| |
| |||||||
Log-Analyse und Auswertung: PC friert ein, Bild bleibt stehen, Maus nicht bewegbar.Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
30.08.2014, 13:02
| #1 |
| |  PC friert ein, Bild bleibt stehen, Maus nicht bewegbar. Ja, aber hab schon deinstalliert.. unter Programme läuft es nicht mehr auf. |
|
30.08.2014, 13:04
| #2 | |
| /// TB-Ausbilder   | PC friert ein, Bild bleibt stehen, Maus nicht bewegbar.Zitat:
|
|
30.08.2014, 13:11
| #3 |
| | PC friert ein, Bild bleibt stehen, Maus nicht bewegbar. Matthias,
__________________vielen Dank für so schnelle Reaktion. Ich muss jetzt weg, werde heute Abend wieder vorbei schauen. LG, Julia |
|
30.08.2014, 13:12
| #4 | |
| /// TB-Ausbilder | PC friert ein, Bild bleibt stehen, Maus nicht bewegbar. Servus, Zitat:
Bitte alle Tools direkt auf den Desktop downloaden bzw. dorthin verschieben und vom Desktop starten, da unsere Anleitungen daraufhin ausgelegt sind. Zudem lassen sich dann am Ende der Bereinigung alle verwendeten Tools sehr einfach entfernen. Scan mit Combofix
|
|
30.08.2014, 19:46
| #5 |
| | PC friert ein, Bild bleibt stehen, Maus nicht bewegbar. Hallo, ich habe versucht diesmal alles richtig zu machen :-) Code:
ATTFilter ComboFix 14-08-29.03 - HYRICAN 30.08.2014 20:28:36.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.1533.593 [GMT 2:00]
ausgeführt von:: c:\users\HYRICAN\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\HYRICAN\AppData\Local\Temp\OCS\Downloads\705f49176579a643660bff5ff6ae3956\ad094ab0c268fb769b61c44eb5899eea
c:\users\HYRICAN\AppData\Local\Temp\OCS\Downloads\705f49176579a643660bff5ff6ae3956\ad094ab0c268fb769b61c44eb5899eea\IE10-Windows6.1-de-de.exe .exe
c:\users\HYRICAN\AppData\Roaming\Mozilla\Firefox\Profiles\0mku6c02.default\search-metadata.json
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-07-28 bis 2014-08-30 ))))))))))))))))))))))))))))))
.
.
2014-08-30 18:35 . 2014-08-30 18:35 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-08-30 10:52 . 2014-08-30 11:46 -------- d-----w- C:\FRST
2014-08-30 08:26 . 2014-08-21 02:44 8581864 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5EB3E90A-F808-4AC0-B2CC-F126A498C713}\mpengine.dll
2014-08-30 08:15 . 2014-08-30 08:15 -------- d-----w- c:\users\HYRICAN\AppData\Local\Adobe
2014-08-29 18:59 . 2014-08-30 18:24 110296 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-08-29 18:58 . 2014-08-29 18:58 -------- d-----w- c:\program files\ Malwarebytes Anti-Malware
2014-08-29 18:58 . 2014-05-12 05:26 51928 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-08-29 18:58 . 2014-05-12 05:25 74456 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-08-29 18:58 . 2014-05-12 05:25 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-08-29 04:31 . 2014-08-20 04:22 893248 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7B82308F-D32A-4184-8C35-56EE42A360D5}\gapaengine.dll
2014-08-29 04:31 . 2014-08-21 02:44 8581864 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-08-28 04:22 . 2014-08-23 00:42 2352640 ----a-w- c:\windows\system32\win32k.sys
2014-08-28 04:21 . 2014-08-23 01:46 305152 ----a-w- c:\windows\system32\gdi32.dll
2014-08-25 04:22 . 2014-05-14 16:23 45536 ----a-w- c:\windows\system32\wups2.dll
2014-08-25 04:22 . 2014-05-14 16:23 54240 ----a-w- c:\windows\system32\wuauclt.exe
2014-08-25 04:22 . 2014-05-14 16:23 1973728 ----a-w- c:\windows\system32\wuaueng.dll
2014-08-25 04:22 . 2014-05-14 16:17 2425856 ----a-w- c:\windows\system32\wucltux.dll
2014-08-25 04:22 . 2014-05-14 16:23 36320 ----a-w- c:\windows\system32\wups.dll
2014-08-25 04:22 . 2014-05-14 16:23 581600 ----a-w- c:\windows\system32\wuapi.dll
2014-08-25 04:22 . 2014-05-14 16:17 92672 ----a-w- c:\windows\system32\wudriver.dll
2014-08-25 04:22 . 2014-05-14 07:23 179656 ----a-w- c:\windows\system32\wuwebv.dll
2014-08-25 04:22 . 2014-05-14 07:17 33792 ----a-w- c:\windows\system32\wuapp.exe
2014-08-14 05:10 . 2014-03-09 21:47 99480 ----a-w- c:\windows\system32\infocardapi.dll
2014-08-14 05:10 . 2014-06-30 22:14 8856 ----a-w- c:\windows\system32\icardres.dll
2014-08-14 05:10 . 2014-03-09 21:47 619672 ----a-w- c:\windows\system32\icardagt.exe
2014-08-14 05:09 . 2014-06-06 06:16 35480 ----a-w- c:\windows\system32\TsWpfWrp.exe
2014-08-14 04:26 . 2014-07-16 02:46 2048 ----a-w- c:\windows\system32\tzres.dll
2014-08-14 04:26 . 2014-06-03 09:30 101824 ----a-w- c:\windows\system32\consent.exe
2014-08-14 04:26 . 2014-06-03 09:29 337408 ----a-w- c:\windows\system32\msihnd.dll
2014-08-14 04:26 . 2014-06-03 09:29 2363392 ----a-w- c:\windows\system32\msi.dll
2014-08-14 04:26 . 2014-06-03 09:29 1805824 ----a-w- c:\windows\system32\authui.dll
2014-08-14 04:26 . 2014-08-07 01:43 412160 ----a-w- c:\windows\system32\aepdu.dll
2014-08-14 04:26 . 2014-08-07 01:39 302592 ----a-w- c:\windows\system32\aeinv.dll
2014-08-14 04:26 . 2014-07-09 01:29 6144 ----a-w- c:\windows\system32\KBDYAK.DLL
2014-08-14 04:26 . 2014-07-09 01:29 6144 ----a-w- c:\windows\system32\KBDBASH.DLL
2014-08-07 18:35 . 2014-08-07 18:35 -------- d-----w- c:\users\HYRICAN\AppData\Local\Blizzard Entertainment
2014-08-07 18:35 . 2014-08-08 08:04 -------- d-----w- c:\users\HYRICAN\AppData\Local\Battle.net
2014-08-07 18:35 . 2014-08-07 19:40 -------- d-----w- c:\users\HYRICAN\AppData\Roaming\Battle.net
2014-08-07 18:35 . 2014-08-07 18:54 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2014-08-07 18:35 . 2014-08-07 18:35 -------- d-----w- c:\program files\Battle.net
2014-08-07 18:35 . 2014-08-07 18:35 -------- d-----w- c:\programdata\Blizzard Entertainment
2014-08-07 18:30 . 2014-08-07 18:30 -------- d-----w- c:\programdata\Battle.net
2014-08-01 16:55 . 2014-08-01 16:55 21840 ----a-w- c:\windows\system32\SIntfNT.dll
2014-08-01 16:55 . 2014-08-01 16:55 17212 ----a-w- c:\windows\system32\SIntf32.dll
2014-08-01 16:55 . 2014-08-01 16:55 12067 ----a-w- c:\windows\system32\SIntf16.dll
2014-08-01 16:46 . 2014-08-01 16:46 2829 ----a-w- c:\windows\DIIUnin.pif
2014-08-01 16:46 . 2014-08-01 16:46 102400 ----a-w- c:\windows\DIIUnin.exe
2014-08-01 16:40 . 2014-08-22 09:47 -------- d-----w- c:\program files\Diablo II
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-08-29 19:15 . 2012-07-18 13:55 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-08-29 19:15 . 2012-07-18 13:55 699568 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-08-20 04:22 . 2012-09-27 15:09 893248 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2014-06-18 01:51 . 2014-07-10 04:28 646144 ----a-w- c:\windows\system32\osk.exe
2014-06-06 09:44 . 2014-07-10 04:28 509440 ----a-w- c:\windows\system32\qedit.dll
2014-06-05 14:26 . 2014-07-10 04:27 1059840 ----a-w- c:\windows\system32\lsasrv.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2014-03-11 951576]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SPReview"="c:\windows\System32\SPReview\SPReview.exe" [2013-03-20 280576]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R1 MpKslcc04e436;MpKslcc04e436;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6AE2888D-EF58-4C7A-AB69-95505CFFE970}\MpKslcc04e436.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-07-25 108032]
R3 InputFilter_Hid_FlexDef2b;Siliten HID Devices(FlexDef2b) Driver Service;c:\windows\system32\DRIVERS\InputFilter_FlexDef2b.sys [2010-06-18 14848]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2014-05-12 51928]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2014-03-11 104264]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe [2014-03-11 279776]
R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [2010-03-10 539168]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-06-26 217600]
S2 MBAMService;MBAMService;c:\program files\ Malwarebytes Anti-Malware \mbamservice.exe [2014-05-12 860472]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2011-08-11 88176]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2014-05-12 23256]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [2014-08-30 110296]
S4 MBAMScheduler;MBAMScheduler;c:\program files\ Malwarebytes Anti-Malware \mbamscheduler.exe [2014-05-12 1809720]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - MBAMSWISSARMY
.
Inhalt des "geplante Tasks" Ordners
.
2014-08-30 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-18 19:15]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.king.com/
IE: Nach Microsoft &Excel exportieren - d:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\HYRICAN\AppData\Roaming\Mozilla\Firefox\Profiles\0mku6c02.default\
FF - prefs.js: keyword.URL - hxxp://go.mail.ru/search?fr=fftb&q=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM-Run-WinampAgent - c:\program files\Winamp\winampa.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-08-30 20:40:10
ComboFix-quarantined-files.txt 2014-08-30 18:40
.
Vor Suchlauf: 7 Verzeichnis(se), 228.093.620.224 Bytes frei
Nach Suchlauf: 11 Verzeichnis(se), 229.262.389.248 Bytes frei
.
- - End Of File - - 7017E6785564577031B01831C06AE4E4
A36C5E4F47E84449FF07ED3517B43A31
|
|
31.08.2014, 09:03
| #6 |
| /// TB-Ausbilder | PC friert ein, Bild bleibt stehen, Maus nicht bewegbar. Gut gemacht.  So geht es weiter: Schritt 1 Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Schritt 2 Downloade Dir bitte  Malwarebytes Anti-Malware
Schritt 3 Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Schritt 4
Bitte poste mit deiner nächsten Antwort
|
|
31.08.2014, 11:36
| #7 |
| | PC friert ein, Bild bleibt stehen, Maus nicht bewegbar. Hallo Matthias, hier sind die Daten. Hoffentlich habe ich alles richtig gemacht. Code:
ATTFilter # AdwCleaner v3.308 - Bericht erstellt am 31/08/2014 um 11:58:19
# Aktualisiert 20/08/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (32 bits)
# Benutzername : HYRICAN - HYRICAN-PC
# Gestartet von : C:\Users\HYRICAN\Desktop\adwcleaner_3.308.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\AlawarWrapper
Ordner Gelöscht : C:\Program Files\Mail.Ru
Ordner Gelöscht : C:\Users\HYRICAN\AppData\Local\Mail.Ru
Ordner Gelöscht : C:\Users\HYRICAN\AppData\Local\AlawarWrapper
Datei Gelöscht : C:\Users\HYRICAN\AppData\Roaming\Mozilla\Firefox\Profiles\0mku6c02.default\.autoreg
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_drivereasy_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_drivereasy_RASMANCS
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}
Schlüssel Gelöscht : HKCU\Software\OCS
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17239
-\\ Mozilla Firefox v31.0 (x86 de)
[ Datei : C:\Users\HYRICAN\AppData\Roaming\Mozilla\Firefox\Profiles\0mku6c02.default\prefs.js ]
-\\ Google Chrome v
[ Datei : C:\Users\HYRICAN\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [1894 octets] - [31/08/2014 11:56:17]
AdwCleaner[S0].txt - [1815 octets] - [31/08/2014 11:58:19]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1875 octets] ##########
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 29.08.2014 Suchlauf-Zeit: 21:00:37 Logdatei: MBAM31.08.14.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.08.29.05 Rootkit Datenbank: v2014.08.21.01 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x86 Dateisystem: NTFS Benutzer: HYRICAN Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 269942 Verstrichene Zeit: 11 Min, 13 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 1 PUP.Optional.Bandoo, C:\$Recycle.Bin\S-1-5-21-3404808311-1410851660-3682891413-1000\$RP679UN.exe, In Quarantäne, [ff5a418bd6a5979f16bf22f434cd6f91], Physische Sektoren: 0 (No malicious items detected) (end) Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x86
Ran by HYRICAN on 31.08.2014 at 12:23:03,46
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\HYRICAN\AppData\Roaming\mozilla\firefox\profiles\0mku6c02.default\minidumps [382 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 31.08.2014 at 12:25:08,00
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:30-08-2014 01 Ran by HYRICAN (administrator) on HYRICAN-PC on 31-08-2014 12:30:12 Running from C:\Users\HYRICAN\Desktop Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe () C:\Program Files\DivX\DivX Update\DivXUpdate.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\VS7DEBUG\MDM.EXE (Microsoft Corporation) C:\Windows\System32\wuauclt.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe (Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_179.exe (Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_179.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [951576 2014-03-11] (Microsoft Corporation) HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM\...\Run: [DivXUpdate] => C:\Program Files\DivX\DivX Update\DivXUpdate.exe [1259376 2011-07-29] () HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation) HKU\.DEFAULT\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2013-03-20] (Microsoft Corporation) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.king.com/ HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xA24D9205EB64CD01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de BHO: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: No Name -> {8984B388-A5BB-4DF7-B274-77B879E179DB} -> No File BHO: No Name -> {D5FEC983-01DB-414a-9456-AF95AC9ED7B5} -> No File BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\HYRICAN\AppData\Roaming\Mozilla\Firefox\Profiles\0mku6c02.default FF Keyword.URL: hxxp://go.mail.ru/search?fr=fftb&q= FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_179.dll () FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1165635.dll (Adobe Systems, Inc.) FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @java.com/JavaPlugin,version=10.21.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npmidas.dll (Midasplayer Ltd) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\HYRICAN\AppData\Roaming\Mozilla\Firefox\Profiles\0mku6c02.default\searchplugins\yandex.ru-204113.xml FF SearchPlugin: C:\Users\HYRICAN\AppData\Roaming\Mozilla\Firefox\Profiles\0mku6c02.default\searchplugins\yandex.ru-204811.xml FF SearchPlugin: C:\Users\HYRICAN\AppData\Roaming\Mozilla\Firefox\Profiles\0mku6c02.default\searchplugins\yqs-barff-yandex.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Спутник @Mail.Ru - C:\Users\HYRICAN\AppData\Roaming\Mozilla\Firefox\Profiles\0mku6c02.default\Extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D} [2013-12-19] FF Extension: ВКонтакте.ру Downloader - C:\Users\HYRICAN\AppData\Roaming\Mozilla\Firefox\Profiles\0mku6c02.default\Extensions\vk@sergeykolosov.mp.xpi [2013-07-13] FF HKLM\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012-11-07] Chrome: ======= CHR CustomProfile: C:\Users\HYRICAN\AppData\Local\Google\Chrome\User Data\Default CHR Extension: («Визуальные Закладки» от Mail.Ru) - C:\Users\HYRICAN\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcncjpganfocbfoenaemagjjopkkindp [2014-06-27] CHR Extension: (Mail.ru «Визуальные закладки») - C:\Users\HYRICAN\AppData\Local\Google\Chrome\User Data\Default\Extensions\jaocgokledfmfebefgbeokdodbbdjhdd [2013-04-11] CHR HKLM\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2011-12-12] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2014-03-11] (Microsoft Corporation) S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [279776 2014-03-11] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 InputFilter_Hid_FlexDef2b; C:\Windows\System32\DRIVERS\InputFilter_FlexDef2b.sys [14848 2010-06-19] (Siliten) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-08-31] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [231960 2014-01-25] (Microsoft Corporation) S3 USBAAPL; C:\Windows\System32\Drivers\usbaapl.sys [45056 2012-12-13] (Apple, Inc.) [File not signed] U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation) S3 catchme; \??\C:\Users\HYRICAN\AppData\Local\Temp\catchme.sys [X] S1 MpKslcc04e436; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{6AE2888D-EF58-4C7A-AB69-95505CFFE970}\MpKslcc04e436.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-31 12:30 - 2014-08-31 12:30 - 00009435 _____ () C:\Users\HYRICAN\Desktop\FRST.txt 2014-08-31 12:26 - 2014-08-31 12:26 - 01095680 _____ (Farbar) C:\Users\HYRICAN\Desktop\FRST.exe 2014-08-31 12:25 - 2014-08-31 12:25 - 00000762 _____ () C:\Users\HYRICAN\Desktop\JRT.txt 2014-08-31 12:18 - 2014-08-31 12:18 - 00000000 ____D () C:\Windows\ERUNT 2014-08-31 12:13 - 2014-08-31 12:13 - 01016261 _____ (Thisisu) C:\Users\HYRICAN\Desktop\JRT.exe 2014-08-31 12:12 - 2014-08-31 12:12 - 00001287 _____ () C:\Users\HYRICAN\Desktop\MBAM31.08.14.txt 2014-08-31 12:00 - 2014-08-31 12:00 - 00001955 _____ () C:\Users\HYRICAN\Desktop\AdwCleaner[S0].txt 2014-08-31 11:56 - 2014-08-31 11:58 - 00000000 ____D () C:\AdwCleaner 2014-08-31 11:54 - 2014-08-31 11:54 - 01364531 _____ () C:\Users\HYRICAN\Desktop\adwcleaner_3.308.exe 2014-08-30 22:19 - 2014-08-30 22:22 - 00000000 ____D () C:\Users\HYRICAN\Documents\Comdir 2014-08-30 20:40 - 2014-08-30 20:40 - 00011423 _____ () C:\ComboFix.txt 2014-08-30 20:27 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-08-30 20:27 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-08-30 20:27 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-08-30 20:27 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-08-30 20:27 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-08-30 20:27 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe 2014-08-30 20:27 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe 2014-08-30 20:27 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe 2014-08-30 20:26 - 2014-08-30 20:40 - 00000000 ____D () C:\Qoobox 2014-08-30 20:26 - 2014-08-30 20:38 - 00000000 ____D () C:\Windows\erdnt 2014-08-30 20:12 - 2014-08-30 20:13 - 05576760 ____R (Swearware) C:\Users\HYRICAN\Desktop\ComboFix.exe 2014-08-30 12:52 - 2014-08-31 12:30 - 00000000 ____D () C:\FRST 2014-08-30 10:15 - 2014-08-30 10:15 - 00000000 ____D () C:\Users\HYRICAN\AppData\Local\Adobe 2014-08-29 20:59 - 2014-08-31 12:29 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-08-29 20:59 - 2014-08-29 20:59 - 00001064 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-08-29 20:59 - 2014-08-29 20:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-08-29 20:58 - 2014-08-29 20:58 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-08-29 20:58 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-08-29 20:58 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-08-29 20:58 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-08-28 19:43 - 2014-08-28 19:43 - 210443681 _____ () C:\Windows\MEMORY.DMP 2014-08-28 19:43 - 2014-08-28 19:43 - 00000000 ____D () C:\Windows\Minidump 2014-08-28 06:22 - 2014-08-23 02:42 - 02352640 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-08-28 06:21 - 2014-08-23 03:46 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-08-25 06:22 - 2014-05-14 18:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2014-08-25 06:22 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll 2014-08-25 06:22 - 2014-05-14 18:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2014-08-25 06:22 - 2014-05-14 18:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll 2014-08-25 06:22 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll 2014-08-25 06:22 - 2014-05-14 18:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2014-08-25 06:22 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll 2014-08-25 06:22 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2014-08-25 06:22 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2014-08-19 11:45 - 2014-08-19 11:45 - 00015360 _____ () C:\Users\HYRICAN\Desktop\Lebenslauf Inga.xls 2014-08-14 07:10 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll 2014-08-14 07:10 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe 2014-08-14 07:10 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll 2014-08-14 07:09 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe 2014-08-14 06:30 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-08-14 06:30 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-08-14 06:30 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-08-14 06:30 - 2014-07-25 15:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-08-14 06:30 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-08-14 06:30 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-08-14 06:30 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-08-14 06:30 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-08-14 06:30 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-08-14 06:30 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-08-14 06:30 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-08-14 06:30 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-08-14 06:30 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-08-14 06:30 - 2014-07-25 14:10 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-08-14 06:30 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-08-14 06:30 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-08-14 06:30 - 2014-07-25 13:59 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-08-14 06:30 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-08-14 06:30 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-08-14 06:30 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-08-14 06:30 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-08-14 06:30 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-08-14 06:30 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-08-14 06:30 - 2014-07-25 13:09 - 00663040 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-08-14 06:30 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-08-14 06:30 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-08-14 06:30 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-08-14 06:30 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-08-14 06:30 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-08-14 06:30 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-08-14 06:30 - 2014-07-14 03:42 - 00654336 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2014-08-14 06:30 - 2014-06-16 03:44 - 00730048 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2014-08-14 06:30 - 2014-06-16 03:44 - 00219072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys 2014-08-14 06:30 - 2014-06-16 03:40 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll 2014-08-14 06:26 - 2014-08-07 03:43 - 00412160 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-08-14 06:26 - 2014-08-07 03:39 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-08-14 06:26 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-08-14 06:26 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL 2014-08-14 06:26 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL 2014-08-14 06:26 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL 2014-08-14 06:26 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL 2014-08-14 06:26 - 2014-07-09 03:29 - 00005632 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL 2014-08-14 06:26 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\system32\locale.nls 2014-08-14 06:26 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-08-14 06:26 - 2014-06-03 11:30 - 00101824 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe 2014-08-14 06:26 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll 2014-08-14 06:26 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2014-08-14 06:26 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll 2014-08-08 09:50 - 2014-08-08 09:50 - 00000000 ____D () C:\Users\HYRICAN\Documents\Diablo III 2014-08-07 20:35 - 2014-08-08 10:04 - 00000000 ____D () C:\Users\HYRICAN\AppData\Local\Battle.net 2014-08-07 20:35 - 2014-08-07 21:40 - 00000000 ____D () C:\Users\HYRICAN\AppData\Roaming\Battle.net 2014-08-07 20:35 - 2014-08-07 20:54 - 00000000 ____D () C:\Program Files\Common Files\Blizzard Entertainment 2014-08-07 20:35 - 2014-08-07 20:35 - 00000000 ____D () C:\Users\HYRICAN\AppData\Local\Blizzard Entertainment 2014-08-07 20:35 - 2014-08-07 20:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net 2014-08-07 20:35 - 2014-08-07 20:35 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment 2014-08-07 20:35 - 2014-08-07 20:35 - 00000000 ____D () C:\Program Files\Battle.net 2014-08-07 20:30 - 2014-08-07 20:30 - 00000000 ____D () C:\ProgramData\Battle.net 2014-08-01 18:55 - 2014-08-01 18:55 - 00021840 _____ () C:\Windows\system32\SIntfNT.dll 2014-08-01 18:55 - 2014-08-01 18:55 - 00017212 _____ () C:\Windows\system32\SIntf32.dll 2014-08-01 18:55 - 2014-08-01 18:55 - 00012067 _____ () C:\Windows\system32\SIntf16.dll 2014-08-01 18:55 - 2014-08-01 18:55 - 00000000 ____D () C:\Users\HYRICAN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games 2014-08-01 18:54 - 2014-08-01 18:54 - 00001851 _____ () C:\Users\HYRICAN\Desktop\Diablo II - Lord of Destruction.lnk 2014-08-01 18:54 - 2014-08-01 18:54 - 00000000 ____D () C:\Users\HYRICAN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Diablo II 2014-08-01 18:46 - 2014-08-01 18:56 - 00036069 _____ () C:\Windows\DIIUnin.dat 2014-08-01 18:46 - 2014-08-01 18:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo II 2014-08-01 18:46 - 2014-08-01 18:46 - 00102400 _____ (Blizzard Entertainment) C:\Windows\DIIUnin.exe 2014-08-01 18:46 - 2014-08-01 18:46 - 00002829 _____ () C:\Windows\DIIUnin.pif 2014-08-01 18:40 - 2014-08-22 11:47 - 00000000 ____D () C:\Program Files\Diablo II ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-31 12:30 - 2014-08-31 12:30 - 00009435 _____ () C:\Users\HYRICAN\Desktop\FRST.txt 2014-08-31 12:30 - 2014-08-30 12:52 - 00000000 ____D () C:\FRST 2014-08-31 12:29 - 2014-08-29 20:59 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-08-31 12:27 - 2009-07-14 06:34 - 00023504 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-08-31 12:27 - 2009-07-14 06:34 - 00023504 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-08-31 12:26 - 2014-08-31 12:26 - 01095680 _____ (Farbar) C:\Users\HYRICAN\Desktop\FRST.exe 2014-08-31 12:25 - 2014-08-31 12:25 - 00000762 _____ () C:\Users\HYRICAN\Desktop\JRT.txt 2014-08-31 12:23 - 2012-07-18 14:35 - 01449642 _____ () C:\Windows\WindowsUpdate.log 2014-08-31 12:20 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-08-31 12:20 - 2009-07-14 06:39 - 00084428 _____ () C:\Windows\setupact.log 2014-08-31 12:18 - 2014-08-31 12:18 - 00000000 ____D () C:\Windows\ERUNT 2014-08-31 12:13 - 2014-08-31 12:13 - 01016261 _____ (Thisisu) C:\Users\HYRICAN\Desktop\JRT.exe 2014-08-31 12:12 - 2014-08-31 12:12 - 00001287 _____ () C:\Users\HYRICAN\Desktop\MBAM31.08.14.txt 2014-08-31 12:07 - 2012-07-18 15:55 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-08-31 12:00 - 2014-08-31 12:00 - 00001955 _____ () C:\Users\HYRICAN\Desktop\AdwCleaner[S0].txt 2014-08-31 11:59 - 2012-07-18 15:56 - 00187516 _____ () C:\Windows\PFRO.log 2014-08-31 11:58 - 2014-08-31 11:56 - 00000000 ____D () C:\AdwCleaner 2014-08-31 11:54 - 2014-08-31 11:54 - 01364531 _____ () C:\Users\HYRICAN\Desktop\adwcleaner_3.308.exe 2014-08-31 10:57 - 2012-07-18 15:55 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk 2014-08-30 22:22 - 2014-08-30 22:19 - 00000000 ____D () C:\Users\HYRICAN\Documents\Comdir 2014-08-30 22:18 - 2013-06-04 17:53 - 00013312 ___SH () C:\Users\HYRICAN\Documents\Thumbs.db 2014-08-30 20:40 - 2014-08-30 20:40 - 00011423 _____ () C:\ComboFix.txt 2014-08-30 20:40 - 2014-08-30 20:26 - 00000000 ____D () C:\Qoobox 2014-08-30 20:40 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Default 2014-08-30 20:40 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public 2014-08-30 20:38 - 2014-08-30 20:26 - 00000000 ____D () C:\Windows\erdnt 2014-08-30 20:35 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini 2014-08-30 20:13 - 2014-08-30 20:12 - 05576760 ____R (Swearware) C:\Users\HYRICAN\Desktop\ComboFix.exe 2014-08-30 13:35 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache 2014-08-30 10:15 - 2014-08-30 10:15 - 00000000 ____D () C:\Users\HYRICAN\AppData\Local\Adobe 2014-08-29 21:15 - 2012-07-18 15:55 - 00699568 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2014-08-29 21:15 - 2012-07-18 15:55 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2014-08-29 21:13 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\security 2014-08-29 20:59 - 2014-08-29 20:59 - 00001064 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-08-29 20:59 - 2014-08-29 20:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-08-29 20:58 - 2014-08-29 20:58 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-08-29 20:58 - 2013-09-24 16:56 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-08-28 20:39 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF 2014-08-28 20:39 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\LogFiles 2014-08-28 20:36 - 2013-03-26 12:17 - 00000000 ____D () C:\Program Files\epson 2014-08-28 20:33 - 2013-03-26 12:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON 2014-08-28 20:32 - 2013-03-26 12:17 - 00008284 _____ () C:\Windows\system32\eps_icon.avi 2014-08-28 20:32 - 2013-03-26 12:17 - 00000093 _____ () C:\Windows\EPSMTL32.TXT 2014-08-28 20:32 - 2009-07-14 06:52 - 00000000 ____D () C:\Windows\twain_32 2014-08-28 20:26 - 2012-11-07 21:11 - 00000000 ____D () C:\Program Files\Winamp 2014-08-28 20:23 - 2009-07-14 04:04 - 00002577 _____ () C:\Windows\system32\config.nt 2014-08-28 19:43 - 2014-08-28 19:43 - 210443681 _____ () C:\Windows\MEMORY.DMP 2014-08-28 19:43 - 2014-08-28 19:43 - 00000000 ____D () C:\Windows\Minidump 2014-08-28 15:54 - 2009-07-14 06:33 - 00408232 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-08-25 16:26 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE 2014-08-23 03:46 - 2014-08-28 06:21 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-08-23 02:42 - 2014-08-28 06:22 - 02352640 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-08-22 11:47 - 2014-08-01 18:40 - 00000000 ____D () C:\Program Files\Diablo II 2014-08-20 16:42 - 2014-07-31 12:46 - 00000000 ____D () C:\Users\HYRICAN\Desktop\Roma 2014-08-19 11:45 - 2014-08-19 11:45 - 00015360 _____ () C:\Users\HYRICAN\Desktop\Lebenslauf Inga.xls 2014-08-14 19:25 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET 2014-08-14 16:44 - 2014-05-06 10:32 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-08-08 10:04 - 2014-08-07 20:35 - 00000000 ____D () C:\Users\HYRICAN\AppData\Local\Battle.net 2014-08-08 09:50 - 2014-08-08 09:50 - 00000000 ____D () C:\Users\HYRICAN\Documents\Diablo III 2014-08-07 21:40 - 2014-08-07 20:35 - 00000000 ____D () C:\Users\HYRICAN\AppData\Roaming\Battle.net 2014-08-07 20:54 - 2014-08-07 20:35 - 00000000 ____D () C:\Program Files\Common Files\Blizzard Entertainment 2014-08-07 20:35 - 2014-08-07 20:35 - 00000000 ____D () C:\Users\HYRICAN\AppData\Local\Blizzard Entertainment 2014-08-07 20:35 - 2014-08-07 20:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net 2014-08-07 20:35 - 2014-08-07 20:35 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment 2014-08-07 20:35 - 2014-08-07 20:35 - 00000000 ____D () C:\Program Files\Battle.net 2014-08-07 20:30 - 2014-08-07 20:30 - 00000000 ____D () C:\ProgramData\Battle.net 2014-08-07 03:43 - 2014-08-14 06:26 - 00412160 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-08-07 03:39 - 2014-08-14 06:26 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-08-01 18:56 - 2014-08-01 18:46 - 00036069 _____ () C:\Windows\DIIUnin.dat 2014-08-01 18:55 - 2014-08-01 18:55 - 00021840 _____ () C:\Windows\system32\SIntfNT.dll 2014-08-01 18:55 - 2014-08-01 18:55 - 00017212 _____ () C:\Windows\system32\SIntf32.dll 2014-08-01 18:55 - 2014-08-01 18:55 - 00012067 _____ () C:\Windows\system32\SIntf16.dll 2014-08-01 18:55 - 2014-08-01 18:55 - 00000000 ____D () C:\Users\HYRICAN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games 2014-08-01 18:54 - 2014-08-01 18:54 - 00001851 _____ () C:\Users\HYRICAN\Desktop\Diablo II - Lord of Destruction.lnk 2014-08-01 18:54 - 2014-08-01 18:54 - 00000000 ____D () C:\Users\HYRICAN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Diablo II 2014-08-01 18:54 - 2014-08-01 18:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo II 2014-08-01 18:46 - 2014-08-01 18:46 - 00102400 _____ (Blizzard Entertainment) C:\Windows\DIIUnin.exe 2014-08-01 18:46 - 2014-08-01 18:46 - 00002829 _____ () C:\Windows\DIIUnin.pif 2014-08-01 11:32 - 2012-07-26 16:20 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service 2014-08-01 01:16 - 2014-08-14 06:30 - 00307384 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll Some content of TEMP: ==================== C:\Users\HYRICAN\AppData\Local\Temp\catchme.dll C:\Users\HYRICAN\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-08-30 13:28 ==================== End Of Log ============================ --- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version:30-08-2014 01
Ran by HYRICAN at 2014-08-31 12:31:08
Running from C:\Users\HYRICAN\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (HKLM\...\7-Zip) (Version: - )
Adobe Flash Player 14 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 14.0.0.179 - Adobe Systems Incorporated)
Adobe Reader X (10.1.11) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.11 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.6 (HKLM\...\Adobe Shockwave Player) (Version: 11.6.5.635 - Adobe Systems, Inc.)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.0.4.4 - Atheros Communications Inc.)
Battle.net (HKLM\...\Battle.net) (Version: - Blizzard Entertainment)
calibre (HKLM\...\{60C18701-A823-4165-8E58-C083673F90DC}) (Version: 1.14.0 - Kovid Goyal)
Diablo II (HKLM\...\Diablo II) (Version: - )
DivX-Setup (HKLM\...\DivX Setup) (Version: 2.6.1.9 - DivX, LLC)
Java 7 Update 21 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217017FF}) (Version: 7.0.210 - Oracle)
Java Auto Updater (Version: 2.1.9.5 - Sun Microsystems, Inc.) Hidden
king.com (remove only) (HKLM\...\king.com) (Version: - Midasplayer Ltd (king.com))
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Professional Edition 2003 (HKLM\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Mozilla Firefox 31.0 (x86 de) (HKLM\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Realtek Ethernet Controller Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.49.927.2011 - Realtek)
Russisch / deutsche Tastatur - WinRus.com (Russian Phonetic for German keyboard) (HKLM\...\{6E524EA9-6961-4E29-B8D4-1BFDDDB63F30}) (Version: 1.0.3.40 - Paul Gorodyansky)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0 - DivX, Inc) Hidden
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
30-08-2014 11:35:11 Geplanter Prüfpunkt
31-08-2014 09:01:10 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:04 - 2014-08-30 20:35 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {4A382E3B-818B-42BE-95A4-9A75159AC73B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-08-29] (Adobe Systems Incorporated)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2011-07-29 01:08 - 2011-07-29 01:08 - 01259376 _____ () C:\Program Files\DivX\DivX Update\DivXUpdate.exe
2011-07-29 01:09 - 2011-07-29 01:09 - 00096112 _____ () C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll
2014-07-31 14:44 - 2014-07-31 14:44 - 03800688 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-08-29 21:15 - 2014-08-29 21:15 - 17048240 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_179.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
==================== Faulty Device Manager Devices =============
Name: MpKslcc04e436
Description: MpKslcc04e436
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: MpKslcc04e436
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Event log errors: =========================
Application errors:
==================
System errors:
=============
Microsoft Office Sessions:
=========================
==================== Memory info ===========================
Processor: AMD A4-3300 APU with Radeon(tm) HD Graphics
Percentage of memory in use: 60%
Total physical RAM: 1533.41 MB
Available physical RAM: 604.95 MB
Total Pagefile: 3066.83 MB
Available Pagefile: 1900.78 MB
Total Virtual: 2047.88 MB
Available Virtual: 1914.28 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:244.04 GB) (Free:213.33 GB) NTFS
Drive d: (Allgemein) (Fixed) (Total:211.62 GB) (Free:210.35 GB) NTFS
Drive e: (Expansion) (CDROM) (Total:0.53 GB) (Free:0 GB) CDFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 1140A77D)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=244 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=211.6 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=10 GB) - (Type=27)
==================== End Of Log ============================
|
|
| Themen zu PC friert ein, Bild bleibt stehen, Maus nicht bewegbar. |
| ahnung, bedrohung, fehlercode 0x0, fehlercode 0x0000000011308000, fehlercode 0x00008000, fehlercode 0xc0000005, fehlercode 0xc0000006, friert, gescannt, gespeichert, hardware, heute, log, minute, nötig, pc friert ein, pup.optional.bandoo, stehe, stunde |
WARNUNG an die MITLESER: 
Hybrid-Darstellung
