| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Weißer Bildschirm nach Windows7 SystemstartWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
02.05.2013, 09:48
| #1 |
| |  Weißer Bildschirm nach Windows7 Systemstart Hallo, ich habe das hier schon öfters beschriebene Problem mit dem weißen Bildschirm nach Systemstart von Windows7. Kann auch das System nicht zu einem früheren Zeitpunkt im abgesicherten Modus wiederherstellen, weil der Laptop dann sofort herunterfährt. Arbeite jetzt auf einem anderen PC. Bitte um Hilfe. Danke und LG! Geändert von Schludi1 (02.05.2013 um 09:57 Uhr) |
|
02.05.2013, 14:23
| #2 |
| /// Helfer-Team  |  Weißer Bildschirm nach Windows7 Systemstart Mit einem sauberen 2. Rechner eine OTLPE-CD erstellen und den infizierten Rechner dann von dieser CD booten: Falls Du kein Brennprogramm installiert hast, lade dir bitte ISOBurner herunter. Das Programm wird Dir erlauben, OTLPE auf eine CD zu brennen und sie bootfähig zu machen. Du brauchst das Tool nur zu installieren, der Rest läuft automatisch => Wie brenne ich eine ISO Datei auf CD/DVD.
__________________ |
|
02.05.2013, 15:58
| #3 |
| | Weißer Bildschirm nach Windows7 Systemstart Hallo,
__________________beim starten von Reatogo-X-PE passiert folgendes: Nach erscheinen des XP-Logos kommt ein Bluescreen mit folgendem Inhalt: A problem has been deteced and windows has been shut down to prevent damage to your computer. If this ist the first time you've seen this stop error screen, restart your computer. If this screen appears again, follow these steps: Check for viruses on your computer. Remove any newly installed hard drives or hard drive controllers. ... Technical information: ***STOP; 0x0000007B (0xF78DA528, 0xC0000034, 0x00000000, 0x00000000) Wie soll ich weiter vorgehen? |
|
03.05.2013, 09:23
| #4 |
| /// Helfer-Team | Weißer Bildschirm nach Windows7 Systemstart Schalte im BIOS den SATA-Modus von AHCI auf IDE um. |
|
03.05.2013, 10:33
| #5 |
| | Weißer Bildschirm nach Windows7 Systemstart Hallo, es wurde nur das otl.txt erstellt.OTL Logfile: Code:
ATTFilter OTL logfile created on: 5/3/2013 5:08:26 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
Windows 7 Professional Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.10.9200.16521)
Locale: 00000409 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 88.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 96.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = D: | %SystemRoot% = D:\windows | %ProgramFiles% = D:\Program Files
Drive C: | 300.00 Mb Total Space | 263.18 Mb Free Space | 87.73% Space Free | Partition Type: NTFS
Drive D: | 280.79 Gb Total Space | 183.39 Gb Free Space | 65.31% Space Free | Partition Type: NTFS
Drive E: | 15.00 Gb Total Space | 3.68 Gb Free Space | 24.53% Space Free | Partition Type: NTFS
Drive F: | 1.99 Gb Total Space | 1.46 Gb Free Space | 73.31% Space Free | Partition Type: FAT32
Drive G: | 252.67 Mb Total Space | 152.84 Mb Free Space | 60.49% Space Free | Partition Type: FAT
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
========== Win32 Services (SafeList) ==========
SRV - File not found [Auto] -- -- (Hp.Skyroom.Windows.Service)
SRV - [2013/02/05 11:48:00 | 000,235,216 | ---- | M] (McAfee, Inc.) [On_Demand] -- D:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe -- (McComponentHostService)
SRV - [2012/08/20 05:20:49 | 001,564,368 | ---- | M] () [Auto] -- D:\Program Files\Guard-ICQ\GuardICQ.exe -- (Guard.Mail.ru)
SRV - [2012/07/13 07:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto] -- D:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/06/03 17:25:45 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand] -- D:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/05/28 00:31:24 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- D:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012/05/28 00:31:23 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- D:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/06/06 06:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto] -- D:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011/05/04 08:14:38 | 000,081,408 | ---- | M] () [Auto] -- D:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe -- (PassThru Service)
SRV - [2011/03/19 04:57:35 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2010/06/25 16:55:34 | 000,092,216 | ---- | M] (Hewlett-Packard Company) [Auto] -- D:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe -- (HPDrvMntSvc.exe)
SRV - [2010/06/14 08:39:06 | 000,090,112 | ---- | M] (Hewlett-Packard Company) [Auto] -- D:\Program Files\Hewlett-Packard\HP QuickLook\HPDayStarterService.exe -- (HPDayStarterService)
SRV - [2010/06/08 10:51:06 | 000,084,808 | ---- | M] (Smith Micro Software, Inc.) [Auto] -- D:\Program Files\Hewlett-Packard\HP Connection Manager\SMManager.exe -- (SMManager)
SRV - [2010/04/05 13:40:44 | 000,354,840 | ---- | M] (Intel Corporation) [Auto] -- D:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2010/03/15 19:05:30 | 000,331,000 | ---- | M] (QUALCOMM, Inc.) [Auto] -- D:\Program Files\QUALCOMM\QDLService2k\QDLService2kHP.exe -- (QDLService2kHP) Qualcomm Gobi 2000 Download Service (HP)
SRV - [2010/01/29 00:15:24 | 000,229,458 | ---- | M] (IDT, Inc.) [Auto] -- D:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9b219d80a8843bf8\stacsv.exe -- (STacSV)
SRV - [2009/12/02 17:23:52 | 000,209,768 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2009/12/02 17:23:46 | 000,483,688 | ---- | M] (Microsoft Corporation) [Auto] -- D:\Program Files\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2009/11/24 21:57:20 | 000,300,808 | ---- | M] (DigitalPersona, Inc.) [Auto] -- D:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe -- (DpHost)
SRV - [2009/11/19 18:14:32 | 000,102,968 | ---- | M] (Hewlett-Packard) [Auto] -- D:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe -- (HP Power Assistant Service)
SRV - [2009/11/19 18:11:24 | 000,102,968 | ---- | M] (Hewlett-Packard) [Auto] -- D:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe -- (HP Wireless Assistant Service)
SRV - [2009/11/19 13:42:42 | 000,379,904 | ---- | M] (Hewlett-Packard, Inc.) [Auto] -- D:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\rgsendersvc.exe -- (rgsender)
SRV - [2009/11/18 18:17:36 | 000,036,864 | ---- | M] (Hewlett-Packard Development Company, L.P) [Auto] -- D:\Program Files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe -- (HP ProtectTools Service)
SRV - [2009/11/11 11:42:40 | 000,277,096 | ---- | M] (McAfee, Inc.) [Auto] -- D:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe -- (HpFkCryptService)
SRV - [2009/11/04 17:46:40 | 002,320,920 | ---- | M] (Intel Corporation) [Auto] -- D:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2009/11/04 17:46:38 | 000,268,824 | ---- | M] (Intel Corporation) [Auto] -- D:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2009/10/21 21:30:46 | 001,639,728 | ---- | M] (Validity Sensors, Inc.) [Auto] -- D:\Windows\System32\vcsFPService.exe -- (vcsFPService)
SRV - [2009/09/04 16:43:38 | 000,595,232 | ---- | M] (Broadcom Corporation.) [Auto] -- D:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV - [2009/08/03 16:32:22 | 000,014,336 | ---- | M] (LSI Corporation) [Auto] -- D:\Program Files\LSI SoftModem\agrsmsvc.exe -- (AgereModemAudio)
SRV - [2009/07/13 21:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009/07/13 21:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 21:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009/07/13 21:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009/03/03 06:43:08 | 000,081,920 | ---- | M] (Andrea Electronics Corporation) [Auto] -- D:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9b219d80a8843bf8\AEstSrv.exe -- (AESTFilters)
========== Driver Services (SafeList) ==========
DRV - [2012/05/28 00:31:24 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System] -- D:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012/05/28 00:31:24 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto] -- D:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011/10/19 11:56:15 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System] -- D:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2010/11/20 08:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot] -- D:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010/11/20 08:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot] -- D:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010/11/20 08:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | Boot] -- D:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010/11/20 06:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 05:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010/11/20 05:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\windows\system32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010/11/20 05:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\windows\system32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010/06/23 04:24:58 | 000,023,040 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand] -- D:\Windows\System32\drivers\htcnprot.sys -- (htcnprot)
DRV - [2010/06/17 10:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- D:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010/03/15 18:02:30 | 000,208,384 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand] -- D:\Windows\System32\drivers\qcusbnethp2k.sys -- (qcusbnethp2k) Gobi 2000 USB-NDIS miniport(03F0-251D)
DRV - [2010/03/15 18:02:30 | 000,106,880 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand] -- D:\Windows\System32\drivers\qcusbserhp2k.sys -- (qcusbserhp2k) Gobi 2000 USB Device for Legacy Serial Communication(03F0-251D)
DRV - [2010/03/15 18:02:30 | 000,005,248 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand] -- D:\Windows\System32\drivers\qcfilterhp2k.sys -- (qcfilterhp2k) Gobi 2000 USB Composite Device Filter Driver(03F0-251D)
DRV - [2010/02/27 03:18:56 | 009,957,288 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2010/01/29 00:15:24 | 000,423,424 | ---- | M] (IDT, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\stwrt.sys -- (STHDA)
DRV - [2010/01/28 11:25:04 | 000,068,200 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
DRV - [2010/01/13 10:36:40 | 006,755,840 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\NETw5s32.sys -- (NETw5s32) Intel(R)
DRV - [2009/12/02 17:23:52 | 000,019,304 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\Sftvollh.sys -- (Sftvol)
DRV - [2009/12/02 17:23:50 | 000,021,864 | ---- | M] (Microsoft Corporation) [File_System | On_Demand] -- D:\Windows\System32\drivers\Sftredirlh.sys -- (Sftredir)
DRV - [2009/12/02 17:23:48 | 000,195,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\Sftplaylh.sys -- (Sftplay)
DRV - [2009/12/02 17:23:46 | 000,550,760 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\Sftfslh.sys -- (Sftfs)
DRV - [2009/11/20 23:15:18 | 000,137,728 | ---- | M] (NEC Electronics Corporation) [Kernel | On_Demand] -- D:\windows\system32\DRIVERS\nusb3xhc.sys -- (nusb3xhc)
DRV - [2009/11/20 23:15:16 | 000,058,880 | ---- | M] (NEC Electronics Corporation) [Kernel | On_Demand] -- D:\windows\system32\DRIVERS\nusb3hub.sys -- (nusb3hub)
DRV - [2009/11/11 11:43:00 | 000,051,800 | ---- | M] (McAfee, Inc.) [Kernel | Boot] -- D:\windows\System32\drivers\SbAlg.sys -- (SbAlg)
DRV - [2009/11/11 11:42:52 | 000,013,256 | ---- | M] (McAfee, Inc.) [File_System | Boot] -- D:\windows\System32\drivers\SbFsLock.sys -- (SbFsLock)
DRV - [2009/11/11 11:42:50 | 000,040,088 | ---- | M] (McAfee, Inc.) [Kernel | System] -- D:\windows\System32\drivers\rsvlock.sys -- (RsvLock)
DRV - [2009/11/11 11:42:48 | 000,110,520 | ---- | M] (McAfee, Inc.) [Kernel | Boot] -- D:\windows\System32\drivers\SafeBoot.sys -- (SafeBoot)
DRV - [2009/11/05 20:35:22 | 000,214,696 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\e1k6232.sys -- (e1kexpress) Intel(R)
DRV - [2009/10/28 20:55:00 | 000,047,616 | ---- | M] (REDC) [Kernel | Auto] -- D:\windows\system32\DRIVERS\risdpe86.sys -- (risdpcie)
DRV - [2009/10/26 17:39:00 | 000,048,640 | ---- | M] (REDC) [Kernel | Auto] -- D:\windows\system32\DRIVERS\rimspe86.sys -- (rimspci)
DRV - [2009/10/26 16:39:04 | 000,125,696 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\Impcd.sys -- (Impcd)
DRV - [2009/10/26 02:54:24 | 000,025,088 | ---- | M] (HTC, Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\ANDROIDUSB.sys -- (HTCAND32)
DRV - [2009/09/28 17:47:00 | 000,038,912 | ---- | M] (REDC) [Kernel | Auto] -- D:\windows\system32\DRIVERS\rixdpe86.sys -- (rixdpcie)
DRV - [2009/09/17 16:54:14 | 000,041,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\HECI.sys -- (HECI) Intel(R)
DRV - [2009/08/03 16:32:22 | 001,161,760 | ---- | M] (LSI Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2009/07/20 18:05:16 | 000,049,152 | ---- | M] (RICOH Company, Ltd.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\rismc32.sys -- (rismc32)
DRV - [2009/07/13 19:12:52 | 000,030,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\tpm.sys -- (TPM)
DRV - [2009/07/08 16:48:38 | 000,025,656 | ---- | M] (Hewlett-Packard) [Kernel | Boot] -- D:\Windows\System32\drivers\hpdskflt.sys -- (hpdskflt)
DRV - [2009/07/08 16:48:22 | 000,033,848 | ---- | M] (Hewlett-Packard) [Kernel | On_Demand] -- D:\windows\system32\DRIVERS\Accelerometer.sys -- (Accelerometer)
DRV - [2009/06/25 19:58:10 | 000,048,128 | ---- | M] (REDC) [Kernel | Auto] -- D:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2009/06/25 19:25:58 | 000,038,400 | ---- | M] (REDC) [Kernel | Auto] -- D:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2009/06/25 19:10:48 | 000,044,544 | ---- | M] (REDC) [Kernel | Auto] -- D:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2009/04/29 10:46:54 | 000,015,872 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)
DRV - [2006/08/27 22:45:15 | 000,147,968 | ---- | M] () [Kernel | On_Demand] -- D:\Windows\System32\drivers\UDTTAFAT.sys -- (UDTTAFAT)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\ARAMIS_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/10
IE - HKU\ARAMIS_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.ask.com/web?l=dis&o=APN10234&gct=hp&apn_dtid=^YYYYYY^YY^US&apn_ptnrs=^A8B&apn_uid=4041158050114242&p2=^A8B^YYYYYY^YY^US
IE - HKU\ARAMIS_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\ARAMIS_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKU\ARAMIS_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = proxy.bau.oebb.at:80
========== FireFox ==========
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.at/|hxxp://www.google.at/firefox?client=firefox-a&rls=org.mozilla:de:official"
FF - prefs.js..extensions.enabledItems: otis@digitalpersona.com:5.0.0.4189
FF - prefs.js..extensions.enabledItems: 2020Player@2020Technologies.com:5.0.4.0
FF - prefs.js..network.proxy.type: 4
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: D:\Windows\System32\Macromed\Flash\NPSWF32_11_6_602_180.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: D:\Windows\System32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: D:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: D:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMSS.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: D:\Program Files\Microsoft Silverlight\4.0.60129.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpWinExt,version=5.0: D:\Program Files\MSN Toolbar\Platform\6.0.2237.0\npwinext.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: D:\Program Files\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: D:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\otis@digitalpersona.com: c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt\ [2010/09/07 00:12:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\msntoolbar@msn.com: C:\Program Files\MSN Toolbar\Platform\6.0.2237.0\Firefox [2010/09/07 00:27:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2010/09/07 00:27:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}: C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\ [2010/09/07 00:27:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/06/03 17:25:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/07/04 12:57:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.11\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011/06/29 12:32:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.11\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
[2011/03/20 07:01:28 | 000,000,000 | ---D | M] (No name found) -- D:\Users\ARAMIS\AppData\Roaming\Mozilla\Extensions
[2011/03/18 14:30:23 | 000,000,000 | ---D | M] (No name found) -- D:\Users\ARAMIS\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012/10/29 14:25:40 | 000,000,000 | ---D | M] (No name found) -- D:\Users\ARAMIS\AppData\Roaming\Mozilla\Firefox\Profiles\t00eelsm.default\extensions
[2012/05/02 14:11:46 | 000,000,000 | ---D | M] (AskToolbar) -- D:\Users\ARAMIS\AppData\Roaming\Mozilla\Firefox\Profiles\t00eelsm.default\extensions\{3cb073f3-be3c-4e8f-942d-8a747b54486f}
[2011/04/18 10:18:44 | 000,000,000 | ---D | M] (20-20 3D Viewer) -- D:\Users\ARAMIS\AppData\Roaming\Mozilla\Firefox\Profiles\t00eelsm.default\extensions\2020Player@2020Technologies.com
[2011/07/07 07:04:14 | 000,000,000 | ---D | M] (20-20 3D Viewer - IKEA) -- D:\Users\ARAMIS\AppData\Roaming\Mozilla\Firefox\Profiles\t00eelsm.default\extensions\2020Player_IKEA@2020Technologies.com
[2011/04/30 03:27:02 | 000,000,000 | ---D | M] (No name found) -- D:\Program Files\Mozilla Firefox\extensions
File not found (No name found) --
[2012/06/03 17:25:45 | 000,097,208 | ---- | M] (Mozilla Foundation) -- D:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/04/03 10:09:40 | 000,001,392 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/05/02 14:12:16 | 000,002,275 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\ask.xml
[2012/04/03 10:09:40 | 000,002,252 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/04/03 10:09:40 | 000,001,153 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012/04/03 10:09:40 | 000,006,805 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/04/03 10:09:40 | 000,001,178 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/04/03 10:09:40 | 000,001,105 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2009/06/10 17:39:37 | 000,000,824 | ---- | M]) - D:\Windows\System32\drivers\etc\hosts
O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - D:\Program Files\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
O2 - BHO: (HP ProtectTools Security Manager Extension) - {395610AE-C624-4f58-B89E-23733EA00F9A} - D:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.)
O2 - BHO: (AskToolbar) - {3cb073f3-be3c-4e8f-942d-8a747b54486f} - D:\Program Files\asktoolbar4\asktoolbar4X.dll (Ask.com)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (AskToolbar) - {3cb073f3-be3c-4e8f-942d-8a747b54486f} - D:\Program Files\asktoolbar4\asktoolbar4X.dll (Ask.com)
O3 - HKU\ARAMIS_ON_D\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] D:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] D:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Guard.Mail.ru.gui] D:\Program Files\Guard-ICQ\GuardICQ.exe ()
O4 - HKLM..\Run: [HP Connection Manager.exe] D:\Program Files\Hewlett-Packard\HP Connection Manager\HP Connection Manager.exe (Smith Micro Software, Inc)
O4 - HKLM..\Run: [HPPowerAssistant] D:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe (Hewlett-Packard)
O4 - HKLM..\Run: [HPWirelessAssistant] D:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe (Hewlett-Packard)
O4 - HKLM..\Run: [HTC Sync Loader] D:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe ()
O4 - HKLM..\Run: [IAAnotif] D:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [IMSS] D:\Program Files\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe ()
O4 - HKLM..\Run: [NUSB3MON] D:\Program Files\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (NEC Electronics Corporation)
O4 - HKLM..\Run: [NvCplDaemon] D:\windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] D:\windows\System32\nwiz.exe ()
O4 - HKLM..\Run: [SysTrayApp] D:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKU\LocalService_ON_D..\RunOnce: [mctadmin] D:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_D..\RunOnce: [mctadmin] D:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SoftwareSASGeneration = 3
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - D:\Program Files\ICQ7M\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - D:\Program Files\ICQ7M\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - D:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - D:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe) - D:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe (DigitalPersona, Inc.)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - D:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKU\ARAMIS_ON_D Winlogon: Shell - (explorer.exe) - D:\windows\explorer.exe (Microsoft Corporation)
O20 - HKU\ARAMIS_ON_D Winlogon: Shell - (C:\Users\ARAMIS\AppData\Roaming\skype.dat) - D:\Users\ARAMIS\AppData\Roaming\skype.dat ()
O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{668e80bb-fe75-11df-897c-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{668e80bb-fe75-11df-897c-806e6f6e6963}\Shell\AutoRun\command - "" = G:\AUTORUN.EXE
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2013/05/03 16:58:32 | 000,000,000 | -HSD | C] -- D:\RECYCLER
[2013/05/02 13:41:23 | 000,745,472 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\MsSpellCheckingFacility.exe
[2013/05/02 13:41:23 | 000,185,344 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\elshyph.dll
[2013/05/02 13:41:22 | 002,877,440 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\jscript9.dll
[2013/05/02 13:41:22 | 002,706,432 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\mshtml.tlb
[2013/05/02 13:41:22 | 001,441,280 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\inetcpl.cpl
[2013/05/02 13:41:22 | 001,400,416 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\ieapfltr.dat
[2013/05/02 13:41:22 | 000,719,360 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\mshtmlmedia.dll
[2013/05/02 13:41:22 | 000,690,688 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\jscript.dll
[2013/05/02 13:41:22 | 000,629,248 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\ieapfltr.dll
[2013/05/02 13:41:22 | 000,523,264 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\vbscript.dll
[2013/05/02 13:41:22 | 000,493,056 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\msfeeds.dll
[2013/05/02 13:41:22 | 000,391,680 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\ieui.dll
[2013/05/02 13:41:22 | 000,361,984 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\html.iec
[2013/05/02 13:41:22 | 000,357,888 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\dxtmsft.dll
[2013/05/02 13:41:22 | 000,242,200 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\iedkcs32.dll
[2013/05/02 13:41:22 | 000,232,960 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\url.dll
[2013/05/02 13:41:22 | 000,226,816 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\dxtrans.dll
[2013/05/02 13:41:22 | 000,163,840 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\msrating.dll
[2013/05/02 13:41:22 | 000,158,720 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\msls31.dll
[2013/05/02 13:41:22 | 000,150,528 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\iexpress.exe
[2013/05/02 13:41:22 | 000,138,752 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\wextract.exe
[2013/05/02 13:41:22 | 000,137,216 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\ieUnatt.exe
[2013/05/02 13:41:22 | 000,117,248 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\iepeers.dll
[2013/05/02 13:41:22 | 000,110,592 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\IEAdvpack.dll
[2013/05/02 13:41:22 | 000,109,056 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\iesysprep.dll
[2013/05/02 13:41:22 | 000,082,432 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\inseng.dll
[2013/05/02 13:41:22 | 000,073,728 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\SetIEInstalledDate.exe
[2013/05/02 13:41:22 | 000,071,680 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\RegisterIEPKEYs.exe
[2013/05/02 13:41:22 | 000,061,440 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\iesetup.dll
[2013/05/02 13:41:22 | 000,057,344 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\pngfilt.dll
[2013/05/02 13:41:22 | 000,048,640 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\mshtmler.dll
[2013/05/02 13:41:22 | 000,042,496 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\ie4uinit.exe
[2013/05/02 13:41:22 | 000,041,984 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\msfeedsbs.dll
[2013/05/02 13:41:22 | 000,039,936 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\jsproxy.dll
[2013/05/02 13:41:22 | 000,038,400 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\imgutil.dll
[2013/05/02 13:41:22 | 000,033,280 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\iernonce.dll
[2013/05/02 13:41:22 | 000,023,040 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\licmgr10.dll
[2013/05/02 13:41:22 | 000,011,776 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\msfeedssync.exe
[2013/05/02 13:40:50 | 003,419,136 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\d2d1.dll
[2013/05/02 13:40:50 | 002,284,544 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\msmpeg2vdec.dll
[2013/05/02 13:40:50 | 001,988,096 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\d3d10warp.dll
[2013/05/02 13:40:50 | 001,504,768 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\d3d11.dll
[2013/05/02 13:40:50 | 001,247,744 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\DWrite.dll
[2013/05/02 13:40:50 | 001,158,144 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\XpsPrint.dll
[2013/05/02 13:40:50 | 001,080,832 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\d3d10.dll
[2013/05/02 13:40:50 | 000,604,160 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\d3d10level9.dll
[2013/05/02 13:40:50 | 000,417,792 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\WMPhoto.dll
[2013/05/02 13:40:50 | 000,364,544 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\XpsGdiConverter.dll
[2013/05/02 13:40:50 | 000,293,376 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\dxgi.dll
[2013/05/02 13:40:50 | 000,249,856 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\d3d10_1core.dll
[2013/05/02 13:40:50 | 000,220,160 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\d3d10core.dll
[2013/05/02 13:40:50 | 000,207,872 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\WindowsCodecsExt.dll
[2013/05/02 13:40:50 | 000,187,392 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\UIAnimation.dll
[2013/05/02 13:40:50 | 000,161,792 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\d3d10_1.dll
[2013/05/02 13:40:50 | 000,010,752 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2013/05/02 13:40:50 | 000,009,728 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2013/05/02 13:40:50 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2013/05/02 13:40:50 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll
[2013/05/02 13:40:50 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll
[2013/05/02 13:40:50 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2013/05/02 13:40:50 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-downlevel-version-l1-1-0.dll
[2013/05/02 13:40:50 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-downlevel-shell32-l1-1-0.dll
[2013/05/02 13:40:50 | 000,002,560 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2013/04/12 03:46:25 | 002,347,008 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\win32k.sys
[2013/04/12 03:46:24 | 003,968,856 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\ntkrnlpa.exe
[2013/04/12 03:46:24 | 003,913,560 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\ntoskrnl.exe
[2013/04/12 03:46:23 | 000,038,912 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\csrsrv.dll
[2013/04/12 03:46:21 | 000,131,584 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\aaclient.dll
[2013/04/12 03:46:21 | 000,036,864 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\tsgqec.dll
[2013/04/07 13:16:44 | 000,000,000 | ---D | C] -- D:\Filme
========== Files - Modified Within 30 Days ==========
[2013/05/02 13:46:07 | 000,067,584 | --S- | M] () -- D:\windows\bootstat.dat
[2013/05/02 13:45:22 | 000,000,004 | ---- | M] () -- D:\Users\ARAMIS\AppData\Roaming\skype.ini
[2013/05/02 13:42:42 | 000,020,944 | -H-- | M] () -- D:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/05/02 13:42:42 | 000,020,944 | -H-- | M] () -- D:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/05/02 13:42:09 | 000,654,610 | ---- | M] () -- D:\windows\System32\perfh007.dat
[2013/05/02 13:42:09 | 000,616,452 | ---- | M] () -- D:\windows\System32\perfh009.dat
[2013/05/02 13:42:09 | 000,130,192 | ---- | M] () -- D:\windows\System32\perfc007.dat
[2013/05/02 13:42:09 | 000,106,574 | ---- | M] () -- D:\windows\System32\perfc009.dat
[2013/05/02 13:41:23 | 000,745,472 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\MsSpellCheckingFacility.exe
[2013/05/02 13:41:23 | 000,185,344 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\elshyph.dll
[2013/05/02 13:41:22 | 002,877,440 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\jscript9.dll
[2013/05/02 13:41:22 | 002,706,432 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\mshtml.tlb
[2013/05/02 13:41:22 | 001,441,280 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\inetcpl.cpl
[2013/05/02 13:41:22 | 001,400,416 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\ieapfltr.dat
[2013/05/02 13:41:22 | 000,719,360 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\mshtmlmedia.dll
[2013/05/02 13:41:22 | 000,690,688 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\jscript.dll
[2013/05/02 13:41:22 | 000,629,248 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\ieapfltr.dll
[2013/05/02 13:41:22 | 000,523,264 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\vbscript.dll
[2013/05/02 13:41:22 | 000,493,056 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\msfeeds.dll
[2013/05/02 13:41:22 | 000,391,680 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\ieui.dll
[2013/05/02 13:41:22 | 000,361,984 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\html.iec
[2013/05/02 13:41:22 | 000,357,888 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\dxtmsft.dll
[2013/05/02 13:41:22 | 000,242,200 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\iedkcs32.dll
[2013/05/02 13:41:22 | 000,232,960 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\url.dll
[2013/05/02 13:41:22 | 000,226,816 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\dxtrans.dll
[2013/05/02 13:41:22 | 000,163,840 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\msrating.dll
[2013/05/02 13:41:22 | 000,158,720 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\msls31.dll
[2013/05/02 13:41:22 | 000,150,528 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\iexpress.exe
[2013/05/02 13:41:22 | 000,138,752 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\wextract.exe
[2013/05/02 13:41:22 | 000,137,216 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\ieUnatt.exe
[2013/05/02 13:41:22 | 000,117,248 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\iepeers.dll
[2013/05/02 13:41:22 | 000,110,592 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\IEAdvpack.dll
[2013/05/02 13:41:22 | 000,109,056 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\iesysprep.dll
[2013/05/02 13:41:22 | 000,082,432 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\inseng.dll
[2013/05/02 13:41:22 | 000,073,728 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\SetIEInstalledDate.exe
[2013/05/02 13:41:22 | 000,071,680 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\RegisterIEPKEYs.exe
[2013/05/02 13:41:22 | 000,061,440 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\iesetup.dll
[2013/05/02 13:41:22 | 000,057,344 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\pngfilt.dll
[2013/05/02 13:41:22 | 000,048,640 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\mshtmler.dll
[2013/05/02 13:41:22 | 000,042,496 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\ie4uinit.exe
[2013/05/02 13:41:22 | 000,041,984 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\msfeedsbs.dll
[2013/05/02 13:41:22 | 000,039,936 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\jsproxy.dll
[2013/05/02 13:41:22 | 000,038,400 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\imgutil.dll
[2013/05/02 13:41:22 | 000,033,280 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\iernonce.dll
[2013/05/02 13:41:22 | 000,025,185 | ---- | M] () -- D:\windows\System32\ieuinit.inf
[2013/05/02 13:41:22 | 000,023,040 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\licmgr10.dll
[2013/05/02 13:41:22 | 000,011,776 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\msfeedssync.exe
[2013/05/02 13:40:50 | 003,419,136 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\d2d1.dll
[2013/05/02 13:40:50 | 002,284,544 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\msmpeg2vdec.dll
[2013/05/02 13:40:50 | 001,988,096 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\d3d10warp.dll
[2013/05/02 13:40:50 | 001,504,768 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\d3d11.dll
[2013/05/02 13:40:50 | 001,247,744 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\DWrite.dll
[2013/05/02 13:40:50 | 001,158,144 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\XpsPrint.dll
[2013/05/02 13:40:50 | 001,080,832 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\d3d10.dll
[2013/05/02 13:40:50 | 000,604,160 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\d3d10level9.dll
[2013/05/02 13:40:50 | 000,417,792 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\WMPhoto.dll
[2013/05/02 13:40:50 | 000,364,544 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\XpsGdiConverter.dll
[2013/05/02 13:40:50 | 000,293,376 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\dxgi.dll
[2013/05/02 13:40:50 | 000,249,856 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\d3d10_1core.dll
[2013/05/02 13:40:50 | 000,220,160 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\d3d10core.dll
[2013/05/02 13:40:50 | 000,207,872 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\WindowsCodecsExt.dll
[2013/05/02 13:40:50 | 000,187,392 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\UIAnimation.dll
[2013/05/02 13:40:50 | 000,161,792 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\d3d10_1.dll
[2013/05/02 13:40:50 | 000,010,752 | -H-- | M] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2013/05/02 13:40:50 | 000,009,728 | -H-- | M] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2013/05/02 13:40:50 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2013/05/02 13:40:50 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll
[2013/05/02 13:40:50 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll
[2013/05/02 13:40:50 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2013/05/02 13:40:50 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-downlevel-version-l1-1-0.dll
[2013/05/02 13:40:50 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-downlevel-shell32-l1-1-0.dll
[2013/05/02 13:40:50 | 000,002,560 | -H-- | M] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2013/05/02 13:34:50 | 2402,844,672 | -HS- | M] () -- D:\hiberfil.sys
[2013/05/02 10:11:24 | 000,000,017 | ---- | M] () -- D:\windows\System32\shortcut_ex.dat
[2013/05/01 08:23:38 | 174,407,400 | ---- | M] () -- D:\windows\MEMORY.DMP
[2013/04/25 12:03:54 | 000,000,324 | ---- | M] () -- D:\windows\tasks\HPCeeScheduleForARAMIS.job
[2013/04/13 05:00:51 | 000,089,816 | -H-- | M] () -- D:\windows\System32\mlfcache.dat
[2013/04/13 04:51:12 | 000,000,000 | -H-- | M] () -- D:\windows\System32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2013/04/12 10:18:57 | 000,270,424 | ---- | M] () -- D:\windows\System32\FNTCACHE.DAT
========== Files Created - No Company Name ==========
[2013/05/02 13:41:22 | 000,025,185 | ---- | C] () -- D:\windows\System32\ieuinit.inf
[2013/05/02 10:11:24 | 000,000,017 | ---- | C] () -- D:\windows\System32\shortcut_ex.dat
[2013/05/01 01:34:44 | 000,000,004 | ---- | C] () -- D:\Users\ARAMIS\AppData\Roaming\skype.ini
[2013/04/23 12:51:04 | 000,000,324 | ---- | C] () -- D:\windows\tasks\HPCeeScheduleForARAMIS.job
[2013/04/13 05:00:51 | 000,089,816 | -H-- | C] () -- D:\windows\System32\mlfcache.dat
[2013/04/13 04:51:12 | 000,000,000 | -H-- | C] () -- D:\windows\System32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2012/10/14 09:04:58 | 000,147,968 | ---- | C] () -- D:\windows\System32\drivers\UDTTAFAT.sys
[2012/03/30 13:25:03 | 000,024,576 | ---- | C] () -- D:\windows\UniFISH.exe
[2012/03/29 10:00:36 | 000,122,880 | ---- | C] () -- D:\Users\ARAMIS\AppData\Roaming\skype.dat
[2011/04/24 04:34:22 | 000,252,928 | ---- | C] () -- D:\windows\System32\DShowRdpFilter.dll
[2011/04/24 04:33:45 | 000,066,048 | ---- | C] () -- D:\windows\System32\PrintBrmUi.exe
[2011/03/18 14:30:23 | 000,000,000 | ---- | C] () -- D:\windows\nsreg.dat
[2010/12/02 20:39:11 | 001,731,176 | ---- | C] () -- D:\windows\System32\nvwdmcpl.dll
[2010/12/02 20:39:11 | 001,657,448 | ---- | C] () -- D:\windows\System32\nwiz.exe
[2010/12/02 20:39:11 | 001,612,392 | ---- | C] () -- D:\windows\System32\nView.dll
[2010/12/02 20:39:11 | 001,108,584 | ---- | C] () -- D:\windows\System32\nvwimg.dll
[2010/12/02 20:39:11 | 000,473,704 | ---- | C] () -- D:\windows\System32\nvShell.dll
[2010/12/02 20:39:11 | 000,449,128 | ---- | C] () -- D:\windows\System32\nvAppBar.exe
[2010/12/02 20:39:11 | 000,260,712 | ---- | C] () -- D:\windows\System32\nViewSetup.exe
[2010/09/07 00:27:08 | 000,000,188 | ---- | C] () -- D:\windows\System32\HPWA.ini
[2010/09/07 00:16:45 | 000,000,178 | ---- | C] () -- D:\windows\System32\HPPA.ini
[2010/09/07 00:15:05 | 000,654,610 | ---- | C] () -- D:\windows\System32\perfh007.dat
[2010/09/07 00:15:05 | 000,295,922 | ---- | C] () -- D:\windows\System32\perfi007.dat
[2010/09/07 00:15:05 | 000,130,192 | ---- | C] () -- D:\windows\System32\perfc007.dat
[2010/09/07 00:15:05 | 000,038,104 | ---- | C] () -- D:\windows\System32\perfd007.dat
[2009/11/24 21:57:20 | 000,000,256 | ---- | C] () -- D:\windows\System32\DPSCEL.dll.hpsign
[2009/11/24 21:57:20 | 000,000,256 | ---- | C] () -- D:\windows\System32\DPFPApi.dll.hpsign
[2009/11/24 21:57:20 | 000,000,256 | ---- | C] () -- D:\windows\System32\DPClback.dll.hpsign
[2009/11/24 16:55:38 | 000,000,256 | ---- | C] () -- D:\windows\System32\DPFPApiUI.dll.hpsign
[2009/11/24 16:55:20 | 000,000,256 | ---- | C] () -- D:\windows\System32\DPPassFilter.dll.hpsign
[2009/11/24 16:55:20 | 000,000,256 | ---- | C] () -- D:\windows\System32\DPCrProv.dll.hpsign
[2009/10/22 12:56:00 | 000,000,256 | ---- | C] () -- D:\windows\System32\vcsAPIShared.dll.hpsign
[2009/07/14 00:57:37 | 000,067,584 | --S- | C] () -- D:\windows\bootstat.dat
[2009/07/14 00:33:53 | 000,270,424 | ---- | C] () -- D:\windows\System32\FNTCACHE.DAT
[2009/07/13 22:05:48 | 000,616,452 | ---- | C] () -- D:\windows\System32\perfh009.dat
[2009/07/13 22:05:48 | 000,291,294 | ---- | C] () -- D:\windows\System32\perfi009.dat
[2009/07/13 22:05:48 | 000,106,574 | ---- | C] () -- D:\windows\System32\perfc009.dat
[2009/07/13 22:05:48 | 000,031,548 | ---- | C] () -- D:\windows\System32\perfd009.dat
[2009/07/13 22:05:05 | 000,000,741 | ---- | C] () -- D:\windows\System32\NOISE.DAT
[2009/07/13 22:04:11 | 000,215,943 | ---- | C] () -- D:\windows\System32\dssec.dat
[2009/07/13 19:55:01 | 000,043,131 | ---- | C] () -- D:\windows\mib.bin
[2009/07/13 19:51:43 | 000,073,728 | ---- | C] () -- D:\windows\System32\BthpanContextHandler.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- D:\windows\System32\BWContextHandler.dll
[2009/07/13 18:09:19 | 000,982,196 | ---- | C] () -- D:\windows\System32\igkrng500.bin
[2009/07/13 18:09:19 | 000,417,344 | ---- | C] () -- D:\windows\System32\igcompkrng500.bin
[2009/07/13 18:09:19 | 000,139,824 | ---- | C] () -- D:\windows\System32\igfcg500.bin
[2009/07/13 18:09:19 | 000,097,448 | ---- | C] () -- D:\windows\System32\igfcg500m.bin
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- D:\windows\System32\mlang.dat
========== LOP Check ==========
[2013/03/28 11:46:05 | 000,000,000 | ---D | M] -- D:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Application Data
[2010/12/02 20:53:46 | 000,000,000 | ---D | M] -- D:\ProgramData\AT&T
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Desktop
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Documents
[2012/10/14 09:59:36 | 000,000,000 | ---D | M] -- D:\ProgramData\DriverBoost
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favorites
[2010/12/02 20:49:06 | 000,000,000 | ---D | M] -- D:\ProgramData\QUALCOMM
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Start Menu
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Templates
[2011/03/19 05:00:41 | 000,000,000 | ---D | M] -- D:\ProgramData\VirtualizedApplications
[2010/09/07 00:16:55 | 000,000,000 | ---D | M] -- D:\ProgramData\{DA06AA03-DF24-4ECE-939E-1B0939235C66}
[2013/05/02 13:35:33 | 000,032,632 | ---- | M] () -- D:\windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
< End of report >
|
|
03.05.2013, 11:45
| #6 |
| /// Helfer-Team | Weißer Bildschirm nach Windows7 Systemstart Fixen mit OTLpe
Code:
ATTFilter :OTL
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O20 - HKU\ARAMIS_ON_D Winlogon: Shell - (C:\Users\ARAMIS\AppData\Roaming\skype.dat) - D:\Users\ARAMIS\AppData\Roaming\skype.dat ()
[2012/03/29 10:00:36 | 000,122,880 | ---- | C] () -- D:\Users\ARAMIS\AppData\Roaming\skype.dat
:Files
ipconfig /flushdns /c
:Commands
[emptytemp]
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!
__________________ --> Weißer Bildschirm nach Windows7 Systemstart |
|
03.05.2013, 13:24
| #7 |
| | Weißer Bildschirm nach Windows7 Systemstart Hallo, der PC ist wieder normal zu booten. Danke! Hier das Logfile: Code:
ATTFilter ========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLUA deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\PromptOnSecureDesktop deleted successfully.
Registry value HKEY_USERS\ARAMIS_ON_D\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Users\ARAMIS\AppData\Roaming\skype.dat deleted successfully.
D:\Users\ARAMIS\AppData\Roaming\skype.dat moved successfully.
File D:\Users\ARAMIS\AppData\Roaming\skype.dat not found.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
D:\cmd.bat deleted successfully.
D:\cmd.txt deleted successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: ARAMIS
->Temp folder emptied: 61358127 bytes
->Temporary Internet Files folder emptied: 48427936 bytes
->Java cache emptied: 1637768 bytes
->FireFox cache emptied: 65710909 bytes
->Flash cache emptied: 67229 bytes
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56466 bytes
User: Default User
User: Public
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 247323587 bytes
Total Files Cleaned = 405.00 mb
OTLPE by OldTimer - Version 3.1.48.0 log created on 05032013_205809
|
|
03.05.2013, 14:13
| #8 |
| /// Helfer-Team | Weißer Bildschirm nach Windows7 Systemstart Sehr gut. Downloade Dir bitte  Malwarebytes Anti-Malware
dann: Downloade Dir bitte  AdwCleaner auf deinen Desktop.
|
|
03.05.2013, 18:03
| #9 |
| | Weißer Bildschirm nach Windows7 Systemstart Hallo, hier die Logfiles: Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.05.03.05 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 10.0.9200.16521 ARAMIS :: ARAMIS-HP [Administrator] Schutz: Aktiviert 03.05.2013 22:57:48 mbam-log-2013-05-03 (22-57-48).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|F:\|Q:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 372442 Laufzeit: 1 Stunde(n), 14 Minute(n), 5 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 3 C:\_OTL\MovedFiles\05032013_205809\D_Users\ARAMIS\AppData\Roaming\skype.dat (Trojan.Agent.zr0) -> Erfolgreich gelöscht und in Quarantäne gestellt. E:\FH\4.Semester\BWLsoftware\cd-dvd-daemon400.zip (Adware.WhenU) -> Erfolgreich gelöscht und in Quarantäne gestellt. E:\FH\4.Semester\BWLsoftware\SAP\cd-dvd-daemon400.exe (Adware.WhenU) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter # AdwCleaner v2.300 - Datei am 04/05/2013 um 01:47:54 erstellt
# Aktualisiert am 28/04/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (32 bits)
# Benutzer : ARAMIS - ARAMIS-HP
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\ARAMIS\Desktop\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Datei Gelöscht : C:\Program Files\Mozilla Firefox\searchplugins\ask.xml
Ordner Gelöscht : C:\Program Files\asktoolbar4
Ordner Gelöscht : C:\Users\ARAMIS\AppData\LocalLow\asktoolbar4
Ordner Gelöscht : C:\Users\ARAMIS\AppData\LocalLow\searchresultstb
Ordner Gelöscht : C:\Users\ARAMIS\AppData\Roaming\Mozilla\Firefox\Profiles\t00eelsm.default\asktoolbar4
***** [Registrierungsdatenbank] *****
Schlüssel Gelöscht : HKCU\Software\APN DTX
Schlüssel Gelöscht : HKCU\Software\Headlight
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B9C7CE32-DA91-43C2-B7E9-0E9AAFC675CD}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3CB073F3-BE3C-4E8F-942D-8A747B54486F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CB073F3-BE3C-4E8F-942D-8A747B54486F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3CB073F3-BE3C-4E8F-942D-8A747B54486F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3CB073F3-BE3C-4E8F-942D-8A747B54486F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CB073F3-BE3C-4E8F-942D-8A747B54486F}
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{3CB073F3-BE3C-4E8F-942D-8A747B54486F}]
***** [Internet Browser] *****
-\\ Internet Explorer v10.0.9200.16521
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://www.ask.com/web?l=dis&o=APN10234&gct=hp&apn_dtid=^YYYYYY^YY^US&apn_ptnrs=^A8B&apn_uid=4041158050114242&p2=^A8B^YYYYYY^YY^US --> hxxp://www.google.com
-\\ Mozilla Firefox v12.0 (de)
Datei : C:\Users\ARAMIS\AppData\Roaming\Mozilla\Firefox\Profiles\t00eelsm.default\prefs.js
[OK] Die Datei ist sauber.
*************************
AdwCleaner[S1].txt - [2610 octets] - [04/05/2013 01:47:54]
########## EOF - C:\AdwCleaner[S1].txt - [2670 octets] ##########
Vielen Dank! |
|
03.05.2013, 20:04
| #10 |
| /// Helfer-Team | Weißer Bildschirm nach Windows7 Systemstart Sehr gut!  Downloade dir bitte  aswMBR.exe und speichere die Datei auf deinem Desktop.
Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none). danach: ESET Online Scanner
danach: Downloade Dir bitte  SecurityCheck und:
|
|
04.05.2013, 12:27
| #11 |
| | Weißer Bildschirm nach Windows7 Systemstart Hallo, habe alles nach deinen Anweisungen gemacht! Code:
ATTFilter aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-05-04 11:01:33
-----------------------------
11:01:33.607 OS Version: Windows 6.1.7601 Service Pack 1
11:01:33.607 Number of processors: 4 586 0x2505
11:01:33.607 ComputerName: ARAMIS-HP UserName: ARAMIS
11:01:34.777 Initialize success
11:01:46.914 AVAST engine defs: 13050400
11:01:55.806 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
11:01:55.806 Disk 0 Vendor: WDC_WD3200BEKT-60V5T1 12.01A12 Size: 305245MB BusType: 3
11:01:55.915 Disk 0 MBR read successfully
11:01:55.915 Disk 0 MBR scan
11:01:55.931 Disk 0 Windows 7 default MBR code
11:01:55.946 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 300 MB offset 2048
11:01:55.946 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 287533 MB offset 616448
11:01:55.993 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 15360 MB offset 589484032
11:01:56.009 Disk 0 Partition 4 00 0C FAT32 LBA MSDOS5.0 2043 MB offset 620941312
11:01:56.024 Disk 0 scanning sectors +625125376
11:01:56.071 Disk 0 scanning C:\windows\system32\drivers
11:02:10.368 Service scanning
11:02:32.494 Service SafeBoot C:\windows\System32\Drivers\SafeBoot.sys **LOCKED** 32
11:02:41.605 Modules scanning
11:02:55.333 Disk 0 trace - called modules:
11:02:55.348 ntkrnlpa.exe CLASSPNP.SYS disk.sys hpdskflt.sys halmacpi.dll ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys
11:02:55.364 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x872e3030]
11:02:55.364 3 CLASSPNP.SYS[8c24559e] -> nt!IofCallDriver -> [0x872e14e0]
11:02:55.380 5 hpdskflt.sys[8cfb1090] -> nt!IofCallDriver -> [0x8717f3e0]
11:02:55.380 7 ACPI.sys[8c0a13d4] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x86410610]
11:02:56.596 AVAST engine scan C:\windows
11:02:59.545 AVAST engine scan C:\windows\system32
11:06:33.731 AVAST engine scan C:\windows\system32\drivers
11:06:48.332 AVAST engine scan C:\Users\ARAMIS
11:09:34.555 AVAST engine scan C:\ProgramData
11:09:57.191 Scan finished successfully
11:18:59.819 Disk 0 MBR has been saved successfully to "C:\Users\ARAMIS\Desktop\MBR.dat"
11:18:59.835 The log file has been saved successfully to "C:\Users\ARAMIS\Desktop\aswMBR.txt"
Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=ee3b90c6cbe4cb4aa22dd121264c330e
# engine=13753
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-05-04 11:12:23
# local_time=2013-05-04 01:12:23 (+0100, Mitteleuropäische Sommerzeit)
# country="Austria"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 100 0 233085633 31905 0
# compatibility_mode=5893 16776574 100 94 34477572 119297134 0 0
# scanned=175160
# found=1
# cleaned=1
# scan_time=5495
sh=BC5DCA8444E574162B7EBCC56A4C381BA126D382 ft=0 fh=0000000000000000 vn="multiple threats (deleted - quarantined)" ac=C fn="E:\ARAMIS-HP\Backup Set 2013-01-13 190000\Backup Files 2013-01-13 190000\Backup files 1.zip"
Code:
ATTFilter Results of screen317's Security Check version 0.99.62 Windows 7 Service Pack 1 x86 Internet Explorer 9 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 Java 7 Update 9 Java version out of Date! Adobe Flash Player 10 Flash Player out of Date! Adobe Flash Player 11.6.602.180 Adobe Reader 10.1.0 Adobe Reader out of Date! Mozilla Firefox 12.0 Firefox out of Date! Mozilla Thunderbird (3.1.11) Thunderbird out of Date! ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Avira Antivir avgnt.exe Avira Antivir avguard.exe Malwarebytes' Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` |
|
04.05.2013, 13:31
| #12 |
| /// Helfer-Team | Weißer Bildschirm nach Windows7 Systemstart OK: Scan mit Combofix
|
|
04.05.2013, 14:32
| #13 |
| | Weißer Bildschirm nach Windows7 Systemstart Hallo, Combofix ist ohne Unterbrechung durchgelaufen. Nur einige Windows-Meldungen kamen, dass Programme nicht mehr funktionieren. Nach dem Ende von Combofix war aber wieder alles ok. Combofix Logfile: Code:
ATTFilter ComboFix 13-05-04.01 - ARAMIS 04.05.2013 15:12:36.1.4 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1252.43.1031.18.3055.1388 [GMT 2:00]
ausgeführt von:: c:\users\ARAMIS\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Thumbs.db
c:\users\ARAMIS\AppData\Roaming\skype.ini
c:\windows\system32\pt
c:\windows\system32\pt\DPCrProv.dll.mui
c:\windows\system32\pt\DPFPApiUI.dll.mui
c:\windows\system32\pt\DPPassFilter.dll.mui
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-04-04 bis 2013-05-04 ))))))))))))))))))))))))))))))
.
.
2013-05-04 13:16 . 2013-05-04 13:16 -------- d-----w- c:\users\ARAMIS\AppData\Local\temp
2013-05-04 13:16 . 2013-05-04 13:16 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-05-04 00:58 . 2013-05-04 00:58 -------- d-----w- C:\_OTL
2013-05-03 20:54 . 2013-05-03 20:54 -------- d-----w- c:\users\ARAMIS\AppData\Roaming\Malwarebytes
2013-05-03 20:53 . 2013-05-03 20:53 -------- d-----w- c:\programdata\Malwarebytes
2013-05-03 20:53 . 2013-05-03 20:53 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-05-03 20:53 . 2013-04-04 12:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-05-03 20:52 . 2013-05-03 20:52 -------- d-----w- c:\users\ARAMIS\AppData\Local\Programs
2013-05-02 17:40 . 2013-05-02 17:40 9728 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-04-25 16:17 . 2013-04-12 13:45 1211752 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-12 07:46 . 2013-03-01 03:09 2347008 ----a-w- c:\windows\system32\win32k.sys
2013-04-12 07:46 . 2013-01-24 04:47 196328 ----a-w- c:\windows\system32\drivers\fvevol.sys
2013-04-12 07:46 . 2013-03-19 05:04 3968856 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-04-12 07:46 . 2013-03-19 05:04 3913560 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-04-12 07:46 . 2013-03-19 02:49 69632 ----a-w- c:\windows\system32\smss.exe
2013-04-12 07:46 . 2013-03-19 04:48 38912 ----a-w- c:\windows\system32\csrsrv.dll
2013-04-12 07:46 . 2013-02-15 04:37 3217408 ----a-w- c:\windows\system32\mstscax.dll
2013-04-12 07:46 . 2013-02-15 04:34 131584 ----a-w- c:\windows\system32\aaclient.dll
2013-04-12 07:46 . 2013-02-15 03:25 36864 ----a-w- c:\windows\system32\tsgqec.dll
2013-04-07 17:16 . 2013-04-07 17:16 -------- d-----w- C:\Filme
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-03-22 13:34 . 2012-09-23 11:21 693976 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-03-22 13:34 . 2011-07-31 09:37 73432 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-02-12 04:48 . 2013-03-13 17:34 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-02-12 04:48 . 2013-03-13 17:34 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-02-12 03:32 . 2013-03-21 16:35 15872 ----a-w- c:\windows\system32\drivers\usb8023.sys
2012-06-03 21:25 . 2011-04-30 07:27 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2009-11-11 287800]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2010-04-05 186904]
"NUSB3MON"="c:\program files\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2009-11-21 106496]
"HPPowerAssistant"="c:\program files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe" [2009-11-19 1690680]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-02-26 1713448]
"HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe" [2009-11-19 363064]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]
"nwiz"="nwiz.exe" [2010-02-25 1657448]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-02-27 13830760]
"IMSS"="c:\program files\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe" [2009-11-04 111640]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2010-01-29 495708]
"HP Connection Manager.exe"="c:\program files\Hewlett-Packard\HP Connection Manager\HP Connection Manager.exe" [2010-06-08 1120072]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"HTC Sync Loader"="c:\program files\HTC\HTC Sync 3.0\htcUPCTLoader.exe" [2011-05-12 593920]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-08-09 348664]
"Guard.Mail.ru.gui"="c:\program files\Guard-ICQ\GuardICQ.exe" [2012-08-20 1564368]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-02-20 152392]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-9-4 795936]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.318\SSScheduler.exe [2013-2-5 272248]
WinManager.lnk - c:\program files\KingDTV\WinManager\WinManager.exe [2012-10-14 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 3 (0x3)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ DPPassFilter scecli
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Connection Manager.exe]
2010-06-08 14:51 1120072 ----a-w- c:\program files\Hewlett-Packard\HP Connection Manager\HP Connection Manager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
2012-08-20 09:20 127040 ----a-w- c:\program files\ICQ7M\ICQ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2012-07-13 11:33 17418928 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
R2 rgsender;Remote Graphics Sender Service;c:\program files\Hewlett-Packard\HP SkyRoom\remote graphics sender\rgsendersvc.exe [x]
R2 rimspci;rimspci;c:\windows\system32\DRIVERS\rimspe86.sys [x]
R2 risdpcie;risdpcie;c:\windows\system32\DRIVERS\risdpe86.sys [x]
R2 rixdpcie;rixdpcie;c:\windows\system32\DRIVERS\rixdpe86.sys [x]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe [x]
R3 HTCAND32;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [x]
R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.0.318\McCHSvc.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 UDTTAFAT;DVB-T USB Stick;c:\windows\system32\DRIVERS\UDTTAFAT.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 SafeBoot;SafeBoot; [x]
S0 SbAlg;SbAlg; [x]
S0 SbFsLock;SbFsLock; [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]
S1 RsvLock;RsvLock; [x]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9b219d80a8843bf8\aestsrv.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 Guard.Mail.ru;Guard.Mail.ru;c:\program files\Guard-ICQ\GuardICQ.exe [x]
S2 HP Power Assistant Service;HP Power Assistant Service;c:\program files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe [x]
S2 HP ProtectTools Service;HP ProtectTools Service;c:\program files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [x]
S2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [x]
S2 Hp.Skyroom.Windows.Service;HP SkyRoom;c:\program files\Hewlett-Packard\HP SkyRoom\Hp.Skyroom.Windows.Service.exe [x]
S2 HPDayStarterService;HP DayStarter Service;c:\program files\Hewlett-Packard\HP QuickLook\HPDayStarterService.exe [x]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files\Hewlett-Packard\Shared\HPDrvMntSvc.exe [x]
S2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [x]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 PassThru Service;Internet Pass-Through Service;c:\program files\HTC\Internet Pass-Through\PassThruSvr.exe [x]
S2 QDLService2kHP;Qualcomm Gobi 2000 Download Service (HP);c:\program files\QUALCOMM\QDLService2k\QDLService2kHP.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 SMManager;HP Connection Manager Service;c:\program files\Hewlett-Packard\HP Connection Manager\SMManager.exe [x]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [x]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k6232.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 NETw5s32;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 32-Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [x]
S3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]
S3 qcfilterhp2k;Gobi 2000 USB Composite Device Filter Driver(03F0-251D);c:\windows\system32\DRIVERS\qcfilterhp2k.sys [x]
S3 qcusbnethp2k;Gobi 2000 USB-NDIS miniport(03F0-251D);c:\windows\system32\DRIVERS\qcusbnethp2k.sys [x]
S3 qcusbserhp2k;Gobi 2000 USB Device for Legacy Serial Communication(03F0-251D);c:\windows\system32\DRIVERS\qcusbserhp2k.sys [x]
S3 rismc32;RICOH Smart Card Reader;c:\windows\system32\DRIVERS\rismc32.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - aswMBR
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS fdrespub AppIDSvc QWAVE wcncsvc Mcx2Svc SensrSvc
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-05-03 c:\windows\Tasks\HPCeeScheduleForARAMIS.job
- c:\program files\Hewlett-Packard\HP Ceement\HPCEE.exe [2009-10-07 11:22]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com
uInternet Settings,ProxyServer = proxy.bau.oebb.at:80
uInternet Settings,ProxyOverride = *.local
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {{781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - c:\program files\ICQ7M\ICQ.exe
TCP: Interfaces\{63612FBB-26A2-4DDA-8A9E-D33EF336FCB3}: NameServer = 194.48.139.254 194.48.124.200
FF - ProfilePath - c:\users\ARAMIS\AppData\Roaming\Mozilla\Firefox\Profiles\t00eelsm.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.at/|hxxp://www.google.at/firefox?client=firefox-a&rls=org.mozilla:de:official
FF - prefs.js: network.proxy.type - 4
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-asktoolbar4 - c:\program files\asktoolbar4\uninstall.exe
AddRemove-LSI Soft Modem - c:\windows\agrsmdel
AddRemove-{B60DCA15-56A3-4D2D-8747-22CF7D7B588B} - c:\program files\InstallShield Installation Information\{B60DCA15-56A3-4D2D-8747-22CF7D7B588B}\setup.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'lsass.exe'(660)
c:\windows\system32\DPFPApi.DLL
.
Zeit der Fertigstellung: 2013-05-04 15:17:59
ComboFix-quarantined-files.txt 2013-05-04 13:17
.
Vor Suchlauf: 12 Verzeichnis(se), 196.963.123.200 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 196.915.597.312 Bytes frei
.
- - End Of File - - A2B6F645541926CA800B706B9DEAF4DE
|
|
04.05.2013, 19:36
| #14 |
| /// Helfer-Team | Weißer Bildschirm nach Windows7 Systemstart Aktualisiere:
Java aktualisieren Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html Danach poste (kopieren und einfuegen) mir, was du hier angezeigt bekommst: PluginCheck Java deaktivieren Aufgrund derezeitigen Sicherheitsluecke: http://www.trojaner-board.de/122961-...ktivieren.html Danach poste mir (kopieren und einfuegen), was du hier angezeigt bekommst: PluginCheck |
|
06.05.2013, 18:12
| #15 |
| | Weißer Bildschirm nach Windows7 Systemstart So hier der Plugin-Check: PluginCheck Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen. Überprüft wird: Browser, Flash, Java und Adobe Reader Version. Firefox 12.0 ist veraltet! Flash (11,6,602,180) ist aktuell. Java (1,7,0,21) ist aktuell. Adobe Reader 10,1,0,534 ist veraltet! Aktualisieren Sie bitte auf die neueste Version: 11.0 Und hier nachdem das Plugin deaktiviert wurde: PluginCheck Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen. Überprüft wird: Browser, Flash, Java und Adobe Reader Version. Firefox 12.0 ist veraltet! Flash (11,6,602,180) ist aktuell. Java ist Installiert aber nicht aktiviert. Adobe Reader 10,1,0,534 ist veraltet! Aktualisieren Sie bitte auf die neueste Version: 11.0 Beste Grüße! |
|
| Themen zu Weißer Bildschirm nach Windows7 Systemstart |
| abgesicherte, abgesicherten, abgesicherten modus, adware.whenu, andere, anderen, bildschirm, früheren, laptop, modus, problem, punkt, sofort, systems, systemstart, trojan.agent.zr0, weiße, weißer, weißer bildschirm, wiederherstellen, windows, windows7, öfters |
.
WARNUNG an die MITLESER: 
Linear-Darstellung
