| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Hartnäckiger Tastaturvirus verhindert das Booten, bedingt mit Shift-Taste deaktivierbarWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
10.06.2015, 23:08
| #1 |
| |  Hartnäckiger Tastaturvirus verhindert das Booten, bedingt mit Shift-Taste deaktivierbar Hallo liebe Helfer, ich habe seit einiger Zeit folgendes Problem mit meinem Laptop: Wenn ich den Laptop neu starten will, kommt der Rechner aus der Boot-Phase nicht heraus, sondern läuft immer wieder die gleiche Bootschleife bis kurz vor dem Auftauchen des Windows-Symbols durch. Nur wenn man - in dem Moment, wo die Auswahlmöglichkeiten zum Wechsel ins BIOS oder Bootmenü auf dem Bildschirm auftauchen - kurz schnell die Shift-Taste drückt, fährt das Betriebssystem zunächst ohne weitere Probleme hoch. Nutzt man den Laptop aber eine Weile, kommt es vor, dass der Virus das Öffnen einer Anwendung mit Einfach- oder Doppelklick (führt beides zum gleichen Ergebnis) verhindert, es sei denn, man drückt vorher kurz die Shift-Taste. Dann scheint der Virus kurzzeitig außer Gefecht gesetzt zu sein und das Programm, das man öffnen will, oder der rechte Mausklick lassen sich kurzzeitig wieder wie gewohnt betätigen, ohne dass ein Programmstart blockiert oder das Kontextmenü nach dem Mausklick wieder verschwindet. Wenn man die Windows-Taste betätigt, um beispielsweise das Startmenü zu öffnen, klickt sich das Startmenü automatisch wieder weg, es sei denn, man betätigt kurz die Shift-Taste. Dies scheint bei dem Virus die einzige kontrollierbare Schwachstelle zu sein. Allerdings hat man nicht wirklich lange seinen Rechner unter Kontrolle bzw. weiß nicht, wie lange der Virus nach dem Betätigen der Shift-Taste inaktiv bleibt. In Anwendungsprogrammen wie Excel oder Word kann es passieren, dass ganze Eingaben plötzlich rückgängig gemacht werden. Zuletzt hat das Ding über mein Heimnetzwerk die Faxverbindung meines Druckers ansteuern wollen und sendete völlig unkontrollierte eingehende Anrufe, solange der Drucker über das Netzwerk mit dem Laptop verbunden war. Also konnte ich schonmal ausschließen, dass das Problem auf den Drucker übersprungen ist und konnte es auf den Laptop eingrenzen. Besorgniserregend an der ganzen Sache ist, dass ich den Schädling selbst dann nicht losgeworden bin, nachdem ich die Festplatte mit DBAN gründlich formatiert (Festplatte 3x überschrieben) habe. Nachdem ich mein Betriebssystem Windos 7 Ultimate installiert habe, hat mich der Virus mit dem ersten Neustart wieder nach alter Manier begrüßt. Nun erhoffe ich mir von Euch die letzte Rettung, bevor ich entnervt und für teures Geld den nächsten Computerladen mit den demütigenden Worten "ich habe mir wohl einen Virus eingefangen, können Sie mir helfen?" aufsuchen muss. Meine Scans ergaben folgende Ergebisse: Additional scan result of Farbar Recovery Scan Tool (x64) Version:08-06-2015 Ran by Bülent at 2015-06-10 21:53:18 Running from C:\Users\Bülent\Downloads Boot Mode: Safe Mode (with Networking) ========================================================== ==================== Accounts: ============================= Administrator (S-1-5-21-2412839086-3049318983-3414219307-500 - Administrator - Disabled) Bülent (S-1-5-21-2412839086-3049318983-3414219307-1000 - Administrator - Enabled) => C:\Users\Bülent Gast (S-1-5-21-2412839086-3049318983-3414219307-501 - Limited - Disabled) HomeGroupUser$ (S-1-5-21-2412839086-3049318983-3414219307-1002 - Limited - Enabled) ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Norton Internet Security (Enabled - Up to date) {53C7D717-52E2-B95E-FA61-6F32ECC805DB} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Norton Internet Security (Enabled - Up to date) {E8A636F3-74D8-B6D0-C0D1-5440974F4F66} FW: Norton Internet Security (Enabled) {6BFC5632-188D-B806-D13E-C607121B42A0} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Avanquest Message (HKU\S-1-5-21-2412839086-3049318983-3414219307-1000\...\{20573C69-4A68-4BEF-A23D-365CB66924CE}) (Version: 2.0.0 - Avanquest Software) CCleaner (HKLM\...\CCleaner) (Version: 5.06 - Piriform) Driver Genius (HKLM-x32\...\Driver Genius_is1) (Version: 15.0 - Driver-Soft Inc.) Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 10.0.38.1036 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.9.4.1000 - Intel Corporation) Intel(R) Wireless Bluetooth(R)(patch version 17.1.1450.402) (HKLM\...\{302600C1-6BDF-4FD1-1411-148929CC1385}) (Version: 17.1.1411.0502 - Intel Corporation) Intel® Chipsatz-Gerätesoftware (x32 Version: 10.0.27 - Intel(R) Corporation) Hidden Intel® PROSet/Wireless WiFi-Software (HKLM\...\{BAA0BE9B-9E6D-4802-91CB-FB7ED5CD4BEF}) (Version: 15.01.1500.1034 - Intel Corporation) Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation) Mozilla Firefox 38.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.5 (x86 de)) (Version: 38.0.5 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 38.0.5 - Mozilla) Norton Internet Security (HKLM-x32\...\NIS) (Version: 21.7.0.11 - Symantec Corporation) Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.370.77 - Realtek Semiconductor Corp.) Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.92.115.2015 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7520 - Realtek Semiconductor Corp.) ==================== Custom CLSID (Whitelisted): ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== Restore Points ========================= ==================== Hosts content: =============================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (Whitelisted) ============= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) Task: {3C444E2C-1938-4564-B5F1-CEF34D5D34C7} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\WSCStub.exe [2015-03-07] (Symantec Corporation) Task: {9899E298-77B5-478D-BF54-AABE2A5B15D9} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-05-08] (Piriform Ltd) Task: {A64DA4E2-F7C4-4AE7-B93B-8823F28F6811} - System32\Tasks\Driver Genius => C:\Program Files (x86)\Driver-Soft\DriverGenius\DriverGenius.exe [2015-05-09] (Driver-Soft Inc.) Task: {D95D6967-F66B-44EA-BD4C-274B7C3DD0AA} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\SymErr.exe [2014-01-30] (Symantec Corporation) Task: {DA2A23AB-89FF-4D7D-9D67-6E440BCDA641} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\SymErr.exe [2014-01-30] (Symantec Corporation) ==================== Loaded Modules (Whitelisted) ============== ==================== Alternate Data Streams (Whitelisted) ========= (If an entry is included in the fixlist, only the ADS will be removed.) ==================== Safe Mode (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="2" ==================== EXE Association (Whitelisted) =============== (If an entry is included in the fixlist, the registry item will be restored to default or removed.) ==================== Internet Explorer trusted/restricted =============== (If an entry is included in the fixlist, it will be removed from the registry.) ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-2412839086-3049318983-3414219307-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Bülent\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg DNS Servers: 192.168.178.1 ==================== MSCONFIG/TASK MANAGER disabled items == (Currently there is no automatic fix for this section.) ==================== FirewallRules (Whitelisted) =============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [{C4C87391-2F1C-4A34-9161-DC97441159B7}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe FirewallRules: [{A23DAD42-8836-4C25-A10F-3861A81ABD61}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{DD4E80DE-CA57-43C8-8611-29A14A2AE455}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe ==================== Faulty Device Manager Devices ============= Name: Security Processor Loader Driver Description: Security Processor Loader Driver Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1} Manufacturer: Service: spldr Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24) Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed. Devices stay in this state if they have been prepared for removal. After you remove the device, this error disappears.Remove the device, and this error should be resolved. Name: Description: Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. Name: Description: Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. ==================== Event log errors: ========================= Application errors: ================== Error: (06/10/2015 09:41:00 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (06/10/2015 09:31:27 PM) (Source: System Restore) (EventID: 8193) (User: ) Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\servicing\TrustedInstaller.exe; Beschreibung = Windows Modules Installer; Fehler = 0x8004231f). Error: (06/10/2015 09:31:22 PM) (Source: System Restore) (EventID: 8193) (User: ) Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\svchost.exe -k netsvcs; Beschreibung = Windows Update; Fehler = 0x8004231f). Error: (06/10/2015 09:09:09 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (06/10/2015 09:07:43 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (06/10/2015 09:06:02 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (06/10/2015 09:04:24 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: ) Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Es steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung. . Error: (06/10/2015 09:04:23 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: ) Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Es steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung. . Error: (06/10/2015 09:04:22 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: ) Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Es steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung. . Error: (06/10/2015 09:04:22 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: ) Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Es steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung. . System errors: ============= Error: (06/10/2015 09:48:42 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error: (06/10/2015 09:48:42 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error: (06/10/2015 09:48:42 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error: (06/10/2015 09:46:42 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error: (06/10/2015 09:46:42 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error: (06/10/2015 09:46:42 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error: (06/10/2015 09:41:44 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error: (06/10/2015 09:41:44 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error: (06/10/2015 09:41:44 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error: (06/10/2015 09:39:54 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Microsoft Office: ========================= Error: (06/10/2015 09:41:00 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (06/10/2015 09:31:27 PM) (Source: System Restore) (EventID: 8193) (User: ) Description: C:\Windows\servicing\TrustedInstaller.exeWindows Modules Installer0x8004231f Error: (06/10/2015 09:31:22 PM) (Source: System Restore) (EventID: 8193) (User: ) Description: C:\Windows\system32\svchost.exe -k netsvcsWindows Update0x8004231f Error: (06/10/2015 09:09:09 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (06/10/2015 09:07:43 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (06/10/2015 09:06:02 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (06/10/2015 09:04:24 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: ) Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEs steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung. Error: (06/10/2015 09:04:23 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: ) Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEs steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung. Error: (06/10/2015 09:04:22 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: ) Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEs steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung. Error: (06/10/2015 09:04:22 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: ) Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEs steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung. ==================== Memory info =========================== Processor: Intel(R) Pentium(R) CPU 2020M @ 2.40GHz Percentage of memory in use: 17% Total physical RAM: 3986.12 MB Available physical RAM: 3273.17 MB Total Pagefile: 7970.43 MB Available Pagefile: 7284.18 MB Total Virtual: 8192 MB Available Virtual: 8191.82 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:16.62 GB) (Free:0 GB) NTFS Drive d: () (Fixed) (Total:449.04 GB) (Free:445.05 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: C08E0645) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=16.6 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=449 GB) - (Type=07 NTFS) ==================== End of log ============================ defogger_disable by jpshortstuff (23.02.10.1) Log created at 21:49 on 10/06/2015 (Bülent) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:08-06-2015 Ran by Bülent (administrator) on BÜLENT-PC on 10-06-2015 21:52:26 Running from C:\Users\Bülent\Downloads Loaded Profiles: Bülent (Available Profiles: Bülent) Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 8 (Default browser: FF) Boot Mode: Safe Mode (with Networking) Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2014-04-24] (Intel Corporation) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13876952 2015-05-20] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg_DTS] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1393880 2015-04-28] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg_DTS_SWVOL] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1393880 2015-04-28] (Realtek Semiconductor) HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe [1174816 2015-01-06] (Intel Corporation) HKU\S-1-5-21-2412839086-3049318983-3414219307-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8322328 2015-05-08] (Piriform Ltd) HKU\S-1-5-21-2412839086-3049318983-3414219307-1000\...\Run: [Avanquest Message] => C:\Users\Bülent\AppData\Local\Avanquest\Avanquest Message\AQNotif.exe [374240 2015-02-27] (Avanquest Software) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-2412839086-3049318983-3414219307-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp SearchScopes: HKU\S-1-5-21-2412839086-3049318983-3414219307-1000 -> DefaultScope {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = hxxp://nortonsafe.search.ask.com/web?q={SEARCHTERMS}&o=APN10506&l=dis&prt=NIS&chn=retail&geo=DE&ver=21&locale=de_DE&gct=sb&qsrc=2869 SearchScopes: HKU\S-1-5-21-2412839086-3049318983-3414219307-1000 -> {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = hxxp://nortonsafe.search.ask.com/web?q={SEARCHTERMS}&o=APN10506&l=dis&prt=NIS&chn=retail&geo=DE&ver=21&locale=de_DE&gct=sb&qsrc=2869 BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine64\21.7.0.11\coIEPlg.dll [2015-03-05] (Symantec Corporation) BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\coIEPlg.dll [2015-03-05] (Symantec Corporation) BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\IPS\IPSBHO.DLL [2015-03-05] (Symantec Corporation) Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.7.0.11\coIEPlg.dll [2015-03-05] (Symantec Corporation) Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\coIEPlg.dll [2015-03-05] (Symantec Corporation) Toolbar: HKU\S-1-5-21-2412839086-3049318983-3414219307-1000 -> Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.7.0.11\coIEPlg.dll [2015-03-05] (Symantec Corporation) Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation) Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation) Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation) Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Bülent\AppData\Roaming\Mozilla\Firefox\Profiles\ufbjzd87.default FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.56 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2015-01-06] (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2015-01-06] (Intel Corporation) FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn [2015-06-10] Chrome: ======= CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - https://clients2.google.com/service/update2/crx CHR HKLM\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\Exts\Chrome.crx [2015-06-10] CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - https://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\Exts\Chrome.crx [2015-06-10] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) S2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2014-04-24] (Intel Corporation) S2 iBtSiva; C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe [125168 2014-12-13] (Intel Corporation) S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887256 2014-05-13] (Intel(R) Corporation) S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [158496 2015-01-06] (Intel Corporation) S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation) S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation) S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2012-04-17] () S2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\NIS.exe [276336 2015-03-07] (Symantec Corporation) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation) S2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2671376 2012-04-17] (Intel® Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) S1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20150602.001\BHDrvx64.sys [1640152 2015-06-02] (Symantec Corporation) S3 btmaux; C:\Windows\System32\DRIVERS\btmaux.sys [141624 2014-10-28] (Motorola Solutions, Inc.) S1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1507000.00B\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation) S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [489776 2015-06-09] (Symantec Corporation) S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [145200 2015-06-09] (Symantec Corporation) R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2014-04-24] (Intel Corporation) S1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20150609.002\IDSvia64.sys [684248 2015-06-08] (Symantec Corporation) S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation) S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-06-10] (Malwarebytes Corporation) S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation) R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [129312 2015-01-06] (Intel Corporation) S3 NAVENG; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20150609.032\ENG64.SYS [129752 2015-06-09] (Symantec Corporation) S3 NAVEX15; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20150609.032\EX64.SYS [2137304 2015-06-09] (Symantec Corporation) R3 NETwNs64; C:\Windows\System32\DRIVERS\NETwsw01.sys [11532704 2015-01-10] (Intel Corporation) S3 RTSUER; C:\Windows\System32\Drivers\RtsUer.sys [391896 2015-02-06] (Realsil Semiconductor Corporation) S3 SRTSP; C:\Windows\System32\Drivers\NISx64\1507000.00B\SRTSP64.SYS [876248 2014-08-26] (Symantec Corporation) S1 SRTSPX; C:\Windows\system32\drivers\NISx64\1507000.00B\SRTSPX64.SYS [37592 2014-08-26] (Symantec Corporation) R0 SymDS; C:\Windows\System32\drivers\NISx64\1507000.00B\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation) R0 SymEFA; C:\Windows\System32\drivers\NISx64\1507000.00B\SYMEFA64.SYS [1148120 2014-08-26] (Symantec Corporation) S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2015-06-09] (Symantec Corporation) S1 SymIRON; C:\Windows\system32\drivers\NISx64\1507000.00B\Ironx64.SYS [266968 2014-08-06] (Symantec Corporation) S1 SymNetS; C:\Windows\System32\Drivers\NISx64\1507000.00B\SYMNETS.SYS [593112 2014-08-26] (Symantec Corporation) S3 VGPU; System32\drivers\rdvgkmd.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-06-10 21:52 - 2015-06-10 21:52 - 00010753 _____ C:\Users\Bülent\Downloads\FRST.txt 2015-06-10 21:52 - 2015-06-10 21:52 - 00000000 ____D C:\FRST 2015-06-10 21:51 - 2015-06-10 21:51 - 02108928 _____ (Farbar) C:\Users\Bülent\Downloads\FRST64.exe 2015-06-10 21:45 - 2015-06-10 21:49 - 00000474 _____ C:\Users\Bülent\Downloads\defogger_disable.log 2015-06-10 21:45 - 2015-06-10 21:45 - 00000000 _____ C:\Users\Bülent\defogger_reenable 2015-06-10 21:43 - 2015-06-10 21:44 - 00050477 _____ C:\Users\Bülent\Downloads\Defogger.exe 2015-06-10 21:17 - 2015-06-10 21:17 - 00000000 ____D C:\Windows\System32\Tasks\Norton Internet Security 2015-06-10 21:12 - 2015-06-10 21:12 - 00003234 _____ C:\Windows\System32\Tasks\Norton WSC Integration 2015-06-10 19:28 - 2013-04-12 16:45 - 01656680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys 2015-06-10 19:25 - 2014-05-08 11:32 - 01112064 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll 2015-06-10 19:24 - 2015-01-14 08:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-06-10 19:24 - 2015-01-14 08:09 - 00155064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2015-06-10 19:24 - 2015-01-14 08:09 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2015-06-10 19:24 - 2015-01-14 08:05 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2015-06-10 19:24 - 2015-01-14 08:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2015-06-10 19:24 - 2015-01-14 08:05 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2015-06-10 19:24 - 2015-01-14 08:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll 2015-06-10 19:24 - 2015-01-14 08:05 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2015-06-10 19:24 - 2015-01-14 08:05 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2015-06-10 19:24 - 2015-01-14 08:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe 2015-06-10 19:24 - 2015-01-14 08:04 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe 2015-06-10 19:24 - 2015-01-14 08:04 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2015-06-10 19:24 - 2015-01-14 08:02 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2015-06-10 19:24 - 2015-01-14 08:02 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll 2015-06-10 19:24 - 2015-01-14 07:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2015-06-10 19:24 - 2015-01-14 07:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2015-06-10 19:24 - 2015-01-14 07:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2015-06-10 19:24 - 2015-01-14 07:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll 2015-06-10 19:24 - 2015-01-14 07:41 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2015-06-10 19:24 - 2015-01-14 07:40 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2015-06-10 19:24 - 2015-01-14 07:40 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe 2015-06-10 19:24 - 2015-01-14 07:38 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll 2015-06-10 19:24 - 2015-01-14 07:37 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll 2015-06-10 19:24 - 2015-01-14 07:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2015-06-10 19:24 - 2014-12-30 03:23 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2015-06-10 19:24 - 2014-11-11 05:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2015-06-10 19:24 - 2014-11-11 04:44 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2015-06-10 19:24 - 2014-09-19 11:42 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2015-06-10 19:24 - 2014-09-19 11:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2015-06-10 19:24 - 2014-09-19 11:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2015-06-10 19:24 - 2014-09-19 11:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2015-06-10 19:24 - 2014-09-19 11:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2015-06-10 19:24 - 2014-09-19 11:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2015-06-10 19:24 - 2014-09-19 11:23 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2015-06-10 19:24 - 2014-09-19 11:23 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2015-06-10 19:24 - 2014-09-19 11:23 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2015-06-10 19:24 - 2014-09-19 11:23 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2015-06-10 19:24 - 2014-09-19 11:23 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2015-06-10 19:24 - 2014-09-19 11:23 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2015-06-10 19:24 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll 2015-06-10 19:24 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll 2015-06-10 19:24 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll 2015-06-10 19:24 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe 2015-06-10 19:22 - 2015-02-03 05:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll 2015-06-10 19:22 - 2015-02-03 05:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll 2015-06-10 19:20 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2015-06-10 19:20 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS 2015-06-10 19:20 - 2014-01-29 04:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll 2015-06-10 19:20 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll 2015-06-10 19:20 - 2013-11-27 03:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys 2015-06-10 19:20 - 2013-11-27 03:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys 2015-06-10 19:20 - 2013-11-27 03:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys 2015-06-10 19:20 - 2013-11-27 03:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys 2015-06-10 19:20 - 2013-11-27 03:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys 2015-06-10 19:20 - 2013-11-26 13:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys 2015-06-10 19:20 - 2013-10-05 22:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2015-06-10 19:20 - 2013-10-05 21:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2015-06-10 19:20 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll 2015-06-10 19:20 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll 2015-06-10 19:20 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll 2015-06-10 19:20 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll 2015-06-10 19:19 - 2014-12-08 05:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll 2015-06-10 19:19 - 2014-12-08 04:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll 2015-06-10 19:19 - 2013-10-19 04:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll 2015-06-10 19:19 - 2013-10-19 03:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll 2015-06-10 19:19 - 2013-10-12 04:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx 2015-06-10 19:19 - 2013-10-12 04:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll 2015-06-10 19:19 - 2013-10-12 04:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx 2015-06-10 19:19 - 2013-10-12 04:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll 2015-06-10 19:19 - 2013-10-12 03:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe 2015-06-10 19:19 - 2013-10-12 03:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe 2015-06-10 19:19 - 2013-10-12 03:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe 2015-06-10 19:19 - 2013-10-12 03:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe 2015-06-10 19:19 - 2013-05-13 07:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll 2015-06-10 19:19 - 2013-05-13 05:43 - 01192448 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe 2015-06-10 19:19 - 2013-05-13 05:08 - 00903168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe 2015-06-10 19:19 - 2013-05-13 05:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll 2015-06-10 19:19 - 2012-03-17 09:58 - 00075120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\partmgr.sys 2015-06-10 19:19 - 2012-03-01 08:46 - 00023408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fs_rec.sys 2015-06-10 19:19 - 2012-03-01 08:28 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\wmi.dll 2015-06-10 19:19 - 2012-03-01 07:29 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmi.dll 2015-06-10 19:19 - 2011-12-16 10:46 - 00634880 _____ (Microsoft Corporation) C:\Windows\system32\msvcrt.dll 2015-06-10 19:19 - 2011-12-16 09:52 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcrt.dll 2015-06-10 19:19 - 2011-05-03 07:29 - 00976896 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll 2015-06-10 19:19 - 2011-05-03 06:30 - 00741376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll 2015-06-10 19:18 - 2012-07-05 00:16 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\netapi32.dll 2015-06-10 19:18 - 2012-07-05 00:13 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\browser.dll 2015-06-10 19:18 - 2012-07-05 00:13 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\browcli.dll 2015-06-10 19:18 - 2012-07-04 23:16 - 00057344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netapi32.dll 2015-06-10 19:18 - 2012-07-04 23:14 - 00041984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\browcli.dll 2015-06-10 19:18 - 2011-02-12 13:34 - 00267776 _____ (Microsoft Corporation) C:\Windows\system32\FXSCOVER.exe 2015-06-10 00:13 - 2015-06-10 21:05 - 00001664 _____ C:\Windows\PFRO.log 2015-06-10 00:07 - 2015-06-10 00:07 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_btmaux_01009.Wdf 2015-06-10 00:07 - 2015-06-10 00:07 - 00000000 ____D C:\Users\Bülent\Documents\Meine empfangenen Dateien 2015-06-10 00:02 - 2015-06-10 21:34 - 00009734 _____ C:\Windows\SysWOW64\Gms.log 2015-06-10 00:02 - 2013-08-30 11:21 - 07584752 _____ (Intel Corporation) C:\Windows\system32\GfxUIEx.exe 2015-06-10 00:02 - 2013-08-30 11:21 - 00843248 _____ (Intel Corporation) C:\Windows\system32\igfxsrvc.exe 2015-06-10 00:02 - 2013-08-30 11:21 - 00771056 _____ (Intel Corporation) C:\Windows\system32\hkcmd.exe 2015-06-10 00:02 - 2013-08-30 11:21 - 00769520 _____ (Intel Corporation) C:\Windows\system32\igfxpers.exe 2015-06-10 00:02 - 2013-08-30 11:21 - 00754672 _____ (Intel Corporation) C:\Windows\system32\GfxUIHotKeyMenu.exe 2015-06-10 00:02 - 2013-08-30 11:21 - 00531440 _____ (Intel Corporation) C:\Windows\system32\DPTopologyApp.exe 2015-06-10 00:02 - 2013-08-30 11:21 - 00396784 _____ (Intel Corporation) C:\Windows\system32\CustomModeApp.exe 2015-06-10 00:02 - 2013-08-30 11:21 - 00391152 _____ (Intel Corporation) C:\Windows\system32\igfxtray.exe 2015-06-10 00:02 - 2013-08-30 11:21 - 00386544 _____ (Intel Corporation) C:\Windows\system32\igfxext.exe 2015-06-10 00:02 - 2013-08-30 11:21 - 00279024 _____ (Intel Corporation) C:\Windows\SysWOW64\IntelCpHeciSvc.exe 2015-06-10 00:02 - 2013-08-30 11:21 - 00153072 _____ (Intel Corporation) C:\Windows\system32\difx64.exe 2015-06-10 00:02 - 2013-08-26 05:39 - 00002980 _____ C:\Windows\system32\iglhxs64.vp 2015-06-10 00:02 - 2013-08-26 05:37 - 13739008 _____ (Intel Corporation) C:\Windows\system32\igd10iumd64.dll 2015-06-10 00:02 - 2013-08-26 05:37 - 13136384 _____ (Intel Corporation) C:\Windows\SysWOW64\igd10iumd32.dll 2015-06-10 00:02 - 2013-08-26 05:37 - 12078592 _____ (Intel Corporation) C:\Windows\system32\igdumdim64.dll 2015-06-10 00:02 - 2013-08-26 05:37 - 11368960 _____ (Intel Corporation) C:\Windows\SysWOW64\igdumdim32.dll 2015-06-10 00:02 - 2013-08-26 05:37 - 09081856 _____ (Intel Corporation) C:\Windows\system32\igfxress.dll 2015-06-10 00:02 - 2013-08-26 05:37 - 07850496 _____ (Intel Corporation) C:\Windows\system32\ig7icd64.dll 2015-06-10 00:02 - 2013-08-26 05:37 - 06235136 _____ (Intel Corporation) C:\Windows\SysWOW64\ig7icd32.dll 2015-06-10 00:02 - 2013-08-26 05:37 - 04166656 _____ (Intel Corporation) C:\Windows\system32\Drivers\igdkmd64.sys 2015-06-10 00:02 - 2013-08-26 05:37 - 04067328 _____ (Intel Corporation) C:\Windows\system32\MetroIntelGenericUIFramework.dll 2015-06-10 00:02 - 2013-08-26 05:37 - 02384896 _____ C:\Windows\system32\GfxRes.dll 2015-06-10 00:02 - 2013-08-26 05:37 - 00622080 _____ (Intel Corporation) C:\Windows\system32\igfxdev.dll 2015-06-10 00:02 - 2013-08-26 05:37 - 00548864 _____ (Intel Corporation) C:\Windows\system32\igfxpph.dll 2015-06-10 00:02 - 2013-08-26 05:37 - 00527360 _____ (Intel Corporation) C:\Windows\system32\igfxrell.lrc 2015-06-10 00:02 - 2013-08-26 05:37 - 00526848 _____ (Intel Corporation) C:\Windows\system32\igfxrplk.lrc 2015-06-10 00:02 - 2013-08-26 05:37 - 00526848 _____ (Intel Corporation) C:\Windows\system32\igfxrfra.lrc 2015-06-10 00:02 - 2013-08-26 05:37 - 00526848 _____ (Intel Corporation) C:\Windows\system32\igfxresn.lrc 2015-06-10 00:02 - 2013-08-26 05:37 - 00526336 _____ (Intel Corporation) C:\Windows\system32\igfxrrus.lrc 2015-06-10 00:02 - 2013-08-26 05:37 - 00526336 _____ (Intel Corporation) C:\Windows\system32\igfxrnld.lrc 2015-06-10 00:02 - 2013-08-26 05:37 - 00526336 _____ (Intel Corporation) C:\Windows\system32\igfxrdeu.lrc 2015-06-10 00:02 - 2013-08-26 05:37 - 00525824 _____ (Intel Corporation) C:\Windows\system32\igfxrsky.lrc 2015-06-10 00:02 - 2013-08-26 05:37 - 00525824 _____ (Intel Corporation) C:\Windows\system32\igfxrrom.lrc 2015-06-10 00:02 - 2013-08-26 05:37 - 00525824 _____ (Intel Corporation) C:\Windows\system32\igfxrita.lrc 2015-06-10 00:02 - 2013-08-26 05:37 - 00525312 _____ (Intel Corporation) C:\Windows\system32\igfxrptg.lrc 2015-06-10 00:02 - 2013-08-26 05:37 - 00525312 _____ (Intel Corporation) C:\Windows\system32\igfxrhun.lrc 2015-06-10 00:02 - 2013-08-26 05:37 - 00525312 _____ (Intel Corporation) C:\Windows\system32\igfxrhrv.lrc 2015-06-10 00:02 - 2013-08-26 05:37 - 00525312 _____ (Intel Corporation) C:\Windows\system32\igfxrcsy.lrc 2015-06-10 00:02 - 2013-08-26 05:37 - 00524800 _____ (Intel Corporation) C:\Windows\system32\igfxrsve.lrc 2015-06-10 00:02 - 2013-08-26 05:37 - 00524800 _____ (Intel Corporation) C:\Windows\system32\igfxrslv.lrc 2015-06-10 00:02 - 2013-08-26 05:37 - 00524800 _____ (Intel Corporation) C:\Windows\system32\igfxrfin.lrc 2015-06-10 00:02 - 2013-08-26 05:37 - 00524288 _____ (Intel Corporation) C:\Windows\system32\igfxrtrk.lrc 2015-06-10 00:02 - 2013-08-26 05:37 - 00524288 _____ (Intel Corporation) C:\Windows\system32\igfxrptb.lrc 2015-06-10 00:02 - 2013-08-26 05:37 - 00523776 _____ (Intel Corporation) C:\Windows\system32\igfxrtha.lrc 2015-06-10 00:02 - 2013-08-26 05:37 - 00523776 _____ (Intel Corporation) C:\Windows\system32\igfxrnor.lrc 2015-06-10 00:02 - 2013-08-26 05:37 - 00523776 _____ (Intel Corporation) C:\Windows\system32\igfxrdan.lrc 2015-06-10 00:02 - 2013-08-26 05:37 - 00522240 _____ (Intel Corporation) C:\Windows\system32\igfxrheb.lrc 2015-06-10 00:02 - 2013-08-26 05:37 - 00521728 _____ (Intel Corporation) C:\Windows\system32\igfxrara.lrc 2015-06-10 00:02 - 2013-08-26 05:37 - 00517120 _____ (Intel Corporation) C:\Windows\system32\igfxrjpn.lrc 2015-06-10 00:02 - 2013-08-26 05:37 - 00516096 _____ (Intel Corporation) C:\Windows\system32\igfxrkor.lrc 2015-06-10 00:02 - 2013-08-26 05:37 - 00513536 _____ (Intel Corporation) C:\Windows\system32\igfxrcht.lrc 2015-06-10 00:02 - 2013-08-26 05:37 - 00513024 _____ (Intel Corporation) C:\Windows\system32\igfxrchs.lrc 2015-06-10 00:02 - 2013-08-26 05:37 - 00371200 _____ (Intel Corporation) C:\Windows\system32\igfxrenu.lrc 2015-06-10 00:02 - 2013-08-26 05:37 - 00365568 _____ C:\Windows\system32\igdmd64.dll 2015-06-10 00:02 - 2013-08-26 05:37 - 00345600 _____ (Intel Corporation) C:\Windows\system32\igfxTMM.dll 2015-06-10 00:02 - 2013-08-26 05:37 - 00303104 _____ C:\Windows\SysWOW64\igdmd32.dll 2015-06-10 00:02 - 2013-08-26 05:37 - 00279040 _____ (Intel Corporation) C:\Windows\system32\igfxcpl.cpl 2015-06-10 00:02 - 2013-08-26 05:37 - 00265276 _____ C:\Windows\system32\Gfxres.th-TH.resources 2015-06-10 00:02 - 2013-08-26 05:37 - 00251789 _____ C:\Windows\system32\Gfxres.el-GR.resources 2015-06-10 00:02 - 2013-08-26 05:37 - 00243712 _____ (Intel Corporation) C:\Windows\system32\igfxdo.dll 2015-06-10 00:02 - 2013-08-26 05:37 - 00233511 _____ C:\Windows\system32\Gfxres.ru-RU.resources 2015-06-10 00:02 - 2013-08-26 05:37 - 00223744 _____ (Intel Corporation) C:\Windows\system32\hccutils.dll 2015-06-10 00:02 - 2013-08-26 05:37 - 00220672 _____ C:\Windows\system32\igdde64.dll 2015-06-10 00:02 - 2013-08-26 05:37 - 00199408 _____ C:\Windows\system32\Gfxres.ar-SA.resources 2015-06-10 00:02 - 2013-08-26 05:37 - 00196971 _____ C:\Windows\system32\Gfxres.ja-JP.resources 2015-06-10 00:02 - 2013-08-26 05:37 - 00194048 _____ (Intel Corporation) C:\Windows\system32\gfxSrvc.dll 2015-06-10 00:02 - 2013-08-26 05:37 - 00191013 _____ C:\Windows\system32\Gfxres.he-IL.resources 2015-06-10 00:02 - 2013-08-26 05:37 - 00180736 _____ C:\Windows\SysWOW64\igdde32.dll 2015-06-10 00:02 - 2013-08-26 05:37 - 00179280 _____ C:\Windows\system32\Gfxres.ko-KR.resources 2015-06-10 00:02 - 2013-08-26 05:37 - 00179165 _____ C:\Windows\system32\Gfxres.it-IT.resources 2015-06-10 00:02 - 2013-08-26 05:37 - 00176878 _____ C:\Windows\system32\Gfxres.es-ES.resources 2015-06-10 00:02 - 2013-08-26 05:37 - 00176612 _____ C:\Windows\system32\Gfxres.fr-FR.resources 2015-06-10 00:02 - 2013-08-26 05:37 - 00176565 _____ C:\Windows\system32\Gfxres.de-DE.resources 2015-06-10 00:02 - 2013-08-26 05:37 - 00175186 _____ C:\Windows\system32\Gfxres.ro-RO.resources 2015-06-10 00:02 - 2013-08-26 05:37 - 00174171 _____ C:\Windows\system32\Gfxres.hu-HU.resources 2015-06-10 00:02 - 2013-08-26 05:37 - 00173880 _____ C:\Windows\system32\Gfxres.tr-TR.resources 2015-06-10 00:02 - 2013-08-26 05:37 - 00173740 _____ C:\Windows\system32\Gfxres.pl-PL.resources 2015-06-10 00:02 - 2013-08-26 05:37 - 00173421 _____ C:\Windows\system32\Gfxres.nl-NL.resources 2015-06-10 00:02 - 2013-08-26 05:37 - 00172688 _____ C:\Windows\system32\Gfxres.pt-BR.resources 2015-06-10 00:02 - 2013-08-26 05:37 - 00171968 _____ C:\Windows\system32\Gfxres.fi-FI.resources 2015-06-10 00:02 - 2013-08-26 05:37 - 00171636 _____ C:\Windows\system32\Gfxres.sk-SK.resources 2015-06-10 00:02 - 2013-08-26 05:37 - 00171474 _____ C:\Windows\system32\Gfxres.sv-SE.resources 2015-06-10 00:02 - 2013-08-26 05:37 - 00171244 _____ C:\Windows\system32\Gfxres.pt-PT.resources 2015-06-10 00:02 - 2013-08-26 05:37 - 00170923 _____ C:\Windows\system32\Gfxres.cs-CZ.resources 2015-06-10 00:02 - 2013-08-26 05:37 - 00170102 _____ C:\Windows\system32\Gfxres.hr-HR.resources 2015-06-10 00:02 - 2013-08-26 05:37 - 00166599 _____ C:\Windows\system32\Gfxres.sl-SI.resources 2015-06-10 00:02 - 2013-08-26 05:37 - 00165301 _____ C:\Windows\system32\Gfxres.nb-NO.resources 2015-06-10 00:02 - 2013-08-26 05:37 - 00164625 _____ C:\Windows\system32\Gfxres.da-DK.resources 2015-06-10 00:02 - 2013-08-26 05:37 - 00160256 _____ C:\Windows\system32\igdail64.dll 2015-06-10 00:02 - 2013-08-26 05:37 - 00159874 _____ C:\Windows\system32\Gfxres.en-US.resources 2015-06-10 00:02 - 2013-08-26 05:37 - 00153176 _____ C:\Windows\system32\Gfxres.zh-TW.resources 2015-06-10 00:02 - 2013-08-26 05:37 - 00151397 _____ C:\Windows\system32\Gfxres.zh-CN.resources 2015-06-10 00:02 - 2013-08-26 05:37 - 00142848 _____ C:\Windows\SysWOW64\igdail32.dll 2015-06-10 00:02 - 2013-08-26 05:37 - 00066048 _____ (Intel Corporation) C:\Windows\system32\igfxsrvc.dll 2015-06-10 00:02 - 2013-08-26 05:37 - 00029184 _____ (Intel Corporation) C:\Windows\system32\igfxexps.dll 2015-06-10 00:02 - 2013-08-26 05:37 - 00012288 _____ ( ) C:\Windows\system32\IGFXDEVLib.dll 2015-06-10 00:02 - 2013-08-26 05:36 - 00491520 _____ (Intel Corporation) C:\Windows\SysWOW64\igfxdv32.dll 2015-06-10 00:02 - 2013-08-26 05:36 - 00025088 _____ (Intel Corporation) C:\Windows\SysWOW64\igfxexps32.dll 2015-06-10 00:02 - 2013-08-26 05:23 - 04413952 _____ (Intel Corporation) C:\Windows\system32\igdusc64.dll 2015-06-10 00:02 - 2013-08-26 05:23 - 03507200 _____ (Intel Corporation) C:\Windows\SysWOW64\igdusc32.dll 2015-06-10 00:02 - 2013-08-12 12:52 - 02813952 _____ C:\Windows\system32\iglhxa64.cpa 2015-06-10 00:02 - 2013-08-12 12:52 - 02064896 _____ (Intel Corporation) C:\Windows\system32\igfxcmjit64.dll 2015-06-10 00:02 - 2013-08-12 12:52 - 01814016 _____ (Intel Corporation) C:\Windows\SysWOW64\igfxcmjit32.dll 2015-06-10 00:02 - 2013-08-12 12:52 - 01127424 _____ (Intel Corporation) C:\Windows\system32\iglhsip64.dll 2015-06-10 00:02 - 2013-08-12 12:52 - 01123328 _____ (Intel Corporation) C:\Windows\SysWOW64\iglhsip32.dll 2015-06-10 00:02 - 2013-08-12 12:52 - 00214528 _____ (Intel Corporation) C:\Windows\system32\iglhcp64.dll 2015-06-10 00:02 - 2013-08-12 12:52 - 00179712 _____ (Intel Corporation) C:\Windows\SysWOW64\iglhcp32.dll 2015-06-10 00:02 - 2013-08-12 12:52 - 00151552 _____ (Intel Corporation) C:\Windows\system32\igfxcmrt64.dll 2015-06-10 00:02 - 2013-08-12 12:52 - 00143360 _____ (Intel Corporation) C:\Windows\system32\igfx11cmrt64.dll 2015-06-10 00:02 - 2013-08-12 12:52 - 00129024 _____ (Intel Corporation) C:\Windows\SysWOW64\igfxcmrt32.dll 2015-06-10 00:02 - 2013-08-12 12:52 - 00122880 _____ (Intel Corporation) C:\Windows\SysWOW64\igfx11cmrt32.dll 2015-06-10 00:02 - 2013-08-12 12:52 - 00094208 _____ C:\Windows\system32\IccLibDll_x64.dll 2015-06-10 00:02 - 2013-08-12 12:52 - 00044025 _____ C:\Windows\system32\iglhxo64.vp 2015-06-10 00:02 - 2013-08-12 12:52 - 00043816 _____ C:\Windows\system32\iglhxc64_dev.vp 2015-06-10 00:02 - 2013-08-12 12:52 - 00043494 _____ C:\Windows\system32\iglhxc64.vp 2015-06-10 00:02 - 2013-08-12 12:52 - 00043298 _____ C:\Windows\system32\iglhxg64_dev.vp 2015-06-10 00:02 - 2013-08-12 12:52 - 00043256 _____ C:\Windows\system32\iglhxg64.vp 2015-06-10 00:02 - 2013-08-12 12:52 - 00042079 _____ C:\Windows\system32\iglhxo64_dev.vp 2015-06-10 00:02 - 2013-08-12 12:52 - 00001125 _____ C:\Windows\system32\iglhxa64.vp 2015-06-10 00:00 - 2015-06-10 00:00 - 00000000 ____H C:\Windows\system32\Drivers\MsftWdf_Kernel_01011_Coinstaller_Critical.Wdf 2015-06-10 00:00 - 2015-06-10 00:00 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_TeeDriverx64_01011.Wdf 2015-06-09 23:59 - 2012-07-26 06:55 - 00785512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys 2015-06-09 23:59 - 2012-07-26 06:55 - 00054376 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfLdr.sys 2015-06-09 23:59 - 2012-07-26 04:36 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\Wdfres.dll 2015-06-09 23:59 - 2012-06-02 16:35 - 00000003 _____ C:\Windows\system32\Drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf 2015-06-09 23:58 - 2015-06-10 21:08 - 00002600 _____ C:\Windows\setupact.log 2015-06-09 23:58 - 2015-06-09 23:58 - 00000000 ____H C:\ProgramData\DP45977C.lfl 2015-06-09 23:58 - 2015-06-09 23:58 - 00000000 ____D C:\Windows\SysWOW64\RTCOM 2015-06-09 23:58 - 2015-06-09 23:58 - 00000000 ____D C:\Program Files\Realtek 2015-06-09 23:58 - 2015-06-09 23:58 - 00000000 _____ C:\Windows\setuperr.log 2015-06-09 23:57 - 2015-05-26 18:55 - 04468952 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHD64.sys 2015-06-09 23:57 - 2015-05-26 17:26 - 01746136 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoInstII64.dll 2015-06-09 23:57 - 2015-05-26 16:59 - 02072039 _____ C:\Windows\system32\Drivers\RTAIODAT.DAT 2015-06-09 23:57 - 2015-05-26 13:42 - 02847448 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RltkAPO64.dll 2015-06-09 23:57 - 2015-05-26 13:42 - 02531544 _____ (Realtek Semiconductor Corp.) C:\Windows\SysWOW64\RltkAPO.dll 2015-06-09 23:57 - 2015-05-26 11:59 - 00166616 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCfg64.dll 2015-06-09 23:57 - 2015-05-20 16:14 - 03234520 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApi64.dll 2015-06-09 23:57 - 2015-05-18 14:47 - 02702040 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSnMg64.cpl 2015-06-09 23:57 - 2015-05-15 19:27 - 02918104 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtPgEx64.dll 2015-06-09 23:57 - 2015-05-15 16:32 - 01316056 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTCOM64.dll 2015-06-09 23:57 - 2015-04-28 10:52 - 05706688 _____ (Nahimic Inc) C:\Windows\system32\NAHIMICV2apo.dll 2015-06-09 23:57 - 2015-04-27 16:09 - 00328816 _____ (ICEpower a/s) C:\Windows\system32\ICEsoundAPO64.dll 2015-06-09 23:57 - 2015-04-24 05:42 - 00858256 _____ (Sound Research, Corp.) C:\Windows\system32\SEHDRA64.dll 2015-06-09 23:57 - 2015-04-24 05:42 - 00684176 _____ (Sound Research, Corp.) C:\Windows\system32\SECOMN64.dll 2015-06-09 23:57 - 2015-04-24 05:42 - 00435856 _____ (Sound Research, Corp.) C:\Windows\system32\SEAPO64.dll 2015-06-09 23:57 - 2015-04-24 05:41 - 00555664 _____ (Sound Research, Corp.) C:\Windows\SysWOW64\SECOMN32.DLL 2015-06-09 23:57 - 2015-04-13 16:25 - 03262184 _____ (Yamaha Corporation) C:\Windows\system32\YamahaAE2.dll 2015-06-09 23:57 - 2015-04-09 15:23 - 01559744 _____ (Conexant Systems Inc.) C:\Windows\system32\CX64APO.dll 2015-06-09 23:57 - 2015-04-03 13:24 - 01365768 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO6064.dll 2015-06-09 23:57 - 2015-03-08 12:22 - 03182104 _____ (Fortemedia Corporation) C:\Windows\system32\FMAPO64.dll 2015-06-09 23:57 - 2015-02-05 17:48 - 12834736 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVoiceAPO4064.dll 2015-06-09 23:57 - 2015-02-05 17:48 - 02789808 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO7064.dll 2015-06-09 23:57 - 2015-02-04 00:38 - 01413776 _____ (Synopsys, Inc.) C:\Windows\system32\SRRPTR64.dll 2015-06-09 23:57 - 2015-02-04 00:38 - 00454288 _____ (Synopsys, Inc.) C:\Windows\system32\SRAPO64.dll 2015-06-09 23:57 - 2015-02-04 00:38 - 00369296 _____ (Synopsys, Inc.) C:\Windows\system32\SRCOM64.dll 2015-06-09 23:57 - 2015-02-04 00:38 - 00329360 _____ (Synopsys, Inc.) C:\Windows\SysWOW64\SRCOM.dll 2015-06-09 23:57 - 2015-02-04 00:38 - 00329360 _____ (Synopsys, Inc.) C:\Windows\system32\SRCOM.dll 2015-06-09 23:57 - 2015-01-23 18:16 - 00213432 _____ (TOSHIBA Corporation) C:\Windows\system32\tossaemaxapo64.dll 2015-06-09 23:57 - 2015-01-19 18:10 - 72113152 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoRes64.dat 2015-06-09 23:57 - 2015-01-19 09:08 - 12975360 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVoiceAPO3064.dll 2015-06-09 23:57 - 2014-12-11 08:10 - 01104040 _____ (SRS Labs, Inc.) C:\Windows\system32\slcnt64.dll 2015-06-09 23:57 - 2014-12-11 08:10 - 00943784 _____ (DTS, Inc.) C:\Windows\system32\sl3apo64.dll 2015-06-09 23:57 - 2014-12-11 08:10 - 00734376 _____ (DTS, Inc.) C:\Windows\system32\sltech64.dll 2015-06-09 23:57 - 2014-12-11 08:10 - 00250536 _____ (TODO: <Company name>) C:\Windows\system32\slprp64.dll 2015-06-09 23:57 - 2014-11-11 13:44 - 00631000 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtDataProc64.dll 2015-06-09 23:57 - 2014-11-04 13:42 - 06242576 _____ (Dolby Laboratories) C:\Windows\system32\DDPP64AF3.dll 2015-06-09 23:57 - 2014-11-04 13:42 - 01933584 _____ (Dolby Laboratories) C:\Windows\system32\DDPD64AF3.dll 2015-06-09 23:57 - 2014-11-04 13:42 - 00336144 _____ (Dolby Laboratories) C:\Windows\system32\DDPO64AF3.dll 2015-06-09 23:57 - 2014-11-04 13:42 - 00284944 _____ (Dolby Laboratories) C:\Windows\system32\DDPA64F3.dll 2015-06-09 23:57 - 2014-10-24 10:12 - 05234952 _____ (Nahimic Inc) C:\Windows\system32\NAHIMICAPOlfx.dll 2015-06-09 23:57 - 2014-10-24 10:12 - 00995120 _____ (Nahimic Inc) C:\Windows\system32\NahimicAPONSControl.dll 2015-06-09 23:57 - 2014-09-24 11:31 - 07087448 _____ (Dolby Laboratories) C:\Windows\system32\DDPP64A.dll 2015-06-09 23:57 - 2014-09-24 11:31 - 01939800 _____ (Dolby Laboratories) C:\Windows\system32\DDPD64A.dll 2015-06-09 23:57 - 2014-09-24 11:31 - 00315736 _____ (Dolby Laboratories) C:\Windows\system32\DDPO64A.dll 2015-06-09 23:57 - 2014-09-24 11:31 - 00261464 _____ (Dolby Laboratories) C:\Windows\system32\DDPA64.dll 2015-06-09 23:57 - 2014-08-14 19:16 - 05804772 _____ C:\Windows\system32\Drivers\rtvienna.dat 2015-06-09 23:57 - 2014-07-03 14:44 - 01499984 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO5064.dll 2015-06-09 23:57 - 2014-07-03 14:44 - 00979280 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVoiceAPO2064.dll 2015-06-09 23:57 - 2014-06-17 19:17 - 00856992 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo264.dll 2015-06-09 23:57 - 2014-06-09 10:59 - 00560328 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAC64.dll 2015-06-09 23:57 - 2014-05-22 16:24 - 00096568 _____ C:\Windows\system32\audioLibVc.dll 2015-06-09 23:57 - 2014-04-17 17:42 - 01136728 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO4064.dll 2015-06-09 23:57 - 2014-04-10 12:19 - 02101848 _____ (Waves Audio Ltd.) C:\Windows\system32\WavesGUILib64.dll 2015-06-09 23:57 - 2014-04-10 12:19 - 02041432 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioEQ64.dll 2015-06-09 23:57 - 2014-02-27 20:02 - 02162992 _____ (Yamaha Corporation) C:\Windows\system32\YamahaAE.dll 2015-06-09 23:57 - 2014-01-31 17:27 - 01313904 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxSpeechAPO64.dll 2015-06-09 23:57 - 2013-10-11 12:47 - 00113576 _____ (Real Sound Lab SIA) C:\Windows\system32\CONEQMSAPOGUILibrary.dll 2015-06-09 23:57 - 2013-10-11 11:31 - 00947760 _____ (Sony Corporation) C:\Windows\system32\SFSS_APO.dll 2015-06-09 23:57 - 2013-10-07 00:26 - 00501184 _____ (DTS) C:\Windows\system32\DTSU2PLFX64.dll 2015-06-09 23:57 - 2013-10-07 00:26 - 00487360 _____ (DTS) C:\Windows\system32\DTSU2PGFX64.dll 2015-06-09 23:57 - 2013-10-07 00:26 - 00415680 _____ (DTS) C:\Windows\system32\DTSU2PREC64.dll 2015-06-09 23:57 - 2013-08-14 15:36 - 00662784 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVolumeSDAPO.dll 2015-06-09 23:57 - 2013-08-14 15:35 - 00663296 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO30.dll 2015-06-09 23:57 - 2013-07-23 15:39 - 14048512 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioRealtek64.dll 2015-06-09 23:57 - 2013-07-23 15:39 - 00922880 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPOShell64.dll 2015-06-09 23:57 - 2013-06-25 12:47 - 00871856 _____ (TOSHIBA Corporation) C:\Windows\system32\tossaeapo64.dll 2015-06-09 23:57 - 2013-06-25 12:47 - 00162224 _____ (TOSHIBA Corporation) C:\Windows\system32\toseaeapo64.dll 2015-06-09 23:57 - 2013-06-25 12:46 - 00582056 _____ (TOSHIBA Corporation) C:\Windows\system32\tosasfapo64.dll 2015-06-09 23:57 - 2013-06-21 11:01 - 00109848 _____ C:\Windows\system32\AcpiServiceVnA64.dll 2015-06-09 23:57 - 2013-04-03 14:13 - 00906800 _____ (Sony Corporation) C:\Windows\system32\MISS_APO.dll 2015-06-09 23:57 - 2012-08-31 19:18 - 07164176 _____ (Dolby Laboratories) C:\Windows\system32\R4EEP64A.dll 2015-06-09 23:57 - 2012-08-31 19:17 - 00434960 _____ (Dolby Laboratories) C:\Windows\system32\R4EED64A.dll 2015-06-09 23:57 - 2012-08-31 19:17 - 00141584 _____ (Dolby Laboratories) C:\Windows\system32\R4EEL64A.dll 2015-06-09 23:57 - 2012-08-31 19:17 - 00124176 _____ (Dolby Laboratories) C:\Windows\system32\R4EEA64A.dll 2015-06-09 23:57 - 2012-08-31 19:17 - 00075024 _____ (Dolby Laboratories) C:\Windows\system32\R4EEG64A.dll 2015-06-09 23:57 - 2012-03-08 11:47 - 00108640 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAR64.dll 2015-06-09 23:57 - 2012-01-10 10:20 - 00065944 _____ (TOSHIBA CORPORATION.) C:\Windows\system32\tepeqapo64.dll 2015-06-09 23:57 - 2011-12-20 15:32 - 00331880 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtlCPAPI64.dll 2015-06-09 23:57 - 2011-11-22 16:28 - 00014952 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCoLDR64.dll 2015-06-09 23:57 - 2011-09-02 14:21 - 00221024 _____ (Synopsys, Inc.) C:\Windows\system32\SFNHK64.dll 2015-06-09 23:57 - 2011-09-02 14:21 - 00081248 _____ (Synopsys, Inc.) C:\Windows\system32\SFCOM64.dll 2015-06-09 23:57 - 2011-09-02 14:21 - 00078688 _____ (Synopsys, Inc.) C:\Windows\system32\SFAPO64.dll 2015-06-09 23:57 - 2011-08-23 17:00 - 00603984 _____ (Knowles Acoustics ) C:\Windows\system32\KAAPORT64.dll 2015-06-09 23:57 - 2011-05-31 09:42 - 01756264 _____ (DTS) C:\Windows\system32\DTSS2SpeakerDLL64.dll 2015-06-09 23:57 - 2011-05-31 09:42 - 01568360 _____ (DTS) C:\Windows\system32\DTSS2HeadphoneDLL64.dll 2015-06-09 23:57 - 2011-05-31 09:42 - 01486952 _____ (DTS) C:\Windows\system32\DTSBoostDLL64.dll 2015-06-09 23:57 - 2011-05-31 09:42 - 00728680 _____ (DTS) C:\Windows\system32\DTSBassEnhancementDLL64.dll 2015-06-09 23:57 - 2011-05-31 09:42 - 00712296 _____ (DTS) C:\Windows\system32\DTSSymmetryDLL64.dll 2015-06-09 23:57 - 2011-05-31 09:42 - 00693352 _____ (DTS) C:\Windows\system32\DTSVoiceClarityDLL64.dll 2015-06-09 23:57 - 2011-05-31 09:42 - 00491112 _____ (DTS) C:\Windows\system32\DTSNeoPCDLL64.dll 2015-06-09 23:57 - 2011-05-31 09:42 - 00432744 _____ (DTS) C:\Windows\system32\DTSLimiterDLL64.dll 2015-06-09 23:57 - 2011-05-31 09:42 - 00428648 _____ (DTS) C:\Windows\system32\DTSGainCompensatorDLL64.dll 2015-06-09 23:57 - 2011-05-31 09:42 - 00242792 _____ (DTS) C:\Windows\system32\DTSLFXAPO64.dll 2015-06-09 23:57 - 2011-05-31 09:42 - 00242792 _____ (DTS) C:\Windows\system32\DTSGFXAPO64.dll 2015-06-09 23:57 - 2011-05-31 09:42 - 00241768 _____ (DTS) C:\Windows\system32\DTSGFXAPONS64.dll 2015-06-09 23:57 - 2011-03-17 12:17 - 01361336 _____ (TOSHIBA Corporation) C:\Windows\system32\tosade.dll 2015-06-09 23:57 - 2011-03-07 17:11 - 00148416 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo.dll 2015-06-09 23:57 - 2010-11-08 07:31 - 00375128 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP64A.dll 2015-06-09 23:57 - 2010-11-08 07:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DHT64.dll 2015-06-09 23:57 - 2010-11-08 07:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DAA64.dll 2015-06-09 23:57 - 2010-11-08 07:31 - 00204120 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED64A.dll 2015-06-09 23:57 - 2010-11-08 07:31 - 00101208 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL64A.dll 2015-06-09 23:57 - 2010-11-08 07:31 - 00078680 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG64A.dll 2015-06-09 23:57 - 2010-09-27 09:34 - 00318808 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO20.dll 2015-06-09 23:57 - 2010-07-22 16:48 - 00074064 _____ (Virage Logic Corporation / Sonic Focus) C:\Windows\SysWOW64\SFCOM.dll 2015-06-09 23:57 - 2009-11-24 09:55 - 00518896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSX64.dll 2015-06-09 23:57 - 2009-11-24 09:55 - 00211184 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSH64.dll 2015-06-09 23:57 - 2009-11-24 09:55 - 00198896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSHP64.dll 2015-06-09 23:57 - 2009-11-24 09:55 - 00155888 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSWOW64.dll 2015-06-09 23:56 - 2015-06-09 23:58 - 00000000 ___HD C:\Program Files (x86)\Temp 2015-06-09 23:56 - 2015-03-11 18:04 - 02825944 _____ (Realtek Semiconductor Corp.) C:\Windows\RtlExUpd.dll 2015-06-09 23:55 - 2015-06-10 00:01 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel 2015-06-09 23:55 - 2015-06-09 23:55 - 01500444 _____ C:\Windows\SysWOW64\PerfStringBackup.INI 2015-06-09 23:55 - 2015-06-09 23:55 - 00057560 _____ C:\Users\Bülent\AppData\Local\GDIPFONTCACHEV1.DAT 2015-06-09 23:55 - 2015-06-09 23:55 - 00000000 ____D C:\Users\Bülent\AppData\Roaming\Intel Corporation 2015-06-09 23:54 - 2015-06-09 23:54 - 00000000 ____D C:\Users\Bülent\Intel 2015-06-09 23:53 - 2015-01-15 08:42 - 00977624 _____ (Realtek ) C:\Windows\system32\Drivers\Rt64win7.sys 2015-06-09 23:53 - 2015-01-15 08:42 - 00107552 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst64.dll 2015-06-09 23:53 - 2015-01-15 08:42 - 00073800 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RtNicProp64.dll 2015-06-09 23:52 - 2015-06-09 23:52 - 00008994 _____ C:\Windows\DPINST.LOG 2015-06-09 23:52 - 2015-06-09 23:52 - 00000000 ____D C:\Windows\SysWOW64\sda 2015-06-09 23:51 - 2015-06-09 23:57 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2015-06-09 23:51 - 2015-06-09 23:57 - 00000000 ____D C:\Program Files (x86)\Realtek 2015-06-09 23:51 - 2015-02-06 01:21 - 00391896 _____ (Realsil Semiconductor Corporation) C:\Windows\system32\Drivers\RtsUer.sys 2015-06-09 23:51 - 2014-10-20 03:50 - 00083160 _____ (Realtek Semiconductor.) C:\Windows\system32\RtCRX64.dll 2015-06-09 23:51 - 2014-01-26 23:39 - 09890008 _____ (Realtek Semiconductor Corp.) C:\Windows\SysWOW64\RsCRIcon.dll 2015-06-09 23:50 - 2015-06-09 23:50 - 00000000 ____D C:\ProgramData\Package Cache 2015-06-09 23:49 - 2015-06-10 00:03 - 00000000 ____D C:\Intel 2015-06-09 23:49 - 2014-04-25 09:31 - 00053248 _____ (Windows XP Bundled build C-Centric Single User) C:\Windows\SysWOW64\CSVer.dll 2015-06-09 23:48 - 2015-06-09 23:49 - 00000000 ____D C:\ProgramData\DriverGenius 2015-06-09 23:47 - 2015-06-09 23:47 - 00003346 _____ C:\Windows\System32\Tasks\Driver Genius 2015-06-09 23:47 - 2015-06-09 23:47 - 00001211 _____ C:\Users\Bülent\Desktop\Driver Genius.lnk 2015-06-09 23:47 - 2015-06-09 23:47 - 00000000 ____D C:\Users\Bülent\AppData\Roaming\Avanquest Software 2015-06-09 23:47 - 2015-06-09 23:47 - 00000000 ____D C:\Users\Bülent\AppData\Local\Avanquest 2015-06-09 23:47 - 2015-06-09 23:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Genius 2015-06-09 23:47 - 2015-06-09 23:47 - 00000000 ____D C:\Program Files (x86)\Driver-Soft 2015-06-09 23:44 - 2015-06-09 23:44 - 10460232 _____ (Driver-Soft Inc. ) C:\Users\Bülent\Downloads\Driver_Genius_15_GMR_DE.exe 2015-06-09 23:39 - 2015-06-09 23:39 - 00000000 ____D C:\Users\Bülent\AppData\Roaming\Mozilla 2015-06-09 23:39 - 2015-06-09 23:39 - 00000000 ____D C:\Users\Bülent\AppData\Local\Mozilla 2015-06-09 23:38 - 2015-06-09 23:38 - 00001163 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2015-06-09 23:38 - 2015-06-09 23:38 - 00001151 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2015-06-09 23:38 - 2015-06-09 23:38 - 00000000 ____D C:\ProgramData\Mozilla 2015-06-09 23:38 - 2015-06-09 23:38 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2015-06-09 23:38 - 2015-06-09 23:38 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2015-06-09 22:41 - 2015-06-09 22:54 - 00000000 ____D C:\Program Files\CCleaner 2015-06-09 22:41 - 2015-06-09 22:41 - 00002794 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC 2015-06-09 22:41 - 2015-06-09 22:41 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk 2015-06-09 22:41 - 2015-06-09 22:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner 2015-06-09 22:13 - 2015-06-09 22:13 - 00001106 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-06-09 22:13 - 2015-06-09 22:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-06-09 22:13 - 2015-06-09 22:13 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-06-09 22:13 - 2015-04-14 09:37 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-06-09 22:13 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-06-09 22:12 - 2015-06-09 22:12 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Bülent\Desktop\mbam-setup-2.1.6.1022.exe 2015-06-09 21:55 - 2015-06-10 21:10 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-06-09 21:55 - 2015-06-09 22:13 - 00000000 ____D C:\ProgramData\Malwarebytes 2015-06-09 21:55 - 2015-06-09 22:09 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2015-06-09 21:54 - 2015-06-09 22:09 - 00000000 ____D C:\Users\Bülent\Desktop\mbar 2015-06-09 21:54 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-06-09 21:29 - 2015-06-09 21:29 - 00000000 ____D C:\NPE 2015-06-09 21:24 - 2015-06-09 21:24 - 10079720 _____ (Symantec Corporation) C:\Users\Bülent\Desktop\NPE.exe 2015-06-09 21:22 - 2015-06-09 21:31 - 00000000 ____D C:\Users\Bülent\AppData\Local\NPE 2015-06-09 20:55 - 2015-06-09 20:55 - 00000000 ____D C:\Users\Bülent\Documents\Symantec 2015-06-09 20:53 - 2015-06-10 21:08 - 00000000 ____D C:\Windows\system32\Drivers\NISx64 2015-06-09 20:53 - 2015-06-10 21:07 - 00002501 _____ C:\Users\Public\Desktop\Norton Internet Security.lnk 2015-06-09 20:53 - 2015-06-09 20:53 - 00177752 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS 2015-06-09 20:53 - 2015-06-09 20:53 - 00008222 _____ C:\Windows\system32\Drivers\SYMEVENT64x86.CAT 2015-06-09 20:53 - 2015-06-09 20:53 - 00000000 ____D C:\Program Files\Common Files\Symantec Shared 2015-06-09 20:52 - 2015-06-10 21:07 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Internet Security 2015-06-09 20:52 - 2015-06-09 21:22 - 00000000 ____D C:\ProgramData\Norton 2015-06-09 20:52 - 2015-06-09 20:53 - 00000000 ____D C:\Program Files (x86)\Norton Internet Security 2015-06-09 18:42 - 2015-06-09 22:45 - 00000000 ____D C:\Windows\Panther 2015-06-09 18:19 - 2012-02-17 08:38 - 01031680 _____ (Microsoft Corporation) C:\Windows\system32\rdpcore.dll 2015-06-09 18:19 - 2012-02-17 07:34 - 00826880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpcore.dll 2015-06-09 18:19 - 2012-02-17 06:58 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys 2015-06-09 18:19 - 2012-02-17 06:57 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdtcp.sys 2015-06-09 18:07 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2015-06-09 18:07 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll 2015-06-09 18:07 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll 2015-06-09 18:07 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2015-06-09 18:07 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll 2015-06-09 18:07 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll 2015-06-09 18:07 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll 2015-06-09 18:07 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2015-06-09 18:07 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll 2015-06-09 18:07 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll 2015-06-09 18:07 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2015-06-09 18:07 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll 2015-06-09 18:07 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2015-06-09 18:07 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe 2015-06-09 18:01 - 2015-06-09 18:01 - 00000000 ____D C:\Users\Bülent\AppData\Roaming\Intel 2015-06-09 18:00 - 2015-06-10 00:07 - 00000000 ____D C:\Program Files (x86)\Intel 2015-06-09 18:00 - 2015-06-10 00:02 - 00000000 ____D C:\Program Files\Intel 2015-06-09 18:00 - 2015-06-10 00:01 - 00000000 ____D C:\ProgramData\Intel 2015-06-09 18:00 - 2015-06-09 18:00 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel PROSet Wireless 2015-06-09 18:00 - 2015-06-09 18:00 - 00000000 ____D C:\Program Files\Common Files\Intel 2015-06-09 18:00 - 2015-06-09 18:00 - 00000000 ____D C:\Program Files (x86)\Cisco 2015-06-09 17:55 - 2015-06-10 21:45 - 00000000 ____D C:\Users\Bülent 2015-06-09 17:55 - 2015-06-09 17:55 - 00001443 _____ C:\Users\Bülent\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2015-06-09 17:55 - 2015-06-09 17:55 - 00001409 _____ C:\Users\Bülent\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk 2015-06-09 17:55 - 2015-06-09 17:55 - 00000020 ___SH C:\Users\Bülent\ntuser.ini 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Musik 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Bilder 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Default\Vorlagen 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Default\Startmenü 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Default\Netzwerkumgebung 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Default\Lokale Einstellungen 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Default\Eigene Dateien 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Default\Druckumgebung 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Musik 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Bilder 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Default\AppData\Local\Verlauf 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Default\AppData\Local\Anwendungsdaten 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Default\Anwendungsdaten 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Musik 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Bilder 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Verlauf 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Anwendungsdaten 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Bülent\Vorlagen 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Bülent\Startmenü 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Bülent\Netzwerkumgebung 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Bülent\Lokale Einstellungen 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Bülent\Eigene Dateien 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Bülent\Druckumgebung 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Bülent\Documents\Eigene Musik 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Bülent\Documents\Eigene Bilder 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Bülent\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Bülent\AppData\Local\Verlauf 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Bülent\AppData\Local\Anwendungsdaten 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Users\Bülent\Anwendungsdaten 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Programme 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\ProgramData\Vorlagen 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\ProgramData\Startmenü 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\ProgramData\Microsoft\Windows\Start Menu\Programme 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\ProgramData\Favoriten 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\ProgramData\Dokumente 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\ProgramData\Anwendungsdaten 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Program Files\Gemeinsame Dateien 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 _SHDL C:\Dokumente und Einstellungen 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 __SHD C:\Recovery 2015-06-09 17:55 - 2015-06-09 17:55 - 00000000 ____D C:\Users\Bülent\AppData\Local\VirtualStore 2015-06-09 17:55 - 2009-07-14 06:54 - 00000000 ___RD C:\Users\Bülent\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2015-06-09 17:55 - 2009-07-14 06:49 - 00000000 ___RD C:\Users\Bülent\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance 2015-06-09 17:47 - 2015-06-09 17:47 - 00001345 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk 2015-06-09 17:47 - 2015-06-09 17:47 - 00001326 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk 2015-06-09 17:45 - 2015-06-10 21:34 - 01872392 _____ C:\Windows\WindowsUpdate.log 2015-06-09 17:45 - 2015-06-09 17:45 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-06-10 21:43 - 2011-04-12 09:43 - 00644666 _____ C:\Windows\system32\perfh007.dat 2015-06-10 21:43 - 2011-04-12 09:43 - 00126724 _____ C:\Windows\system32\perfc007.dat 2015-06-10 21:43 - 2009-07-14 07:13 - 01475424 _____ C:\Windows\system32\PerfStringBackup.INI 2015-06-10 21:16 - 2009-07-14 06:45 - 00020272 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-06-10 21:16 - 2009-07-14 06:45 - 00020272 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-06-10 21:09 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2015-06-10 21:06 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions 2015-06-09 18:41 - 2009-07-14 07:38 - 00025600 ___SH C:\Windows\system32\config\BCD-Template.LOG 2015-06-09 18:41 - 2009-07-14 07:32 - 00028672 _____ C:\Windows\system32\config\BCD-Template 2015-06-09 18:26 - 2009-07-14 07:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games 2015-06-09 18:07 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Public\Libraries 2015-06-09 18:01 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default 2015-06-09 17:59 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\system32\restore 2015-06-09 17:55 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\Recovery 2015-06-09 17:55 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Windows NT 2015-06-09 17:50 - 2009-07-14 06:45 - 00274464 _____ C:\Windows\system32\FNTCACHE.DAT 2015-06-09 17:47 - 2009-07-14 05:20 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories 2015-06-09 17:47 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\sysprep 2015-06-09 17:43 - 2011-04-12 09:54 - 00000000 ____D C:\Windows\CSC ==================== Files in the root of some directories ======= 2015-06-09 23:58 - 2015-06-09 23:58 - 0000000 ____H () C:\ProgramData\DP45977C.lfl ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-06-09 18:55 ==================== End of log ============================ GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2015-06-10 22:18:06 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000006a TOSHIBA_ rev.AX00 465,76GB Running: Gmer-19357.exe; Driver: C:\Users\BLENT~1\AppData\Local\Temp\agdiipow.sys ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00c2c648a697 Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00c2c648a697 (not active ControlSet) ---- EOF - GMER 2.1 ---- <?xml version="1.0" encoding="UTF-16" ?> - <mbam-log> - <header> <date>2015/06/10 22:31:00 +0200</date> <logfile>mbam-log-2015-06-10 (22-30-59).xml</logfile> <isadmin>yes</isadmin> </header> - <engine> <version>2.01.6.1022</version> <malware-database>v2015.06.10.05</malware-database> <rootkit-database>v2015.06.02.01</rootkit-database> <license>premium</license> <file-protection>disabled</file-protection> <web-protection>disabled</web-protection> <self-protection>disabled</self-protection> </engine> - <system> <osversion>Windows 7 Service Pack 1</osversion> <arch>x64</arch> <username>Bülent</username> <filesys>NTFS</filesys> </system> - <summary> <type>threat</type> <result>completed</result> <objects>338618</objects> <time>595</time> <processes>0</processes> <modules>0</modules> <keys>0</keys> <values>0</values> <datas>0</datas> <folders>0</folders> <files>0</files> <sectors>0</sectors> </summary> - <options> <memory>enabled</memory> <startup>enabled</startup> <filesystem>enabled</filesystem> <archives>enabled</archives> <rootkits>disabled</rootkits> <deeprootkit>disabled</deeprootkit> <heuristics>enabled</heuristics> <pup>enabled</pup> <pum>enabled</pum> </options> <items /> </mbam-log> Vielen Dank vorab |
|
11.06.2015, 05:51
| #2 | |
| /// the machine /// TB-Ausbilder    | Hartnäckiger Tastaturvirus verhindert das Booten, bedingt mit Shift-Taste deaktivierbar hi,
__________________Zitat:
 Festplatte formatiert = Virus weg, wenn einer da ist. Dein Laptop-interne Tastatur hängt.
__________________ |
|
11.06.2015, 17:44
| #3 |
| | Hartnäckiger Tastaturvirus verhindert das Booten, bedingt mit Shift-Taste deaktivierbar Kannst Du mir etwas nähere Informationen dazu geben? Ich weiß jetzt nicht, ob ich in den Computerladen gehen und mir eine neue Tastatur in den Laptop einbauen lassen soll. Für mich als Laien erklärt sich durch Deine Antwort nicht, warum bei Eingaben in Word ode Excel die Einträge nach einer Zeit ohne jegliche Anzeichen einer Tastenbetätigung gelöscht werden. Wenn nur die Shift-Taste hängen würde, wäre das dann nicht ein Dauerzustand und müsste ich dann nicht gezwungen sein, alles groß zu schreiben?
__________________ |
|
12.06.2015, 16:57
| #4 |
| /// the machine /// TB-Ausbilder | Hartnäckiger Tastaturvirus verhindert das Booten, bedingt mit Shift-Taste deaktivierbar Ich sage nicht es hängt die Shift Taste, ich persönlich denke es ist die ESC Taste, und du kannst es mit Shift unterbinden. Entweder hängt da was mechanisch, oder die Kabelverbindung, wo das Keyboard auf dem Mainboard angesteckt ist. Auf jeden Fall, zu 1000%, ist es keine Malware. Was Du versuchen kannst: http://support2.microsoft.com/kb/929135/de Bitte einen Clean Boot machen. Wenn das Problem dann weg ist, einzeln wieder Dienste aktivieren, dazwischen immer einen Reboot machen. Solange bis Du weißt welcher Dienst die Probleme macht. Diesen dann hier benennen.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Hartnäckiger Tastaturvirus verhindert das Booten, bedingt mit Shift-Taste deaktivierbar |
| bildschirm, blockiert, booten, bootschleife, desktop, error, excel, fehler, festplatte, firefox, firefox 38.0.5, geld, installation, internet, internet explorer, logfile, nicht genug speicherplatz, problem, programm, prozess, schädling, security, software, starten, svchost.exe, symantec, virus, windows xp |
Linear-Darstellung
