| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Mein Laptop zeigt die Meldung an: Ihr Computer ist gesperrt, nun immer ein weißer BildschirmWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
23.05.2013, 10:24
| #1 |
| |  Mein Laptop zeigt die Meldung an: Ihr Computer ist gesperrt, nun immer ein weißer Bildschirm Hallo zusammen, leider habe ich mir anscheinend ein Virus eingefangen. Der Laptop zeigte immer nach dem Start einen weißen Bildschirm. Ich konnte nun eine Sysmtewiederherstellung machen, sodass ich wieder einen Zugang habe und ich mit dem PC arbeiten kann. Damit ist das Problem aber nicht gelöst oder?# Wie müsste ich nun weiter vorgehen. Viele lieben Dank für mögliche Antworten im Voraus, Caro Habe jetzt schon ein bissl in anderen Themen geschaut und otl heruntergeladen. Der Scan ergibt folgenden Auswurf: OTL Logfile: Code:
ATTFilter OTL logfile created on: 23.05.2013 11:15:36 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Caro\Downloads Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.10.9200.16576) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,97 Gb Total Physical Memory | 1,70 Gb Available Physical Memory | 57,49% Memory free 5,93 Gb Paging File | 4,49 Gb Available in Paging File | 75,72% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 226,76 Gb Total Space | 157,50 Gb Free Space | 69,46% Space Free | Partition Type: NTFS Drive D: | 226,00 Gb Total Space | 43,06 Gb Free Space | 19,05% Space Free | Partition Type: NTFS Drive E: | 37,43 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Drive F: | 14,89 Gb Total Space | 10,77 Gb Free Space | 72,33% Space Free | Partition Type: FAT32 Computer Name: CARO-PC | User Name: Caro | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Caro\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe (Adobe Systems, Inc.) PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation) PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation) PRC - C:\Programme\pdf24\pdf24.exe (Geek Software GmbH) PRC - C:\Programme\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH) PRC - C:\Windows\System32\atieclxx.exe (AMD) PRC - C:\Windows\System32\atiesrxx.exe (AMD) PRC - C:\Windows\System32\StikyNot.exe (Microsoft Corporation) PRC - C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation) ========== Modules (No Company Name) ========== MOD - C:\Windows\System32\Macromed\Flash\NPSWF32_11_7_700_202.dll () MOD - C:\Programme\Mozilla Firefox\mozjs.dll () ========== Services (SafeList) ========== SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (odserv) -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE (Microsoft Corporation) SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) SRV - (AMD External Events Utility) -- C:\Windows\System32\atiesrxx.exe (AMD) SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (Microsoft Office Groove Audit Service) -- C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation) SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (pccsmcfd) -- system32\DRIVERS\pccsmcfd.sys File not found DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH) DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH) DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation) DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.) DRV - (vwifimp) -- C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation) DRV - (yukonw7) -- C:\Windows\System32\drivers\yk62x86.sys (Marvell) DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (FsUsbExDisk) -- C:\Windows\System32\FsUsbExDisk.Sys () ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2162288561-3997283006-3457503459-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn IE - HKU\S-1-5-21-2162288561-3997283006-3457503459-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.aol.de/ IE - HKU\S-1-5-21-2162288561-3997283006-3457503459-1000\..\URLSearchHook: - No CLSID value found IE - HKU\S-1-5-21-2162288561-3997283006-3457503459-1000\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ) IE - HKU\S-1-5-21-2162288561-3997283006-3457503459-1000\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64} IE - HKU\S-1-5-21-2162288561-3997283006-3457503459-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-2162288561-3997283006-3457503459-1000\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd IE - HKU\S-1-5-21-2162288561-3997283006-3457503459-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.suggest.enabled: false FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "www.aol.de" FF - prefs.js..extensions.enabledAddons: software%40loadtubes.com:1.01 FF - prefs.js..extensions.enabledAddons: %7B4D144BC3-23FB-47de-90C5-63CCB0139CCF%7D:1.0 FF - prefs.js..extensions.enabledAddons: %7BEEE6C361-6118-11DC-9C72-001320C79847%7D:1.9.0.0 FF - prefs.js..extensions.enabledAddons: %7B872b5b88-9db5-4310-bdd0-ac189557e5f5%7D:3.18.0.7 FF - prefs.js..extensions.enabledAddons: toolbar%40web.de:2.6 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1 FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.0.14 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.0 FF - prefs.js..extensions.enabledItems: {4D144BC3-23FB-47de-90C5-63CCB0139CCF}:1.0 FF - prefs.js..extensions.enabledItems: {8AA36F4F-6DC7-4c06-77AF-5035170634FE}:2010.01.21 FF - prefs.js..network.proxy.type: 0 FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "" FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll () FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.04.12 10:53:36 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.04.12 10:53:36 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.07.15 21:56:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Caro\AppData\Roaming\mozilla\Extensions [2013.05.14 20:29:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Caro\AppData\Roaming\mozilla\Firefox\Profiles\nkbemj0b.default\extensions [2010.12.21 15:35:12 | 000,000,000 | ---D | M] (TradeManager-Plugin) -- C:\Users\Caro\AppData\Roaming\mozilla\Firefox\Profiles\nkbemj0b.default\extensions\{4D144BC3-23FB-47de-90C5-63CCB0139CCF} [2013.02.09 20:21:18 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\Caro\AppData\Roaming\mozilla\Firefox\Profiles\nkbemj0b.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [2011.05.12 14:11:14 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Caro\AppData\Roaming\mozilla\Firefox\Profiles\nkbemj0b.default\extensions\engine@conduit.com [2012.08.27 23:24:06 | 000,000,000 | ---D | M] (loadtbs) -- C:\Users\Caro\AppData\Roaming\mozilla\Firefox\Profiles\nkbemj0b.default\extensions\software@loadtubes.com [2013.05.14 20:29:13 | 000,620,130 | ---- | M] () (No name found) -- C:\Users\Caro\AppData\Roaming\mozilla\firefox\profiles\nkbemj0b.default\extensions\toolbar@web.de.xpi [2012.12.12 10:49:59 | 000,036,098 | ---- | M] () (No name found) -- C:\Users\Caro\AppData\Roaming\mozilla\firefox\profiles\nkbemj0b.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2013.01.07 22:23:56 | 000,190,000 | ---- | M] () (No name found) -- C:\Users\Caro\AppData\Roaming\mozilla\firefox\profiles\nkbemj0b.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi [2013.05.14 20:29:17 | 000,001,050 | ---- | M] () -- C:\Users\Caro\AppData\Roaming\mozilla\firefox\profiles\nkbemj0b.default\searchplugins\11-suche.xml [2013.05.14 20:29:17 | 000,002,418 | ---- | M] () -- C:\Users\Caro\AppData\Roaming\mozilla\firefox\profiles\nkbemj0b.default\searchplugins\englische-ergebnisse.xml [2013.05.14 20:29:17 | 000,010,701 | ---- | M] () -- C:\Users\Caro\AppData\Roaming\mozilla\firefox\profiles\nkbemj0b.default\searchplugins\gmx-suche.xml [2013.05.22 10:06:35 | 000,001,056 | ---- | M] () -- C:\Users\Caro\AppData\Roaming\mozilla\firefox\profiles\nkbemj0b.default\searchplugins\icqplugin.xml [2013.05.14 20:29:17 | 000,002,432 | ---- | M] () -- C:\Users\Caro\AppData\Roaming\mozilla\firefox\profiles\nkbemj0b.default\searchplugins\lastminute.xml [2012.11.12 13:56:35 | 000,003,915 | ---- | M] () -- C:\Users\Caro\AppData\Roaming\mozilla\firefox\profiles\nkbemj0b.default\searchplugins\sweetim.xml [2013.05.14 20:29:17 | 000,005,682 | ---- | M] () -- C:\Users\Caro\AppData\Roaming\mozilla\firefox\profiles\nkbemj0b.default\searchplugins\webde-suche.xml [2013.04.12 10:53:31 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2013.04.12 10:53:36 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012.09.06 04:07:37 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.09.06 04:07:37 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.09.06 04:07:37 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.09.06 04:07:37 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.09.06 04:07:37 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.09.06 04:07:37 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ) O3 - HKLM\..\Toolbar: (loadtbs) - {DFEFCDEE-CF1A-4FC8-88AD-129872198372} - C:\Users\Caro\AppData\Roaming\loadtbs\toolbar.dll (InfiniAd GmbH) O3 - HKU\S-1-5-21-2162288561-3997283006-3457503459-1000\..\Toolbar\WebBrowser: (loadtbs) - {DFEFCDEE-CF1A-4FC8-88AD-129872198372} - C:\Users\Caro\AppData\Roaming\loadtbs\toolbar.dll (InfiniAd GmbH) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.) O4 - HKLM..\Run: [CanonSolutionMenuEx] C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.) O4 - HKLM..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start File not found O4 - HKLM..\Run: [PDFPrint] C:\Programme\pdf24\pdf24.exe (Geek Software GmbH) O4 - HKU\S-1-5-21-2162288561-3997283006-3457503459-1000..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup File not found O4 - HKU\S-1-5-21-2162288561-3997283006-3457503459-1000..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Caro\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O13 - gopher Prefix: missing O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab (EPUImageControl Class) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.54.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{140F1B57-30B6-41F4-B84B-DE52D0244CF0}: DhcpNameServer = 192.168.54.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C99CD17B-F8E2-446B-831A-CAB0BC6A877D}: NameServer = 212.6.108.140 217.237.150.115 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CB5C9055-DBA6-4DF9-B82F-7D265FBFE627}: DhcpNameServer = 192.168.54.1 O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2010.07.14 16:07:08 | 000,000,047 | RH-- | M] () - E:\AUTORUN.INF -- [ CDFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.05.21 11:59:03 | 000,000,000 | ---D | C] -- C:\Users\Caro\Desktop\Material für die Prüfungseinheit SU [2013.05.20 12:50:38 | 000,000,000 | ---D | C] -- C:\Users\Caro\Desktop\Material PU SU [2013.05.16 19:58:41 | 000,000,000 | ---D | C] -- C:\Users\Caro\Desktop\Pädagogischer Ansatz - Stiftung Haus der kleinen Forscher-Dateien [2013.05.15 21:43:51 | 002,706,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2013.05.15 21:43:50 | 002,877,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll [2013.05.15 21:43:49 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll [2013.05.15 21:43:49 | 000,039,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2013.05.15 21:43:48 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2013.05.15 21:43:47 | 000,493,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2013.05.15 21:43:47 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll [2013.05.15 21:43:47 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe [2013.05.15 21:43:47 | 000,042,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe [2013.05.15 21:43:47 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll [2013.05.15 18:44:33 | 000,040,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wwanprotdim.dll [2013.05.15 18:44:32 | 002,347,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2013.05.15 18:37:22 | 000,218,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\dxgmms1.sys [2013.05.15 18:37:14 | 001,796,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\authui.dll [2013.05.15 18:37:14 | 000,101,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\consent.exe [2013.05.12 13:16:32 | 000,000,000 | ---D | C] -- C:\Users\Caro\Desktop\Unterrichtseinheit Magnetismus - Kann der Magnet auch durch Materialien ... - Esenguel Takmaz - Google Books-Dateien [2013.05.11 23:36:44 | 000,000,000 | ---D | C] -- C:\Users\Caro\Desktop\Magnetismus durchdringt die Magnetkraft alle Stoffe [2013.05.07 15:43:03 | 000,000,000 | ---D | C] -- C:\Users\Caro\Desktop\Material PU Deutsch [2013.04.26 21:45:52 | 000,000,000 | ---D | C] -- C:\Users\Caro\Desktop\Deutschunterricht in der Grundschule-Dateien [8 C:\Users\Caro\Desktop\*.tmp files -> C:\Users\Caro\Desktop\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013.05.23 11:14:07 | 000,010,608 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.05.23 11:14:07 | 000,010,608 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.05.23 11:06:32 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.05.23 11:06:25 | 2388,086,784 | -HS- | M] () -- C:\hiberfil.sys [2013.05.22 22:54:01 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013.05.22 22:07:22 | 000,654,400 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2013.05.22 22:07:22 | 000,616,242 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2013.05.22 22:07:22 | 000,130,240 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2013.05.22 22:07:22 | 000,106,622 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2013.05.21 07:54:14 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat(25).dat [2013.05.20 19:23:18 | 000,724,156 | ---- | M] () -- C:\Users\Caro\Desktop\Heran-Doerr_workshop_magnetismus.pdf [2013.05.17 17:08:58 | 320,770,042 | ---- | M] () -- C:\Windows\MEMORY.DMP [2013.05.16 20:03:23 | 003,315,947 | ---- | M] () -- C:\Users\Caro\Desktop\120322_Nachhaltigkeit.pdf [2013.05.16 19:58:44 | 000,045,011 | ---- | M] () -- C:\Users\Caro\Desktop\Pädagogischer Ansatz - Stiftung Haus der kleinen Forscher.htm [2013.05.16 08:54:51 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe [2013.05.16 08:54:51 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl [2013.05.15 22:16:20 | 000,412,720 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2013.05.12 13:16:34 | 000,126,888 | ---- | M] () -- C:\Users\Caro\Desktop\Unterrichtseinheit Magnetismus - Kann der Magnet auch durch Materialien ... - Esenguel Takmaz - Google Books.htm [2013.05.10 12:22:41 | 000,093,926 | ---- | M] () -- C:\Users\Caro\Documents\Lebenslauf Carolin Knorr-Hahnenfeld.pdf [2013.05.07 16:54:18 | 000,769,790 | ---- | M] () -- C:\Users\Caro\Desktop\__ Enwurf_Mitschau_12.März_2013_Knorr.pdf [2013.05.02 02:06:08 | 000,238,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe [2013.04.28 11:21:29 | 001,653,155 | ---- | M] () -- C:\Users\Caro\Desktop\Naturwissenschaftliche_Arbeitsweisen.pdf [2013.04.26 21:45:53 | 000,067,585 | ---- | M] () -- C:\Users\Caro\Desktop\Deutschunterricht in der Grundschule.htm [2013.04.26 20:53:56 | 000,157,365 | ---- | M] () -- C:\Users\Caro\Desktop\20130328_E_813_Merkblatt_neu_pdf.pdf [2013.04.25 22:24:31 | 002,611,295 | ---- | M] () -- C:\Users\Caro\Desktop\Methodenkiste.pdf [2013.04.25 21:45:43 | 000,107,937 | ---- | M] () -- C:\Users\Caro\Desktop\Sexualerziehung Prüfung.pdf [8 C:\Users\Caro\Desktop\*.tmp files -> C:\Users\Caro\Desktop\*.tmp -> ] ========== Files Created - No Company Name ========== [2013.05.20 19:23:18 | 000,724,156 | ---- | C] () -- C:\Users\Caro\Desktop\Heran-Doerr_workshop_magnetismus.pdf [2013.05.16 20:03:18 | 003,315,947 | ---- | C] () -- C:\Users\Caro\Desktop\120322_Nachhaltigkeit.pdf [2013.05.16 19:58:41 | 000,045,011 | ---- | C] () -- C:\Users\Caro\Desktop\Pädagogischer Ansatz - Stiftung Haus der kleinen Forscher.htm [2013.05.12 13:16:32 | 000,126,888 | ---- | C] () -- C:\Users\Caro\Desktop\Unterrichtseinheit Magnetismus - Kann der Magnet auch durch Materialien ... - Esenguel Takmaz - Google Books.htm [2013.05.10 12:22:40 | 000,093,926 | ---- | C] () -- C:\Users\Caro\Documents\Lebenslauf Carolin Knorr-Hahnenfeld.pdf [2013.05.07 16:54:18 | 000,769,790 | ---- | C] () -- C:\Users\Caro\Desktop\__ Enwurf_Mitschau_12.März_2013_Knorr.pdf [2013.04.28 11:21:29 | 001,653,155 | ---- | C] () -- C:\Users\Caro\Desktop\Naturwissenschaftliche_Arbeitsweisen.pdf [2013.04.26 21:45:51 | 000,067,585 | ---- | C] () -- C:\Users\Caro\Desktop\Deutschunterricht in der Grundschule.htm [2013.04.26 20:53:56 | 000,157,365 | ---- | C] () -- C:\Users\Caro\Desktop\20130328_E_813_Merkblatt_neu_pdf.pdf [2013.04.25 22:24:31 | 002,611,295 | ---- | C] () -- C:\Users\Caro\Desktop\Methodenkiste.pdf [2013.04.25 21:45:43 | 000,107,937 | ---- | C] () -- C:\Users\Caro\Desktop\Sexualerziehung Prüfung.pdf [2012.01.11 10:01:08 | 000,147,456 | ---- | C] () -- C:\Users\Caro\AppData\Roaming\skype.dat [2011.11.10 16:52:06 | 000,001,024 | ---- | C] () -- C:\Windows\System32\clauth2.dll [2011.11.10 16:52:06 | 000,001,024 | ---- | C] () -- C:\Windows\System32\clauth1.dll [2011.11.10 16:52:06 | 000,000,000 | ---- | C] () -- C:\Windows\System32\ssprs.dll [2011.11.10 16:52:06 | 000,000,000 | ---- | C] () -- C:\Windows\System32\serauth2.dll [2011.11.10 16:52:06 | 000,000,000 | ---- | C] () -- C:\Windows\System32\serauth1.dll [2011.11.10 16:52:06 | 000,000,000 | ---- | C] () -- C:\Windows\System32\nsprs.dll [2011.11.10 16:51:24 | 000,001,025 | ---- | C] () -- C:\Windows\System32\sysprs7.dll [2011.11.10 16:51:24 | 000,000,205 | ---- | C] () -- C:\Windows\System32\lsprst7.dll [2011.03.20 20:54:22 | 000,004,096 | -H-- | C] () -- C:\Users\Caro\AppData\Local\keyfile3.drm ========== ZeroAccess Check ========== [2009.07.14 06:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 03:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2011.03.02 08:57:49 | 000,000,000 | ---D | M] -- C:\Users\Caro\AppData\Roaming\Academic Software Zurich [2013.01.08 18:18:04 | 000,000,000 | ---D | M] -- C:\Users\Caro\AppData\Roaming\Canon [2012.08.27 23:18:41 | 000,000,000 | ---D | M] -- C:\Users\Caro\AppData\Roaming\convert [2012.10.14 12:55:22 | 000,000,000 | ---D | M] -- C:\Users\Caro\AppData\Roaming\Cornelsen [2010.07.29 14:52:27 | 000,000,000 | ---D | M] -- C:\Users\Caro\AppData\Roaming\DeepBurner [2012.08.28 10:34:27 | 000,000,000 | ---D | M] -- C:\Users\Caro\AppData\Roaming\Dropbox [2012.03.19 14:51:09 | 000,000,000 | ---D | M] -- C:\Users\Caro\AppData\Roaming\DVDVideoSoft [2012.03.19 14:50:46 | 000,000,000 | ---D | M] -- C:\Users\Caro\AppData\Roaming\DVDVideoSoftIEHelpers [2013.05.22 19:52:36 | 000,000,000 | ---D | M] -- C:\Users\Caro\AppData\Roaming\ICQ [2012.08.27 23:18:41 | 000,000,000 | ---D | M] -- C:\Users\Caro\AppData\Roaming\loadtbs [2010.07.29 15:00:09 | 000,000,000 | ---D | M] -- C:\Users\Caro\AppData\Roaming\MAGIX [2012.11.19 21:46:04 | 000,000,000 | ---D | M] -- C:\Users\Caro\AppData\Roaming\Ofhoa [2011.04.07 15:59:48 | 000,000,000 | ---D | M] -- C:\Users\Caro\AppData\Roaming\PC Suite [2012.10.08 10:31:46 | 000,000,000 | ---D | M] -- C:\Users\Caro\AppData\Roaming\Samsung ========== Purity Check ========== < End of report > |
| Themen zu Mein Laptop zeigt die Meldung an: Ihr Computer ist gesperrt, nun immer ein weißer Bildschirm |
| antworten, arbeiten, bildschirm, canon, compu, computer, ellung, gelöst, gesperrt, hallo zusammen, konnte, laptop, liebe, lieben, meldung, mögliche, plug-in, problem, schei, start, taskhost.exe, virus, weiße, weißer, weißer bildschirm, worte, zugang, zusammen |
Baum-Darstellung