| |
| |||||||
Log-Analyse und Auswertung: Notebook_Win 7 SP1 64Bit HP_IE 11 baut Seite nicht auf, obwohl WiFi OK --> BlueScreenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
25.12.2013, 20:34
| #1 |
 |  Notebook_Win 7 SP1 64Bit HP_IE 11 baut Seite nicht auf, obwohl WiFi OK --> BlueScreen Hallo, kann sich bitte einer mein Notebook anschauen? Problem: IE 11 baut die Seite nicht mehr auf. Ebenso Google-Chrom. Dies wurde aber mittlerweile auch schon wieder deinstalliert. Hatte zwischensitig auch schon nen blue-Screen mit Text. Habe ihn fotografiert und kann ihn wenn es gewunscht ist auch posten. Habe versucht den IExplorer 11 zurückzusetzten. Ohne erfolg. Danach kam dann auch der BlueScreen. Die Verbindung zum Internet ist auf dem Rechner über WiFi sehr gut und zeigt auch keine Probleme an. Hier die Log-Files Defogger: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 19:57 on 25/12/2013 (Meli)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-12-2013
Ran by Meli (administrator) on NOTEBOOK_MELI on 25-12-2013 19:59:07
Running from C:\Users\Meli\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.2.241.0\BBSvc.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(cyberlink) C:\Program Files (x86)\CyberLink\Shared files\brs.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.2.241.0\SeaPort.EXE
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPConnectionManager.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2799912 2013-06-02] (Synaptics Incorporated)
HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1266912 2013-10-23] (Microsoft Corporation)
HKLM\...\Run: [IntelPAN] - C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-07-27] (Intel(R) Corporation)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1425408 2013-06-02] (IDT, Inc.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [499608 2011-06-16] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-05-20] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-05-08] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2013-06-02] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [87336 2010-02-03] (CyberLink Corp.)
HKLM-x32\...\Run: [BDRegion] - C:\Program Files (x86)\CyberLink\Shared files\brs.exe [75048 2011-01-25] (cyberlink)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe [40312 2013-09-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2011-03-16] (EasyBits Software AS)
HKLM-x32\...\Run: [HPConnectionManager] - C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [103992 2011-06-14] (Hewlett-Packard Development Company L.P.)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [HPOSD] - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [Magic Desktop for HP notification] - C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [1243656 2013-12-09] (Easybits)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2013-12-12] (Hewlett-Packard)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKCU\...\Policies\system: [DisableLockWorkstation] 0
HKCU\...\Policies\system: [DisableChangePassword] 0
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.ch/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.google.de/
https://my.screenname.aol.com/_cqr/login/login.psp?seamless=novl&locale=de&offerId=webmail-de-de&siteState=ver%3A4%7Crt%3ASTANDARD%7Cat%3ASNS%7Cld%3Amail.aol.de%7Cuv%3AAOL%7Clc%3Ade-de%7Cmt%3AANGELIA%7Csnt%3AScreenName%7Csid%3A4da79db2-547c-49ec-9e42-70283234daab&authLev=0&sitedomain=sns.webmail.aol.com&lang=de
SearchScopes: HKLM - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM - {80AFFC3E-020C-44D5-9287-1C73DFCBDAA6} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://ch.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/5222-111091-7834-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM-x32 - {80AFFC3E-020C-44D5-9287-1C73DFCBDAA6} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://ch.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/5222-111091-7834-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKCU - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKCU - {80AFFC3E-020C-44D5-9287-1C73DFCBDAA6} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKCU - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://ch.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKCU - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/5222-111091-7834-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
BHO: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll (HP)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll (HP)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.2.241.0\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.2.241.0\BingExt.dll (Microsoft Corporation.)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2011-09-02] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: () - C:\Users\Meli\AppData\Local\Google\Chrome\User Data\Default\Extensions\aepeildmfnnehghlknddebgjghlompfe\1.0_0
CHR Extension: () - C:\Users\Meli\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0
CHR HKLM-x32\...\Chrome\Extension: [aepeildmfnnehghlknddebgjghlompfe] - C:\Program Files (x86)\HP SimplePass 2011\tschrome.crx
==================== Services (Whitelisted) =================
R2 AdobeActiveFileMonitor11.0; C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe [171600 2012-09-17] (Adobe Systems Incorporated)
S2 CLKMSVC10_38F51D56; C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [241648 2011-01-25] (CyberLink)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [398184 2012-12-14] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [682344 2012-12-14] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-10-23] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-07-27] ()
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [348376 2013-10-23] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [24176 2012-12-14] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [248240 2013-09-27] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [134944 2013-09-27] (Microsoft Corporation)
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-08-10] (Corel Corporation)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-12-25 19:59 - 2013-12-25 19:59 - 00015639 _____ C:\Users\Meli\Desktop\FRST.txt
2013-12-25 19:58 - 2013-12-25 19:58 - 00000000 ____D C:\Users\Meli\Desktop\FRST-OlderVersion
2013-12-25 19:57 - 2013-12-25 19:57 - 00000470 _____ C:\Users\Meli\Desktop\defogger_disable.log
2013-12-25 19:55 - 2013-12-06 21:07 - 00377856 _____ C:\Users\Meli\Desktop\gmer_2.1.19163.exe
2013-12-25 19:54 - 2013-12-06 21:00 - 00050477 _____ C:\Users\Meli\Desktop\Defogger.exe
2013-12-25 19:50 - 2013-12-25 19:50 - 00273744 _____ C:\Windows\Minidump\122513-31730-01.dmp
2013-12-14 13:07 - 2013-12-14 13:07 - 00000000 ____D C:\ProgramData\Oracle
2013-12-14 13:07 - 2013-10-08 07:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-12-14 13:07 - 2013-10-08 07:46 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-12-14 13:07 - 2013-10-08 07:46 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-12-14 13:07 - 2013-10-08 07:46 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-12-14 13:06 - 2013-12-14 13:07 - 00004886 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-12-14 12:23 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-14 12:23 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-14 12:23 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-14 12:23 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-14 12:22 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-14 12:22 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-12-14 12:22 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-14 12:22 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-12-14 12:22 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-14 12:22 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-14 12:22 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-14 12:22 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-14 12:22 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-12-14 12:22 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-14 12:22 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-14 12:22 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-14 12:21 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-14 12:21 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-14 12:21 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-14 12:21 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-12-14 12:21 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-12-14 12:21 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-14 12:21 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-14 12:21 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-12-14 12:21 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-14 12:21 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-12-14 12:21 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-14 12:21 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-12-14 12:21 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-14 12:21 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-14 12:21 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-14 12:21 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-12-14 12:21 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-12-14 12:21 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-14 12:21 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-13 20:42 - 2013-12-25 19:58 - 00000000 ____D C:\FRST
2013-12-13 20:41 - 2013-12-25 19:58 - 01928716 _____ (Farbar) C:\Users\Meli\Desktop\FRST64.exe
2013-12-12 20:19 - 2013-12-12 20:19 - 02347384 _____ (ESET) C:\Users\Downloads\esetsmartinstaller_enu (1).exe
2013-12-12 20:18 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-12 20:18 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-12 20:18 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-12 20:18 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-12 20:18 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-12 20:18 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-12 20:18 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-12 20:18 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-12 20:18 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-12 20:18 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-12 20:18 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-12 20:18 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2013-12-12 20:18 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-12 20:18 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-12 20:18 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-12 20:18 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-12 20:18 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-12 20:18 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-12 20:18 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-09 22:06 - 2013-12-10 19:32 - 00000000 ____D C:\ProgramData\Easybits Magic Desktop for HP
2013-12-08 07:46 - 2013-12-08 07:47 - 05153293 _____ (Swearware) C:\Users\Downloads\ComboFix.exe
2013-12-05 11:41 - 2013-12-05 11:41 - 00000000 ____D C:\Users\Meli\AppData\Local\{34617FDC-0BAD-4AFE-B582-04E33D68E6F9}
2013-12-04 23:36 - 2013-12-04 23:36 - 00000000 ____D C:\ProgramData\mquadr.at
2013-12-04 23:36 - 2012-12-03 14:58 - 00279040 ____N (Nicomsoft Ltd.) C:\Windows\system32\WiFiMan.dll
2013-12-04 23:36 - 2012-12-03 14:57 - 00238592 ____N (Nicomsoft Ltd.) C:\Windows\SysWOW64\WiFiMan.dll
2013-12-04 23:35 - 2013-12-04 23:35 - 08520120 _____ (mquadr.at software engineering und consulting GmbH) C:\Users\Downloads\SwisscomWLAN_optimizer.exe
2013-12-04 23:35 - 2013-12-04 23:35 - 00000000 ____D C:\Users\Meli\AppData\Local\Swisscom
2013-12-02 11:57 - 2013-12-17 13:18 - 00000328 _____ C:\Windows\Tasks\HPCeeScheduleForMeli.job
2013-12-02 11:57 - 2013-12-16 11:27 - 00003180 _____ C:\Windows\System32\Tasks\HPCeeScheduleForMeli
==================== One Month Modified Files and Folders =======
2013-12-25 19:59 - 2013-12-25 19:59 - 00015639 _____ C:\Users\Meli\Desktop\FRST.txt
2013-12-25 19:58 - 2013-12-25 19:58 - 00000000 ____D C:\Users\Meli\Desktop\FRST-OlderVersion
2013-12-25 19:58 - 2013-12-13 20:42 - 00000000 ____D C:\FRST
2013-12-25 19:58 - 2013-12-13 20:41 - 01928716 _____ (Farbar) C:\Users\Meli\Desktop\FRST64.exe
2013-12-25 19:57 - 2013-12-25 19:57 - 00000470 _____ C:\Users\Meli\Desktop\defogger_disable.log
2013-12-25 19:55 - 2011-09-03 09:22 - 00654400 _____ C:\Windows\system32\perfh007.dat
2013-12-25 19:55 - 2011-09-03 09:22 - 00130240 _____ C:\Windows\system32\perfc007.dat
2013-12-25 19:55 - 2009-07-14 06:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-25 19:51 - 2013-05-30 22:03 - 00001102 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-12-25 19:51 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-25 19:50 - 2013-12-25 19:50 - 00273744 _____ C:\Windows\Minidump\122513-31730-01.dmp
2013-12-25 19:50 - 2013-03-03 13:04 - 334806346 _____ C:\Windows\MEMORY.DMP
2013-12-25 19:50 - 2013-03-03 13:04 - 00000000 ____D C:\Windows\Minidump
2013-12-25 19:50 - 2011-12-21 15:41 - 00000000 ____D C:\Users\Meli
2013-12-25 19:50 - 2009-07-14 05:51 - 00145111 _____ C:\Windows\setupact.log
2013-12-25 18:13 - 2013-05-30 22:03 - 00000000 ____D C:\Program Files (x86)\Google
2013-12-25 18:13 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-12-25 18:13 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2013-12-25 18:13 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\AppCompat
2013-12-25 18:12 - 2013-05-30 22:03 - 00000000 ____D C:\Users\Meli\AppData\Local\Google
2013-12-25 18:12 - 2011-12-21 22:51 - 00000000 __RHD C:\MSOCache
2013-12-25 18:08 - 2009-07-14 05:45 - 00032064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-25 18:08 - 2009-07-14 05:45 - 00032064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-25 17:47 - 2013-04-03 17:01 - 00000331 _____ C:\Users\Favorites\mbs Markgräfler Bau- & Immo Service e.K. - Makler Kandern Immobilienmakler.url
2013-12-25 17:47 - 2013-03-27 18:38 - 00001266 _____ C:\Users\Favorites\Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten - Trojaner-Board.url
2013-12-22 15:12 - 2012-04-17 20:21 - 00000000 ____D C:\Users\Leo
2013-12-19 09:24 - 2011-11-07 11:35 - 01082771 _____ C:\Windows\WindowsUpdate.log
2013-12-19 09:19 - 2011-12-21 15:51 - 00003946 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{D18F30CF-5767-4AE6-97AB-6444837A73B2}
2013-12-17 13:18 - 2013-12-02 11:57 - 00000328 _____ C:\Windows\Tasks\HPCeeScheduleForMeli.job
2013-12-16 13:01 - 2013-05-30 22:03 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-16 12:38 - 2013-05-30 22:03 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-12-16 11:43 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-16 11:27 - 2013-12-02 11:57 - 00003180 _____ C:\Windows\System32\Tasks\HPCeeScheduleForMeli
2013-12-16 11:27 - 2012-01-28 16:41 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-12-16 11:27 - 2011-12-24 20:50 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2013-12-14 13:07 - 2013-12-14 13:07 - 00000000 ____D C:\ProgramData\Oracle
2013-12-14 13:07 - 2013-12-14 13:06 - 00004886 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-12-14 13:07 - 2013-09-01 12:41 - 00000000 ____D C:\Program Files (x86)\Java
2013-12-14 13:03 - 2012-07-09 19:32 - 00002021 _____ C:\Users\Public\Desktop\Adobe Reader X.lnk
2013-12-14 13:03 - 2012-07-09 19:32 - 00002021 _____ C:\ProgramData\Desktop\Adobe Reader X.lnk
2013-12-14 12:58 - 2009-07-14 05:45 - 01964104 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-14 12:35 - 2013-07-18 02:05 - 00000000 ____D C:\Windows\system32\MRT
2013-12-14 12:33 - 2011-12-23 14:08 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-14 12:23 - 2011-12-21 22:52 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-12 21:01 - 2013-05-30 22:03 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-12-12 21:01 - 2013-05-04 18:54 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-12 21:01 - 2013-05-04 18:54 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-12 20:33 - 2013-05-30 22:03 - 00004102 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-12-12 20:33 - 2013-05-30 22:03 - 00003850 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-12-12 20:19 - 2013-12-12 20:19 - 02347384 _____ (ESET) C:\Users\Downloads\esetsmartinstaller_enu (1).exe
2013-12-10 19:32 - 2013-12-09 22:06 - 00000000 ____D C:\ProgramData\Easybits Magic Desktop for HP
2013-12-08 07:47 - 2013-12-08 07:46 - 05153293 _____ (Swearware) C:\Users\Downloads\ComboFix.exe
2013-12-06 21:07 - 2013-12-25 19:55 - 00377856 _____ C:\Users\Meli\Desktop\gmer_2.1.19163.exe
2013-12-06 21:00 - 2013-12-25 19:54 - 00050477 _____ C:\Users\Meli\Desktop\Defogger.exe
2013-12-06 17:35 - 2013-05-30 22:04 - 00002177 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-12-06 17:35 - 2013-05-30 22:04 - 00002177 _____ C:\ProgramData\Desktop\Google Chrome.lnk
2013-12-05 11:41 - 2013-12-05 11:41 - 00000000 ____D C:\Users\Meli\AppData\Local\{34617FDC-0BAD-4AFE-B582-04E33D68E6F9}
2013-12-04 23:36 - 2013-12-04 23:36 - 00000000 ____D C:\ProgramData\mquadr.at
2013-12-04 23:35 - 2013-12-04 23:35 - 08520120 _____ (mquadr.at software engineering und consulting GmbH) C:\Users\Downloads\SwisscomWLAN_optimizer.exe
2013-12-04 23:35 - 2013-12-04 23:35 - 00000000 ____D C:\Users\Meli\AppData\Local\Swisscom
2013-12-04 23:29 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2013-12-04 22:23 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Public\Libraries
2013-11-26 12:54 - 2013-12-14 12:21 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-26 11:19 - 2013-12-14 12:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-26 11:18 - 2013-12-14 12:22 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-11-26 11:11 - 2013-12-14 12:21 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-26 10:48 - 2013-12-14 12:22 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-26 10:46 - 2013-12-14 12:22 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-11-26 10:41 - 2013-12-14 12:21 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-26 10:29 - 2013-12-14 12:22 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-26 10:27 - 2013-12-14 12:22 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-26 10:23 - 2013-12-14 12:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-26 10:21 - 2013-12-14 12:22 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-26 10:18 - 2013-12-14 12:22 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-26 10:18 - 2013-12-14 12:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-11-26 10:16 - 2013-12-14 12:21 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-11-26 09:57 - 2013-12-14 12:22 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-26 09:38 - 2013-12-14 12:22 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-26 09:38 - 2013-12-14 12:21 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-26 09:35 - 2013-12-14 12:21 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-26 09:32 - 2013-12-14 12:22 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-26 09:28 - 2013-12-14 12:21 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-11-26 09:16 - 2013-12-14 12:21 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-26 09:02 - 2013-12-14 12:21 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-26 08:48 - 2013-12-14 12:21 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-26 08:32 - 2013-12-14 12:21 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-11-26 08:26 - 2013-12-14 12:21 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-26 08:07 - 2013-12-14 12:21 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-26 07:40 - 2013-12-14 12:21 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-26 07:34 - 2013-12-14 12:21 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-11-26 07:34 - 2013-12-14 12:21 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-11-26 07:33 - 2013-12-14 12:21 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-26 07:27 - 2013-12-14 12:21 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
Files to move or delete:
====================
C:\Users\Downloads\ComboFix.exe
C:\Users\Downloads\esetsmartinstaller_enu (1).exe
C:\Users\Downloads\SwisscomWLAN_optimizer.exe
Some content of TEMP:
====================
C:\Users\Meli\AppData\Local\Temp\Extract.exe
C:\Users\Meli\AppData\Local\Temp\HPHelpUpdater.exe
C:\Users\Meli\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Meli\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Meli\AppData\Local\Temp\readSTILog.dll
C:\Users\Meli\AppData\Local\Temp\Resource.exe
C:\Users\Meli\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Meli\AppData\Local\Temp\SP54841.exe
C:\Users\Meli\AppData\Local\Temp\SP54900.exe
C:\Users\Meli\AppData\Local\Temp\SP55101.exe
C:\Users\Meli\AppData\Local\Temp\SP55102.exe
C:\Users\Meli\AppData\Local\Temp\SP55104.exe
C:\Users\Meli\AppData\Local\Temp\SP55107.exe
C:\Users\Meli\AppData\Local\Temp\SP55109.exe
C:\Users\Meli\AppData\Local\Temp\SP55152.exe
C:\Users\Meli\AppData\Local\Temp\SP56929.exe
C:\Users\Meli\AppData\Local\Temp\sp58915.exe
C:\Users\Meli\AppData\Local\Temp\SP59542.exe
C:\Users\Meli\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\Meli\AppData\Local\Temp\{F274F7D6-079A-48F2-8160-A1AB0AD4A1B2}-31.0.1650.48_chrome_installer.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-12-21 21:20
==================== End Of Log ============================
GMER: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-12-25 20:16:55
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.JE4O 698,64GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Meli\AppData\Local\Temp\kxtdqpob.sys
---- User code sections - GMER 2.1 ----
.text C:\Windows\SysWOW64\ezSharedSvcHost.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076301465 2 bytes [30, 76]
.text C:\Windows\SysWOW64\ezSharedSvcHost.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000763014bb 2 bytes [30, 76]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4220] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076301465 2 bytes [30, 76]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4220] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000763014bb 2 bytes [30, 76]
.text ... * 2
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[304] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076301465 2 bytes [30, 76]
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[304] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000763014bb 2 bytes [30, 76]
.text ... * 2
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[5280] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076301465 2 bytes [30, 76]
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[5280] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000763014bb 2 bytes [30, 76]
.text ... * 2
---- Processes - GMER 2.1 ----
Library c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{F6949E09-D254-4929-A9B0-61683B8BFA56}\mpengine.dll (*** suspicious ***) @ c:\Program Files\Microsoft Security Client\MsMpEng.exe [488] 000007fef8c80000
Library C:\Windows\TEMP\IXP000.TMP\BBSetup.exe (*** suspicious ***) @ C:\Windows\TEMP\IXP000.TMP\BBSetup.exe [4164] 0000000001390000
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{110CB786-62CE-4007-8708-636B54C141C4}\Connection@Name isatap.{C437E580-5143-4E15-A2BB-626522BF07D1}
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Bind \Device\{110CB786-62CE-4007-8708-636B54C141C4}?\Device\{3E6B1F5A-5B5D-4FAD-BD81-886477AB65A3}?\Device\{44ABD7A0-31F7-4275-BA78-6C50CBAF071D}?
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Route "{110CB786-62CE-4007-8708-636B54C141C4}"?"{3E6B1F5A-5B5D-4FAD-BD81-886477AB65A3}"?"{44ABD7A0-31F7-4275-BA78-6C50CBAF071D}"?
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Export \Device\TCPIP6TUNNEL_{110CB786-62CE-4007-8708-636B54C141C4}?\Device\TCPIP6TUNNEL_{3E6B1F5A-5B5D-4FAD-BD81-886477AB65A3}?\Device\TCPIP6TUNNEL_{44ABD7A0-31F7-4275-BA78-6C50CBAF071D}?
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\ac7289d8293e
Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{110CB786-62CE-4007-8708-636B54C141C4}@InterfaceName isatap.{C437E580-5143-4E15-A2BB-626522BF07D1}
Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{110CB786-62CE-4007-8708-636B54C141C4}@ReusableType 0
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\ac7289d8293e (not active ControlSet)
---- EOF - GMER 2.1 ----
Vielen Dank schon mal für die Hilfe. Ist echt super von euch. PS: bin die nächsten paar Tage unterwegs und weiss nicht, ob ich dabei zugang zu nem Rechner hab. Also wenn ich mich nicht gleich melde, liegt es daran... PPS: das Notebook hat Probleme beim Shutdown gemacht.... brauchte ewig. Habe nach ca. 10 min. den Power-Knopf gedrückt. |
| Themen zu Notebook_Win 7 SP1 64Bit HP_IE 11 baut Seite nicht auf, obwohl WiFi OK --> BlueScreen |
| 4d36e972-e325-11ce-bfc1-08002be10318, administrator, adobe, adobe flash player, bingbar, bluescreen, combofix, dll, explorer.exe, flash player, harddisk, home, ie 11, internet, launch, malwarebytes, microsoft, minidump, notebook, plug-in, realtek, registry, rundll, scan, security, shutdown, software, super, system, temp, tunnel, usb, winlogon.exe |
Baum-Darstellung