefile: 1624.31 MB
Total Virtual: 2047.88 MB
Available Virtual: 1945.12 MB
==================== Drives ================================
Drive c: (WINDOWS7) (Fixed) (Total:78.03 GB) (Free:44.36 GB) NTFS
Drive d: (DATA) (Fixed) (Total:154.76 GB) (Free:145.51 GB) NTFS
Drive k: (PLATINUM) (Removable) (Total:1.95 GB) (Free:0.6 GB) FAT
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.06 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: B731081E)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=78 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=155 GB) - (Type=OF Extended)
========================================================
Disk: 5 (Size: 2 GB) (Disk ID: 0034EBB6)
Partition 1: (Not Active) - (Size=2 GB) - (Type=0E)
LastRegBack: 2013-09-02 10:30
==================== End Of Log ============================
--- --- --- Update: Ich kann jetzt aber den Taskmanager starten. Jedoch den explorer.exe nicht als neuen Task ausführen. Also sind wir schon einen Schritt voran gekommen ;-) |
|
03.09.2013, 11:18
| #4 |
| /// the machine /// TB-Ausbilder | BlackScreenOfDeath: Trojan:Win32/Urausy.C Was passiert denn wenn Du Explorer als Task öffnest? Kannst DU CMD als Task öffnen und dann FRST auf dem Stick ansteuern? Das Log aus der Recovery zeigt die Malware nämlich nicht.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
03.09.2013, 11:52
| #5 |
| | BlackScreenOfDeath: Trojan:Win32/Urausy.C Explorer öffnen als neue Task geht nicht. CMD geht auch nicht. -> es stürzt jeweils der TaskManager ab !? Ich habe aber die Benutzerkontensteuerung starten können und habe einen neuen Benutzer angelegt. Der startet nun auch ohne Probleme. Ich hätte aber gerne den alten Benutzer wieder am Laufen. Komme ich da vom neuen Benutzer aus irgendwie weiter ??? Danke. Hier mal die ScanLogs vom neuen Benutzer aus gemacht. Vielleicht hilft das ja: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-09-2013
Ran by Admin (administrator) on HASI-PC on 03-09-2013 12:48:38
Running from F:\
Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\system32\atiesrxx.exe
( ) C:\Windows\system32\lxducoms.exe
(NCP engineering GmbH) C:\Program Files\WatchGuard\Mobile VPN\ncpclcfg.exe
(NCP Engineering GmbH) C:\Program Files\WatchGuard\Mobile VPN\ncprwsnt.exe
() C:\Program Files\WatchGuard\Mobile VPN\ncpsec.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe
(AMD) C:\Windows\system32\atieclxx.exe
() C:\Program Files\WatchGuard\Mobile VPN\NcpBudgetGui.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [NcpPopup] - C:\Program Files\WatchGuard\Mobile VPN\ncppopup.exe [579072 2010-01-13] ()
HKLM\...\Run: [NcpBudgetGui] - C:\Program Files\WatchGuard\Mobile VPN\NcpBudgetGui.exe [1032192 2010-01-29] ()
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [995176 2013-06-20] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.)
==================== Internet (Whitelisted) ====================
SearchScopes: HKLM - DefaultScope value is missing.
BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455}
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p4ray7tv.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin: @exent.com/npExentCtl,version=7.0.0.0 - C:\Program Files\FantastiGames\npExentCtl.dll No File
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.6.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.6.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin: www.exent.com/GameTreatWidget - C:\Program Files\FantastiGames\NPGameTreatPlugin.dll No File
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
========================== Services (Whitelisted) =================
R2 lxdu_device; C:\Windows\system32\lxducoms.exe [589824 2009-10-16] ( )
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-06-20] (Microsoft Corporation)
R2 ncpclcfg; C:\Program Files\WatchGuard\Mobile VPN\ncpclcfg.exe [86016 2008-06-30] (NCP engineering GmbH)
R2 ncprwsnt; C:\Program Files\WatchGuard\Mobile VPN\ncprwsnt.exe [1092104 2010-02-25] (NCP Engineering GmbH)
R2 NcpSec; C:\Program Files\WatchGuard\Mobile VPN\ncpsec.exe [97280 2010-02-05] ()
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [295376 2013-06-20] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
R3 ALCXWDM; C:\Windows\System32\drivers\RTKVAC.SYS [4172832 2009-06-18] (Realtek Semiconductor Corp.)
R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [38400 2009-06-10] (Samsung Electronics Co., Ltd.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [211560 2013-06-18] (Microsoft Corporation)
S3 ncpfilt; C:\Windows\System32\DRIVERS\ncplelhp.sys [77128 2010-02-23] (NCP Engineering GmbH)
R3 ncplelhp; C:\Windows\System32\DRIVERS\ncplelhp.sys [77128 2010-02-23] (NCP Engineering GmbH)
R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2007-01-12] (Samsung Electronics)
S3 cmnsusbser; system32\DRIVERS\cmnsusbser.sys [x]
S0 Lbd; system32\DRIVERS\Lbd.sys [x]
S2 X6XSEx_Pr143; \??\C:\Program Files\FantastiGames\X6XSEx_Pr143.Sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-03 12:47 - 2013-09-03 12:47 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Macromedia
2013-09-03 11:42 - 2013-09-03 11:42 - 00000625 _____ C:\Users\Admin\Desktop\JRT.txt
2013-09-03 11:37 - 2013-09-03 11:37 - 00000000 ____D C:\Windows\ERUNT
2013-09-03 11:31 - 2013-09-03 11:34 - 00000000 ____D C:\AdwCleaner
2013-09-03 11:31 - 2013-09-03 10:07 - 01037134 _____ C:\Users\Admin\Desktop\adwcleaner.exe
2013-09-03 11:30 - 2013-09-03 10:09 - 01028757 _____ (Thisisu) C:\Users\Admin\Desktop\JRT.exe
2013-09-03 11:19 - 2012-08-23 16:48 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2013-09-03 11:19 - 2012-08-23 16:44 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2013-09-03 11:19 - 2012-08-23 16:40 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2013-09-03 11:19 - 2012-08-23 16:10 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2013-09-03 11:19 - 2012-08-23 16:10 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2013-09-03 11:19 - 2012-08-23 15:52 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2013-09-03 11:19 - 2012-08-23 15:47 - 00046592 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2013-09-03 11:19 - 2012-08-23 15:46 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2013-09-03 11:19 - 2012-08-23 15:32 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2013-09-03 11:19 - 2012-08-23 15:18 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2013-09-03 11:19 - 2012-08-23 13:40 - 00056320 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2013-09-03 11:19 - 2012-08-23 13:32 - 00317440 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2013-09-03 11:19 - 2012-08-23 13:15 - 00269312 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2013-09-03 11:19 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2013-09-03 11:19 - 2012-08-23 12:39 - 01048064 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2013-09-03 11:19 - 2012-08-23 12:08 - 02739712 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2013-09-03 11:19 - 2012-08-23 10:19 - 04916224 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2013-09-03 11:12 - 2012-08-24 19:05 - 00136560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-09-03 11:12 - 2012-08-24 19:02 - 00369856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-09-03 11:12 - 2012-08-24 18:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-09-03 11:12 - 2012-08-24 18:56 - 01039360 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-09-03 11:08 - 2013-09-03 11:08 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Mozilla
2013-09-03 11:08 - 2013-09-03 11:08 - 00000000 ____D C:\Users\Admin\AppData\Local\Mozilla
2013-09-03 11:07 - 2013-09-03 11:07 - 00114672 _____ C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2013-09-03 11:05 - 2013-09-03 11:06 - 00000000 ____D C:\Users\Admin
2013-09-03 11:05 - 2013-09-03 11:05 - 00001468 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-09-03 11:05 - 2013-09-03 11:05 - 00000020 ___SH C:\Users\Admin\ntuser.ini
2013-09-03 11:05 - 2013-09-03 11:05 - 00000000 _SHDL C:\Users\Admin\Startmenü
2013-09-03 11:05 - 2013-09-03 11:05 - 00000000 _SHDL C:\Users\Admin\Netzwerkumgebung
2013-09-03 11:05 - 2013-09-03 11:05 - 00000000 _SHDL C:\Users\Admin\Druckumgebung
2013-09-03 11:05 - 2013-09-03 11:05 - 00000000 _SHDL C:\Users\Admin\Documents\Eigene Musik
2013-09-03 11:05 - 2013-09-03 11:05 - 00000000 _SHDL C:\Users\Admin\Documents\Eigene Bilder
2013-09-03 11:05 - 2013-09-03 11:05 - 00000000 _SHDL C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-09-03 11:05 - 2013-09-03 11:05 - 00000000 _SHDL C:\Users\Admin\AppData\Local\Verlauf
2013-09-03 11:05 - 2013-09-03 11:05 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Adobe
2013-09-03 11:05 - 2011-12-26 18:46 - 00000000 ____D C:\Users\Admin\AppData\Local\Microsoft Help
2013-09-03 11:05 - 2009-07-14 06:42 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-09-03 11:05 - 2009-07-14 06:37 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-09-02 11:33 - 2013-09-02 11:33 - 00000000 ____D C:\FRST
2013-08-18 17:46 - 2013-08-18 18:01 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-08-17 22:16 - 2013-08-17 22:19 - 00000000 ____D C:\Windows\system32\MRT
2013-08-17 21:56 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-17 21:56 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-17 21:56 - 2013-07-26 05:13 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-17 21:56 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-17 21:56 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-17 21:56 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-17 21:56 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-17 21:56 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-17 21:56 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-17 21:56 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-17 21:56 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-17 21:56 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-17 21:56 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-17 21:56 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-17 21:56 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-17 21:56 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-14 18:28 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 18:28 - 2013-07-09 06:50 - 00652800 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 18:28 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 18:28 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 18:28 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 18:27 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-14 18:27 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-08-14 18:27 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 18:27 - 2013-07-09 06:53 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 18:27 - 2013-07-06 07:05 - 01293760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 18:26 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 18:26 - 2013-06-15 05:38 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-08 08:13 - 2013-08-08 08:13 - 00000375 _____ C:\Windows\system32\Drivers\etc\hosts.ics
==================== One Month Modified Files and Folders =======
2013-09-03 12:47 - 2013-09-03 12:47 - 01084685 _____ (Farbar) C:\Users\Admin\Downloads\FRST.exe
2013-09-03 12:47 - 2013-09-03 12:47 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Macromedia
2013-09-03 12:43 - 2009-07-14 06:34 - 00017216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-03 12:43 - 2009-07-14 06:34 - 00017216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-03 12:39 - 2010-09-10 11:51 - 01919884 _____ C:\Windows\WindowsUpdate.log
2013-09-03 12:36 - 2012-08-27 11:09 - 00023385 _____ C:\Windows\setupact.log
2013-09-03 12:36 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-03 12:08 - 2013-03-29 15:28 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-03 11:55 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-09-03 11:42 - 2013-09-03 11:42 - 00000625 _____ C:\Users\Admin\Desktop\JRT.txt
2013-09-03 11:37 - 2013-09-03 11:37 - 00000000 ____D C:\Windows\ERUNT
2013-09-03 11:34 - 2013-09-03 11:31 - 00000000 ____D C:\AdwCleaner
2013-09-03 11:28 - 2010-09-10 12:05 - 00719716 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-03 11:20 - 2009-07-14 10:47 - 00000000 ____D C:\Windows\system32\Drivers\de-DE
2013-09-03 11:20 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-09-03 11:19 - 2012-08-26 11:38 - 00001912 _____ C:\Windows\epplauncher.mif
2013-09-03 11:18 - 2012-08-26 11:37 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-09-03 11:08 - 2013-09-03 11:08 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Mozilla
2013-09-03 11:08 - 2013-09-03 11:08 - 00000000 ____D C:\Users\Admin\AppData\Local\Mozilla
2013-09-03 11:07 - 2013-09-03 11:07 - 00114672 _____ C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2013-09-03 11:06 - 2013-09-03 11:05 - 00000000 ____D C:\Users\Admin
2013-09-03 11:05 - 2013-09-03 11:05 - 00001468 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-09-03 11:05 - 2013-09-03 11:05 - 00000020 ___SH C:\Users\Admin\ntuser.ini
2013-09-03 11:05 - 2013-09-03 11:05 - 00000000 _SHDL C:\Users\Admin\Startmenü
2013-09-03 11:05 - 2013-09-03 11:05 - 00000000 _SHDL C:\Users\Admin\Netzwerkumgebung
2013-09-03 11:05 - 2013-09-03 11:05 - 00000000 _SHDL C:\Users\Admin\Druckumgebung
2013-09-03 11:05 - 2013-09-03 11:05 - 00000000 _SHDL C:\Users\Admin\Documents\Eigene Musik
2013-09-03 11:05 - 2013-09-03 11:05 - 00000000 _SHDL C:\Users\Admin\Documents\Eigene Bilder
2013-09-03 11:05 - 2013-09-03 11:05 - 00000000 _SHDL C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-09-03 11:05 - 2013-09-03 11:05 - 00000000 _SHDL C:\Users\Admin\AppData\Local\Verlauf
2013-09-03 11:05 - 2013-09-03 11:05 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Adobe
2013-09-03 10:09 - 2013-09-03 11:30 - 01028757 _____ (Thisisu) C:\Users\Admin\Desktop\JRT.exe
2013-09-03 10:07 - 2013-09-03 11:31 - 01037134 _____ C:\Users\Admin\Desktop\adwcleaner.exe
2013-09-02 11:33 - 2013-09-02 11:33 - 00000000 ____D C:\FRST
2013-09-02 10:52 - 2013-03-29 15:28 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-09-02 10:52 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\wfp
2013-09-02 10:52 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\registration
2013-09-02 10:52 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\AppCompat
2013-09-02 10:21 - 2010-09-10 11:56 - 00000000 ____D C:\Users\Hasi
2013-09-02 10:19 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\LogFiles
2013-08-23 13:08 - 2013-03-29 15:28 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-08-23 13:08 - 2011-11-22 19:53 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-08-19 16:24 - 2012-08-21 14:40 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-08-18 19:26 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-08-18 18:01 - 2013-08-18 17:46 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-08-17 22:19 - 2013-08-17 22:16 - 00000000 ____D C:\Windows\system32\MRT
2013-08-17 22:16 - 2010-09-10 17:06 - 75778376 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-17 22:15 - 2011-01-23 19:53 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-08 20:45 - 2009-07-14 06:52 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-08-08 08:13 - 2013-08-08 08:13 - 00000375 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2013-08-08 08:12 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\NDF
Files to move or delete:
====================
C:\Users\Admin\AppData\Local\Temp\Quarantine.exe
C:\Users\Admin\AppData\Local\Temp\jrt\erunt\ERUNT.EXE
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-02 11:30
==================== End Of Log ============================
--- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 03-09-2013 Ran by Admin at 2013-09-03 12:50:31 Running from F:\ Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= Update for Microsoft Office 2007 (KB2508958) 7 Wonders II 7-Zip 4.65 Adobe Flash Player 11 ActiveX (Version: 11.8.800.94) Adobe Flash Player 11 Plugin (Version: 11.8.800.94) Adobe Reader X (10.1.4) - Deutsch (Version: 10.1.4) AMD APP SDK Runtime (Version: 10.0.937.2) AMD Catalyst Install Manager (Version: 8.0.877.0) Application Verifier (Version: 4.0.917) ATI AVIVO Codecs (Version: 10.9.0.40813) Audacity 1.2.6 CanoScan LiDE 110 Scanner Driver Catalyst Control Center - Branding (Version: 1.00.0000) Catalyst Control Center Core Implementation (Version: 2009.0813.2131.36817) Catalyst Control Center Graphics Full Existing (Version: 2009.0813.2131.36817) Catalyst Control Center Graphics Full New (Version: 2009.0813.2131.36817) Catalyst Control Center Graphics Light (Version: 2009.0813.2131.36817) Catalyst Control Center Graphics Previews Common (Version: 2009.0813.2131.36817) Catalyst Control Center Graphics Previews Vista (Version: 2009.0813.2131.36817) Catalyst Control Center HydraVision Full (Version: 2009.0813.2131.36817) Catalyst Control Center Localization All (Version: 2009.0813.2131.36817) CCC Help English (Version: 2009.0813.2130.36817) ccc-core-static (Version: 2009.0813.2131.36817) ccc-utility (Version: 2009.0813.2131.36817) CCleaner (Version: 3.21) Cradle of Rome Debugging Tools for Windows (x86) (Version: 6.11.1.404) dm-Fotowelt FotoalbumFotobuchSoftware 3.0.9 Geogrid®-Viewer (Version: 6.3.2.0000) Google Earth (Version: 5.2.1.1588) Heroes of Hellas HiJackThis (Version: 1.0.0) IrfanView (remove only) (Version: 4.27) Java 7 Update 6 (Version: 7.0.60) Java Auto Updater (Version: 2.1.9.0) K-Lite Codec Pack 6.3.0 (Full) (Version: 6.3.0) Landwirtschafts Simulator 2013 (Version: 1.0) Malwarebytes Anti-Malware Version 1.62.0.1300 (Version: 1.62.0.1300) McAfee Security Scan Plus (Version: 3.0.318.3) Mein CEWE FOTOBUCH Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319) Microsoft Document Explorer 2008 Microsoft Document Explorer 2008 (Version: 9.0.21022) Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000) Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office File Validation Add-In (Version: 14.0.5130.5003) Microsoft Office Groove MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1) Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000) Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000) Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000) Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014) Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Security Client (Version: 4.3.0215.0) Microsoft Security Essentials (Version: 4.3.215.0) Microsoft Silverlight (Version: 5.1.20513.0) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219) Microsoft Visual C++ Compilers 2008 Standard Edition - enu - x86 (Version: 9.0.30729) Microsoft Windows SDK .NET Framework Tools (40715) (Version: 7.0.40715) Microsoft Windows SDK for Windows 7 (7.0) (Version: 7.0.40715) Microsoft Windows SDK for Windows 7 (7.0) (Version: 7.0.7600.16385.40715) Microsoft Windows SDK for Windows 7 .NET Documentation (40715) (Version: 7.0.40715) Microsoft Windows SDK for Windows 7 Common Utilities (40715) (Version: 7.0.40715) Microsoft Windows SDK for Windows 7 Headers and Libraries (40715) (Version: 7.0.40715) Microsoft Windows SDK for Windows 7 Samples (40715) (Version: 7.0.40715) Microsoft Windows SDK for Windows 7 Utilities for Win32 Development (40715) (Version: 7.0.40715) Microsoft Windows SDK for Windows 7 Win32 Documentation (40715) (Version: 7.0.40715) Microsoft Windows SDK Intellisense and Reference Assemblies (40715) (Version: 7.0.40715) Microsoft Windows SDK Net Fx Interop Headers And Libraries (40715) (Version: 7.0.40715) Microsoft WSE 3.0 Runtime (Version: 3.0.5305.0) Mozilla Firefox 23.0.1 (x86 de) (Version: 23.0.1) Mozilla Maintenance Service (Version: 23.0.1) Notepad++ (Version: 5.7) Picasa 3 (Version: 3.9) Ravensburger tiptoi Realtek AC'97 Audio Samsung ML-3470 Series Time Riddles: The Mansion Top50 V5 Viewer (Version: 6.3.2.0000) Total Commander (Remove or Repair) (Version: 7.50a) Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition Update for Microsoft Office Outlook 2007 (KB2768023) 32-Bit Edition Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817642) 32-Bit Edition Update für Microsoft Office Excel 2007 Help (KB963678) Update für Microsoft Office Outlook 2007 Help (KB963677) Update für Microsoft Office Powerpoint 2007 Help (KB963669) Update für Microsoft Office Word 2007 Help (KB963665) Visual C++ 2008 x86 Runtime - (v9.0.30729) (Version: 9.0.30729) Visual C++ 2008 x86 Runtime - v9.0.30729.01 (Version: 9.0.30729.01) VLC media player 1.1.4 (Version: 1.1.4) WatchGuard Mobile VPN (Version: 10.22) Windows SDK Intellidocs (Version: 9.0.30729) WinRAR ==================== Restore Points ========================= 21-08-2013 15:14:26 Windows Update 25-08-2013 15:19:41 Windows Update 30-08-2013 13:26:12 Windows Update 03-09-2013 07:24:00 Windows Update 03-09-2013 09:12:45 Windows Update ==================== Hosts content: ========================== 2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {02905FA9-B304-4A91-B781-EB0D4F7B2FB8} - System32\Tasks\User_Feed_Synchronization-{0EB3223D-0B3F-4CEA-B55B-E3266F46ADF5} => C:\Windows\system32\msfeedssync.exe [2013-04-05] (Microsoft Corporation) Task: {0D9B5D92-3A22-486D-A887-3AA21597CF27} - System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime => start w32time task_started Task: {607903AC-BD36-4572-8DE6-000D60314C4D} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2012-07-24] (Piriform Ltd) Task: {8A68FDB1-CBAD-4427-AED0-203717B2DB8E} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-11] (Microsoft Corporation) Task: {8CBF26B4-6416-450E-8726-25231BD59688} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => C:\Program Files\Microsoft Security Client\MpCmdRun.exe [2013-06-20] (Microsoft Corporation) Task: {98573E17-8B77-4EAA-A1C8-AB5618516B05} - System32\Tasks\Ad-Aware Update (Weekly) => C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe No File Task: {B1B02FB5-9D67-41DF-BB25-545019E02BEB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-23] (Adobe Systems Incorporated) Task: {C9E147E7-9E93-475F-B631-22F2863093DB} - System32\Tasks\task2760968 => C:\Users\Hasi\AppData\Local\Temp\cgs8h1.exe No File Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe ==================== Loaded Modules (whitelisted) ============= 2009-08-13 16:10 - 2009-08-13 16:10 - 02896896 _____ (ATI Technologies Inc. ) C:\Windows\system32\atidxx32.dll 2009-02-26 19:37 - 2009-02-26 19:37 - 00178040 _____ (Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll 2009-02-26 19:36 - 2009-02-26 19:36 - 01560912 _____ (Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMisc.dll 2009-02-27 15:52 - 2009-02-27 15:52 - 01048944 _____ (Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\1031\GrooveIntlResource.dll 2010-09-10 20:43 - 2010-03-15 11:28 - 00141824 _____ () C:\Program Files\WinRAR\rarext.dll 2009-08-13 21:26 - 2009-08-13 21:26 - 00704512 _____ (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll 2009-08-13 21:25 - 2009-08-13 21:25 - 00003584 _____ (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiamdeu.dll 2011-04-21 16:54 - 2010-01-21 18:26 - 00097792 _____ () C:\Program Files\WatchGuard\Mobile VPN\ncpmif32.dll 2011-04-21 16:54 - 2002-06-28 10:16 - 00151552 _____ () C:\Program Files\WatchGuard\Mobile VPN\ncpcfg.dll 2011-04-21 16:54 - 2009-10-21 12:29 - 00139264 _____ () C:\Program Files\WatchGuard\Mobile VPN\ncpdlg.dll 2011-04-21 16:54 - 2010-02-02 16:23 - 00249344 _____ (NCP engineering GmbH) C:\Program Files\WatchGuard\Mobile VPN\ncpmon3.dll 2011-04-21 16:54 - 2009-11-27 11:11 - 00081920 _____ () C:\Program Files\WatchGuard\Mobile VPN\ncpclcfg.dll ==================== Alternate Data Streams (whitelisted) ========== ==================== Faulty Device Manager Devices ============= Name: X6XSEx_Pr143 Description: X6XSEx_Pr143 Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1} Manufacturer: Service: X6XSEx_Pr143 Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24) Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed. Devices stay in this state if they have been prepared for removal. After you remove the device, this error disappears.Remove the device, and this error should be resolved. Name: DgiVecp Description: DgiVecp Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1} Manufacturer: Service: DgiVecp Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24) Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed. Devices stay in this state if they have been prepared for removal. After you remove the device, this error disappears.Remove the device, and this error should be resolved. ==================== Event log errors: ========================= Application errors: ================== Error: (09/03/2013 00:45:35 PM) (Source: Application Error) (User: ) Description: Aus einem der folgenden Gründe kann nicht auf die Datei "C:\Users\Hasi\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" zugegriffen werden: Es besteht ein Problem mit der Netzwerkverbindung, dem Datenträger mit der gespeicherten Datei bzw. den auf dem Computer installierten Speichertreibern, oder der Datenträger fehlt. Das Programm FRST.exe wurde wegen dieses Fehlers geschlossen. Programm: FRST.exe Datei: C:\Users\Hasi\AppData\Local\Microsoft\Windows\Caches\cversions.1.db Der Fehlerwert ist im Abschnitt "Zusätzliche Dateien" aufgelistet. Benutzeraktion 1. Öffnen Sie die Datei erneut. Diese Situation ist eventuell ein temporäres Problem, das selbstständig behoben wird, wenn das Programm erneut ausgeführt wird. 2. Wenn Sie weiterhin nicht auf die Datei zugreifen können und - diese sich im Netzwerk befindet, dann sollte der Netzwerkadministrator überprüfen, dass kein Netzwerkproblem besteht und dass eine Verbindung mit dem Server hergestellt werden kann. - diese sich auf einem Wechseldatenträger, wie z. B. einer Diskette oder einer CD, befindet, überprüfen Sie, ob der Datenträger richtig in den Computer eingelegt ist. 3. Überprüfen und reparieren Sie das Dateisystem, indem Sie CHKDSK ausführen. Klicken Sie dazu im Menü "Start" auf "Ausführen", geben Sie CMD ein, und klicken Sie auf "OK". Geben Sie an der Eingabeaufforderung CHKDSK /F ein, und drücken Sie die EINGABETASTE. 4. Stellen Sie die Datei von einer Sicherungskopie wieder her, wenn das Problem weiterhin besteht. 5. Überprüfen Sie, ob andere Dateien auf demselben Datenträger geöffnet werden können. Falls dies nicht möglich ist, ist der Datenträger eventuell beschädigt. Wenden Sie sich an den Administrator oder den Hersteller der Computerhardware, um weitere Unterstützung zu erhalten, wenn es sich um eine Festplatte handelt. Zusätzliche Daten Fehlerwert: C000009C Datenträgertyp: 3 Error: (09/03/2013 00:45:35 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: FRST.exe, Version: 3.3.8.1, Zeitstempel: 0x4f25baec Name des fehlerhaften Moduls: PROPSYS.dll, Version: 7.0.7601.17514, Zeitstempel: 0x4ce7b983 Ausnahmecode: 0xc0000006 Fehleroffset: 0x000051e4 ID des fehlerhaften Prozesses: 0xc7c Startzeit der fehlerhaften Anwendung: 0xFRST.exe0 Pfad der fehlerhaften Anwendung: FRST.exe1 Pfad des fehlerhaften Moduls: FRST.exe2 Berichtskennung: FRST.exe3 Error: (09/03/2013 00:45:25 PM) (Source: ESENT) (User: ) Description: taskhost (2868) WebCacheLocal: Bei Datenbankwiederherstellung trat ein unerwarteter Fehler -1022 auf. Error: (09/03/2013 00:45:25 PM) (Source: ESENT) (User: ) Description: taskhost (2868) WebCacheLocal: Seite 682 der Datenbank C:\Users\Hasi\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat konnte nicht gelesen werden. Fehler -1022. Error: (09/03/2013 00:45:22 PM) (Source: ESENT) (User: ) Description: taskhost (2868) WebCacheLocal: Bei Datenbankwiederherstellung trat ein unerwarteter Fehler -1022 auf. Error: (09/03/2013 00:45:22 PM) (Source: ESENT) (User: ) Description: taskhost (2868) WebCacheLocal: Seite 682 der Datenbank C:\Users\Hasi\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat konnte nicht gelesen werden. Fehler -1022. Error: (09/03/2013 00:45:18 PM) (Source: ESENT) (User: ) Description: taskhost (2868) WebCacheLocal: Bei Datenbankwiederherstellung trat ein unerwarteter Fehler -1022 auf. Error: (09/03/2013 00:45:18 PM) (Source: ESENT) (User: ) Description: taskhost (2868) WebCacheLocal: Seite 682 der Datenbank C:\Users\Hasi\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat konnte nicht gelesen werden. Fehler -1022. Error: (09/03/2013 00:45:01 PM) (Source: Application Error) (User: ) Description: Aus einem der folgenden Gründe kann nicht auf die Datei "C:\Users\Hasi\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" zugegriffen werden: Es besteht ein Problem mit der Netzwerkverbindung, dem Datenträger mit der gespeicherten Datei bzw. den auf dem Computer installierten Speichertreibern, oder der Datenträger fehlt. Das Programm FRST.exe wurde wegen dieses Fehlers geschlossen. Programm: FRST.exe Datei: C:\Users\Hasi\AppData\Local\Microsoft\Windows\Caches\cversions.1.db Der Fehlerwert ist im Abschnitt "Zusätzliche Dateien" aufgelistet. Benutzeraktion 1. Öffnen Sie die Datei erneut. Diese Situation ist eventuell ein temporäres Problem, das selbstständig behoben wird, wenn das Programm erneut ausgeführt wird. 2. Wenn Sie weiterhin nicht auf die Datei zugreifen können und - diese sich im Netzwerk befindet, dann sollte der Netzwerkadministrator überprüfen, dass kein Netzwerkproblem besteht und dass eine Verbindung mit dem Server hergestellt werden kann. - diese sich auf einem Wechseldatenträger, wie z. B. einer Diskette oder einer CD, befindet, überprüfen Sie, ob der Datenträger richtig in den Computer eingelegt ist. 3. Überprüfen und reparieren Sie das Dateisystem, indem Sie CHKDSK ausführen. Klicken Sie dazu im Menü "Start" auf "Ausführen", geben Sie CMD ein, und klicken Sie auf "OK". Geben Sie an der Eingabeaufforderung CHKDSK /F ein, und drücken Sie die EINGABETASTE. 4. Stellen Sie die Datei von einer Sicherungskopie wieder her, wenn das Problem weiterhin besteht. 5. Überprüfen Sie, ob andere Dateien auf demselben Datenträger geöffnet werden können. Falls dies nicht möglich ist, ist der Datenträger eventuell beschädigt. Wenden Sie sich an den Administrator oder den Hersteller der Computerhardware, um weitere Unterstützung zu erhalten, wenn es sich um eine Festplatte handelt. Zusätzliche Daten Fehlerwert: C000009C Datenträgertyp: 3 Error: (09/03/2013 00:45:01 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: FRST.exe, Version: 3.3.8.1, Zeitstempel: 0x4f25baec Name des fehlerhaften Moduls: PROPSYS.dll, Version: 7.0.7601.17514, Zeitstempel: 0x4ce7b983 Ausnahmecode: 0xc0000006 Fehleroffset: 0x000051e4 ID des fehlerhaften Prozesses: 0xa24 Startzeit der fehlerhaften Anwendung: 0xFRST.exe0 Pfad der fehlerhaften Anwendung: FRST.exe1 Pfad des fehlerhaften Moduls: FRST.exe2 Berichtskennung: FRST.exe3 System errors: ============= Error: (09/03/2013 00:45:35 PM) (Source: Disk) (User: ) Description: Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0. Error: (09/03/2013 00:45:33 PM) (Source: Disk) (User: ) Description: Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0. Error: (09/03/2013 00:45:25 PM) (Source: Disk) (User: ) Description: Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0. Error: (09/03/2013 00:45:24 PM) (Source: Disk) (User: ) Description: Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0. Error: (09/03/2013 00:45:22 PM) (Source: Disk) (User: ) Description: Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0. Error: (09/03/2013 00:45:20 PM) (Source: Disk) (User: ) Description: Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0. Error: (09/03/2013 00:45:18 PM) (Source: Disk) (User: ) Description: Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0. Error: (09/03/2013 00:45:16 PM) (Source: Disk) (User: ) Description: Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0. Error: (09/03/2013 00:45:01 PM) (Source: Disk) (User: ) Description: Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0. Error: (09/03/2013 00:44:59 PM) (Source: Disk) (User: ) Description: Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0. Microsoft Office Sessions: ========================= Error: (08/27/2012 00:04:58 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 6 seconds with 0 seconds of active time. This session ended with a crash. ==================== Memory info =========================== Percentage of memory in use: 32% Total physical RAM: 2047.55 MB Available physical RAM: 1372.09 MB Total Pagefile: 4095.11 MB Available Pagefile: 3144.71 MB Total Virtual: 2047.88 MB Available Virtual: 1926.2 MB ==================== Drives ================================ Drive c: (WINDOWS7) (Fixed) (Total:78.03 GB) (Free:45.84 GB) NTFS Drive d: (DATA) (Fixed) (Total:154.76 GB) (Free:145.51 GB) NTFS Drive f: (PLATINUM) (Removable) (Total:1.95 GB) (Free:0.6 GB) FAT ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: B731081E) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=78 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=155 GB) - (Type=OF Extended) ======================================================== Disk: 5 (Size: 2 GB) (Disk ID: 0034EBB6) Partition 1: (Not Active) - (Size=2 GB) - (Type=0E) ==================== End Of Log ============================ |
|
03.09.2013, 12:18
| #6 |
| /// the machine /// TB-Ausbilder | BlackScreenOfDeath: Trojan:Win32/Urausy.C Nö, alles sauber. Was genau bekommste denn? Sperrbildschirm oder nur schwarzen Bildschirm? Mit oder ohne Mauszeiger? Wenn Du deinen normalen Benutzer starten willst.
__________________ --> BlackScreenOfDeath: Trojan:Win32/Urausy.C |
|
03.09.2013, 12:29
| #7 |
| | BlackScreenOfDeath: Trojan:Win32/Urausy.C Ich bekomme einen schwarzen Bildschirm mit Mauszeiger. Taskmanager kann ich starten und wird auch angezeigt. Explorer aus Taskmanager raus starten geht aber nicht. |
|
03.09.2013, 12:40
| #8 |
| /// the machine /// TB-Ausbilder | BlackScreenOfDeath: Trojan:Win32/Urausy.C Strange. Bitte nochmal ein FRST Log aus der Recovery. Hast Du auch mal die Startreparatur versucht?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
03.09.2013, 13:37
| #9 |
| | BlackScreenOfDeath: Trojan:Win32/Urausy.C Startreperatur habe ich schon mehrfach ohne Erfolg probiert. Hier nochmal der Log: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-09-2013
Ran by SYSTEM on MININT-C8J4A47 on 03-09-2013 13:46:44
Running from K:\
Windows 7 Home Premium (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery
The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [NcpPopup] - C:\Program Files\WatchGuard\Mobile VPN\ncppopup.exe [579072 2010-01-13] ()
HKLM\...\Run: [NcpBudgetGui] - C:\Program Files\WatchGuard\Mobile VPN\NcpBudgetGui.exe [1032192 2010-01-29] ()
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [995176 2013-06-20] (Microsoft Corporation)
========================== Services (Whitelisted) =================
S2 lxdu_device; C:\Windows\system32\lxducoms.exe [589824 2009-10-16] ( )
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
S2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-06-20] (Microsoft Corporation)
S2 ncpclcfg; C:\Program Files\WatchGuard\Mobile VPN\ncpclcfg.exe [86016 2008-06-30] (NCP engineering GmbH)
S2 ncprwsnt; C:\Program Files\WatchGuard\Mobile VPN\ncprwsnt.exe [1092104 2010-02-25] (NCP Engineering GmbH)
S2 NcpSec; C:\Program Files\WatchGuard\Mobile VPN\ncpsec.exe [97280 2010-02-05] ()
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [295376 2013-06-20] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
S3 ALCXWDM; C:\Windows\System32\drivers\RTKVAC.SYS [4172832 2009-06-18] (Realtek Semiconductor Corp.)
S0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [38400 2009-06-10] (Samsung Electronics Co., Ltd.)
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [211560 2013-06-18] (Microsoft Corporation)
S3 ncpfilt; C:\Windows\System32\DRIVERS\ncplelhp.sys [77128 2010-02-23] (NCP Engineering GmbH)
S3 ncplelhp; C:\Windows\System32\DRIVERS\ncplelhp.sys [77128 2010-02-23] (NCP Engineering GmbH)
S2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2007-01-12] (Samsung Electronics)
S3 cmnsusbser; system32\DRIVERS\cmnsusbser.sys [x]
S0 Lbd; system32\DRIVERS\Lbd.sys [x]
S2 X6XSEx_Pr143; \??\C:\Program Files\FantastiGames\X6XSEx_Pr143.Sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-03 11:47 - 2013-09-03 11:47 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Macromedia
2013-09-03 10:42 - 2013-09-03 10:42 - 00000625 _____ C:\Users\Admin\Desktop\JRT.txt
2013-09-03 10:37 - 2013-09-03 10:37 - 00000000 ____D C:\Windows\ERUNT
2013-09-03 10:31 - 2013-09-03 10:34 - 00000000 ____D C:\AdwCleaner
2013-09-03 10:31 - 2013-09-03 09:07 - 01037134 _____ C:\Users\Admin\Desktop\adwcleaner.exe
2013-09-03 10:30 - 2013-09-03 09:09 - 01028757 _____ (Thisisu) C:\Users\Admin\Desktop\JRT.exe
2013-09-03 10:19 - 2012-08-23 15:48 - 00221184 _____ (Microsoft Corporation) C:\Windows\System32\rdpudd.dll
2013-09-03 10:19 - 2012-08-23 15:44 - 00014848 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\rdpvideominiport.sys
2013-09-03 10:19 - 2012-08-23 15:40 - 00049664 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\TsUsbFlt.sys
2013-09-03 10:19 - 2012-08-23 15:10 - 00013312 _____ (Microsoft Corporation) C:\Windows\System32\TsUsbRedirectionGroupPolicyExtension.dll
2013-09-03 10:19 - 2012-08-23 15:10 - 00012288 _____ (Microsoft Corporation) C:\Windows\System32\TsUsbRedirectionGroupPolicyControl.exe
2013-09-03 10:19 - 2012-08-23 14:52 - 00012800 _____ (Microsoft Corporation) C:\Windows\System32\RdpGroupPolicyExtension.dll
2013-09-03 10:19 - 2012-08-23 14:47 - 00046592 _____ (Microsoft Corporation) C:\Windows\System32\MsRdpWebAccess.dll
2013-09-03 10:19 - 2012-08-23 14:46 - 00016896 _____ (Microsoft Corporation) C:\Windows\System32\wksprtPS.dll
2013-09-03 10:19 - 2012-08-23 14:32 - 00032768 _____ (Microsoft Corporation) C:\Windows\System32\TsUsbGDCoInstaller.dll
2013-09-03 10:19 - 2012-08-23 14:18 - 00037376 _____ (Microsoft Corporation) C:\Windows\System32\tsgqec.dll
2013-09-03 10:19 - 2012-08-23 12:40 - 00056320 _____ (Microsoft Corporation) C:\Windows\System32\TSWbPrxy.exe
2013-09-03 10:19 - 2012-08-23 12:32 - 00317440 _____ (Microsoft Corporation) C:\Windows\System32\wksprt.exe
2013-09-03 10:19 - 2012-08-23 12:15 - 00269312 _____ (Microsoft Corporation) C:\Windows\System32\aaclient.dll
2013-09-03 10:19 - 2012-08-23 12:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\System32\rdpendp_winip.dll
2013-09-03 10:19 - 2012-08-23 11:39 - 01048064 _____ (Microsoft Corporation) C:\Windows\System32\mstsc.exe
2013-09-03 10:19 - 2012-08-23 11:08 - 02739712 _____ (Microsoft Corporation) C:\Windows\System32\rdpcorets.dll
2013-09-03 10:19 - 2012-08-23 09:19 - 04916224 _____ (Microsoft Corporation) C:\Windows\System32\mstscax.dll
2013-09-03 10:12 - 2012-08-24 18:05 - 00136560 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
2013-09-03 10:12 - 2012-08-24 18:02 - 00369856 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys
2013-09-03 10:12 - 2012-08-24 17:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\System32\schannel.dll
2013-09-03 10:12 - 2012-08-24 17:56 - 01039360 _____ (Microsoft Corporation) C:\Windows\System32\lsasrv.dll
2013-09-03 10:08 - 2013-09-03 10:08 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Mozilla
2013-09-03 10:08 - 2013-09-03 10:08 - 00000000 ____D C:\Users\Admin\AppData\Local\Mozilla
2013-09-03 10:07 - 2013-09-03 10:07 - 00114672 _____ C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2013-09-03 10:05 - 2013-09-03 10:06 - 00000000 ____D C:\users\Admin
2013-09-03 10:05 - 2013-09-03 10:05 - 00000020 ___SH C:\Users\Admin\ntuser.ini
2013-09-03 10:05 - 2013-09-03 10:05 - 00000000 _SHDL C:\Users\Admin\Startmenü
2013-09-03 10:05 - 2013-09-03 10:05 - 00000000 _SHDL C:\Users\Admin\Netzwerkumgebung
2013-09-03 10:05 - 2013-09-03 10:05 - 00000000 _SHDL C:\Users\Admin\Druckumgebung
2013-09-03 10:05 - 2013-09-03 10:05 - 00000000 _SHDL C:\Users\Admin\Documents\Eigene Musik
2013-09-03 10:05 - 2013-09-03 10:05 - 00000000 _SHDL C:\Users\Admin\Documents\Eigene Bilder
2013-09-03 10:05 - 2013-09-03 10:05 - 00000000 _SHDL C:\Users\Admin\AppData\Local\Verlauf
2013-09-03 10:05 - 2013-09-03 10:05 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Adobe
2013-09-03 10:05 - 2011-12-26 17:46 - 00000000 ____D C:\Users\Admin\AppData\Local\Microsoft Help
2013-09-02 10:33 - 2013-09-02 10:33 - 00000000 ____D C:\FRST
2013-08-18 16:46 - 2013-08-18 17:01 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-08-17 21:16 - 2013-08-17 21:19 - 00000000 ____D C:\Windows\System32\MRT
2013-08-17 20:56 - 2013-07-26 04:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-08-17 20:56 - 2013-07-26 04:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-08-17 20:56 - 2013-07-26 04:13 - 00042496 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-08-17 20:56 - 2013-07-26 04:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-08-17 20:56 - 2013-07-26 04:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-08-17 20:56 - 2013-07-26 04:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-08-17 20:56 - 2013-07-26 04:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-08-17 20:56 - 2013-07-26 04:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-08-17 20:56 - 2013-07-26 04:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-08-17 20:56 - 2013-07-26 04:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-08-17 20:56 - 2013-07-26 04:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-08-17 20:56 - 2013-07-26 04:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-08-17 20:56 - 2013-07-26 04:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-08-17 20:56 - 2013-07-26 04:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-08-17 20:56 - 2013-07-26 03:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-08-17 20:56 - 2013-07-26 02:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-08-14 17:28 - 2013-07-09 05:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\System32\wintrust.dll
2013-08-14 17:28 - 2013-07-09 05:50 - 00652800 _____ (Microsoft Corporation) C:\Windows\System32\rpcrt4.dll
2013-08-14 17:28 - 2013-07-09 05:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-08-14 17:28 - 2013-07-09 05:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-08-14 17:28 - 2013-07-09 05:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-08-14 17:27 - 2013-07-25 09:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL
2013-08-14 17:27 - 2013-07-09 06:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-08-14 17:27 - 2013-07-09 06:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-08-14 17:27 - 2013-07-09 05:53 - 01289096 _____ (Microsoft Corporation) C:\Windows\System32\ntdll.dll
2013-08-14 17:27 - 2013-07-06 06:05 - 01293760 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-08-14 17:26 - 2013-07-19 02:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\tzres.dll
2013-08-14 17:26 - 2013-06-15 04:38 - 00031232 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tssecsrv.sys
2013-08-08 07:13 - 2013-08-08 07:13 - 00000375 _____ C:\Windows\System32\Drivers\etc\hosts.ics
==================== One Month Modified Files and Folders =======
2013-09-03 12:44 - 2010-09-10 10:51 - 01920509 _____ C:\Windows\WindowsUpdate.log
2013-09-03 12:16 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-09-03 11:47 - 2013-09-03 11:47 - 01084685 _____ (Farbar) C:\Users\Admin\Downloads\FRST.exe
2013-09-03 11:47 - 2013-09-03 11:47 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Macromedia
2013-09-03 11:43 - 2009-07-14 05:34 - 00017216 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-03 11:43 - 2009-07-14 05:34 - 00017216 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-03 11:36 - 2012-08-27 10:09 - 00023385 _____ C:\Windows\setupact.log
2013-09-03 10:55 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-09-03 10:42 - 2013-09-03 10:42 - 00000625 _____ C:\Users\Admin\Desktop\JRT.txt
2013-09-03 10:37 - 2013-09-03 10:37 - 00000000 ____D C:\Windows\ERUNT
2013-09-03 10:34 - 2013-09-03 10:31 - 00000000 ____D C:\AdwCleaner
2013-09-03 10:28 - 2010-09-10 11:05 - 00719716 _____ C:\Windows\System32\PerfStringBackup.INI
2013-09-03 10:20 - 2009-07-14 09:47 - 00000000 ____D C:\Windows\System32\Drivers\de-DE
2013-09-03 10:20 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-09-03 10:19 - 2012-08-26 10:38 - 00001912 _____ C:\Windows\epplauncher.mif
2013-09-03 10:18 - 2012-08-26 10:37 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-09-03 10:08 - 2013-09-03 10:08 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Mozilla
2013-09-03 10:08 - 2013-09-03 10:08 - 00000000 ____D C:\Users\Admin\AppData\Local\Mozilla
2013-09-03 10:07 - 2013-09-03 10:07 - 00114672 _____ C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2013-09-03 10:06 - 2013-09-03 10:05 - 00000000 ____D C:\users\Admin
2013-09-03 10:05 - 2013-09-03 10:05 - 00000020 ___SH C:\Users\Admin\ntuser.ini
2013-09-03 10:05 - 2013-09-03 10:05 - 00000000 _SHDL C:\Users\Admin\Startmenü
2013-09-03 10:05 - 2013-09-03 10:05 - 00000000 _SHDL C:\Users\Admin\Netzwerkumgebung
2013-09-03 10:05 - 2013-09-03 10:05 - 00000000 _SHDL C:\Users\Admin\Druckumgebung
2013-09-03 10:05 - 2013-09-03 10:05 - 00000000 _SHDL C:\Users\Admin\Documents\Eigene Musik
2013-09-03 10:05 - 2013-09-03 10:05 - 00000000 _SHDL C:\Users\Admin\Documents\Eigene Bilder
2013-09-03 10:05 - 2013-09-03 10:05 - 00000000 _SHDL C:\Users\Admin\AppData\Local\Verlauf
2013-09-03 10:05 - 2013-09-03 10:05 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Adobe
2013-09-03 09:09 - 2013-09-03 10:30 - 01028757 _____ (Thisisu) C:\Users\Admin\Desktop\JRT.exe
2013-09-03 09:07 - 2013-09-03 10:31 - 01037134 _____ C:\Users\Admin\Desktop\adwcleaner.exe
2013-09-02 10:33 - 2013-09-02 10:33 - 00000000 ____D C:\FRST
2013-09-02 09:52 - 2013-03-29 14:28 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-09-02 09:52 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\wfp
2013-09-02 09:52 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\registration
2013-09-02 09:52 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\AppCompat
2013-09-02 09:21 - 2010-09-10 10:56 - 00000000 ____D C:\users\Hasi
2013-09-02 09:19 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\LogFiles
2013-08-23 12:08 - 2013-03-29 14:28 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-08-23 12:08 - 2011-11-22 18:53 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-08-19 15:24 - 2012-08-21 13:40 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-08-18 17:01 - 2013-08-18 16:46 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-08-17 21:19 - 2013-08-17 21:16 - 00000000 ____D C:\Windows\System32\MRT
2013-08-17 21:16 - 2010-09-10 16:06 - 75778376 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-08-17 21:15 - 2011-01-23 18:53 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-08 19:45 - 2009-07-14 05:52 - 00000000 ____D C:\Windows\System32\FxsTmp
2013-08-08 07:13 - 2013-08-08 07:13 - 00000375 _____ C:\Windows\System32\Drivers\etc\hosts.ics
2013-08-08 07:12 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\NDF
Files to move or delete:
====================
C:\Users\Admin\AppData\Local\Temp\Quarantine.exe
C:\Users\Admin\AppData\Local\Temp\jrt\erunt\ERUNT.EXE
==================== Known DLLs (Whitelisted) ============
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
==================== Restore Points =========================
Restore point made on: 2013-08-21 16:14:59
Restore point made on: 2013-08-25 16:20:12
Restore point made on: 2013-08-30 14:26:26
Restore point made on: 2013-09-03 08:24:15
Restore point made on: 2013-09-03 10:13:06
==================== Memory info ===========================
Percentage of memory in use: 20%
Total physical RAM: 2047.55 MB
Available physical RAM: 1625.48 MB
Total Pagefile: 2047.55 MB
Available Pagefile: 1622.65 MB
Total Virtual: 2047.88 MB
Available Virtual: 1945.12 MB
==================== Drives ================================
Drive c: (WINDOWS7) (Fixed) (Total:78.03 GB) (Free:45.85 GB) NTFS
Drive d: (DATA) (Fixed) (Total:154.76 GB) (Free:145.51 GB) NTFS
Drive k: (PLATINUM) (Removable) (Total:1.95 GB) (Free:0.6 GB) FAT
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.06 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: B731081E)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=78 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=155 GB) - (Type=OF Extended)
========================================================
Disk: 5 (Size: 2 GB) (Disk ID: 0034EBB6)
Partition 1: (Not Active) - (Size=2 GB) - (Type=0E)
LastRegBack: 2013-09-02 10:30
==================== End Of Log ============================
|
|
03.09.2013, 18:27
| #10 |
| /// the machine /// TB-Ausbilder | BlackScreenOfDeath: Trojan:Win32/Urausy.C zum Verständnis: Mit nem anderen Benutzer geht es? ODer kommt der Schirm schon vor der Benutzerauswahl?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
03.09.2013, 20:55
| #11 |
| | BlackScreenOfDeath: Trojan:Win32/Urausy.C Ja mit dem anderen Profil funktioniert alles bestens. Der BSOD kommt erst nach dem anmelden. Für mich ist das so eigentlich OK. Hab die Einstellungen auf das neue Benutzerprofil übertragen und kann damit arbeiten. Danke soweit... |
|
04.09.2013, 08:54
| #12 |
| /// the machine /// TB-Ausbilder | BlackScreenOfDeath: Trojan:Win32/Urausy.C Dann das alte einfach löschen. Auch wenn es immer noch komisch ist.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu BlackScreenOfDeath: Trojan:Win32/Urausy.C |
| adobe, association, avira, bootmgr, crypt, explorer, explorer.exe, farbar, farbar recovery scan tool, free, home, i8042prt.sys, ics, log, microsoft, mozilla, realtek, registry, scan, security, services.exe, super, svchost.exe, system, system32, taskmanager, temp, trojan, trojaner, winlogon.exe |
Linear-Darstellung
