| |
| |||||||
Log-Analyse und Auswertung: BKS/Interpol Sperrbildschirm unter VistaWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
19.10.2013, 10:41
| #1 |
| |  BKS/Interpol Sperrbildschirm unter Vista Hallo Boardies, Als Neuling möchte ich mich gerne erst vorstellen: Ich heiße Sven, arbeite in der IT und bin eigentlich in Unix Umfeld (Mac, Linux) zu Hause. Leider hat mein Vater sich heute eine BKA/Interpol Schadsoftware eingefangen und da ich IT-ler bin hat er sein Problem zu meinem gemacht...  Da keiner der User sauber war hab ich die Platte per USB an meinen Mac angeschlossen und konnte so recht schnell die Schädlinge unter C:\ProgramData\ ausmachen, da waren drei neue Dateien mit kryptischen Namen/Dateiendungen. Nach dem Verschieben in ein neu erstelltes Verzeichnis C:\ttt\ läuft der Rechner auch wieder rund, zumindest vordergründig. Da ich jedoch sicher gehen will dass da nichts mehr im Hintergrund schlummert, habe ich den Rechner gemäß der Anleitung mit FRST im Wiederherstellungsmodus gescannt. Ich würde mich freuen wenn sich jemand das Log-File ansehen könnte: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013
Ran by SYSTEM on MINWINPC on 19-10-2013 11:10:58
Running from G:\
Windows Vista (TM) Home Basic Service Pack 1 (X86) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Recovery
The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-20] (Microsoft Corporation)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1029416 2007-12-06] (Synaptics, Inc.)
HKLM\...\Run: [NDSTray.exe] - NDSTray.exe
HKLM\...\Run: [cfFncEnabler.exe] - cfFncEnabler.exe
HKLM\...\Run: [Toshiba TEMPO] - C:\Program Files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe [103824 2008-04-24] (Toshiba Europe GmbH)
HKLM\...\Run: [topi] - C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe [581632 2007-07-09] (TOSHIBA)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [RtHDVCpl] - C:\Windows\RtHDVCpl.exe [6037504 2008-04-08] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] - C:\Windows\Skytel.exe [1826816 2007-11-20] (Realtek Semiconductor Corp.)
HKLM\...\Run: [TPwrMain] - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [431456 2008-01-17] (TOSHIBA Corporation)
HKLM\...\Run: [SmoothView] - C:\Program Files\Toshiba\SmoothView\SmoothView.exe [509816 2008-06-24] (TOSHIBA Corporation)
HKLM\...\Run: [00TCrdMain] - C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [716800 2008-05-09] (TOSHIBA Corporation)
HKLM\...\Run: [Windows Mobile Device Center] - C:\Windows\WindowsMobile\wmdc.exe [648072 2007-05-30] (Microsoft Corporation)
HKLM\...\Run: [LogitechQuickCamRibbon] - C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe [2793304 2009-10-14] ()
HKLM\...\Run: [vProt] - C:\Program Files\AVG Secure Search\vprot.exe [2404376 2013-10-02] ()
HKLM\...\Run: [AVG_UI] - C:\Program Files\AVG\AVG2013\avgui.exe [4411440 2013-08-15] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default\...\Run: [TOSCDSPD] - C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [ 2008-04-24] (TOSHIBA)
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\Run: [TOSCDSPD] - C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [ 2008-04-24] (TOSHIBA)
HKU\Doris\...\Run: [TOSCDSPD] - TOSCDSPD.EXE
HKU\Doris\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [ 2012-09-10] (Google Inc.)
HKU\Manfred\...\Run: [TOSCDSPD] - C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [ 2008-04-24] (TOSHIBA)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Doris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zjwlwl4ri.lnk
ShortcutTarget: zjwlwl4ri.lnk -> C:\PROGRA~2\ir4lwlwjz.dss (No File)
Startup: C:\Users\Manfred\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zjwlwl4ri.lnk
ShortcutTarget: zjwlwl4ri.lnk -> C:\PROGRA~2\ir4lwlwjz.dss (No File)
========================== Services (Whitelisted) =================
S2 AVGIDSAgent; C:\Program Files\AVG\AVG2013\avgidsagent.exe [4939312 2013-07-04] (AVG Technologies CZ, s.r.o.)
S2 avgwd; C:\Program Files\AVG\AVG2013\avgwdsvc.exe [283136 2013-07-23] (AVG Technologies CZ, s.r.o.)
S2 ConfigFree Service; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [40960 2008-04-16] (TOSHIBA CORPORATION)
S2 gupdate1c9ac639a3f4fb0; C:\Program Files\Google\Update\GoogleUpdate.exe [133104 2009-03-24] (Google Inc.)
S3 jswpsapi; C:\Program Files\Jumpstart\jswpsapi.exe [954368 2008-04-16] (Atheros Communications, Inc.)
S2 TempoMonitoringService; C:\Program Files\Toshiba TEMPRO\TempoSVC.exe [99720 2008-04-24] (Toshiba Europe GmbH)
S2 TOSHIBA SMART Log Service; C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [126976 2008-02-06] (TOSHIBA Corporation)
S2 UleadBurningHelper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [49152 2006-08-23] (Ulead Systems, Inc.)
S2 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-17] (Logitech Inc.)
S2 vToolbarUpdater17.0.12; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\17.0.12\ToolbarUpdater.exe [1734680 2013-10-02] (AVG Secure Search)
S2 Winmgmt; C:\PROGRA~2\ir4lwlwjz.dss [x]
==================== Drivers (Whitelisted) ====================
S1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [208184 2013-07-19] (AVG Technologies CZ, s.r.o.)
S0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [60216 2013-07-19] (AVG Technologies CZ, s.r.o.)
S1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [22328 2013-09-09] (AVG Technologies CZ, s.r.o.)
S1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [171320 2013-07-19] (AVG Technologies CZ, s.r.o.)
S0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [246072 2013-07-19] (AVG Technologies CZ, s.r.o.)
S0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [96568 2013-06-30] (AVG Technologies CZ, s.r.o.)
S0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [39224 2013-09-04] (AVG Technologies CZ, s.r.o.)
S1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [182072 2013-03-20] (AVG Technologies CZ, s.r.o.)
S1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [37664 2013-10-02] (AVG Technologies)
S0 CLFS; C:\Windows\System32\CLFS.sys [245736 2009-04-10] (Microsoft Corporation)
S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2Mon.sys [25752 2009-10-06] ()
S3 PID_PEPI; C:\Windows\System32\DRIVERS\LV302V32.SYS [2687512 2009-04-30] (Logitech Inc.)
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-19 11:10 - 2013-10-19 11:10 - 00000000 ____D C:\FRST
2013-10-19 00:57 - 2013-10-19 00:57 - 01087213 _____ (Farbar) C:\Users\Manfred\Downloads\FRST.exe
2013-10-19 00:50 - 2013-10-19 00:50 - 00000000 ____D C:\ttt
2013-10-19 00:43 - 2013-10-19 00:45 - 00006148 ____H C:\ProgramData\.DS_Store
2013-10-19 00:42 - 2013-10-19 00:42 - 00006148 ____H C:\users\.DS_Store
2013-10-19 00:41 - 2013-10-19 00:46 - 00012292 ____H C:\.DS_Store
2013-10-19 00:41 - 2013-10-19 00:41 - 00000000 ___HD C:\.Trashes
2013-10-19 00:41 - 2013-10-19 00:41 - 00000000 ___HD C:\.fseventsd
2013-10-10 17:10 - 2013-09-22 02:29 - 12336128 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-10-10 17:10 - 2013-09-22 02:22 - 09739264 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-10-10 17:10 - 2013-09-22 02:22 - 01800704 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-10-10 17:10 - 2013-09-22 02:14 - 01427968 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-10-10 17:10 - 2013-09-22 02:13 - 01129472 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-10-10 17:10 - 2013-09-22 02:13 - 01104896 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-10-10 17:10 - 2013-09-22 02:12 - 00231936 _____ (Microsoft Corporation) C:\Windows\System32\url.dll
2013-10-10 17:10 - 2013-09-22 02:09 - 00065024 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-10-10 17:10 - 2013-09-22 02:08 - 00142848 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-10-10 17:10 - 2013-09-22 02:07 - 00717824 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-10-10 17:10 - 2013-09-22 02:06 - 00420864 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-10-10 17:10 - 2013-09-22 02:05 - 00607744 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-10-10 17:10 - 2013-09-22 02:03 - 02382848 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-10-10 17:10 - 2013-09-22 02:03 - 01796096 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-10-10 17:10 - 2013-09-22 02:03 - 00073216 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-10-10 17:10 - 2013-09-22 01:59 - 00176640 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-10-10 04:36 - 2013-08-28 23:36 - 02050048 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-10-10 04:36 - 2013-08-26 18:47 - 01029120 _____ (Microsoft Corporation) C:\Windows\System32\d3d10.dll
2013-10-10 04:36 - 2013-08-26 18:47 - 00219648 _____ (Microsoft Corporation) C:\Windows\System32\d3d10_1core.dll
2013-10-10 04:36 - 2013-08-26 18:47 - 00189952 _____ (Microsoft Corporation) C:\Windows\System32\d3d10core.dll
2013-10-10 04:36 - 2013-08-26 18:47 - 00160768 _____ (Microsoft Corporation) C:\Windows\System32\d3d10_1.dll
2013-10-10 04:36 - 2013-08-26 17:52 - 01172480 _____ (Microsoft Corporation) C:\Windows\System32\d3d10warp.dll
2013-10-10 04:36 - 2013-08-26 17:50 - 00486400 _____ (Microsoft Corporation) C:\Windows\System32\d3d10level9.dll
2013-10-10 04:36 - 2013-08-26 17:32 - 00683008 _____ (Microsoft Corporation) C:\Windows\System32\d2d1.dll
2013-10-10 04:36 - 2013-08-26 17:28 - 01069056 _____ (Microsoft Corporation) C:\Windows\System32\DWrite.dll
2013-10-10 04:36 - 2013-08-26 17:28 - 00798208 _____ (Microsoft Corporation) C:\Windows\System32\FntCache.dll
2013-10-10 04:36 - 2013-07-31 19:16 - 00638400 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys
2013-10-10 04:36 - 2013-07-31 18:49 - 00037376 _____ (Microsoft Corporation) C:\Windows\System32\cdd.dll
2013-10-10 04:36 - 2013-07-20 02:44 - 00102608 _____ (Microsoft Corporation) C:\Windows\System32\PresentationCFFRasterizerNative_v0300.dll
2013-10-10 04:36 - 2013-07-12 01:04 - 00073344 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\USBAUDIO.sys
2013-10-10 04:36 - 2013-07-03 20:21 - 00532480 _____ (Microsoft Corporation) C:\Windows\System32\comctl32.dll
2013-10-10 04:36 - 2013-07-02 18:10 - 00025472 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\hidparse.sys
2013-10-10 04:36 - 2013-06-28 18:07 - 00226304 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbport.sys
2013-10-10 04:36 - 2013-06-28 18:07 - 00197632 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbhub.sys
2013-10-10 04:36 - 2013-06-28 18:07 - 00073216 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbccgp.sys
2013-10-10 04:36 - 2013-06-28 18:06 - 00006016 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbd.sys
2013-10-10 04:36 - 2013-06-26 15:01 - 00527064 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\Wdf01000.sys
2013-10-10 04:36 - 2013-06-03 20:16 - 00034304 _____ (Adobe Systems) C:\Windows\System32\atmlib.dll
2013-10-10 04:36 - 2013-06-03 17:49 - 00293376 _____ (Adobe Systems Incorporated) C:\Windows\System32\atmfd.dll
2013-10-10 04:36 - 2011-05-05 05:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbehci.sys
2013-10-10 04:36 - 2011-05-05 05:54 - 00023552 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbuhci.sys
2013-10-04 08:55 - 2013-10-04 08:55 - 00000000 ____H C:\Windows\System32\Drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2013-09-29 23:46 - 2013-09-29 23:46 - 00000000 ____D C:\Users\Doris\AppData\Local\Avg2014
==================== One Month Modified Files and Folders =======
2013-10-19 11:10 - 2013-10-19 11:10 - 00000000 ____D C:\FRST
2013-10-19 01:07 - 2009-08-25 10:59 - 00000012 _____ C:\Windows\bthservsdp.dat
2013-10-19 01:07 - 2006-11-02 04:45 - 00003344 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-19 01:07 - 2006-11-02 04:45 - 00003344 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-19 01:06 - 2009-03-11 09:58 - 02066620 _____ C:\Windows\WindowsUpdate.log
2013-10-19 00:57 - 2013-10-19 00:57 - 01087213 _____ (Farbar) C:\Users\Manfred\Downloads\FRST.exe
2013-10-19 00:56 - 2006-11-02 04:49 - 00112705 _____ C:\Windows\setupact.log
2013-10-19 00:51 - 2011-02-21 02:46 - 00000000 ____D C:\ProgramData\MFAData
2013-10-19 00:50 - 2013-10-19 00:50 - 00000000 ____D C:\ttt
2013-10-19 00:46 - 2013-10-19 00:41 - 00012292 ____H C:\.DS_Store
2013-10-19 00:45 - 2013-10-19 00:43 - 00006148 ____H C:\ProgramData\.DS_Store
2013-10-19 00:42 - 2013-10-19 00:42 - 00006148 ____H C:\users\.DS_Store
2013-10-19 00:41 - 2013-10-19 00:41 - 00000000 ___HD C:\.Trashes
2013-10-19 00:41 - 2013-10-19 00:41 - 00000000 ___HD C:\.fseventsd
2013-10-18 23:18 - 2009-05-17 03:41 - 00000000 ____D C:\Users\Manfred\AppData\Roaming\Adobe
2013-10-13 10:47 - 2010-01-17 05:21 - 00002637 _____ C:\Users\Doris\Desktop\Microsoft Office Word 2003.lnk
2013-10-10 17:46 - 2006-11-02 03:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-10 17:43 - 2008-01-21 00:21 - 01474544 _____ C:\Windows\System32\PerfStringBackup.INI
2013-10-10 17:39 - 2006-11-02 04:44 - 00405984 _____ C:\Windows\System32\FNTCACHE.DAT
2013-10-10 17:38 - 2008-01-20 19:02 - 00044616 _____ C:\Windows\PFRO.log
2013-10-10 17:15 - 2013-08-14 17:09 - 00000000 ____D C:\Windows\System32\MRT
2013-10-10 17:12 - 2006-11-02 02:24 - 78106760 _____ (Microsoft Corporation) C:\Windows\System32\mrt.exe
2013-10-09 04:05 - 2012-04-03 03:26 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-10-09 04:05 - 2011-05-20 23:51 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-10-04 08:55 - 2013-10-04 08:55 - 00000000 ____H C:\Windows\System32\Drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2013-10-02 07:13 - 2012-10-20 04:35 - 00000000 ____D C:\Program Files\AVG Secure Search
2013-10-02 07:13 - 2012-09-04 00:07 - 00037664 _____ (AVG Technologies) C:\Windows\System32\Drivers\avgtpx86.sys
2013-09-29 23:46 - 2013-09-29 23:46 - 00000000 ____D C:\Users\Doris\AppData\Local\Avg2014
2013-09-22 02:29 - 2013-10-10 17:10 - 12336128 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-09-22 02:22 - 2013-10-10 17:10 - 09739264 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-09-22 02:22 - 2013-10-10 17:10 - 01800704 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-09-22 02:14 - 2013-10-10 17:10 - 01427968 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-09-22 02:13 - 2013-10-10 17:10 - 01129472 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-09-22 02:13 - 2013-10-10 17:10 - 01104896 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-09-22 02:12 - 2013-10-10 17:10 - 00231936 _____ (Microsoft Corporation) C:\Windows\System32\url.dll
2013-09-22 02:09 - 2013-10-10 17:10 - 00065024 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-09-22 02:08 - 2013-10-10 17:10 - 00142848 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-09-22 02:07 - 2013-10-10 17:10 - 00717824 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-09-22 02:06 - 2013-10-10 17:10 - 00420864 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-09-22 02:05 - 2013-10-10 17:10 - 00607744 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-09-22 02:03 - 2013-10-10 17:10 - 02382848 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-09-22 02:03 - 2013-10-10 17:10 - 01796096 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-09-22 02:03 - 2013-10-10 17:10 - 00073216 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-09-22 01:59 - 2013-10-10 17:10 - 00176640 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
Files to move or delete:
====================
C:\Users\Doris\AppData\Roaming\skype.ini
Some content of TEMP:
====================
C:\Users\Doris\AppData\Local\Temp\G2MInstallerExtractor.exe
C:\Users\Manfred\AppData\Local\Temp\AdobeUpdater12345.exe
C:\Users\Manfred\AppData\Local\Temp\ApnStub.exe
C:\Users\Manfred\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\Manfred\AppData\Local\Temp\FlashPlayerUpdate01.exe
C:\Users\Manfred\AppData\Local\Temp\FlashPlayerUpdate02.exe
C:\Users\Manfred\AppData\Local\Temp\FlashPlayerUpdate03.exe
C:\Users\Manfred\AppData\Local\Temp\FlashPlayerUpdate04.exe
C:\Users\Manfred\AppData\Local\Temp\G2MInstallerExtractor.exe
C:\Users\Manfred\AppData\Local\Temp\jre-6u13-windows-i586-p-iftw.exe
C:\Users\Manfred\AppData\Local\Temp\jre-6u14-windows-i586-iftw-rv.exe
C:\Users\Manfred\AppData\Local\Temp\jre-6u15-windows-i586-iftw.exe
C:\Users\Manfred\AppData\Local\Temp\jre-6u16-windows-i586-iftw.exe
C:\Users\Manfred\AppData\Local\Temp\jre-6u20-windows-i586-iftw-rv.exe
C:\Users\Manfred\AppData\Local\Temp\jre-6u21-windows-i586-iftw-rv.exe
C:\Users\Manfred\AppData\Local\Temp\jre-6u24-windows-i586-iftw-rv.exe
C:\Users\Manfred\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe
C:\Users\Manfred\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv.exe
C:\Users\Manfred\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\Manfred\AppData\Local\Temp\jre-6u32-windows-i586-iftw.exe
C:\Users\Manfred\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe
C:\Users\Manfred\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe
C:\Users\Manfred\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Manfred\AppData\Local\Temp\npappdetector.dll
C:\Users\Manfred\AppData\Local\Temp\NV_Support_Participant.exe
C:\Users\Manfred\AppData\Local\Temp\SetupAssistant.exe
C:\Users\Manfred\AppData\Local\Temp\~tmf5025358032683584121.dll
==================== Known DLLs (Whitelisted) ============
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
==================== Restore Points =========================
6
Restore point made on: 2013-09-19 04:21:48
Restore point made on: 2013-09-24 17:00:47
Restore point made on: 2013-10-03 02:28:38
Restore point made on: 2013-10-04 02:30:56
Restore point made on: 2013-10-10 17:01:09
Restore point made on: 2013-10-16 22:42:19
==================== Memory info ===========================
Percentage of memory in use: 23%
Total physical RAM: 1915.25 MB
Available physical RAM: 1457.77 MB
Total Pagefile: 1650.09 MB
Available Pagefile: 1510.18 MB
Total Virtual: 2047.88 MB
Available Virtual: 1961.82 MB
==================== Drives ================================
Drive c: (Vista) (Fixed) (Total:74.37 GB) (Free:21.95 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Data) (Fixed) (Total:73.21 GB) (Free:68.53 GB) NTFS
Drive f: (WinRE) (Fixed) (Total:1.46 GB) (Free:1.22 GB) NTFS
Drive g: () (Removable) (Total:1.87 GB) (Free:1.87 GB) FAT
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 149 GB) (Disk ID: FC5C1CE5)
Partition 1: (Not Active) - (Size=1 GB) - (Type=27)
Partition 2: (Active) - (Size=74 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=73 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (Size: 2 GB) (Disk ID: 6E652072)
No partition Table on disk 1.
LastRegBack: 2013-10-19 00:55
==================== End Of Log ============================
Vielen Dank im Voraus für eure Hilfe! Sven Edit: Sorry für den Vertipper im Thema, sollte natürlich BKA heißen. |
| Themen zu BKS/Interpol Sperrbildschirm unter Vista |
| adobe, association, avg, dateien, defender, desktop, dll, explorer, explorer.exe, farbar, farbar recovery scan tool, google, hintergrund, home, interpol, log-file, lws.exe, microsoft, problem, realtek, registry, rundll, schadsoftware eingefangen, schädlinge, secure, secure search, services.exe, svchost.exe, system, usb, vista, vtoolbarupdater, winlogon.exe |
Baum-Darstellung