| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Weißer Bildschirm nach dem Hochfahren, Windows 7Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
| |
18.07.2013, 07:19
| #1 |
| /// the machine /// TB-Ausbilder    |  Weißer Bildschirm nach dem Hochfahren, Windows 7ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
19.07.2013, 13:26
| #2 |
| | Weißer Bildschirm nach dem Hochfahren, Windows 7 Hier das eset-dings ;-)
__________________Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=f8b8c23bfd57584f92007470b12f9b28
# engine=14448
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-07-18 09:03:40
# local_time=2013-07-18 11:03:40 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 106547 125811270 0 0
# scanned=346119
# found=8
# cleaned=0
# scan_time=12491
sh=39386E0374A92778F3EE506051A29283B3E4797B ft=1 fh=83fe5a399255ac92 vn="Win32/LockScreen.AQD trojan" ac=I fn="C:\FRST\Quarantine\cache.dat"
sh=4F14193A2D9906ED28D23C71F3EB27C4488CFDF2 ft=0 fh=0000000000000000 vn="Win32/Reveton.M trojan" ac=I fn="C:\FRST\Quarantine\w74z6.bat"
sh=5C7B48BD8AB20B62A5CDA0D90B84C544F9449254 ft=0 fh=0000000000000000 vn="Win32/Reveton.R trojan" ac=I fn="C:\ProgramData\w74z6.js"
sh=5C7B48BD8AB20B62A5CDA0D90B84C544F9449254 ft=0 fh=0000000000000000 vn="Win32/Reveton.R trojan" ac=I fn="C:\Users\All Users\w74z6.js"
sh=39386E0374A92778F3EE506051A29283B3E4797B ft=1 fh=83fe5a399255ac92 vn="Win32/LockScreen.AQD trojan" ac=I fn="C:\Users\Schuler\AppData\Local\Temp\bkyblj"
sh=1059C2B6A2363010BB628DF66A75EA72CD79729B ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Schuler\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6\78ffb946-74cfcbb6"
sh=D12295063C541D5194B0107D8F3217278790EF56 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="D:\SCHULER-PC\Backup Set 2013-04-14 190003\Backup Files 2013-06-30 194747\Backup files 1.zip"
sh=0015A301F47A41871E2C741167CBF655C6E98689 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="D:\SCHULER-PC\Backup Set 2013-04-14 190003\Backup Files 2013-07-16 095115\Backup files 2.zip"
Code:
ATTFilter Results of screen317's Security Check version 0.99.70
Windows 7 Service Pack 1 x64 (UAC is disabled!)
Internet Explorer 10
``````````````Antivirus/Firewall Check:``````````````
G Data InternetSecurity 2011
Antivirus out of date!
`````````Anti-malware/Other Utilities Check:`````````
Java(TM) 6 Update 26
Java version out of Date!
Adobe Flash Player 11.7.700.224
Adobe Reader 10.1.7 Adobe Reader out of Date!
Mozilla Firefox (22.0)
Google Chrome 28.0.1500.71
Google Chrome 28.0.1500.72
````````Process Check: objlist.exe by Laurent````````
G Data InternetSecurity Firewall GDFwSvcx64.exe
G Data InternetSecurity Firewall GDFirewallTray.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-07-2013
Ran by Schuler (administrator) on 19-07-2013 14:23:07
Running from C:\Users\Schuler\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Advanced Micro Devices) C:\Program Files (x86)\AMD\AMD Fusion Utility for Desktops\FusionSVC.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\WlanNetService.exe
(Nero AG) C:\Program Files (x86)\Motorola Media Link\NServiceEntry.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
() C:\Program Files (x86)\Lexmark S300-S400 Series\lxeamon.exe
() C:\Program Files (x86)\Lexmark S300-S400 Series\ezprint.exe
(NEC Electronics Corporation) C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(Creative Technology Ltd) C:\Program Files (x86)\InstallShield Installation Information\{F3D9AC82-30F4-4BB9-B9AB-8697637568C1}\AMBSPISyncService.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\WLanGUI.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(Macrovision Europe Ltd.) C:\Users\Schuler\AppData\Local\Temp\Sound_Blaster_X-Fi_MB_Cleanup.0001
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
(Creative Labs) C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AvkBap64.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Farbar) C:\Users\Schuler\Downloads\FRST64(1).exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RunDLLEntry] - C:\Windows\system32\AmbRunE.dll [17920 2009-02-26] (Creative Technology Ltd.)
HKLM\...\Run: [lxeamon.exe] - C:\Program Files (x86)\Lexmark S300-S400 Series\lxeamon.exe [770728 2011-01-23] ()
HKLM\...\Run: [EzPrint] - C:\Program Files (x86)\Lexmark S300-S400 Series\ezprint.exe [148280 2011-01-23] ()
HKCU\...\Run: [ASRockOCTuner] - [x]
HKCU\...\Run: [ASRockIES] - [x]
HKCU\...\Run: [zASRockInstantBoot] - [x]
MountPoints2: {199211f3-8648-11e1-9d96-806e6f6e6963} - G:\LGAutoRun.exe
MountPoints2: {5223aa04-2efa-11e1-82e1-bc0543022983} - G:\Autorun.exe
MountPoints2: {5a348476-f589-11df-b47e-002522693013} - G:\pushinst.exe
MountPoints2: {9dc0680f-cd11-11e1-9e42-bc0543022983} - G:\Startme.exe
HKLM-x32\...\Run: [NUSB3MON] - "C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [106496 2010-01-22] (NEC Electronics Corporation)
HKLM-x32\...\Run: [CTSyncService] - C:\Program Files (x86)\InstallShield Installation Information\{F3D9AC82-30F4-4BB9-B9AB-8697637568C1}\AMBSPISyncService.exe /StartRunKey [1233195 2009-07-08] (Creative Technology Ltd)
HKLM-x32\...\Run: [VolPanel] - "C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe" /r [241789 2009-05-04] (Creative Technology Ltd)
HKLM-x32\...\Run: [UpdReg] - C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM-x32\...\Run: [AVMWlanClient] - C:\Program Files (x86)\avmwlanstick\wlangui.exe [1904640 2009-03-20] (AVM Berlin)
HKLM-x32\...\Run: [G Data AntiVirus Tray Application] - C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe [963144 2010-03-31] (G Data Software AG)
HKLM-x32\...\Run: [GDFirewallTray] - C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1499720 2010-03-31] (G Data Software AG)
HKLM-x32\...\Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-11-28] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [QuickTime Task] - "D:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [x]
HKLM-x32\...\Run: [iTunesHelper] - "D:\Program Files (x86)\iTunes\iTunesHelper.exe" [x]
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-03-20] (Geek Software GmbH)
Startup: C:\Users\Schuler\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: G Data WebFilter - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G Data\InternetSecurity\Webfilter\AVKWebIEx64.dll (G Data Software AG)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: WEB.DE MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll No File
BHO-x32: G Data WebFilter - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G Data\InternetSecurity\WebFilter\AvkWebIE.dll (G Data Software AG)
BHO-x32: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - G Data WebFilter - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G Data\InternetSecurity\Webfilter\AVKWebIEx64.dll (G Data Software AG)
Toolbar: HKLM - WEB.DE MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll No File
Toolbar: HKLM-x32 - G Data WebFilter - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G Data\InternetSecurity\WebFilter\AvkWebIE.dll (G Data Software AG)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKCU - WEB.DE MailCheck - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll No File
DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {6A060448-60F9-11D5-A6CD-0002B31F7455}
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Schuler\AppData\Roaming\Mozilla\Firefox\Profiles\xn1tgjyo.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/MycameraPlugin - C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll No File
FF Plugin-x32: @exent.com/npExentCtl,version=7.0.0.0 - C:\Program Files (x86)\Free Ride Games\npExentCtl.dll No File
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [fmconverter@gmail.com] C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\
FF Extension: Freemake Video Converter Plugin - C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.56\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.9) - D:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - D:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - D:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - D:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - D:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - D:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - D:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Chrome NaCl) - C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.56\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.56\pdf.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Acrobat 5.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll No File
CHR Plugin: (iTunes Application Detector) - D:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Default Plug-in) - default_plugin No File
==================== Services (Whitelisted) =================
S4 AODService; C:\Program Files (x86)\AMD\OverDrive\AODAssist.exe [136544 2010-03-12] ()
R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [1146440 2010-04-07] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [410696 2010-03-31] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe [1778336 2010-03-15] (G Data Software AG)
R2 AVM WLAN Connection Service; C:\Program Files (x86)\avmwlanstick\WlanNetService.exe [368640 2009-03-20] (AVM Berlin)
R2 DeviceMonitorService; C:\Program Files (x86)\Motorola Media Link\NServiceEntry.exe [87336 2009-10-12] (Nero AG)
S4 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [101888 2013-05-30] (Freemake)
R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [1666096 2010-03-22] (G Data Software AG)
R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [330824 2010-03-16] (G Data Software AG)
S2 lxeaCATSCustConnectService; C:\Windows\system32\spool\DRIVERS\x64\3\\lxeaserv.exe [45736 2010-04-14] (Lexmark International, Inc.)
S4 lxea_device; C:\Windows\system32\lxeacoms.exe [1052328 2010-04-14] ( )
S4 mfevtp; C:\Windows\system32\mfevtps.exe [158832 2011-03-13] (McAfee, Inc.)
==================== Drivers (Whitelisted) ====================
S3 61883; C:\Windows\System32\DRIVERS\61883.sys [60288 2009-07-14] (Microsoft Corporation)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2009-03-20] (AVM Berlin)
R3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [460800 2009-03-20] (AVM GmbH)
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [40392 2011-06-05] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [84936 2011-06-05] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [57288 2011-06-05] (G DATA Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [48584 2011-06-05] (G DATA Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [106224 2011-06-05] (G Data Software)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [106224 2011-06-05] (G Data Software)
R3 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [49096 2011-06-05] (G Data Software AG)
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [156792 2011-03-13] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [639216 2011-03-13] (McAfee, Inc.)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [x]
S2 X5XSEx; \??\C:\Program Files (x86)\Free Ride Games\X5XSEx.Sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-07-19 14:22 - 2013-07-19 14:22 - 01778207 _____ (Farbar) C:\Users\Schuler\Downloads\FRST64(1).exe
2013-07-19 14:14 - 2013-07-19 14:14 - 00891062 _____ C:\Users\Schuler\Downloads\SecurityCheck.exe
2013-07-19 05:42 - 2013-07-19 05:54 - 00000000 ____D C:\Windows\rescache
2013-07-18 19:32 - 2013-07-18 19:32 - 02347384 _____ (ESET) C:\Users\Schuler\Downloads\esetsmartinstaller_enu.exe
2013-07-17 17:29 - 2013-07-17 17:29 - 01778209 _____ (Farbar) C:\Users\Schuler\Downloads\FRST64.exe
2013-07-17 17:21 - 2013-07-17 17:21 - 00000000 ____D C:\Windows\ERUNT
2013-07-16 16:12 - 2013-07-16 16:12 - 00007915 _____ C:\AdwCleaner[S1].txt
2013-07-16 16:11 - 2013-07-16 16:11 - 00662345 _____ C:\Users\Schuler\Downloads\adwcleaner.exe
2013-07-16 16:08 - 2013-07-16 16:08 - 00793536 _____ C:\Users\Schuler\Downloads\ZipOpenerSetup.exe
2013-07-15 17:45 - 2013-07-15 17:45 - 00000000 ____D C:\FRST
2013-07-13 11:50 - 2013-07-19 13:52 - 00001456 _____ C:\Windows\setupact.log
2013-07-13 11:50 - 2013-07-13 11:50 - 00000000 _____ C:\Windows\setuperr.log
2013-07-10 15:46 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-10 15:46 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-10 15:46 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-10 15:46 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-10 15:46 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-10 15:46 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-10 15:46 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-10 15:46 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-10 15:46 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-10 15:46 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-10 15:46 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-10 15:46 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-10 15:46 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-10 15:46 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-10 15:46 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-10 15:46 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-10 15:46 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-10 15:46 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-10 15:46 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-10 15:46 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-10 15:46 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-10 15:46 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-10 15:46 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-10 15:46 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-10 15:46 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-10 15:46 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-10 15:46 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-10 15:46 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-10 15:46 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-10 15:46 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-10 15:46 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-10 15:39 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-10 15:39 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-10 15:39 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-10 15:39 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-10 15:39 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-10 15:39 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-10 15:39 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-06 20:42 - 2013-07-06 20:42 - 00012751 _____ C:\Users\Schuler\Documents\~WRD0000.tmp
2013-07-06 10:15 - 2013-07-06 10:16 - 00000000 ____D C:\Users\Schuler\Documents\Fax
2013-07-03 21:53 - 2013-07-03 21:53 - 00940427 _____ C:\Users\Schuler\Desktop\1.odt
2013-07-03 21:28 - 2013-07-03 21:34 - 02039247 _____ C:\Users\Schuler\Desktop\Technik GFS.pptx
2013-07-03 21:01 - 2013-07-03 21:02 - 02108928 _____ C:\Users\Schuler\Desktop\Präsentation.pot
2013-07-03 18:55 - 2013-07-03 21:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-06-29 14:37 - 2013-06-29 14:37 - 00002119 _____ C:\Users\Schuler\AppData\Local\recently-used.xbel
2013-06-29 00:23 - 2013-06-29 14:37 - 00000000 ____D C:\Users\Schuler\AppData\Local\gtk-2.0
2013-06-29 00:08 - 2013-06-29 00:11 - 90116160 _____ (The GIMP Team ) C:\Users\Schuler\Downloads\gimp-2.8.6-setup.exe
2013-06-28 17:23 - 2013-06-28 17:23 - 00004355 _____ C:\Users\Schuler\Downloads\youtube_unblocker-0.4.4-fx.zip
2013-06-25 18:24 - 2013-07-19 14:21 - 00087131 _____ C:\ProgramData\lxea.log
2013-06-24 20:40 - 2013-06-25 18:08 - 00000000 _____ C:\ProgramData\g252qs.txt
2013-06-24 20:40 - 2013-06-24 22:32 - 00044544 _____ (Microsoft Corporation) C:\ProgramData\sdaksda.txt
2013-06-24 20:40 - 2013-06-24 20:40 - 00002653 _____ C:\ProgramData\w74z6.js
2013-06-24 19:59 - 2013-06-24 20:03 - 00000000 ____D C:\Users\Schuler\AppData\Roaming\dvdcss
2013-06-23 14:33 - 2013-07-10 18:51 - 00000000 ____D C:\Program Files\Windows Defender
==================== One Month Modified Files and Folders =======
2013-07-19 14:22 - 2013-07-19 14:22 - 01778207 _____ (Farbar) C:\Users\Schuler\Downloads\FRST64(1).exe
2013-07-19 14:22 - 2011-07-21 15:15 - 00001112 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-19 14:21 - 2013-06-25 18:24 - 00087131 _____ C:\ProgramData\lxea.log
2013-07-19 14:21 - 2013-01-04 16:49 - 00480235 _____ C:\ProgramData\lxeascan.log
2013-07-19 14:14 - 2013-07-19 14:14 - 00891062 _____ C:\Users\Schuler\Downloads\SecurityCheck.exe
2013-07-19 14:11 - 2011-06-09 18:16 - 00003946 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{8AD056EC-7150-425D-8F42-19545E6219A1}
2013-07-19 14:02 - 2012-06-10 16:12 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-19 13:59 - 2009-07-14 06:45 - 00015120 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-19 13:59 - 2009-07-14 06:45 - 00015120 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-19 13:58 - 2010-11-22 00:30 - 01110421 _____ C:\Windows\WindowsUpdate.log
2013-07-19 13:52 - 2013-07-13 11:50 - 00001456 _____ C:\Windows\setupact.log
2013-07-19 13:52 - 2011-08-19 14:39 - 00000000 ____D C:\Program Files (x86)\Motorola Media Link
2013-07-19 13:52 - 2011-07-21 15:15 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-19 13:52 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-19 05:54 - 2013-07-19 05:42 - 00000000 ____D C:\Windows\rescache
2013-07-18 19:33 - 2009-07-14 19:58 - 00657438 _____ C:\Windows\system32\perfh007.dat
2013-07-18 19:33 - 2009-07-14 19:58 - 00130810 _____ C:\Windows\system32\perfc007.dat
2013-07-18 19:33 - 2009-07-14 07:13 - 01507106 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-18 19:32 - 2013-07-18 19:32 - 02347384 _____ (ESET) C:\Users\Schuler\Downloads\esetsmartinstaller_enu.exe
2013-07-17 17:29 - 2013-07-17 17:29 - 01778209 _____ (Farbar) C:\Users\Schuler\Downloads\FRST64.exe
2013-07-17 17:21 - 2013-07-17 17:21 - 00000000 ____D C:\Windows\ERUNT
2013-07-16 16:12 - 2013-07-16 16:12 - 00007915 _____ C:\AdwCleaner[S1].txt
2013-07-16 16:11 - 2013-07-16 16:11 - 00662345 _____ C:\Users\Schuler\Downloads\adwcleaner.exe
2013-07-16 16:08 - 2013-07-16 16:08 - 00793536 _____ C:\Users\Schuler\Downloads\ZipOpenerSetup.exe
2013-07-15 17:45 - 2013-07-15 17:45 - 00000000 ____D C:\FRST
2013-07-13 19:59 - 2012-06-17 18:00 - 00000000 ____D C:\Users\Schuler\AppData\Local\CrashDumps
2013-07-13 12:24 - 2011-07-21 15:16 - 00002213 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-07-13 11:50 - 2013-07-13 11:50 - 00000000 _____ C:\Windows\setuperr.log
2013-07-12 23:37 - 2011-09-19 13:53 - 00000000 ____D C:\Windows\Minidump
2013-07-12 23:17 - 2011-07-21 15:15 - 00004108 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-12 23:17 - 2011-07-21 15:15 - 00003856 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-11 17:30 - 2010-12-13 23:52 - 00000116 _____ C:\Windows\NeroDigital.ini
2013-07-10 18:53 - 2009-07-14 06:45 - 00517792 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-10 18:51 - 2013-06-23 14:33 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-10 18:51 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-10 17:31 - 2009-07-14 20:18 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-10 15:53 - 2010-11-21 18:36 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-10 15:47 - 2011-06-08 21:55 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-07-06 20:42 - 2013-07-06 20:42 - 00012751 _____ C:\Users\Schuler\Documents\~WRD0000.tmp
2013-07-06 10:16 - 2013-07-06 10:15 - 00000000 ____D C:\Users\Schuler\Documents\Fax
2013-07-06 10:15 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-07-03 21:53 - 2013-07-03 21:53 - 00940427 _____ C:\Users\Schuler\Desktop\1.odt
2013-07-03 21:36 - 2013-07-03 18:55 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-03 21:34 - 2013-07-03 21:28 - 02039247 _____ C:\Users\Schuler\Desktop\Technik GFS.pptx
2013-07-03 21:02 - 2013-07-03 21:01 - 02108928 _____ C:\Users\Schuler\Desktop\Präsentation.pot
2013-07-03 15:08 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-06-29 19:02 - 2013-05-09 22:00 - 00000000 ____D C:\Users\Schuler\Desktop\KLeinies
2013-06-29 14:39 - 2012-07-07 12:08 - 00005120 ____H C:\Users\Schuler\Desktop\photothumb.db
2013-06-29 14:38 - 2012-07-22 14:06 - 00000000 ____D C:\Users\Schuler\.gimp-2.8
2013-06-29 14:37 - 2013-06-29 14:37 - 00002119 _____ C:\Users\Schuler\AppData\Local\recently-used.xbel
2013-06-29 14:37 - 2013-06-29 00:23 - 00000000 ____D C:\Users\Schuler\AppData\Local\gtk-2.0
2013-06-29 00:11 - 2013-06-29 00:08 - 90116160 _____ (The GIMP Team ) C:\Users\Schuler\Downloads\gimp-2.8.6-setup.exe
2013-06-28 17:23 - 2013-06-28 17:23 - 00004355 _____ C:\Users\Schuler\Downloads\youtube_unblocker-0.4.4-fx.zip
2013-06-25 18:50 - 2010-11-21 17:38 - 00000000 ___RD C:\Users\Schuler\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-06-25 18:47 - 2012-02-29 21:30 - 00000000 ____D C:\Windows\pss
2013-06-25 18:32 - 2012-12-23 17:47 - 00000000 ____D C:\Program Files (x86)\AVS4YOU
2013-06-25 18:08 - 2013-06-24 20:40 - 00000000 _____ C:\ProgramData\g252qs.txt
2013-06-24 22:32 - 2013-06-24 20:40 - 00044544 _____ (Microsoft Corporation) C:\ProgramData\sdaksda.txt
2013-06-24 20:40 - 2013-06-24 20:40 - 00002653 _____ C:\ProgramData\w74z6.js
2013-06-24 20:03 - 2013-06-24 19:59 - 00000000 ____D C:\Users\Schuler\AppData\Roaming\dvdcss
2013-06-24 20:03 - 2012-02-26 19:59 - 00000000 ____D C:\Users\Schuler\AppData\Roaming\vlc
2013-06-21 16:25 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-07-19 05:36
==================== End Of Log ============================
--- --- --- |
|
| Themen zu Weißer Bildschirm nach dem Hochfahren, Windows 7 |
| 64-bit, abmelden, anmelde, anmelden, bildschirm, einschalten, hochfahren, höchstwahrscheinlich, kommt wieder, komplett, kontrolle, maus, möglichkeit, schalten, version., wahrscheinlich, weiße, weißer, weißer bildschirm, windows, windows 7 |
Hybrid-Darstellung
