Trojaner-Board - vB Code Tags

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 14-08-2013

Ran by SYSTEM on 14-08-2013 12:29:23

Running from H:\

Windows 7 Home Premium (X86) OS Language: English(US)

Internet Explorer Version 10

Boot Mode: Recovery
 

The current controlset is ControlSet001
 ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and Addition.txt log.
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8120864 2009-12-14] (Realtek Semiconductor)

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1713448 2010-02-26] (Synaptics Incorporated)

HKLM\...\Run: [UpdatePDRShortCut] - "C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerDirector" UpdateWithCreateOnce "Software\CyberLink\PowerDirector\7.0" [x]

HKLM\...\Run: [UpdatePSTShortCut] - C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe [210216 2009-07-20] (CyberLink Corp.)

HKLM\...\Run: [APLangApp] - C:\Program Files\AnyPC Client\APLangApp.exe [13312 2009-10-20] (DoctorSoft)

HKLM\...\Run: [UCam_Menu] - C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)

HKLM\...\Run: [NvCplDaemon] - C:\windows\system32\NvCpl.dll [13834856 2010-02-09] (NVIDIA Corporation)

HKLM\...\Run: [VirtualCloneDrive] - C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [85160 2009-06-17] (Elaborate Bytes AG)

HKLM\...\Run: [AppleSyncNotifier] - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [58656 2011-04-20] (Apple Inc.)

HKLM\...\Run: [facemoods] - C:\Program Files\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe [362200 2011-09-05] (facemoods.com)

HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Java\jre1.6.0_11\bin\jusched.exe [136600 2012-01-14] (Sun Microsystems, Inc.)

HKLM\...\Run: [fssui] - C:\Program Files\Windows Live\Family Safety\fsui.exe [884584 2012-03-08] (Microsoft Corporation)

HKLM\...\Run: [SweetIM] - C:\Program Files\SweetIM\Messenger\SweetIM.exe [114992 2012-01-19] (SweetIM Technologies Ltd.)

HKLM\...\Run: [] -  [x]

HKLM\...\Run: [ApnUpdater] - C:\Program Files\Ask.com\Updater\Updater.exe [1568976 2012-06-20] (Ask)

HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-01-28] (Apple Inc.)

HKLM\...\Run: [DivXMediaServer] - C:\Program Files\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-03-28] (DivX, LLC)

HKLM\...\Run: [DivXUpdate] - C:\Program Files\DivX\DivX Update\DivXUpdate.exe [1263952 2013-02-12] ()

HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-02-20] (Apple Inc.)

HKU\Deniz & Selcan57\...\Run: [Google Update] - C:\Users\Deniz & Selcan57\AppData\Local\Google\Update\GoogleUpdate.exe [ 2010-06-04] (Google Inc.)

HKU\Deniz & Selcan57\...\Run: [EA Core] - "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent [x]

HKU\Deniz & Selcan57\...\Run: [Speech Recognition] - C:\windows\Speech\Common\sapisvr.exe [ 2009-07-13] (Microsoft Corporation)

HKU\Deniz & Selcan57\...\Run: [Pando Media Booster] - C:\Program Files\Pando Networks\Media Booster\PMB.exe [ 2010-07-07] ()

HKU\Deniz & Selcan57\...\Run: [Facebook Update] - C:\Users\Deniz & Selcan57\AppData\Local\Facebook\Update\FacebookUpdate.exe [ 2012-09-02] (Facebook Inc.)

HKU\Deniz & Selcan57\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [ 2009-12-04] (Google Inc.)

HKU\Deniz & Selcan57\...\Run: [EADM] - C:\Program Files\Origin\Origin.exe [ 2013-07-31] (Electronic Arts)

HKU\Deniz & Selcan57\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [ 2013-06-03] (Skype Technologies S.A.)

HKU\scheiß Juve\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\SCHEIJ~1\AppData\Local\Temp\xvjaafxpmwrlppisu.exe [ 2013-08-10] (Valve) <===== ATTENTION

HKU\scheiß Juve\...\Winlogon: [Shell] cmd.exe [ 2010-11-20] (Microsoft Corporation) <==== ATTENTION 

HKU\scheiß Juve\...\Command Processor: "C:\Users\SCHEIJ~1\AppData\Local\Temp\xvjaafxpmwrlppisu.exe" <===== ATTENTION!

Startup: C:\Users\Deniz & Selcan57\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk

ShortcutTarget: Facebook Messenger.lnk ->  (No File)

Startup: C:\Users\Deniz & Selcan57\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk

ShortcutTarget: LimeWire On Startup.lnk -> C:\Program Files\LimeWire\LimeWire.exe (No File)

Startup: C:\Users\Deniz & Selcan57\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\program\quickstart.exe ()

BootExecute: autocheck autochk * aswBoot.exe /A:"* " /L:"German" /KBD:2
 

========================== Services (Whitelisted) =================
 

S2 IBUpdaterService; C:\ProgramData\IBUpdaterService\ibsvc.exe [584064 2012-11-01] ()

S2 ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [247096 2010-09-06] ()

S2 OberonGameConsoleService; C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [44312 2009-08-13] ()
 

==================== Drivers (Whitelisted) ====================
 

S1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [239168 2011-11-18] (DT Soft Ltd)

S1 ElbyCDIO; C:\Windows\System32\Drivers\ElbyCDIO.sys [26024 2009-12-17] (Elaborate Bytes AG)

S3 FsUsbExDisk; C:\windows\system32\FsUsbExDisk.SYS [36608 2009-03-30] ()

S3 KMWDFILTERx86; C:\Windows\System32\DRIVERS\KMWDFILTER.sys [25088 2009-04-29] (Windows (R) Codename Longhorn DDK provider)

S3 RDPDISPM; C:\Windows\System32\DRIVERS\rdpdispm.sys [15488 2010-09-22] (Microsoft Corporation)

S1 SABI; C:\windows\system32\Drivers\SABI.sys [10752 2009-05-27] (SAMSUNG ELECTRONICS)

S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [90112 2009-03-20] (MCCI)

S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14976 2009-03-20] (MCCI Corporation)

S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [121856 2009-03-20] (MCCI Corporation)

S3 cpuz132; \??\C:\Users\DENIZ&~1\AppData\Local\Temp\cpuz132\cpuz132_x32.sys [x]

S3 EagleNT; \??\C:\windows\system32\drivers\EagleNT.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-08-10 13:16 - 2013-08-10 13:16 - 01084791 _____ C:\Users\scheiß Juve\AppData\Local\2433f433

2013-08-10 13:16 - 2013-08-10 13:16 - 01084740 _____ C:\ProgramData\2433f433

2013-08-10 13:16 - 2013-08-10 13:16 - 01084720 _____ C:\Users\scheiß Juve\AppData\Roaming\2433f433

2013-08-10 13:13 - 2013-08-10 13:13 - 00000000 ____D C:\Users\scheiß Juve\AppData\Local\AskToolbar

2013-08-08 17:04 - 2013-08-08 17:08 - 00000000 ____D C:\Windows\System32\MRT

2013-08-08 02:04 - 2013-08-08 02:04 - 00000000 ____D C:\Users\scheiß Juve\AppData\Roaming\Google

2013-08-08 02:04 - 2013-08-08 02:04 - 00000000 ____D C:\Users\scheiß Juve\AppData\Local\Google

2013-08-06 00:46 - 2013-08-06 00:46 - 00000000 ____D C:\Users\scheiß Juve\Documents\FUSSBALL MANAGER 13

2013-08-06 00:45 - 2013-08-06 00:45 - 00000000 ____D C:\Program Files\Origin Games

2013-08-06 00:44 - 2013-08-10 08:43 - 00000000 ____D C:\Users\scheiß Juve\AppData\Local\{C5DD8E22-3FA3-4951-80EC-0F3920A6A487}

2013-08-06 00:44 - 2013-08-06 00:45 - 00000000 ____D C:\Users\scheiß Juve\AppData\Roaming\Origin

2013-08-06 00:44 - 2013-08-06 00:45 - 00000000 ____D C:\Users\scheiß Juve\AppData\Local\Origin

2013-08-06 00:44 - 2013-08-06 00:44 - 00000000 ____D C:\Users\scheiß Juve\AppData\Roaming\Apple Computer

2013-08-06 00:44 - 2013-08-06 00:44 - 00000000 ____D C:\Users\scheiß Juve\AppData\Local\Apple Computer

2013-08-06 00:43 - 2013-08-06 00:44 - 00001130 _____ C:\Users\scheiß Juve\Desktop\CyberLink DVD Suite.lnk

2013-08-06 00:43 - 2013-08-06 00:44 - 00001079 _____ C:\Users\scheiß Juve\Desktop\CyberLink YouCam.lnk

2013-08-06 00:43 - 2013-08-06 00:44 - 00000000 ____D C:\Users\scheiß Juve\AppData\Local\VirtualStore

2013-08-06 00:43 - 2013-08-06 00:44 - 00000000 ____D C:\users\scheiß Juve

2013-08-06 00:43 - 2013-08-06 00:43 - 00000020 ___SH C:\Users\scheiß Juve\ntuser.ini

2013-08-06 00:43 - 2013-08-06 00:43 - 00000000 _SHDL C:\Users\scheiß Juve\Startmenü

2013-08-06 00:43 - 2013-08-06 00:43 - 00000000 _SHDL C:\Users\scheiß Juve\Netzwerkumgebung

2013-08-06 00:43 - 2013-08-06 00:43 - 00000000 _SHDL C:\Users\scheiß Juve\Druckumgebung

2013-08-06 00:43 - 2013-08-06 00:43 - 00000000 _SHDL C:\Users\scheiß Juve\Documents\Eigene Musik

2013-08-06 00:43 - 2013-08-06 00:43 - 00000000 _SHDL C:\Users\scheiß Juve\Documents\Eigene Bilder

2013-08-06 00:43 - 2013-08-06 00:43 - 00000000 _SHDL C:\Users\scheiß Juve\AppData\Local\Verlauf

2013-08-06 00:43 - 2013-08-06 00:43 - 00000000 ____D C:\Users\scheiß Juve\AppData\Roaming\Adobe

2013-08-06 00:43 - 2010-09-15 14:51 - 00000000 ____D C:\Users\scheiß Juve\AppData\Local\Microsoft Help

2013-08-06 00:43 - 2010-06-04 04:35 - 00000000 ____D C:\Users\scheiß Juve\AppData\Roaming\Macromedia

2013-08-06 00:33 - 2013-08-06 00:36 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Origin

2013-08-06 00:33 - 2013-08-06 00:36 - 00000000 ____D C:\Users\Gast\AppData\Local\Origin

2013-08-06 00:32 - 2013-08-06 00:32 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Apple Computer

2013-08-06 00:32 - 2013-08-06 00:32 - 00000000 ____D C:\Users\Gast\AppData\Local\Apple Computer

2013-08-06 00:31 - 2013-08-06 00:32 - 00001130 _____ C:\Users\Gast\Desktop\CyberLink DVD Suite.lnk

2013-08-06 00:31 - 2013-08-06 00:32 - 00001079 _____ C:\Users\Gast\Desktop\CyberLink YouCam.lnk

2013-08-06 00:31 - 2013-08-06 00:32 - 00000000 ____D C:\Users\Gast\AppData\Local\VirtualStore

2013-08-06 00:31 - 2013-08-06 00:32 - 00000000 ____D C:\users\Gast

2013-08-06 00:31 - 2013-08-06 00:31 - 00000020 ___SH C:\Users\Gast\ntuser.ini

2013-08-06 00:31 - 2013-08-06 00:31 - 00000000 _SHDL C:\Users\Gast\Startmenü

2013-08-06 00:31 - 2013-08-06 00:31 - 00000000 _SHDL C:\Users\Gast\Netzwerkumgebung

2013-08-06 00:31 - 2013-08-06 00:31 - 00000000 _SHDL C:\Users\Gast\Druckumgebung

2013-08-06 00:31 - 2013-08-06 00:31 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Musik

2013-08-06 00:31 - 2013-08-06 00:31 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Bilder

2013-08-06 00:31 - 2013-08-06 00:31 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Verlauf

2013-08-06 00:31 - 2013-08-06 00:31 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Adobe

2013-08-06 00:31 - 2010-09-15 14:51 - 00000000 ____D C:\Users\Gast\AppData\Local\Microsoft Help

2013-08-06 00:31 - 2010-06-04 04:35 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Macromedia

2013-07-31 03:12 - 2013-08-06 00:30 - 00000000 ____D C:\Users\Deniz & Selcan57\AppData\Local\{222F2FBB-03DC-49D5-9678-DAA7BF218BB4}

2013-07-18 09:19 - 2013-07-29 01:28 - 00000000 ____D C:\Users\Deniz & Selcan57\AppData\Local\{AF3290E6-0995-466E-93F8-20F0922962FF}

2013-07-15 13:48 - 2013-06-11 15:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2013-07-15 13:48 - 2013-06-11 15:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll

2013-07-15 13:48 - 2013-06-11 15:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll

2013-07-15 13:48 - 2013-06-11 15:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2013-07-15 13:48 - 2013-06-11 15:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll

2013-07-15 13:48 - 2013-06-11 15:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll

2013-07-15 13:48 - 2013-06-11 15:43 - 00042496 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe

2013-07-15 13:48 - 2013-06-11 15:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll

2013-07-15 13:48 - 2013-06-11 15:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2013-07-15 13:48 - 2013-06-11 15:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2013-07-15 13:48 - 2013-06-11 15:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll

2013-07-15 13:48 - 2013-06-11 15:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll

2013-07-15 13:48 - 2013-06-11 15:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll

2013-07-15 13:48 - 2013-06-11 15:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll

2013-07-15 13:48 - 2013-06-11 14:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe

2013-07-15 13:48 - 2013-06-06 18:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
 

==================== One Month Modified Files and Folders =======
 

2013-08-14 02:17 - 2009-12-04 15:54 - 01752266 _____ C:\Windows\WindowsUpdate.log

2013-08-14 02:12 - 2009-07-13 20:39 - 00156140 _____ C:\Windows\setupact.log

2013-08-11 08:05 - 2009-07-13 20:34 - 00014512 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-08-11 08:05 - 2009-07-13 20:34 - 00014512 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-08-10 13:16 - 2013-08-10 13:16 - 01084791 _____ C:\Users\scheiß Juve\AppData\Local\2433f433

2013-08-10 13:16 - 2013-08-10 13:16 - 01084740 _____ C:\ProgramData\2433f433

2013-08-10 13:16 - 2013-08-10 13:16 - 01084720 _____ C:\Users\scheiß Juve\AppData\Roaming\2433f433

2013-08-10 13:13 - 2013-08-10 13:13 - 00000000 ____D C:\Users\scheiß Juve\AppData\Local\AskToolbar

2013-08-10 08:43 - 2013-08-06 00:44 - 00000000 ____D C:\Users\scheiß Juve\AppData\Local\{C5DD8E22-3FA3-4951-80EC-0F3920A6A487}

2013-08-09 07:52 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\Microsoft.NET

2013-08-08 17:08 - 2013-08-08 17:04 - 00000000 ____D C:\Windows\System32\MRT

2013-08-08 17:02 - 2009-07-26 12:06 - 01522252 _____ C:\Windows\System32\PerfStringBackup.INI

2013-08-08 02:04 - 2013-08-08 02:04 - 00000000 ____D C:\Users\scheiß Juve\AppData\Roaming\Google

2013-08-08 02:04 - 2013-08-08 02:04 - 00000000 ____D C:\Users\scheiß Juve\AppData\Local\Google

2013-08-06 00:46 - 2013-08-06 00:46 - 00000000 ____D C:\Users\scheiß Juve\Documents\FUSSBALL MANAGER 13

2013-08-06 00:45 - 2013-08-06 00:45 - 00000000 ____D C:\Program Files\Origin Games

2013-08-06 00:45 - 2013-08-06 00:44 - 00000000 ____D C:\Users\scheiß Juve\AppData\Roaming\Origin

2013-08-06 00:45 - 2013-08-06 00:44 - 00000000 ____D C:\Users\scheiß Juve\AppData\Local\Origin

2013-08-06 00:45 - 2012-10-30 09:00 - 00000000 ____D C:\ProgramData\Origin

2013-08-06 00:44 - 2013-08-06 00:44 - 00000000 ____D C:\Users\scheiß Juve\AppData\Roaming\Apple Computer

2013-08-06 00:44 - 2013-08-06 00:44 - 00000000 ____D C:\Users\scheiß Juve\AppData\Local\Apple Computer

2013-08-06 00:44 - 2013-08-06 00:43 - 00001130 _____ C:\Users\scheiß Juve\Desktop\CyberLink DVD Suite.lnk

2013-08-06 00:44 - 2013-08-06 00:43 - 00001079 _____ C:\Users\scheiß Juve\Desktop\CyberLink YouCam.lnk

2013-08-06 00:44 - 2013-08-06 00:43 - 00000000 ____D C:\Users\scheiß Juve\AppData\Local\VirtualStore

2013-08-06 00:44 - 2013-08-06 00:43 - 00000000 ____D C:\users\scheiß Juve

2013-08-06 00:44 - 2012-10-30 09:00 - 00000000 ____D C:\Program Files\Origin

2013-08-06 00:43 - 2013-08-06 00:43 - 00000020 ___SH C:\Users\scheiß Juve\ntuser.ini

2013-08-06 00:43 - 2013-08-06 00:43 - 00000000 _SHDL C:\Users\scheiß Juve\Startmenü

2013-08-06 00:43 - 2013-08-06 00:43 - 00000000 _SHDL C:\Users\scheiß Juve\Netzwerkumgebung

2013-08-06 00:43 - 2013-08-06 00:43 - 00000000 _SHDL C:\Users\scheiß Juve\Druckumgebung

2013-08-06 00:43 - 2013-08-06 00:43 - 00000000 _SHDL C:\Users\scheiß Juve\Documents\Eigene Musik

2013-08-06 00:43 - 2013-08-06 00:43 - 00000000 _SHDL C:\Users\scheiß Juve\Documents\Eigene Bilder

2013-08-06 00:43 - 2013-08-06 00:43 - 00000000 _SHDL C:\Users\scheiß Juve\AppData\Local\Verlauf

2013-08-06 00:43 - 2013-08-06 00:43 - 00000000 ____D C:\Users\scheiß Juve\AppData\Roaming\Adobe

2013-08-06 00:42 - 2010-07-07 04:30 - 00000000 ____D C:\Users\Deniz & Selcan57\AppData\Local\PMB Files

2013-08-06 00:42 - 2010-07-03 04:02 - 00000000 ____D C:\Users\Deniz & Selcan57\AppData\Roaming\Skype

2013-08-06 00:36 - 2013-08-06 00:33 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Origin

2013-08-06 00:36 - 2013-08-06 00:33 - 00000000 ____D C:\Users\Gast\AppData\Local\Origin

2013-08-06 00:32 - 2013-08-06 00:32 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Apple Computer

2013-08-06 00:32 - 2013-08-06 00:32 - 00000000 ____D C:\Users\Gast\AppData\Local\Apple Computer

2013-08-06 00:32 - 2013-08-06 00:31 - 00001130 _____ C:\Users\Gast\Desktop\CyberLink DVD Suite.lnk

2013-08-06 00:32 - 2013-08-06 00:31 - 00001079 _____ C:\Users\Gast\Desktop\CyberLink YouCam.lnk

2013-08-06 00:32 - 2013-08-06 00:31 - 00000000 ____D C:\Users\Gast\AppData\Local\VirtualStore

2013-08-06 00:32 - 2013-08-06 00:31 - 00000000 ____D C:\users\Gast

2013-08-06 00:31 - 2013-08-06 00:31 - 00000020 ___SH C:\Users\Gast\ntuser.ini

2013-08-06 00:31 - 2013-08-06 00:31 - 00000000 _SHDL C:\Users\Gast\Startmenü

2013-08-06 00:31 - 2013-08-06 00:31 - 00000000 _SHDL C:\Users\Gast\Netzwerkumgebung

2013-08-06 00:31 - 2013-08-06 00:31 - 00000000 _SHDL C:\Users\Gast\Druckumgebung

2013-08-06 00:31 - 2013-08-06 00:31 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Musik

2013-08-06 00:31 - 2013-08-06 00:31 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Bilder

2013-08-06 00:31 - 2013-08-06 00:31 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Verlauf

2013-08-06 00:31 - 2013-08-06 00:31 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Adobe

2013-08-06 00:30 - 2013-07-31 03:12 - 00000000 ____D C:\Users\Deniz & Selcan57\AppData\Local\{222F2FBB-03DC-49D5-9678-DAA7BF218BB4}

2013-08-02 13:23 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\rescache

2013-07-29 01:28 - 2013-07-18 09:19 - 00000000 ____D C:\Users\Deniz & Selcan57\AppData\Local\{AF3290E6-0995-466E-93F8-20F0922962FF}

2013-07-22 09:56 - 2012-06-02 10:26 - 00000000 ____D C:\Users\Deniz & Selcan57\Desktop\Gute Musik ;)

2013-07-18 09:17 - 2009-07-13 20:33 - 00454256 _____ C:\Windows\System32\FNTCACHE.DAT

2013-07-18 09:15 - 2010-06-04 02:29 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2013-07-18 09:15 - 2009-12-04 16:39 - 00948478 _____ C:\Windows\PFRO.log

2013-07-17 05:16 - 2009-12-05 09:26 - 00000000 ____D C:\Program Files\Windows Journal

2013-07-17 05:16 - 2009-07-13 20:52 - 00000000 ____D C:\Program Files\Windows Defender

2013-07-17 05:04 - 2013-07-01 09:38 - 00000000 ____D C:\Users\Deniz & Selcan57\AppData\Local\{87A74C74-C5CB-47AC-B2EA-C6C59B09BE18}
 

Files to move or delete:

====================

C:\Users\SCHEIJ~1\AppData\Local\Temp\xvjaafxpmwrlppisu.exe
 

==================== Known DLLs (Whitelisted) ============
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 

==================== EXE ASSOCIATION =====================
 

HKLM\...\.exe: exefile => OK

HKLM\...\exefile\DefaultIcon: %1 => OK

HKLM\...\exefile\open\command: "%1" %* => OK
 

==================== Restore Points  =========================
 

Restore point made on: 2013-07-10 12:29:36

Restore point made on: 2013-07-14 12:34:56

Restore point made on: 2013-07-15 06:04:17

Restore point made on: 2013-07-21 01:48:30

Restore point made on: 2013-07-22 05:26:06

Restore point made on: 2013-07-29 12:15:03

Restore point made on: 2013-07-29 12:25:52

Restore point made on: 2013-08-03 08:58:43

Restore point made on: 2013-08-05 08:17:43

Restore point made on: 2013-08-07 15:53:57

Restore point made on: 2013-08-08 17:00:29
 

==================== Memory info =========================== 
 

Percentage of memory in use: 15%

Total physical RAM: 3036.61 MB

Available physical RAM: 2562.18 MB

Total Pagefile: 3032.83 MB

Available Pagefile: 2577.16 MB

Total Virtual: 2047.88 MB

Available Virtual: 1936.78 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:141.49 GB) (Free:60.08 GB) NTFS

Drive e: () (Fixed) (Total:141.5 GB) (Free:137.67 GB) NTFS

Drive f: (RECOVERY) (Fixed) (Total:15 GB) (Free:3.22 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Drive h: (USB DISK) (Removable) (Total:3.73 GB) (Free:3.72 GB) FAT32

Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Drive y: (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 298 GB) (Disk ID: 711561A4)

Partition 1: (Not Active) - (Size=15 GB) - (Type=27)

Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=141 GB) - (Type=07 NTFS)

Partition 4: (Not Active) - (Size=141 GB) - (Type=07 NTFS)
 

========================================================

Disk: 1 (MBR Code: Windows XP) (Size: 4 GB) (Disk ID: C3072E18)

Partition 1: (Active) - (Size=4 GB) - (Type=0B)
 
 

LastRegBack: 2013-08-07 16:43
 

==================== End Of Log ============================
--- --- ---

--- --- ---

Leider ist der Laptop nicht mein und daher habe ich nur Zugriff auf den Gast-Account, der aber mit Administatorrechten eingerichtet ist.