|
Plagegeister aller Art und deren Bekämpfung: Windows 8.1 schwarzer Schirm Maus lässt sich bewegenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
28.03.2014, 14:13 | #1 |
| Windows 8.1 schwarzer Schirm Maus lässt sich bewegen Hallo zusammen, ich habe gestern genau das gleiche Problem gehabt wie hier beschrieben http://www.trojaner-board.de/151621-...cher-maus.html Nachdem Outlook nicht mehr richtig arbeitete wollte ich einen Neustart machen. Das Herunterfahren dauerte ewig, bis ich mit der Austaste den Laptop abwürgte. Beim Starten kam zuerst der Begrüssungschirm und dann wie beschrieben der schwarze Bildschirm, wobei sich die Maus bewegen liess. Gefühlt hat das Gerät überhaupt nichts mehr gemacht. Nach ca. 4-5 Minuten wollte ich das System wieder mit der Austaste herunterfahren als der Zeiger zum 'arbeitenden' Kreis wurde. Es dauerte nochmals ca. 1 Minute bis ich beim Startbildschirm war. Danach liess sich der Laptop ganz normal herunterfahren und Neustarten. Da das nicht normal ist und ich scheinbar nicht der Einzige bin wende ich mich an Euch. Die frst.txt Datei habe ich bereits und hänge es hier zur Prüfung an. Mein Laptop: Sony Vaio, Windows 8.1, 64bit mit SSD Danke für Eure Hilfe Gruss izaro FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014 Ran by SYSTEM on MININT-073219A on 28-03-2014 13:47:47 Running from D:\ Windows 8.1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Recovery The current controlset is ControlSet001 ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log. ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1307720 2013-05-07] (Realtek Semiconductor) HKLM\...\Run: [BTMTrayAgent] - C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll [7830328 2013-05-21] (Motorola Solutions, Inc.) HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2777840 2013-10-22] (Synaptics Incorporated) HKLM-x32\...\Run: [PMBVolumeWatcher] - C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe [740376 2013-02-06] (Sony Corporation) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [ATLauncher] - "C:\Program Files\McAfeeEx\McAfeeAntiTheft\ATLauncher.exe" /createshortcuts:1 HKLM-x32\...\Run: [ATUninstallIcon] - "C:\Program Files\McAfeeEx\McAfeeAntiTheft\ATLauncher.exe" /createuninstallentry:1 HKLM-x32\...\Run: [Intel AppUp(R) center] - C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [156000 2013-02-19] (Intel Corporation) HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation) HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3767096 2014-03-19] (AVAST Software) HKLM-x32\...\Run: [Wondershare Helper Compact.exe] - C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [1985824 2013-07-25] (Wondershare) HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.) HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\Roland\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2013-07-24] (Google Inc.) HKU\Roland\...\Run: [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.) HKU\Roland\...\Run: [ApplePhotoStreams] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.) Startup: C:\Users\Roland\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sidebar.lnk ShortcutTarget: Sidebar.lnk -> C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation) ==================== Services (Whitelisted) ================= S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-03-19] (AVAST Software) S2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [113704 2014-03-19] (AVAST Software) S2 BrcmSetSecurity; C:\Program Files\Intel Corporation\Intel WiDi\BrcmSetSecurity.exe [101536 2013-03-15] (Intel) S2 ESRV_SVC; C:\Program Files\Sony\VAIO Care\ESRV\esrv_svc.exe [377768 2013-05-29] (Intel Corporation) S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation) S2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-04-02] (Intel Corporation) S2 Intel(R) Wireless Bluetooth(R) 4.0 Radio Management; C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe [157128 2013-09-27] (Intel Corporation) S2 ISCTAgent; C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [198120 2013-09-06] () S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-04-02] (Intel Corporation) S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2013-10-11] () S3 NetworkSupport; C:\Program Files (x86)\Sony\VAIO Control Center\NetworkSetting\NetworkSupport.exe [629336 2013-09-28] (Sony Corporation) S2 PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [483864 2013-02-06] (Sony Corporation) S2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [266168 2013-05-29] (Intel Corporation) S3 USER_ESRV_SVC; C:\Program Files\Sony\VAIO Care\ESRV\esrv_svc.exe [377768 2013-05-29] (Intel Corporation) S3 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [972000 2013-01-06] (Sony Corporation) S3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1368624 2013-08-01] (Sony Corporation) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [348392 2013-10-31] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2013-10-31] (Microsoft Corporation) S2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3671792 2013-10-11] (Intel® Corporation) ==================== Drivers (Whitelisted) ==================== S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra) S1 aswKbd; C:\WINDOWS\system32\drivers\aswKbd.sys [28184 2013-12-27] (AVAST Software) S2 aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [78648 2014-03-19] (AVAST Software) S1 aswNdisFlt; C:\Windows\system32\DRIVERS\aswNdisFlt.sys [440672 2014-03-19] (AVAST Software) S1 aswRdr; C:\WINDOWS\system32\drivers\aswRdr2.sys [92544 2013-12-27] (AVAST Software) S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-12-27] () S1 aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [1038072 2014-03-19] (AVAST Software) S1 aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [421704 2014-03-19] (AVAST Software) S3 aswStm; C:\WINDOWS\system32\drivers\aswStm.sys [80184 2014-03-19] (AVAST Software) S3 aswTap; C:\Windows\system32\DRIVERS\aswTap.sys [44640 2013-12-27] (The OpenVPN Project) S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2014-03-19] () S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider) S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [224768 2013-08-22] (Microsoft Corporation) S3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [132920 2013-04-23] (Motorola Solutions, Inc.) S3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1386296 2013-08-19] (Motorola Solutions, Inc.) S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation) S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation) S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation) S3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [117192 2013-09-27] (Intel Corporation) S3 ikbevent; C:\Windows\system32\DRIVERS\ikbevent.sys [21408 2013-08-08] () S3 imsevent; C:\Windows\system32\DRIVERS\imsevent.sys [21920 2013-08-08] () S3 INETMON; C:\WINDOWS\System32\Drivers\INETMON.sys [29088 2013-08-07] () S0 IntelHSWPcc; C:\Windows\System32\drivers\IntelPcc.sys [77992 2013-11-28] (Intel Corporation) S0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-11] (Microsoft Corporation) S3 ISCT; C:\Windows\System32\drivers\ISCTD64.sys [46568 2013-03-14] () S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation) S3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-12-19] (Intel Corporation) S3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation) S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation) S3 NETwNb64; C:\Windows\system32\DRIVERS\NETwbw02.sys [3607520 2014-01-09] (Intel Corporation) S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [3646432 2013-08-01] (Intel Corporation) S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation) S3 semav6thermal64ro; C:\Windows\system32\drivers\semav6thermal64ro.sys [13792 2013-10-24] () S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-26] (Microsoft Corporation) S3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-10-22] (Synaptics Incorporated) S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-10-05] (Microsoft Corporation) S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation) S3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [207256 2013-03-15] (Windows (R) Win 7 DDK provider) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124760 2013-10-31] (Microsoft Corporation) S3 WinDriver6; C:\Windows\system32\drivers\windrvr6.sys [254976 2010-07-15] (Jungo) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-03-28 13:47 - 2014-03-28 13:47 - 00000000 ____D () C:\FRST 2014-03-23 19:20 - 2014-02-22 13:16 - 00139776 _____ (Microsoft Corporation) C:\Windows\System32\poqexec.exe 2014-03-23 19:20 - 2014-02-22 12:24 - 00124416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe 2014-03-21 08:51 - 2014-03-21 08:53 - 00000000 ____D () C:\Users\Roland\Desktop\QR-Codes 2014-03-19 18:00 - 2014-03-28 01:31 - 00000000 ____D () C:\Users\Roland\Desktop\Ricardo GHs 2014-03-19 14:36 - 2014-03-19 14:36 - 00080184 _____ (AVAST Software) C:\Windows\System32\Drivers\aswStm.sys 2014-03-17 22:20 - 2014-01-08 02:46 - 00325464 ____C (Microsoft Corporation) C:\Windows\System32\Drivers\USBXHCI.SYS 2014-03-17 22:20 - 2014-01-08 02:41 - 01530712 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys 2014-03-17 22:20 - 2014-01-08 02:41 - 00382808 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\dxgmms1.sys 2014-03-17 22:20 - 2014-01-04 16:54 - 00138240 _____ () C:\Windows\System32\OEMLicense.dll 2014-03-17 22:20 - 2014-01-04 16:08 - 00103936 _____ () C:\Windows\SysWOW64\OEMLicense.dll 2014-03-17 22:20 - 2014-01-04 15:08 - 00206336 _____ (Microsoft Corporation) C:\Windows\System32\WSClient.dll 2014-03-17 22:20 - 2014-01-04 14:53 - 00174592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSClient.dll 2014-03-17 22:20 - 2014-01-03 00:54 - 00461312 _____ (Microsoft Corporation) C:\Windows\System32\XpsGdiConverter.dll 2014-03-17 22:20 - 2014-01-03 00:48 - 00336896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll 2014-03-17 22:20 - 2014-01-01 02:55 - 01720560 _____ (Microsoft Corporation) C:\Windows\System32\ntdll.dll 2014-03-17 22:20 - 2014-01-01 02:52 - 00481944 _____ (Microsoft Corporation) C:\Windows\System32\mfsvr.dll 2014-03-17 22:20 - 2014-01-01 01:56 - 01472048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll 2014-03-17 22:20 - 2014-01-01 01:55 - 00381168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfsvr.dll 2014-03-17 22:20 - 2014-01-01 00:59 - 00802816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFMediaEngine.dll 2014-03-17 22:20 - 2014-01-01 00:57 - 01214976 _____ (Microsoft Corporation) C:\Windows\System32\schedsvc.dll 2014-03-17 22:20 - 2014-01-01 00:56 - 00960512 _____ (Microsoft Corporation) C:\Windows\System32\MFMediaEngine.dll 2014-03-17 22:20 - 2013-12-31 00:34 - 00218112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sti.dll 2014-03-17 22:20 - 2013-12-31 00:33 - 00770560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ReAgent.dll 2014-03-17 22:20 - 2013-12-31 00:32 - 00303616 _____ (Microsoft Corporation) C:\Windows\System32\sti.dll 2014-03-17 22:20 - 2013-12-31 00:31 - 00947712 _____ (Microsoft Corporation) C:\Windows\System32\reseteng.dll 2014-03-17 22:20 - 2013-12-31 00:31 - 00914944 _____ (Microsoft Corporation) C:\Windows\System32\ReAgent.dll 2014-03-17 22:20 - 2013-12-27 16:09 - 00419160 _____ (Microsoft Corporation) C:\Windows\System32\hal.dll 2014-03-17 22:20 - 2013-12-27 09:57 - 00842752 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.dll 2014-03-17 22:20 - 2013-12-27 09:57 - 00628736 _____ (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe 2014-03-17 22:20 - 2013-12-27 09:23 - 00749056 _____ (Microsoft Corporation) C:\Windows\System32\SettingSyncCore.dll 2014-03-17 22:20 - 2013-12-27 08:03 - 00630272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsSpellCheckingFacility.dll 2014-03-17 22:20 - 2013-12-27 08:03 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSyncHost.exe 2014-03-17 22:20 - 2013-12-27 07:37 - 00588800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSyncCore.dll 2014-03-17 22:20 - 2013-12-21 08:21 - 00376320 _____ (Microsoft Corporation) C:\Windows\System32\pnrpsvc.dll 2014-03-17 22:20 - 2013-12-17 08:21 - 00408576 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\rdbss.sys 2014-03-17 22:20 - 2013-12-14 07:31 - 13949440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.dll 2014-03-17 22:20 - 2013-12-14 07:19 - 18576384 _____ (Microsoft Corporation) C:\Windows\System32\Windows.UI.Xaml.dll 2014-03-17 22:20 - 2013-12-13 11:54 - 00131160 _____ (Microsoft Corporation) C:\Windows\System32\easinvoker.exe 2014-03-17 22:20 - 2013-12-13 07:36 - 00178176 _____ (Microsoft Corporation) C:\Windows\System32\easwrt.dll 2014-03-17 22:20 - 2013-12-13 06:32 - 00140800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\easwrt.dll 2014-03-17 22:20 - 2013-12-09 09:05 - 21199256 _____ (Microsoft Corporation) C:\Windows\System32\shell32.dll 2014-03-17 22:20 - 2013-12-09 05:51 - 18643560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2014-03-15 00:56 - 2014-03-15 00:57 - 00000000 ____D () C:\Users\Roland\Desktop\Paypal 2014-03-13 07:26 - 2014-03-13 07:26 - 00001795 _____ () C:\Users\Public\Desktop\iTunes.lnk 2014-03-13 07:26 - 2014-03-13 07:26 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2014-03-13 07:26 - 2014-03-13 07:26 - 00000000 ____D () C:\Program Files\iTunes 2014-03-13 07:26 - 2014-03-13 07:26 - 00000000 ____D () C:\Program Files\iPod 2014-03-13 07:26 - 2014-03-13 07:26 - 00000000 ____D () C:\Program Files (x86)\iTunes 2014-03-13 07:24 - 2013-10-31 01:29 - 00236888 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\WdFilter.sys 2014-03-13 07:24 - 2013-10-31 01:29 - 00124760 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\WdNisDrv.sys 2014-03-13 07:24 - 2013-10-31 01:28 - 00035856 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\WdBoot.sys 2014-03-13 07:12 - 2014-03-01 07:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2014-03-13 07:12 - 2014-03-01 05:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2014-03-13 07:12 - 2014-03-01 05:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-03-13 07:12 - 2014-03-01 05:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe 2014-03-13 07:12 - 2014-03-01 04:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2014-03-13 07:12 - 2014-03-01 04:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-03-13 07:12 - 2014-03-01 04:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2014-03-13 07:12 - 2014-03-01 04:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2014-03-13 07:12 - 2014-03-01 04:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-03-13 07:12 - 2014-03-01 04:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll 2014-03-13 07:12 - 2014-03-01 04:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-03-13 07:12 - 2014-03-01 03:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-03-13 07:12 - 2014-03-01 03:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2014-03-13 07:12 - 2014-03-01 03:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-03-13 07:12 - 2014-03-01 03:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-03-13 07:12 - 2014-03-01 03:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll 2014-03-13 07:12 - 2014-03-01 03:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-03-13 07:12 - 2014-02-11 04:04 - 04189184 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys 2014-03-13 07:12 - 2014-02-11 03:43 - 00488448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll 2014-03-13 07:12 - 2014-02-11 03:04 - 00586240 _____ (Microsoft Corporation) C:\Windows\System32\qedit.dll 2014-03-13 07:12 - 2014-01-31 17:15 - 00311640 ____C (Microsoft Corporation) C:\Windows\System32\Drivers\volsnap.sys 2014-03-13 07:12 - 2014-01-31 17:07 - 00233920 _____ (Microsoft Corporation) C:\Windows\System32\mfps.dll 2014-03-13 07:12 - 2014-01-31 17:06 - 02133208 _____ (Microsoft Corporation) C:\Windows\System32\mfcore.dll 2014-03-13 07:12 - 2014-01-31 14:47 - 02143960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcore.dll 2014-03-13 07:12 - 2014-01-31 10:06 - 00716288 _____ (Microsoft Corporation) C:\Windows\System32\swprv.dll 2014-03-13 07:12 - 2014-01-29 10:55 - 01287064 _____ (Microsoft Corporation) C:\Windows\System32\kernel32.dll 2014-03-13 07:12 - 2014-01-29 09:53 - 00458616 _____ (Microsoft Corporation) C:\Windows\System32\WerFault.exe 2014-03-13 07:12 - 2014-01-29 09:53 - 00407024 _____ (Microsoft Corporation) C:\Windows\System32\Faultrep.dll 2014-03-13 07:12 - 2014-01-29 09:49 - 01928144 _____ (Microsoft Corporation) C:\Windows\System32\combase.dll 2014-03-13 07:12 - 2014-01-29 09:47 - 02543960 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys 2014-03-13 07:12 - 2014-01-29 08:44 - 01371824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\combase.dll 2014-03-13 07:12 - 2014-01-29 08:44 - 00408480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFault.exe 2014-03-13 07:12 - 2014-01-29 08:44 - 00369280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Faultrep.dll 2014-03-13 07:12 - 2014-01-29 07:41 - 00208896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpencom.dll 2014-03-13 07:12 - 2014-01-29 01:36 - 00249856 _____ (Microsoft Corporation) C:\Windows\System32\rdpencom.dll 2014-03-13 07:12 - 2014-01-27 20:07 - 04175360 _____ (Microsoft Corporation) C:\Windows\System32\dbgeng.dll 2014-03-13 07:12 - 2014-01-27 20:06 - 00064512 _____ (Microsoft Corporation) C:\Windows\System32\tsgqec.dll 2014-03-13 07:12 - 2014-01-27 20:04 - 00160256 _____ (Microsoft Corporation) C:\Windows\System32\DWWIN.EXE 2014-03-13 07:12 - 2014-01-27 19:52 - 01036288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll 2014-03-13 07:12 - 2014-01-27 19:23 - 02873344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbgeng.dll 2014-03-13 07:12 - 2014-01-27 19:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll 2014-03-13 07:12 - 2014-01-27 19:20 - 00138752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWWIN.EXE 2014-03-13 07:12 - 2014-01-27 19:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\System32\rdvidcrl.dll 2014-03-13 07:12 - 2014-01-27 18:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll 2014-03-13 07:12 - 2014-01-27 18:18 - 01486848 _____ (Microsoft Corporation) C:\Windows\System32\dbghelp.dll 2014-03-13 07:12 - 2014-01-27 18:00 - 01238016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbghelp.dll 2014-03-13 07:12 - 2014-01-27 16:58 - 05770752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll 2014-03-13 07:12 - 2014-01-27 16:50 - 06640640 _____ (Microsoft Corporation) C:\Windows\System32\mstscax.dll 2014-03-13 07:12 - 2014-01-27 12:45 - 00386722 _____ () C:\Windows\System32\ApnDatabase.xml 2014-03-13 07:12 - 2014-01-18 00:04 - 00764864 _____ (Microsoft Corporation) C:\Windows\System32\mfmpeg2srcsnk.dll 2014-03-13 07:12 - 2014-01-17 22:54 - 00669352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmpeg2srcsnk.dll 2014-03-13 07:12 - 2013-12-21 15:51 - 06353960 _____ (Microsoft Corporation) C:\Windows\System32\sppsvc.exe 2014-03-13 07:12 - 2013-12-21 09:54 - 00447488 _____ (Microsoft Corporation) C:\Windows\System32\sppcomapi.dll 2014-03-13 07:12 - 2013-12-20 11:18 - 01643584 _____ (Microsoft Corporation) C:\Windows\System32\winload.efi 2014-03-13 07:12 - 2013-12-20 11:18 - 01507704 _____ (Microsoft Corporation) C:\Windows\System32\winload.exe ==================== One Month Modified Files and Folders ======= 2014-03-28 13:47 - 2014-03-28 13:47 - 00000000 ____D () C:\FRST 2014-03-28 13:45 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-03-28 13:44 - 2014-02-22 01:15 - 00002195 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-03-28 13:44 - 2013-08-22 15:46 - 00308430 _____ () C:\Windows\setupact.log 2014-03-28 13:44 - 2013-07-24 21:17 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-03-28 13:32 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\System32\config\BBI 2014-03-28 13:30 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\System32\sru 2014-03-28 10:43 - 2013-07-24 21:17 - 00001128 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-03-28 10:40 - 2013-07-28 19:27 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-03-28 09:32 - 2013-07-24 20:36 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1899192084-851895800-3781706727-1001 2014-03-28 01:31 - 2014-03-19 18:00 - 00000000 ____D () C:\Users\Roland\Desktop\Ricardo GHs 2014-03-28 00:17 - 2013-10-29 00:05 - 01318414 _____ () C:\Windows\WindowsUpdate.log 2014-03-28 00:13 - 2013-09-30 05:14 - 01776918 _____ () C:\Windows\System32\PerfStringBackup.INI 2014-03-28 00:13 - 2013-09-30 04:56 - 00765582 _____ () C:\Windows\System32\perfh007.dat 2014-03-28 00:13 - 2013-09-30 04:56 - 00159366 _____ () C:\Windows\System32\perfc007.dat 2014-03-27 23:19 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness 2014-03-27 22:37 - 2013-08-17 13:06 - 00000000 ____D () C:\Users\Roland\AppData\Roaming\FileZilla 2014-03-27 22:34 - 2013-10-29 08:50 - 00000000 ____D () C:\Users\Roland\Desktop\Sat und Kabel 2014-03-23 19:19 - 2013-07-25 20:17 - 00000000 ____D () C:\Users\Roland\AppData\Roaming\vlc 2014-03-22 15:00 - 2013-10-06 21:14 - 00000000 ____D () C:\Users\Roland\AppData\Local\CrashDumps 2014-03-21 08:53 - 2014-03-21 08:51 - 00000000 ____D () C:\Users\Roland\Desktop\QR-Codes 2014-03-20 22:21 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\rescache 2014-03-19 14:37 - 2013-12-27 04:22 - 00440672 _____ (AVAST Software) C:\Windows\System32\Drivers\aswndisflt.sys 2014-03-19 14:37 - 2013-12-27 04:22 - 00002048 _____ () C:\Users\Public\Desktop\avast! SafeZone.lnk 2014-03-19 14:37 - 2013-12-27 04:22 - 00001988 _____ () C:\Users\Public\Desktop\avast! Internet Security.lnk 2014-03-19 14:36 - 2014-03-19 14:36 - 00080184 _____ (AVAST Software) C:\Windows\System32\Drivers\aswStm.sys 2014-03-19 14:36 - 2013-12-27 04:22 - 01038072 _____ (AVAST Software) C:\Windows\System32\Drivers\aswSnx.sys 2014-03-19 14:36 - 2013-12-27 04:22 - 00421704 _____ (AVAST Software) C:\Windows\System32\Drivers\aswSP.sys 2014-03-19 14:36 - 2013-12-27 04:22 - 00334136 _____ (AVAST Software) C:\Windows\System32\aswBoot.exe 2014-03-19 14:36 - 2013-12-27 04:22 - 00207904 _____ () C:\Windows\System32\Drivers\aswVmm.sys 2014-03-19 14:36 - 2013-12-27 04:22 - 00078648 _____ (AVAST Software) C:\Windows\System32\Drivers\aswMonFlt.sys 2014-03-19 14:36 - 2013-12-27 04:22 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr 2014-03-19 14:36 - 2013-12-26 23:03 - 00003924 _____ () C:\Windows\System32\Tasks\avast! Emergency Update 2014-03-19 13:04 - 2013-08-22 16:36 - 00000000 ___RD () C:\Windows\ToastData 2014-03-19 08:25 - 2013-07-26 09:01 - 00000000 ____D () C:\Windows\System32\MRT 2014-03-19 08:24 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\System32\config\ELAM 2014-03-19 08:24 - 2013-07-24 22:14 - 90015360 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe 2014-03-15 00:57 - 2014-03-15 00:56 - 00000000 ____D () C:\Users\Roland\Desktop\Paypal 2014-03-14 08:11 - 2013-09-29 20:04 - 00552790 _____ () C:\Windows\PFRO.log 2014-03-14 08:11 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Windows Defender 2014-03-14 08:11 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender 2014-03-14 08:11 - 2013-08-22 15:44 - 00503528 _____ () C:\Windows\System32\FNTCACHE.DAT 2014-03-14 08:11 - 2013-07-28 20:36 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-03-14 08:11 - 2013-07-28 20:36 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-03-13 07:35 - 2013-07-26 08:51 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-03-13 07:26 - 2014-03-13 07:26 - 00001795 _____ () C:\Users\Public\Desktop\iTunes.lnk 2014-03-13 07:26 - 2014-03-13 07:26 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2014-03-13 07:26 - 2014-03-13 07:26 - 00000000 ____D () C:\Program Files\iTunes 2014-03-13 07:26 - 2014-03-13 07:26 - 00000000 ____D () C:\Program Files\iPod 2014-03-13 07:26 - 2014-03-13 07:26 - 00000000 ____D () C:\Program Files (x86)\iTunes 2014-03-11 21:40 - 2013-07-28 19:27 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-03-04 23:53 - 2013-08-22 16:38 - 00693240 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-03-04 23:53 - 2013-08-22 16:38 - 00105464 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-03-01 07:05 - 2014-03-13 07:12 - 23133696 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2014-03-01 05:58 - 2014-03-13 07:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2014-03-01 05:30 - 2014-03-13 07:12 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-03-01 05:17 - 2014-03-13 07:12 - 00218624 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe 2014-03-01 04:54 - 2014-03-13 07:12 - 05768704 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2014-03-01 04:47 - 2014-03-13 07:12 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-03-01 04:42 - 2014-03-13 07:12 - 00627200 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2014-03-01 04:18 - 2014-03-13 07:12 - 13051904 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2014-03-01 04:14 - 2014-03-13 07:12 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-03-01 04:10 - 2014-03-13 07:12 - 02334208 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll 2014-03-01 04:03 - 2014-03-13 07:12 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-03-01 03:57 - 2014-03-13 07:12 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-03-01 03:38 - 2014-03-13 07:12 - 01393664 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2014-03-01 03:32 - 2014-03-13 07:12 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-03-01 03:27 - 2014-03-13 07:12 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-03-01 03:25 - 2014-03-13 07:12 - 00817664 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll 2014-03-01 03:25 - 2014-03-13 07:12 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll Some content of TEMP: ==================== C:\Users\Roland\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe ==================== Known DLLs (Whitelisted) ================ ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys [2014-03-13 07:12] - [2014-01-31 17:15] - 0311640 ___AC (Microsoft Corporation) C85C075DE5B6D0FE116043054DE8EE02 ==================== EXE ASSOCIATION ===================== HKLM\...\.exe: exefile => OK HKLM\...\exefile\DefaultIcon: %1 => OK HKLM\...\exefile\open\command: "%1" %* => OK ==================== Restore Points ========================= Restore point made on: 2014-03-08 22:16:37 Restore point made on: 2014-03-13 07:34:31 Restore point made on: 2014-03-19 08:24:19 Restore point made on: 2014-03-23 20:20:47 ==================== Memory info =========================== Percentage of memory in use: 11% Total physical RAM: 8098.88 MB Available physical RAM: 7207.65 MB Total Pagefile: 8098.88 MB Available Pagefile: 7234.41 MB Total Virtual: 131072 MB Available Virtual: 131071.86 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:210.21 GB) (Free:154.4 GB) NTFS Drive d: () (Removable) (Total:7.45 GB) (Free:7.45 GB) FAT32 Drive e: () (Fixed) (Total:0.34 GB) (Free:0.07 GB) NTFS Drive x: (Boot) (Fixed) (Total:0.5 GB) (Free:0.5 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 238 GB) (Disk ID: 6BF81092) Partition: GPT Partition Type. ======================================================== Disk: 1 (Size: 7 GB) (Disk ID: 00000000) Partition: GPT Partition Type. LastRegBack: 2014-03-28 09:32 ==================== End Of Log ============================ --- --- --- --- --- --- |
28.03.2014, 14:29 | #2 |
/// the machine /// TB-Ausbilder | Windows 8.1 schwarzer Schirm Maus lässt sich bewegen Hi,
__________________der laptop ist jetzt fehlerfrei?
__________________ |
28.03.2014, 14:30 | #3 |
| Windows 8.1 schwarzer Schirm Maus lässt sich bewegen Schrauber war schneller...
__________________ |
28.03.2014, 14:35 | #4 |
| Windows 8.1 schwarzer Schirm Maus lässt sich bewegen Ja, ich kann nichts aussergewöhnliches mehr feststellen. Gruss izaro Habe ich noch vergessen zu erwähnen. Nach dem Vorfall habe ich sofort mein Virenprogramm (Avast, Kaufversion) laufen lassen. Erweiterte Suche und Prüfung des Startprogramms. Keine Fehlermeldung Geändert von izaro (28.03.2014 um 14:45 Uhr) |
29.03.2014, 09:42 | #5 |
/// the machine /// TB-Ausbilder | Windows 8.1 schwarzer Schirm Maus lässt sich bewegen Da ist keine Malware, da war auch keine. Wenn is das ein Windows Bug. Da hat sich beinahe das Benuzerprofil verabschiedet. Bitte einen neuen Nutzer mit Adminrechten anlegen. Zur Sicherheit, dann kannste beim nächsten Mal in diesen booten.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
30.03.2014, 11:42 | #6 |
| Windows 8.1 schwarzer Schirm Maus lässt sich bewegen Herzlich Dank für die schnelle Hilfe. Da bin ich beruhigt, dass nichts infiziert ist. Ich werde nun zur Sicherheit einen zweiten user anlegen. Gruss und einen schönen Sonntag izaro |
31.03.2014, 09:38 | #7 |
/// the machine /// TB-Ausbilder | Windows 8.1 schwarzer Schirm Maus lässt sich bewegen Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
Themen zu Windows 8.1 schwarzer Schirm Maus lässt sich bewegen |
adobe, antivirus, association, bildschirm, defender, desktop, explorer, flash player, google, helper, herunterfahren, home, maus, problem, realtek, registry, scan, security, software, startbildschirm, starten, svchost.exe, system, tcp, temp, usb, windows |