| |
| |||||||
Log-Analyse und Auswertung: Windows 7 hp-Laptop hat nach Start von windows BKA Bildschirm mit 100 Euro ZahlungsaufforderungWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
29.05.2014, 16:19
| #1 |
| |  Windows 7 hp-Laptop hat nach Start von windows BKA Bildschirm mit 100 Euro Zahlungsaufforderung Hallo, nach dem Windowsstart habe ich einen 'BKA-Bildschirm' über meinem Desktop. Ich habe die Anleitung auf eurem Board gelesen und mit FRST über USB-Stick eine Logdatei erstellen lassen. Wäre Klasse wenn mir jemand helfen könnte den Trojaner zu entfernen. Ich bin zwar technisch nicht ganz unbeleckt, aber hier brauche ich echt hilfe. Besten Dank und Grüße, Thomas Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-05-2014 02
Ran by SYSTEM on MININT-3RP3PMI on 29-05-2014 16:56:07
Running from I:\
Platform: Windows 7 Professional (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Recovery
The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2804976 2013-10-29] (Synaptics Incorporated)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [348664 2012-07-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-20] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Startup: C:\Users\wgm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\wgm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk
ShortcutTarget: explorer.lnk -> C:\ProgramData\3C472871614128D3DA081A26B0A2C52F\8ogzfr.cpp ()
==================== Services (Whitelisted) =================
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [375760 2012-07-18] (Avira Operations GmbH & Co. KG)
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86224 2012-07-18] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110032 2012-07-18] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [465360 2012-07-18] (Avira Operations GmbH & Co. KG)
S2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2266296 2014-05-15] (Microsoft Corporation)
S2 ncpclcfg; C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncpclcfg.exe [139344 2011-07-27] (NCP engineering GmbH)
S2 ncprwsnt; C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncprwsnt.exe [1594448 2012-04-04] (NCP Engineering GmbH)
S2 NcpSec; C:\Program Files (x86)\LANCOM\Advanced VPN Client\NCPSEC.EXE [119808 2011-04-20] ()
S2 Winmgmt; C:\ProgramData\3C472871614128D3DA081A26B0A2C52F\rfzgo8.dot [332020 2014-05-29] (Microsoft Corporation)
S2 wltrysvc; C:\Program Files\Broadcom\Broadcom 802.11\bcmwltry.exe [4819968 2012-08-02] (Broadcom Corporation)
S2 HP Health Check Service; "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe" [X]
S2 McAfee Endpoint Encryption Agent; "C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe" [X]
==================== Drivers (Whitelisted) ====================
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-07-18] (Avira GmbH)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-07-18] (Avira GmbH)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2012-07-18] (Avira GmbH)
S3 johci; C:\Windows\System32\DRIVERS\johci.sys [26712 2011-02-08] (JMicron Technology Corp.)
S3 LGDDCDevice; C:\windows\SysWOW64\LGI2CDriver.sys [16384 2012-10-17] (LG Soft India)
S3 LGII2CDevice; C:\windows\SysWOW64\LGPII2CDriver.sys [10752 2012-11-23] (LG Soft India)
S3 ncpfilt; C:\Windows\System32\DRIVERS\ncplelhp.sys [103024 2012-04-03] (NCP Engineering GmbH)
S3 ncplelhp; C:\Windows\System32\DRIVERS\ncplelhp.sys [103024 2012-04-03] (NCP Engineering GmbH)
S3 SPUVCbv; C:\Windows\System32\Drivers\SPUVCbv_x64.sys [2611704 2011-01-12] (Sunplus Technology)
S3 ARCVCAM; system32\DRIVERS\ArcSoftVCapture.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-05-29 06:32 - 2014-05-29 06:34 - 152430976 _____ (AVG Technologies) C:\Users\wgm\Downloads\avg_free_x86_all_2014_4592a7484.exe
2014-05-29 06:18 - 2014-05-29 06:23 - 00023161 _____ () C:\Users\wgm\Desktop\Addition.txt
2014-05-29 06:17 - 2014-05-29 16:56 - 00000000 ____D () C:\FRST
2014-05-29 06:17 - 2014-05-29 06:23 - 00026632 _____ () C:\Users\wgm\Desktop\FRST.txt
2014-05-29 06:17 - 2014-05-29 06:17 - 02066944 _____ (Farbar) C:\Users\wgm\Desktop\FRST64.exe
2014-05-29 06:16 - 2014-05-29 06:16 - 00000468 _____ () C:\Users\wgm\Desktop\defogger_disable.log
2014-05-29 06:16 - 2014-05-29 06:16 - 00000000 _____ () C:\Users\wgm\defogger_reenable
2014-05-29 06:15 - 2014-05-29 06:15 - 00050477 _____ () C:\Users\wgm\Desktop\Defogger.exe
2014-05-29 06:04 - 2014-05-29 06:04 - 00002008 _____ () C:\Users\wgm\Desktop\Entfernen des Avira EU-Cleaners.lnk
2014-05-29 06:04 - 2014-05-29 06:04 - 00001952 _____ () C:\Users\wgm\Desktop\Avira EU-Cleaner.lnk
2014-05-29 06:03 - 2014-05-29 06:03 - 02209056 _____ () C:\Users\wgm\Desktop\avira-eu-cleaner_de.exe
2014-05-29 01:23 - 2014-05-29 06:37 - 00165947 _____ () C:\ProgramData\RUNDLL32.EXE-3124-F.txt
2014-05-29 01:18 - 2014-05-29 01:23 - 00000000 ____D () C:\ProgramData\3C472871614128D3DA081A26B0A2C52F
2014-05-24 07:36 - 2014-05-05 20:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-05-24 07:36 - 2014-05-05 20:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2014-05-24 07:36 - 2014-05-05 19:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-24 07:36 - 2014-05-05 19:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-24 07:36 - 2014-05-05 19:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2014-05-24 07:36 - 2014-05-05 18:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-24 07:33 - 2014-05-08 22:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2014-05-24 07:33 - 2014-05-08 22:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2014-05-24 07:33 - 2014-04-11 18:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
2014-05-24 07:33 - 2014-04-11 18:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2014-05-24 07:33 - 2014-04-11 18:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\System32\lsasrv.dll
2014-05-24 07:33 - 2014-04-11 18:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\System32\sspicli.dll
2014-05-24 07:33 - 2014-04-11 18:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\System32\lsass.exe
2014-05-24 07:33 - 2014-04-11 18:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\System32\sspisrv.dll
2014-05-24 07:33 - 2014-04-11 18:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\System32\secur32.dll
2014-05-24 07:33 - 2014-04-11 18:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-05-24 07:33 - 2014-04-11 18:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-05-24 07:33 - 2014-03-24 18:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\System32\shell32.dll
2014-05-24 07:33 - 2014-03-24 18:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-24 07:33 - 2014-03-04 01:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2014-05-24 07:33 - 2014-03-04 01:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\System32\kerberos.dll
2014-05-24 07:33 - 2014-03-04 01:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\System32\objsel.dll
2014-05-24 07:33 - 2014-03-04 01:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\System32\KernelBase.dll
2014-05-24 07:33 - 2014-03-04 01:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\System32\schannel.dll
2014-05-24 07:33 - 2014-03-04 01:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\System32\msv1_0.dll
2014-05-24 07:33 - 2014-03-04 01:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\System32\wdigest.dll
2014-05-24 07:33 - 2014-03-04 01:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\System32\TSpkg.dll
2014-05-24 07:33 - 2014-03-04 01:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\wincredprovider.dll
2014-05-24 07:33 - 2014-03-04 01:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\System32\winlogon.exe
2014-05-24 07:33 - 2014-03-04 01:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\System32\cngprovider.dll
2014-05-24 07:33 - 2014-03-04 01:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\System32\adprovider.dll
2014-05-24 07:33 - 2014-03-04 01:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\capiprovider.dll
2014-05-24 07:33 - 2014-03-04 01:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\System32\dpapiprovider.dll
2014-05-24 07:33 - 2014-03-04 01:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\System32\dimsroam.dll
2014-05-24 07:33 - 2014-03-04 01:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\System32\credssp.dll
2014-05-24 07:33 - 2014-03-04 01:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-05-24 07:33 - 2014-03-04 01:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-05-24 07:33 - 2014-03-04 01:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-24 07:33 - 2014-03-04 01:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-05-24 07:33 - 2014-03-04 01:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-05-24 07:33 - 2014-03-04 01:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-05-24 07:33 - 2014-03-04 01:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-05-24 07:33 - 2014-03-04 01:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-05-24 07:33 - 2014-03-04 01:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-05-24 07:33 - 2014-03-04 01:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-05-24 07:33 - 2014-03-04 01:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-05-24 07:33 - 2014-03-04 01:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-05-24 07:33 - 2014-03-04 01:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-05-24 07:33 - 2014-03-04 01:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-05-24 07:33 - 2014-03-04 01:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-05-24 07:33 - 2014-03-04 01:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-05-24 07:33 - 2014-01-08 18:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-05-24 07:33 - 2014-01-03 14:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\System32\mstscax.dll
2014-05-23 06:29 - 2014-05-23 06:29 - 00000000 ____D () C:\Users\wgm\AppData\Roaming\PC-FAX TX
2014-05-23 06:23 - 2014-05-23 06:23 - 00000000 ___RD () C:\Users\wgm\AppData\Roaming\Brother
2014-05-19 01:44 - 2014-05-19 04:55 - 00000000 ____D () C:\Users\wgm\AppData\OICE_15_974FA576_32C1D314_1781
2014-05-14 09:35 - 2014-05-14 09:35 - 436677762 _____ () C:\Windows\MEMORY.DMP
2014-05-14 09:35 - 2014-05-14 09:35 - 00442624 _____ () C:\Windows\Minidump\051414-19812-01.dmp
2014-05-14 09:35 - 2014-05-14 09:35 - 00000000 ____D () C:\Windows\Minidump
2014-05-02 05:39 - 2014-05-02 09:05 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-04-29 01:49 - 2014-04-29 01:49 - 00012262 _____ () C:\Users\wgm\Documents\Kopie von Preiszusammenstellung e shelter_STUCKE_2750 kVA.xlsx
==================== One Month Modified Files and Folders =======
2014-05-29 16:56 - 2014-05-29 06:17 - 00000000 ____D () C:\FRST
2014-05-29 06:47 - 2014-01-24 06:10 - 00021606 _____ () C:\Windows\setupact.log
2014-05-29 06:46 - 2009-07-13 21:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-29 06:37 - 2014-05-29 01:23 - 00165947 _____ () C:\ProgramData\RUNDLL32.EXE-3124-F.txt
2014-05-29 06:37 - 2012-08-02 18:30 - 01338307 _____ () C:\Windows\WindowsUpdate.log
2014-05-29 06:34 - 2014-05-29 06:32 - 152430976 _____ (AVG Technologies) C:\Users\wgm\Downloads\avg_free_x86_all_2014_4592a7484.exe
2014-05-29 06:23 - 2014-05-29 06:18 - 00023161 _____ () C:\Users\wgm\Desktop\Addition.txt
2014-05-29 06:23 - 2014-05-29 06:17 - 00026632 _____ () C:\Users\wgm\Desktop\FRST.txt
2014-05-29 06:22 - 2014-02-20 13:21 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-29 06:17 - 2014-05-29 06:17 - 02066944 _____ (Farbar) C:\Users\wgm\Desktop\FRST64.exe
2014-05-29 06:16 - 2014-05-29 06:16 - 00000468 _____ () C:\Users\wgm\Desktop\defogger_disable.log
2014-05-29 06:16 - 2014-05-29 06:16 - 00000000 _____ () C:\Users\wgm\defogger_reenable
2014-05-29 06:16 - 2014-02-10 02:28 - 00000000 ____D () C:\users\wgm
2014-05-29 06:15 - 2014-05-29 06:15 - 00050477 _____ () C:\Users\wgm\Desktop\Defogger.exe
2014-05-29 06:04 - 2014-05-29 06:04 - 00002008 _____ () C:\Users\wgm\Desktop\Entfernen des Avira EU-Cleaners.lnk
2014-05-29 06:04 - 2014-05-29 06:04 - 00001952 _____ () C:\Users\wgm\Desktop\Avira EU-Cleaner.lnk
2014-05-29 06:03 - 2014-05-29 06:03 - 02209056 _____ () C:\Users\wgm\Desktop\avira-eu-cleaner_de.exe
2014-05-29 01:45 - 2014-03-13 08:53 - 00005128 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for STUCKE26-wgm NB021.stucke26.lokal
2014-05-29 01:31 - 2009-07-13 20:45 - 00020720 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-29 01:31 - 2009-07-13 20:45 - 00020720 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-29 01:23 - 2014-05-29 01:18 - 00000000 ____D () C:\ProgramData\3C472871614128D3DA081A26B0A2C52F
2014-05-29 00:14 - 2011-03-08 09:03 - 00742284 _____ () C:\Windows\System32\perfh007.dat
2014-05-29 00:14 - 2011-03-08 09:03 - 00163448 _____ () C:\Windows\System32\perfc007.dat
2014-05-29 00:14 - 2009-07-13 21:13 - 01703604 _____ () C:\Windows\System32\PerfStringBackup.INI
2014-05-28 09:14 - 2014-03-13 08:44 - 00005128 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for {80b42046-c09a-4b3e-9538-4176a042811e} NB021.stucke26.lokal
2014-05-28 06:20 - 2014-02-10 02:11 - 00000128 _____ () C:\Windows\System32\config\netlogon.ftl
2014-05-27 04:55 - 2014-02-10 04:53 - 00000000 ____D () C:\Users\wgm\AppData\Local\Deployment
2014-05-24 22:58 - 2014-01-28 01:24 - 00173666 _____ () C:\Windows\PFRO.log
2014-05-24 08:58 - 2014-01-23 06:35 - 00003212 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForNB021$
2014-05-24 08:58 - 2014-01-23 06:35 - 00000336 _____ () C:\Windows\Tasks\HPCeeScheduleForNB021$.job
2014-05-24 08:37 - 2014-01-23 12:34 - 00000000 ____D () C:\Windows\rescache
2014-05-24 08:10 - 2014-01-28 01:41 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-05-24 07:51 - 2014-02-10 02:29 - 00000000 ___RD () C:\Users\wgm\Virtual Machines
2014-05-24 07:48 - 2014-04-26 06:03 - 00000000 ___SD () C:\Windows\System32\CompatTel
2014-05-24 07:48 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-05-24 07:36 - 2014-01-23 11:48 - 00000000 ____D () C:\Windows\System32\MRT
2014-05-24 07:35 - 2014-01-23 11:48 - 93223848 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2014-05-23 06:30 - 2014-02-04 02:43 - 00000851 _____ () C:\Windows\Brpfx04a.ini
2014-05-23 06:29 - 2014-05-23 06:29 - 00000000 ____D () C:\Users\wgm\AppData\Roaming\PC-FAX TX
2014-05-23 06:29 - 2014-02-04 02:43 - 00000159 _____ () C:\Windows\brpcfx.ini
2014-05-23 06:23 - 2014-05-23 06:23 - 00000000 ___RD () C:\Users\wgm\AppData\Roaming\Brother
2014-05-19 04:55 - 2014-05-19 01:44 - 00000000 ____D () C:\Users\wgm\AppData\OICE_15_974FA576_32C1D314_1781
2014-05-14 23:22 - 2014-02-20 13:21 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-14 23:22 - 2014-02-10 05:09 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-14 23:22 - 2014-02-10 05:09 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-14 09:38 - 2009-07-13 21:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-05-14 09:35 - 2014-05-14 09:35 - 436677762 _____ () C:\Windows\MEMORY.DMP
2014-05-14 09:35 - 2014-05-14 09:35 - 00442624 _____ () C:\Windows\Minidump\051414-19812-01.dmp
2014-05-14 09:35 - 2014-05-14 09:35 - 00000000 ____D () C:\Windows\Minidump
2014-05-13 08:39 - 2009-07-13 19:20 - 00000000 __RHD () C:\Users\Public\Libraries
2014-05-09 02:49 - 2014-04-22 02:06 - 00025621 _____ () C:\Users\wgm\Desktop\winmail.dat
2014-05-08 22:14 - 2014-05-24 07:33 - 00477184 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2014-05-08 22:11 - 2014-05-24 07:33 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2014-05-05 20:40 - 2014-05-24 07:36 - 23544320 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-05-05 20:17 - 2014-05-24 07:36 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2014-05-05 19:25 - 2014-05-24 07:36 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-05 19:07 - 2014-05-24 07:36 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-05 19:00 - 2014-05-24 07:36 - 00084992 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2014-05-05 18:10 - 2014-05-24 07:36 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-02 23:37 - 2014-03-10 01:45 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-02 09:05 - 2014-05-02 05:39 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-04-29 01:49 - 2014-04-29 01:49 - 00012262 _____ () C:\Users\wgm\Documents\Kopie von Preiszusammenstellung e shelter_STUCKE_2750 kVA.xlsx
Some content of TEMP:
====================
C:\Users\User01\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\User01\AppData\Local\Temp\install_reader11_de_mssd_aaa_aih.exe
C:\Users\User01\AppData\Local\Temp\MouseKeyboardCenterx64_1031.exe
C:\Users\User01\AppData\Local\Temp\MSNF77A.exe
C:\Users\User01\AppData\Local\Temp\OfficeSetup.exe
C:\Users\User01\AppData\Local\Temp\Setup.X86.de-DE_HomeBusinessRetail_10e42936-8c3a-4bb0-b237-708a60784538_TX_DB_.exe
C:\Users\wgm\AppData\Local\Temp\0147.dll
C:\Users\wgm\AppData\Local\Temp\uninstall.exe
==================== Known DLLs (Whitelisted) ================
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== Restore Points =========================
Restore point made on: 2014-05-29 02:58:27
Restore point made on: 2014-05-29 05:23:10
Restore point made on: 2014-05-29 05:41:17
Restore point made on: 2014-05-29 06:36:27
==================== Memory info ===========================
Percentage of memory in use: 14%
Total physical RAM: 4030.36 MB
Available physical RAM: 3437.98 MB
Total Pagefile: 4028.5 MB
Available Pagefile: 3431.54 MB
Total Virtual: 8192 MB
Available Virtual: 8191.89 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:60 GB) (Free:14.3 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Daten) (Fixed) (Total:218.76 GB) (Free:217.73 GB) NTFS
Drive e: (HP_RECOVERY) (Fixed) (Total:16.18 GB) (Free:2.43 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (HP_TOOLS) (Fixed) (Total:2.86 GB) (Free:2.85 GB) FAT32
Drive g: (SYSTEM) (Fixed) (Total:0.29 GB) (Free:0.25 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive i: (MY STICK) (Removable) (Total:14.92 GB) (Free:4.58 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.13 GB) (Free:0.12 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 8DC080E5)
Partition 1: (Active) - (Size=298 MB) - (Type=42)
Partition 2: (Not Active) - (Size=60 GB) - (Type=42)
Partition 3: (Not Active) - (Size=238 GB) - (Type=42)
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 15 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=15 GB) - (Type=0C)
LastRegBack: 2014-05-29 00:54
==================== End Of Log ============================
|
| Themen zu Windows 7 hp-Laptop hat nach Start von windows BKA Bildschirm mit 100 Euro Zahlungsaufforderung |
| 100euro, adobe, adobe flash player, antivir, avg, avira, bildschirm, download, euro, explorer, explorer.exe, flash player, microsoft, mozilla, opera, registry, rundll, secur, service.exe, services.exe, start von windows, svchost.exe, system, temp, trojaner, windows, windows xp |
Baum-Darstellung