| |
| |||||||
Log-Analyse und Auswertung: Win 7 extrem verlangsamtWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
03.09.2015, 20:26
| #1 |
 |  Win 7 extrem verlangsamt hallo, ich habe den fehler gemacht eine falsche seite (angeblich zum verglichshören von mp3 vs flac) zu besuchen. ein popup hat sich geöffnet, gleich wieder geschlossen. seit dem ist der pc extrem langsam. booten tut er noch, auch sonst keine virenmeldungen. antivir war runtergefahren u konnte nicht gestartet werden. bin dann mit ESED NOD32 drüber, dann konnte ich antivir deinstallieren, installieren u neu starten. eine datei von der bösen seite runtergeladen u ausgeführt habe ich nicht. hab schon 3 versch malware programme drüber laufen lassen. haben teilw. was gefunden, ich habs gelöscht, geholfen hats nix. protokoll darüber hab ich keines gespeichert. noch ne frage: ich wollte die scanner im safemode laufen lassen. wenn ich F8 drücke komme ich nur zu einer auswahl wo ich die festplate aussuchen kann von der gebootet werden soll. nehme ich C: bootet sofort windows. ich glaub ich hab da irgendein menü von AMD statt dem normalen um zum safemode zu gelangen? kennt das jemand? hier mal meine scans: Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:31-08-2015 durchgeführt von Emil (Administrator) auf EMIL-PC (03-09-2015 20:20:57) Gestartet von D:\Downloads Geladene Profile: & (Verfügbare Profile: Emil & Erina) Platform: Windows 7 Professional Service Pack 1 (X64) Sprache: Deutsch (Deutschland) Internet Explorer Version 11 (Standard-Browser: FF) Start-Modus: Normal Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Prozesse (Nicht auf der Ausnahmeliste) ================= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.) (AMD) C:\Windows\System32\atiesrxx.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (AMD) C:\Windows\System32\atieclxx.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Advanced Micro Devices, Inc.) C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe () C:\Windows\DAODx.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft) C:\Program Files (x86)\Evernote Sticky Notes\StickyNotes.Wpf.exe (Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe (Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe (SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe (Wondershare) C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe (Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe () C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe (Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe (Motorola, Inc.) C:\Program Files\Motorola\Bluetooth\devmgrsrv.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe (Thrustmaster®) D:\drivers\amd64\tmInstall.exe (Motorola, Inc.) C:\Program Files\Motorola\Bluetooth\obexsrv.exe (Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe (Macrovision Europe Ltd.) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe (TOSHIBA CORPORATION) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (Motorola, Inc.) C:\Program Files\Motorola\Bluetooth\audiosrv.exe (Motorola, Inc.) C:\Program Files\Motorola\Bluetooth\btplayerctrl.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (AMD) C:\Windows\System32\atieclxx.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\MediaSource5\Go\CTCMSGoU.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe (Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe (Motorola, Inc.) C:\Program Files\Motorola\Bluetooth\btplayerctrl.exe (SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe (Wondershare) C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe (Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe () C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe (TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng_D.exe (TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe (TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe (TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosHdpProc.exe (TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe (TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtKbd.exe (TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtBty.exe (Malwarebytes Corp.) D:\Downloads\mbar-1.09.2.1008.exe (Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe (Malwarebytes) C:\Users\Emil\Desktop\mbar\mbar.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe ==================== Registry (Nicht auf der Ausnahmeliste) =========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7660760 2000-01-01] (Realtek Semiconductor) HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files\Motorola\Bluetooth\btmshell.dll",TrayApp HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [5595848 2015-07-08] (ESET) HKLM-x32\...\Run: [VolPanel] => C:\Program Files (x86)\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe [184320 2007-04-17] (Creative Technology Ltd) HKLM-x32\...\Run: [SPIRunE] => Rundll32 SPIRunE.dll,RunDLLEntry HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [782008 2015-08-31] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [FUFAXRCV] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe [502912 2012-04-03] (SEIKO EPSON CORPORATION) HKLM-x32\...\Run: [FUFAXSTM] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe [863360 2012-04-03] (SEIKO EPSON CORPORATION) HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1058912 2012-04-02] (SEIKO EPSON CORPORATION) HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2007392 2014-04-01] (Wondershare) HKLM-x32\...\Run: [KeePass 2 PreLoad] => D:\KeePass Password Safe 2\KeePass.exe [2715536 2015-04-10] (Dominik Reichl) HKLM-x32\...\Run: [LWS] => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [204136 2012-09-13] (Logitech Inc.) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-07-15] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-06-08] (Oracle Corporation) HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [KSS] => "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe" autorun HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [KSS] => "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe" autorun HKU\S-1-5-21-523548968-1357001120-3005945389-1000\...\Run: [EDO-Soft Sticky Notes] => C:\Program Files (x86)\Evernote Sticky Notes\StickyNotes.Wpf.exe [373760 2013-12-05] (Microsoft) HKU\S-1-5-21-523548968-1357001120-3005945389-1000\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIIXE.EXE [283232 2012-02-28] (SEIKO EPSON CORPORATION) HKU\S-1-5-21-523548968-1357001120-3005945389-1000\...\Run: [EPLTarget\P0000000000000001] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIIXE.EXE [283232 2012-02-28] (SEIKO EPSON CORPORATION) HKU\S-1-5-21-523548968-1357001120-3005945389-1000\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22344224 2015-07-29] (Google) HKU\S-1-5-21-523548968-1357001120-3005945389-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8358680 2015-06-01] (Piriform Ltd) HKU\S-1-5-21-523548968-1357001120-3005945389-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [EDO-Soft Sticky Notes] => C:\Program Files (x86)\Evernote Sticky Notes\StickyNotes.Wpf.exe [373760 2013-12-05] (Microsoft) HKU\S-1-5-21-523548968-1357001120-3005945389-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIIXE.EXE [283232 2012-02-28] (SEIKO EPSON CORPORATION) HKU\S-1-5-21-523548968-1357001120-3005945389-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [EPLTarget\P0000000000000001] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIIXE.EXE [283232 2012-02-28] (SEIKO EPSON CORPORATION) HKU\S-1-5-21-523548968-1357001120-3005945389-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22344224 2015-07-29] (Google) HKU\S-1-5-21-523548968-1357001120-3005945389-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8358680 2015-06-01] (Piriform Ltd) HKU\S-1-5-21-523548968-1357001120-3005945389-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [EDO-Soft Sticky Notes] => C:\Program Files (x86)\Evernote Sticky Notes\StickyNotes.Wpf.exe [373760 2013-12-05] (Microsoft) HKU\S-1-5-21-523548968-1357001120-3005945389-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIIXE.EXE [283232 2012-02-28] (SEIKO EPSON CORPORATION) HKU\S-1-5-21-523548968-1357001120-3005945389-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [EPLTarget\P0000000000000001] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIIXE.EXE [283232 2012-02-28] (SEIKO EPSON CORPORATION) HKU\S-1-5-21-523548968-1357001120-3005945389-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22344224 2015-07-29] (Google) HKU\S-1-5-21-523548968-1357001120-3005945389-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8358680 2015-06-01] (Piriform Ltd) HKU\S-1-5-21-523548968-1357001120-3005945389-1004\...\Run: [ftweak_RAMRush] => C:\Program Files (x86)\RAMRush\RAMRush.exe HKU\S-1-5-21-523548968-1357001120-3005945389-1004\...\Run: [Creative MediaSource Go] => C:\Program Files (x86)\Creative\MediaSource5\Go\CTCMSGoU.exe [204800 2006-11-09] (Creative Technology Ltd) HKU\S-1-5-21-523548968-1357001120-3005945389-1004\...\Run: [EDO-Soft Sticky Notes] => D:\Programme D\StickyNotes.Wpf.exe HKU\S-1-5-21-523548968-1357001120-3005945389-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [ftweak_RAMRush] => C:\Program Files (x86)\RAMRush\RAMRush.exe HKU\S-1-5-21-523548968-1357001120-3005945389-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Creative MediaSource Go] => C:\Program Files (x86)\Creative\MediaSource5\Go\CTCMSGoU.exe [204800 2006-11-09] (Creative Technology Ltd) HKU\S-1-5-21-523548968-1357001120-3005945389-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [EDO-Soft Sticky Notes] => D:\Programme D\StickyNotes.Wpf.exe HKU\S-1-5-21-523548968-1357001120-3005945389-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [ftweak_RAMRush] => C:\Program Files (x86)\RAMRush\RAMRush.exe HKU\S-1-5-21-523548968-1357001120-3005945389-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [Creative MediaSource Go] => C:\Program Files (x86)\Creative\MediaSource5\Go\CTCMSGoU.exe [204800 2006-11-09] (Creative Technology Ltd) HKU\S-1-5-21-523548968-1357001120-3005945389-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [EDO-Soft Sticky Notes] => D:\Programme D\StickyNotes.Wpf.exe HKU\S-1-5-18\...\Run: [KSS] => "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe" autorun ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-07-29] (Google) ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-07-29] (Google) ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-07-29] (Google) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth Manager.lnk [2013-06-18] ShortcutTarget: Bluetooth Manager.lnk -> C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.) Startup: C:\Users\Emil\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk [2015-02-05] ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation) BootExecute: autocheck autochk * sdnclean64.exe ==================== Internet (Nicht auf der Ausnahmeliste) ==================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt..) ProxyServer: [S-1-5-21-523548968-1357001120-3005945389-1004] => localhost:21320 ProxyServer: [S-1-5-21-523548968-1357001120-3005945389-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0] => localhost:21320 ProxyServer: [S-1-5-21-523548968-1357001120-3005945389-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1] => localhost:21320 Tcpip\Parameters: [DhcpNameServer] 195.34.133.21 212.186.211.21 Tcpip\..\Interfaces\{1DD6E913-165C-428A-A428-E63291A96F3D}: [DhcpNameServer] 195.34.133.21 212.186.211.21 Tcpip\..\Interfaces\{D4C89ACE-0B25-4927-94B9-343A174CD91A}: [DhcpNameServer] 195.34.133.21 212.186.211.21 Internet Explorer: ================== HKU\S-1-5-21-523548968-1357001120-3005945389-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.yahoo.com/?fr=yset_ie_syc_oracle&type=orcl_hpset HKU\S-1-5-21-523548968-1357001120-3005945389-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com HKU\S-1-5-21-523548968-1357001120-3005945389-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.yahoo.com/?fr=yset_ie_syc_oracle&type=orcl_hpset HKU\S-1-5-21-523548968-1357001120-3005945389-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com HKU\S-1-5-21-523548968-1357001120-3005945389-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.yahoo.com/?fr=yset_ie_syc_oracle&type=orcl_hpset HKU\S-1-5-21-523548968-1357001120-3005945389-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com HKU\S-1-5-21-523548968-1357001120-3005945389-1004\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.dell.com HKU\S-1-5-21-523548968-1357001120-3005945389-1004\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com HKU\S-1-5-21-523548968-1357001120-3005945389-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.dell.com HKU\S-1-5-21-523548968-1357001120-3005945389-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com HKU\S-1-5-21-523548968-1357001120-3005945389-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.dell.com HKU\S-1-5-21-523548968-1357001120-3005945389-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com URLSearchHook: HKU\S-1-5-21-523548968-1357001120-3005945389-1004 - (Kein Name) - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - Keine Datei URLSearchHook: HKU\S-1-5-21-523548968-1357001120-3005945389-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 - (Kein Name) - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - Keine Datei URLSearchHook: HKU\S-1-5-21-523548968-1357001120-3005945389-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1 - (Kein Name) - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - Keine Datei SearchScopes: HKU\S-1-5-21-523548968-1357001120-3005945389-1000 -> {22E06A81-68EE-4FF1-A05C-7E542584F957} URL = hxxps://at.search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default SearchScopes: HKU\S-1-5-21-523548968-1357001120-3005945389-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {22E06A81-68EE-4FF1-A05C-7E542584F957} URL = hxxps://at.search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default SearchScopes: HKU\S-1-5-21-523548968-1357001120-3005945389-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1 -> {22E06A81-68EE-4FF1-A05C-7E542584F957} URL = hxxps://at.search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation) BHO-x32: BitComet Helper -> {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} -> D:\Programme D\BitComet\tools\BitCometBHO_1.5.4.11.dll [2013-11-29] (BitComet) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\ssv.dll [2015-08-02] (Oracle Corporation) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\jp2ssv.dll [2015-08-02] (Oracle Corporation) DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab DPF: HKLM-x32 {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab FireFox: ======== FF ProfilePath: C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default FF SelectedSearchEngine: Google FF Homepage: chrome://speeddial/content/speeddial.xul FF NetworkProxy: "no_proxies_on", "127.0.0.1" FF NetworkProxy: "socks", "127.0.0.1" FF NetworkProxy: "socks_port", 9050 FF NetworkProxy: "socks_remote_dns", true FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_232.dll [2015-08-12] () FF Plugin: @microsoft.com/GENUINE -> disabled [Keine Datei] FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.0.8 -> D:\Programme D\VLC\npvlc.dll [2014-07-30] (VideoLAN) FF Plugin: @videolan.org/vlc,version=2.1.5 -> D:\Programme D\VLC\npvlc.dll [2014-07-30] (VideoLAN) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-12] () FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google) FF Plugin-x32: @java.com/DTPlugin,version=11.51.2 -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\dtplugin\npDeployJava1.dll [2015-08-02] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.51.2 -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\plugin2\npjp2.dll [2015-08-02] (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Keine Datei] FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-08-31] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-08-31] (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npBitCometAgent.dll [2012-01-12] (BitComet) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-06-29] (Adobe Systems Inc.) FF SearchPlugin: C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\searchplugins\anonymouseorg---scroogleorg---any.xml [2012-02-29] FF SearchPlugin: C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\searchplugins\scroogle-at.xml [2012-02-29] FF SearchPlugin: C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\searchplugins\scroogle-ssl.xml [2012-02-29] FF Extension: Flash Video Downloader - YouTube HD Download [4K] - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\artur.dubovoy@gmail.com [2015-08-14] FF Extension: HTTPS-Everywhere - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\https-everywhere-eff@eff.org [2015-08-20] FF Extension: ColorfulTabs - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe} [2015-08-25] FF Extension: Flashblock - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} [2015-05-29] FF Extension: FEBE - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3} [2015-05-29] FF Extension: All-in-One Gestures - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{8b86149f-01fb-4842-9dd8-4d7eb02fd055} [2015-05-29] FF Extension: BitComet Video Downloader - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB} [2014-11-24] FF Extension: Adblock Plus Pop-up Addon - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\adblockpopups@jessehakanen.net.xpi [2014-11-22] FF Extension: Element Hiding Helper for Adblock Plus - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\elemhidehelper@adblockplus.org.xpi [2014-11-22] FF Extension: GlassMyFox - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\GlassMyFox@ArisT2_Noia4dev.xpi [2014-11-22] FF Extension: NO Google Analytics - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\jid1-JcGokIiQyjoBAQ@jetpack.xpi [2014-12-28] FF Extension: YesScript - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\yesscript@userstyles.org.xpi [2015-06-10] FF Extension: Flagfox - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}.xpi [2014-11-22] FF Extension: Cookie Cutter - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{4d14a68e-9a97-4358-8603-ed67b332cef1}.xpi [2014-11-22] FF Extension: SmoothWheel (mozdev.org) - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{5F590AA2-1221-4113-A6F4-A4BB62414FAC}.xpi [2014-11-22] FF Extension: Speed Dial - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi [2014-11-22] FF Extension: Binnen-I be gone - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{b65d7d9a-4ec0-4974-b07f-83e30f6e973f}.xpi [2014-11-22] FF Extension: Adblock Plus - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-11-22] FF Extension: BetterPrivacy - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2014-11-22] FF Extension: DownThemAll! - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2014-11-22] Chrome: ======= CHR Profile: C:\Users\Emil\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Drive) - C:\Users\Emil\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-07-12] CHR Extension: (Avira Browser Safety) - C:\Users\Emil\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2015-07-12] CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\Emil\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2015-07-12] CHR Extension: (Google Wallet) - C:\Users\Emil\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-16] CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx CHR HKU\S-1-5-21-523548968-1357001120-3005945389-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Emil\AppData\Local\Google\Drive\user_default\apdfllckaahabafndbhieahigkjlhalf_live.crx [2015-03-21] CHR HKU\S-1-5-21-523548968-1357001120-3005945389-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - https://clients2.google.com/service/update2/crx CHR HKU\S-1-5-21-523548968-1357001120-3005945389-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Emil\AppData\Local\Google\Drive\user_default\apdfllckaahabafndbhieahigkjlhalf_live.crx [2015-03-21] CHR HKU\S-1-5-21-523548968-1357001120-3005945389-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - https://clients2.google.com/service/update2/crx CHR HKU\S-1-5-21-523548968-1357001120-3005945389-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Emil\AppData\Local\Google\Drive\user_default\apdfllckaahabafndbhieahigkjlhalf_live.crx [2015-03-21] CHR HKU\S-1-5-21-523548968-1357001120-3005945389-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - https://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [phegaokedjdajgnfphbnpkcfdgjbidko] - C:\ProgramData\adawaretb\toolbar\chrome\toolbar.crx <nicht gefunden> ==================== Dienste (Nicht auf der Ausnahmeliste) ======================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) R2 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2015-07-15] (Advanced Micro Devices, Inc.) [Datei ist nicht signiert] S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [887128 2015-07-29] (Avira Operations GmbH & Co. KG) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [461672 2015-08-31] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [461672 2015-08-31] (Avira Operations GmbH & Co. KG) S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1213072 2015-08-31] (Avira Operations GmbH & Co. KG) S4 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe [920736 2012-06-01] () S4 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe [951936 2012-06-01] (ASUSTeK Computer Inc.) S4 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe [149120 2012-02-17] (ASUSTeK Computer Inc.) S4 AsusFanControlService; C:\Program Files (x86)\ASUS\AsusFanControlService\1.01.10\AsusFanControlService.exe [1475744 2012-05-25] (ASUSTeK Computer Inc.) S3 BITCOMET_HELPER_SERVICE; D:\Programme D\BitComet\tools\BitCometService.exe [1296728 2013-11-29] (www.BitComet.com) S4 Creative ALchemy AL6 Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2013-06-13] (Creative Labs) [Datei ist nicht signiert] S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2013-06-13] (Creative Labs) [Datei ist nicht signiert] S4 Creative Media Toolbox 6 Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\MT6Licensing.exe [79360 2013-06-13] (Creative Labs) [Datei ist nicht signiert] R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [286720 2010-02-12] (Creative Technology Ltd) [Datei ist nicht signiert] R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [1353720 2015-07-08] (ESET) R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation) S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [647680 2015-05-18] (Macrovision Europe Ltd.) [Datei ist nicht signiert] R3 FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [1028096 2015-05-18] (Macrovision Europe Ltd.) [Datei ist nicht signiert] R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation) R2 tmInstall; D:\drivers\amd64\tmInstall.exe [45296 2014-07-22] (Thrustmaster®) R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) ===================== Treiber (Nicht auf der Ausnahmeliste) ========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) S3 AiChargerPlus; C:\Windows\SysWow64\drivers\AiChargerPlus.sys [14848 2012-04-19] (ASUSTek Computer Inc.) R2 AODDriver4.3; C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices) R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2012-08-22] () R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [14464 2012-09-14] () S3 ASUSFILTER; C:\Windows\SysWow64\drivers\ASUSFILTER.sys [46152 2011-09-20] (MCCI Corporation) S3 ASUSstpt; C:\Windows\System32\DRIVERS\ASUSstpt.sys [24648 2011-09-15] (MCCI Corporation) S3 ASUSumsc; C:\Windows\System32\DRIVERS\ASUSumsc.sys [141896 2011-09-15] (MCCI Corporation) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [162528 2015-07-29] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [141416 2015-07-29] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG) R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-05] (Avira Operations GmbH & Co. KG) R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [255240 2015-07-13] (ESET) S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation) U5 edevmon; C:\Windows\System32\Drivers\edevmon.sys [251632 2015-07-13] (ESET) R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [178520 2015-07-13] (ESET) R2 epfwwfpr; C:\Windows\System32\DRIVERS\epfwwfpr.sys [168208 2015-07-13] (ESET) S3 gfiark; C:\Windows\System32\drivers\gfiark.sys [39504 2013-04-11] (ThreatTrack Security) R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-06-10] (GFI Software) S3 HtcVCom32; C:\Windows\System32\DRIVERS\HtcVComV64.sys [121800 2010-03-09] (QUALCOMM Incorporated) R3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [109272 2015-09-03] (Malwarebytes) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [113880 2015-09-03] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation) S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited) S4 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2006-07-24] () S3 tmbulk; C:\Windows\System32\Drivers\tmbulk.sys [129264 2014-06-20] (© Guillemot R&D, 2014. All rights reserved.) R1 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [307352 2015-05-29] (Trend Micro Inc.) S3 tmhidusb; C:\Windows\System32\DRIVERS\tmhidusb.sys [166640 2014-07-22] (Thrustmaster) S3 tmResetMin; C:\Windows\System32\Drivers\tmResetMin.sys [36080 2014-07-22] (© Guillemot R&D, 2013. All rights reserved.) S3 toshidpt; C:\Windows\System32\drivers\Toshidpt.sys [9608 2009-06-19] (TOSHIBA Corporation.) S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [Datei ist nicht signiert] R1 veracrypt; C:\Windows\System32\drivers\veracrypt.sys [185688 2014-12-16] (IDRIX) ==================== NetSvcs (Nicht auf der Ausnahmeliste) =================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) ==================== Ein Monat: Erstellte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2015-09-03 20:21 - 2015-09-03 20:21 - 00076839 _____ C:\Users\Emil\Desktop\FRST.txt 2015-09-03 20:21 - 2015-09-03 20:21 - 00043041 _____ C:\Users\Emil\Desktop\Addition.txt 2015-09-03 20:16 - 2015-09-03 20:21 - 00000000 ____D C:\FRST 2015-09-03 20:08 - 2015-09-03 20:14 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2015-09-03 20:06 - 2015-09-03 20:06 - 00000000 ____D C:\Users\Emil\Desktop\mbar 2015-09-03 10:21 - 2015-09-03 10:21 - 01572412 _____ C:\Users\Emil\AppData\Local\census.cache 2015-09-03 10:21 - 2015-09-03 10:21 - 00216292 _____ C:\Users\Emil\AppData\Local\ars.cache 2015-09-02 23:56 - 2015-09-02 23:56 - 00000010 _____ C:\Users\Emil\AppData\Local\sponge.last.runtime.cache 2015-09-02 23:45 - 2015-05-29 09:43 - 00307352 _____ (Trend Micro Inc.) C:\Windows\system32\Drivers\tmcomm.sys 2015-09-02 23:09 - 2015-09-02 23:09 - 00000036 _____ C:\Users\Emil\AppData\Local\housecall.guid.cache 2015-09-02 23:05 - 2015-09-02 23:05 - 00000000 ____D C:\Users\Emil\AppData\Local\ESET 2015-09-02 18:18 - 2015-09-02 18:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET 2015-09-02 18:18 - 2015-09-02 18:18 - 00000000 ____D C:\ProgramData\ESET 2015-09-02 18:18 - 2015-09-02 18:18 - 00000000 ____D C:\Program Files\ESET 2015-08-31 09:24 - 2015-08-31 09:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2015-08-31 09:10 - 2015-08-31 09:10 - 00000000 ____D C:\Users\Erina\AppData\Local\Avg 2015-08-31 08:06 - 2015-08-31 08:06 - 00001199 _____ C:\Users\Public\Desktop\Avira Antivirus.lnk 2015-08-31 07:23 - 2015-08-31 07:23 - 00000000 ____D C:\ProgramData\Kaspersky Lab Setup Files 2015-08-30 15:56 - 2015-09-02 07:25 - 00000000 ____D C:\Program Files\Common Files\AV 2015-08-30 15:56 - 2015-08-30 15:56 - 00000000 ____D C:\Users\Emil\AppData\Roaming\TuneUp Software 2015-08-30 15:52 - 2015-09-02 07:28 - 00000000 ____D C:\ProgramData\MFAData 2015-08-30 15:52 - 2015-08-30 15:52 - 00000000 ____D C:\Users\Emil\AppData\Local\MFAData 2015-08-30 15:51 - 2015-09-02 07:43 - 00000000 ____D C:\ProgramData\Avg 2015-08-30 15:51 - 2015-09-02 07:42 - 00000000 ____D C:\Users\Emil\AppData\Local\AvgSetupLog 2015-08-30 15:51 - 2015-08-30 15:51 - 00000000 ____D C:\Users\Emil\AppData\Local\Avg 2015-08-30 13:17 - 2015-08-30 13:17 - 00002318 _____ C:\Users\Emil\Desktop\JRT.txt 2015-08-30 13:04 - 2015-08-30 15:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2015-08-30 12:51 - 2015-08-30 13:45 - 00000000 ____D C:\ProgramData\HitmanPro 2015-08-30 12:49 - 2015-09-03 20:06 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-08-30 12:49 - 2015-09-03 07:49 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-08-30 12:49 - 2015-08-30 12:49 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-08-30 12:49 - 2015-08-30 12:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-08-30 12:49 - 2015-08-30 12:49 - 00000000 ____D C:\ProgramData\Malwarebytes 2015-08-30 12:49 - 2015-08-30 12:49 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-08-30 12:49 - 2015-06-18 08:41 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-08-30 12:49 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-08-30 12:39 - 2015-08-30 12:41 - 00000000 ____D C:\AdwCleaner 2015-08-30 12:38 - 2015-08-31 23:36 - 00000000 ____D C:\Program Files (x86)\VS Revo Group 2015-08-30 10:50 - 2015-08-30 10:50 - 00650657 _____ C:\Users\Emil\Downloads\lame3.99.5.zip 2015-08-20 03:03 - 2015-08-11 03:20 - 25191936 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-08-20 03:03 - 2015-08-11 03:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2015-08-20 03:03 - 2015-08-11 02:33 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2015-08-20 03:03 - 2015-08-11 02:20 - 19871232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2015-08-13 06:50 - 2015-09-02 07:28 - 00011880 _____ C:\Windows\PFRO.log 2015-08-13 03:29 - 2015-07-30 15:13 - 00124624 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll 2015-08-13 03:29 - 2015-07-30 15:13 - 00103120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll 2015-08-12 09:18 - 2015-07-28 22:09 - 00017344 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe 2015-08-12 09:18 - 2015-07-28 22:05 - 01116672 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll 2015-08-12 09:18 - 2015-07-28 22:05 - 00774656 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll 2015-08-12 09:18 - 2015-07-28 22:05 - 00743424 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2015-08-12 09:18 - 2015-07-28 22:05 - 00437760 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll 2015-08-12 09:18 - 2015-07-28 22:05 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2015-08-12 09:18 - 2015-07-28 22:05 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll 2015-08-12 09:18 - 2015-07-28 21:55 - 01148416 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2015-08-12 09:18 - 2015-07-15 20:15 - 05568960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-08-12 09:18 - 2015-07-15 20:15 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2015-08-12 09:18 - 2015-07-15 20:15 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2015-08-12 09:18 - 2015-07-15 20:15 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys 2015-08-12 09:18 - 2015-07-15 20:12 - 01730496 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2015-08-12 09:18 - 2015-07-15 20:11 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll 2015-08-12 09:18 - 2015-07-15 20:11 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll 2015-08-12 09:18 - 2015-07-15 20:11 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll 2015-08-12 09:18 - 2015-07-15 20:11 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2015-08-12 09:18 - 2015-07-15 20:11 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll 2015-08-12 09:18 - 2015-07-15 20:10 - 01743360 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll 2015-08-12 09:18 - 2015-07-15 20:10 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2015-08-12 09:18 - 2015-07-15 20:10 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2015-08-12 09:18 - 2015-07-15 20:10 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll 2015-08-12 09:18 - 2015-07-15 20:10 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2015-08-12 09:18 - 2015-07-15 20:10 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2015-08-12 09:18 - 2015-07-15 20:10 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll 2015-08-12 09:18 - 2015-07-15 20:10 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2015-08-12 09:18 - 2015-07-15 20:10 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2015-08-12 09:18 - 2015-07-15 20:10 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2015-08-12 09:18 - 2015-07-15 20:10 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe 2015-08-12 09:18 - 2015-07-15 20:10 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2015-08-12 09:18 - 2015-07-15 20:10 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe 2015-08-12 09:18 - 2015-07-15 20:10 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2015-08-12 09:18 - 2015-07-15 20:10 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll 2015-08-12 09:18 - 2015-07-15 20:10 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll 2015-08-12 09:18 - 2015-07-15 20:10 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll 2015-08-12 09:18 - 2015-07-15 20:10 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2015-08-12 09:18 - 2015-07-15 20:10 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2015-08-12 09:18 - 2015-07-15 20:10 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2015-08-12 09:18 - 2015-07-15 20:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2015-08-12 09:18 - 2015-07-15 20:10 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll 2015-08-12 09:18 - 2015-07-15 20:10 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll 2015-08-12 09:18 - 2015-07-15 20:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe 2015-08-12 09:18 - 2015-07-15 20:09 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe 2015-08-12 09:18 - 2015-07-15 20:05 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2015-08-12 09:18 - 2015-07-15 20:05 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll 2015-08-12 09:18 - 2015-07-15 20:00 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2015-08-12 09:18 - 2015-07-15 20:00 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll 2015-08-12 09:18 - 2015-07-15 20:00 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 20:00 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 20:00 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 20:00 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 20:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 20:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 20:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 20:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 19:59 - 03989952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2015-08-12 09:18 - 2015-07-15 19:59 - 03934656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2015-08-12 09:18 - 2015-07-15 19:56 - 01311768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll 2015-08-12 09:18 - 2015-07-15 19:55 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2015-08-12 09:18 - 2015-07-15 19:55 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2015-08-12 09:18 - 2015-07-15 19:55 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2015-08-12 09:18 - 2015-07-15 19:55 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll 2015-08-12 09:18 - 2015-07-15 19:55 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2015-08-12 09:18 - 2015-07-15 19:54 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2015-08-12 09:18 - 2015-07-15 19:54 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2015-08-12 09:18 - 2015-07-15 19:54 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2015-08-12 09:18 - 2015-07-15 19:54 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll 2015-08-12 09:18 - 2015-07-15 19:54 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe 2015-08-12 09:18 - 2015-07-15 19:54 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2015-08-12 09:18 - 2015-07-15 19:54 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll 2015-08-12 09:18 - 2015-07-15 19:53 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll 2015-08-12 09:18 - 2015-07-15 19:53 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll 2015-08-12 09:18 - 2015-07-15 19:53 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll 2015-08-12 09:18 - 2015-07-15 19:53 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2015-08-12 09:18 - 2015-07-15 19:53 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe 2015-08-12 09:18 - 2015-07-15 19:53 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll 2015-08-12 09:18 - 2015-07-15 19:49 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll 2015-08-12 09:18 - 2015-07-15 19:48 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll 2015-08-12 09:18 - 2015-07-15 19:44 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2015-08-12 09:18 - 2015-07-15 19:44 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll 2015-08-12 09:18 - 2015-07-15 19:44 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 19:44 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 18:46 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys 2015-08-12 09:18 - 2015-07-15 18:46 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys 2015-08-12 09:18 - 2015-07-15 18:46 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys 2015-08-12 09:18 - 2015-07-15 18:37 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe 2015-08-12 09:18 - 2015-07-15 18:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe 2015-08-12 09:18 - 2015-07-15 18:34 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 18:34 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 18:34 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll 2015-08-12 09:18 - 2015-07-15 18:34 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll 2015-08-12 09:18 - 2015-07-10 19:51 - 03722752 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll 2015-08-12 09:18 - 2015-07-10 19:51 - 00158720 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll 2015-08-12 09:18 - 2015-07-10 19:51 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll 2015-08-12 09:18 - 2015-07-10 19:34 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll 2015-08-12 09:18 - 2015-07-10 19:34 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll 2015-08-12 09:18 - 2015-07-10 19:33 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll 2015-08-12 09:17 - 2015-07-30 20:06 - 01648128 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll 2015-08-12 09:17 - 2015-07-30 20:06 - 01180160 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll 2015-08-12 09:17 - 2015-07-30 19:57 - 01251328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll 2015-08-12 09:17 - 2015-07-21 02:39 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2015-08-12 09:17 - 2015-07-21 02:12 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2015-08-12 09:17 - 2015-07-16 22:54 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2015-08-12 09:17 - 2015-07-16 22:37 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2015-08-12 09:17 - 2015-07-16 22:36 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-08-12 09:17 - 2015-07-16 22:36 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2015-08-12 09:17 - 2015-07-16 22:36 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2015-08-12 09:17 - 2015-07-16 22:35 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-08-12 09:17 - 2015-07-16 22:35 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2015-08-12 09:17 - 2015-07-16 22:27 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2015-08-12 09:17 - 2015-07-16 22:26 - 05923328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-08-12 09:17 - 2015-07-16 22:26 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2015-08-12 09:17 - 2015-07-16 22:23 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2015-08-12 09:17 - 2015-07-16 22:21 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2015-08-12 09:17 - 2015-07-16 22:21 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2015-08-12 09:17 - 2015-07-16 22:21 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2015-08-12 09:17 - 2015-07-16 22:21 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2015-08-12 09:17 - 2015-07-16 22:12 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2015-08-12 09:17 - 2015-07-16 22:08 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-08-12 09:17 - 2015-07-16 22:00 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2015-08-12 09:17 - 2015-07-16 21:55 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2015-08-12 09:17 - 2015-07-16 21:54 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-08-12 09:17 - 2015-07-16 21:51 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2015-08-12 09:17 - 2015-07-16 21:51 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2015-08-12 09:17 - 2015-07-16 21:51 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2015-08-12 09:17 - 2015-07-16 21:50 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2015-08-12 09:17 - 2015-07-16 21:50 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2015-08-12 09:17 - 2015-07-16 21:49 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2015-08-12 09:17 - 2015-07-16 21:45 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2015-08-12 09:17 - 2015-07-16 21:43 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2015-08-12 09:17 - 2015-07-16 21:43 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2015-08-12 09:17 - 2015-07-16 21:41 - 00479232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2015-08-12 09:17 - 2015-07-16 21:39 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2015-08-12 09:17 - 2015-07-16 21:39 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2015-08-12 09:17 - 2015-07-16 21:38 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2015-08-12 09:17 - 2015-07-16 21:36 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-08-12 09:17 - 2015-07-16 21:35 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2015-08-12 09:17 - 2015-07-16 21:34 - 14451200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-08-12 09:17 - 2015-07-16 21:33 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2015-08-12 09:17 - 2015-07-16 21:32 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-08-12 09:17 - 2015-07-16 21:29 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2015-08-12 09:17 - 2015-07-16 21:24 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2015-08-12 09:17 - 2015-07-16 21:20 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2015-08-12 09:17 - 2015-07-16 21:19 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2015-08-12 09:17 - 2015-07-16 21:17 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2015-08-12 09:17 - 2015-07-16 21:12 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2015-08-12 09:17 - 2015-07-16 21:12 - 02427904 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-08-12 09:17 - 2015-07-16 21:10 - 12856832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2015-08-12 09:17 - 2015-07-16 21:06 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2015-08-12 09:17 - 2015-07-16 21:06 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2015-08-12 09:17 - 2015-07-16 21:05 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2015-08-12 09:17 - 2015-07-16 21:01 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-08-12 09:17 - 2015-07-16 20:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2015-08-12 09:17 - 2015-07-16 20:42 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2015-08-12 09:17 - 2015-07-16 20:38 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2015-08-12 09:17 - 2015-07-16 20:37 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2015-08-12 09:17 - 2015-07-15 05:19 - 02004992 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll 2015-08-12 09:17 - 2015-07-15 05:19 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2015-08-12 09:17 - 2015-07-15 05:19 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\basesrv.dll 2015-08-12 09:17 - 2015-07-15 05:14 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll 2015-08-12 09:17 - 2015-07-15 05:13 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll 2015-08-12 09:17 - 2015-07-15 04:55 - 01390592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll 2015-08-12 09:17 - 2015-07-15 04:55 - 01241088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll 2015-08-12 09:17 - 2015-07-15 04:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll 2015-08-12 09:17 - 2015-07-15 04:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll 2015-08-12 09:17 - 2015-07-01 22:49 - 00260096 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll 2015-08-12 09:17 - 2015-07-01 22:48 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll 2015-08-12 09:17 - 2015-07-01 22:30 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll 2015-08-12 09:17 - 2015-07-01 22:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll 2015-08-12 09:16 - 2015-07-30 20:06 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2015-08-12 09:16 - 2015-07-30 20:06 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll 2015-08-12 09:16 - 2015-07-30 20:06 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll 2015-08-12 09:16 - 2015-07-30 20:06 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll 2015-08-12 09:16 - 2015-07-30 20:06 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll 2015-08-12 09:16 - 2015-07-30 19:57 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll 2015-08-12 09:16 - 2015-07-30 19:57 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll 2015-08-12 09:16 - 2015-07-30 19:57 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll 2015-08-12 09:16 - 2015-07-30 19:57 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll 2015-08-12 09:16 - 2015-07-30 19:55 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll 2015-08-12 09:16 - 2015-07-30 18:56 - 03208192 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-08-12 09:16 - 2015-07-30 18:52 - 00372736 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll 2015-08-12 09:16 - 2015-07-30 18:49 - 00299520 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll 2015-08-12 09:16 - 2015-07-20 20:12 - 03154944 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2015-08-12 09:16 - 2015-07-20 20:12 - 02606080 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2015-08-12 09:16 - 2015-07-20 20:12 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll 2015-08-12 09:16 - 2015-07-20 20:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2015-08-12 09:16 - 2015-07-20 20:12 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2015-08-12 09:16 - 2015-07-20 20:12 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll 2015-08-12 09:16 - 2015-07-20 20:12 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll 2015-08-12 09:16 - 2015-07-20 20:12 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll 2015-08-12 09:16 - 2015-07-20 20:12 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2015-08-12 09:16 - 2015-07-20 20:12 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll 2015-08-12 09:16 - 2015-07-20 20:12 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll 2015-08-12 09:16 - 2015-07-20 19:56 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll 2015-08-12 09:16 - 2015-07-20 19:56 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll 2015-08-12 09:16 - 2015-07-20 19:56 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll 2015-08-12 09:16 - 2015-07-20 19:56 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe 2015-08-12 09:16 - 2015-07-20 19:56 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll 2015-08-12 09:16 - 2015-07-10 19:51 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2015-08-12 09:16 - 2015-07-10 19:34 - 12875776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2015-08-12 09:16 - 2015-07-09 19:57 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\notepad.exe 2015-08-12 09:16 - 2015-07-09 19:57 - 00193536 _____ (Microsoft Corporation) C:\Windows\notepad.exe 2015-08-12 09:16 - 2015-07-09 19:42 - 00179712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe 2015-08-12 09:16 - 2015-05-09 20:26 - 00493504 _____ (Microsoft Corporation) C:\Windows\system32\mcupdate_GenuineIntel.dll 2015-08-09 21:39 - 2015-08-09 21:39 - 00005806 _____ C:\Windows\system32\cc_20150809_213913.reg ==================== Ein Monat: Geänderte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2015-09-03 20:15 - 2009-07-14 06:45 - 00036176 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-09-03 20:15 - 2009-07-14 06:45 - 00036176 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-09-03 20:14 - 2013-06-19 20:46 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-09-03 20:05 - 2013-06-10 19:29 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-09-03 13:14 - 2013-06-19 20:46 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-09-02 23:39 - 2015-03-21 22:56 - 00000000 ___RD C:\Users\Emil\Google Drive 2015-09-02 23:38 - 2015-07-13 19:40 - 00003467 _____ C:\Windows\setupact.log 2015-09-02 23:38 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2015-09-02 23:36 - 2013-06-10 15:18 - 01949471 _____ C:\Windows\WindowsUpdate.log 2015-09-02 18:36 - 2013-06-11 01:06 - 00699416 _____ C:\Windows\system32\perfh007.dat 2015-09-02 18:36 - 2013-06-11 01:06 - 00149556 _____ C:\Windows\system32\perfc007.dat 2015-09-02 18:36 - 2009-07-14 07:13 - 01620612 _____ C:\Windows\system32\PerfStringBackup.INI 2015-09-02 12:17 - 2013-07-23 22:26 - 00002182 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2015-09-02 07:46 - 2015-05-18 15:21 - 00000000 ____D C:\Users\Emil\AppData\Roaming\Raptr 2015-09-02 07:46 - 2015-05-18 15:21 - 00000000 ____D C:\Program Files (x86)\Raptr 2015-09-01 23:35 - 2015-05-18 20:48 - 00000000 ____D C:\Users\Erina\AppData\Roaming\Raptr 2015-08-31 23:04 - 2013-06-12 19:27 - 00000000 ____D C:\Users\Emil\AppData\Roaming\vlc 2015-08-31 22:38 - 2014-11-22 15:44 - 00000000 ____D C:\Users\Emil\AppData\Roaming\KeePass 2015-08-31 22:31 - 2014-08-14 20:50 - 00000000 ____D C:\ProgramData\Package Cache 2015-08-31 13:09 - 2013-06-19 20:46 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2015-08-31 13:09 - 2013-06-19 20:46 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2015-08-31 10:12 - 2013-06-11 22:28 - 00000000 ____D C:\Users\Public\Documents\Dokumente Eri 2015-08-31 08:06 - 2013-06-12 19:14 - 00000000 ____D C:\ProgramData\Avira 2015-08-31 08:06 - 2013-06-12 19:14 - 00000000 ____D C:\Program Files (x86)\Avira 2015-08-30 15:16 - 2013-06-15 00:26 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2015-08-30 12:52 - 2013-06-12 22:59 - 00000000 ____D C:\Users\Erina 2015-08-30 12:20 - 2013-06-10 15:18 - 00000000 ____D C:\Users\Emil 2015-08-30 12:18 - 2015-04-05 03:01 - 00000000 ___SD C:\Windows\system32\GWX 2015-08-30 12:18 - 2013-07-22 18:12 - 00000000 ____D C:\Users\Emil\AppData\Roaming\MusicBee 2015-08-30 12:18 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration 2015-08-24 19:12 - 2013-06-11 22:28 - 00000000 ____D C:\Users\Public\Documents\Dokumente Emi 2015-08-19 06:57 - 2014-07-29 22:49 - 00002049 _____ C:\Users\Public\Desktop\Google Slides.lnk 2015-08-19 06:57 - 2014-07-29 22:49 - 00002047 _____ C:\Users\Public\Desktop\Google Sheets.lnk 2015-08-19 06:57 - 2014-07-29 22:49 - 00002037 _____ C:\Users\Public\Desktop\Google Docs.lnk 2015-08-19 06:57 - 2014-07-29 22:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive 2015-08-13 09:31 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache 2015-08-13 06:50 - 2014-06-20 23:16 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2015-08-13 06:50 - 2014-06-20 23:16 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight 2015-08-13 06:50 - 2009-07-14 06:45 - 00341880 _____ C:\Windows\system32\FNTCACHE.DAT 2015-08-13 06:47 - 2014-12-10 19:19 - 00000000 ____D C:\Windows\system32\appraiser 2015-08-13 06:47 - 2014-05-07 03:01 - 00000000 ___SD C:\Windows\system32\CompatTel 2015-08-13 03:29 - 2014-06-20 23:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2015-08-13 03:25 - 2013-06-12 18:39 - 00000000 ____D C:\ProgramData\Microsoft Help 2015-08-13 03:18 - 2013-08-15 03:01 - 00000000 ____D C:\Windows\system32\MRT 2015-08-13 03:05 - 2013-06-12 18:06 - 132483416 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-08-12 08:06 - 2013-06-10 19:29 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2015-08-12 08:05 - 2013-06-10 19:29 - 00778440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-08-12 08:05 - 2013-06-10 19:29 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2015-08-09 21:34 - 2013-06-10 20:07 - 00000000 ____D C:\Sicherheit 2015-08-09 21:32 - 2013-06-10 19:56 - 00000000 ____D C:\Program Files\CCleaner ==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ======= 2014-11-28 14:19 - 2014-11-28 14:20 - 0047104 ___SH () C:\Users\Emil\AppData\Roaming\Thumbs.db 2015-09-03 10:21 - 2015-09-03 10:21 - 0216292 _____ () C:\Users\Emil\AppData\Local\ars.cache 2015-09-03 10:21 - 2015-09-03 10:21 - 1572412 _____ () C:\Users\Emil\AppData\Local\census.cache 2015-09-02 23:09 - 2015-09-02 23:09 - 0000036 _____ () C:\Users\Emil\AppData\Local\housecall.guid.cache 2015-06-07 21:09 - 2015-06-07 21:09 - 0007605 _____ () C:\Users\Emil\AppData\Local\Resmon.ResmonCfg 2015-09-02 23:56 - 2015-09-02 23:56 - 0000010 _____ () C:\Users\Emil\AppData\Local\sponge.last.runtime.cache 2015-05-18 15:46 - 2015-05-18 15:46 - 0000000 ____H () C:\ProgramData\DP45977C.lfl 2013-10-01 22:39 - 2013-10-01 22:39 - 0001534 _____ () C:\ProgramData\ss.ini Einige Dateien in TEMP: ==================== C:\Users\Emil\AppData\Local\Temp\avgnt.exe C:\Users\Emil\AppData\Local\Temp\InstHelper.exe C:\Users\Emil\AppData\Local\Temp\jre-8u51-windows-au.exe C:\Users\Emil\AppData\Local\Temp\ytb.exe C:\Users\Erina\AppData\Local\Temp\avgnt.exe ==================== Bamital & volsnap ================= (Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.) C:\Windows\system32\winlogon.exe => Datei ist digital signiert C:\Windows\system32\wininit.exe => Datei ist digital signiert C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert C:\Windows\explorer.exe => Datei ist digital signiert C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert C:\Windows\system32\svchost.exe => Datei ist digital signiert C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert C:\Windows\system32\services.exe => Datei ist digital signiert C:\Windows\system32\User32.dll => Datei ist digital signiert C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert C:\Windows\system32\userinit.exe => Datei ist digital signiert C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert C:\Windows\system32\rpcss.dll => Datei ist digital signiert C:\Windows\system32\dnsapi.dll => Datei ist digital signiert C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert LastRegBack: 2015-09-01 07:29 ==================== Ende von FRST.txt ============================ Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-09-03 21:13:18
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk1\DR1 -> \Device\0000006d ST500DM0 rev.KC45 465.76GB
Running: mowduqo6.exe; Driver: C:\Users\Emil\AppData\Local\Temp\kwtdapod.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[3372] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 00000000750b8769 4 bytes [C2, 04, 00, 00]
.text D:\Downloads\Defogger.exe[6572] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075871401 2 bytes JMP 750db20b C:\Windows\syswow64\kernel32.dll
.text D:\Downloads\Defogger.exe[6572] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075871419 2 bytes JMP 750db336 C:\Windows\syswow64\kernel32.dll
.text D:\Downloads\Defogger.exe[6572] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075871431 2 bytes JMP 75158f39 C:\Windows\syswow64\kernel32.dll
.text D:\Downloads\Defogger.exe[6572] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007587144a 2 bytes CALL 750b4885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text D:\Downloads\Defogger.exe[6572] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000758714dd 2 bytes JMP 75158832 C:\Windows\syswow64\kernel32.dll
.text D:\Downloads\Defogger.exe[6572] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000758714f5 2 bytes JMP 75158a08 C:\Windows\syswow64\kernel32.dll
.text D:\Downloads\Defogger.exe[6572] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007587150d 2 bytes JMP 75158728 C:\Windows\syswow64\kernel32.dll
.text D:\Downloads\Defogger.exe[6572] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075871525 2 bytes JMP 75158af2 C:\Windows\syswow64\kernel32.dll
.text D:\Downloads\Defogger.exe[6572] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007587153d 2 bytes JMP 750cfc98 C:\Windows\syswow64\kernel32.dll
.text D:\Downloads\Defogger.exe[6572] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075871555 2 bytes JMP 750d68df C:\Windows\syswow64\kernel32.dll
.text D:\Downloads\Defogger.exe[6572] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007587156d 2 bytes JMP 75158ff1 C:\Windows\syswow64\kernel32.dll
.text D:\Downloads\Defogger.exe[6572] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075871585 2 bytes JMP 75158b52 C:\Windows\syswow64\kernel32.dll
.text D:\Downloads\Defogger.exe[6572] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007587159d 2 bytes JMP 751586ec C:\Windows\syswow64\kernel32.dll
.text D:\Downloads\Defogger.exe[6572] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000758715b5 2 bytes JMP 750cfd31 C:\Windows\syswow64\kernel32.dll
.text D:\Downloads\Defogger.exe[6572] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000758715cd 2 bytes JMP 750db2cc C:\Windows\syswow64\kernel32.dll
.text D:\Downloads\Defogger.exe[6572] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000758716b2 2 bytes JMP 75158eb4 C:\Windows\syswow64\kernel32.dll
.text D:\Downloads\Defogger.exe[6572] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000758716bd 2 bytes JMP 75158681 C:\Windows\syswow64\kernel32.dll
---- Processes - GMER 2.1 ----
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\python27.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672] (Python Core/Python Software Foundation)(2015-09-02 21:39:15) 000000001e000000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\win32api.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 000000001e8c0000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\pywintypes27.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:14) 000000001e7a0000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\pythoncom27.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 0000000000510000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\_socket.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 0000000000260000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\_ssl.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 0000000010000000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\win32com.shell.shell.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 000000001e800000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\_hashlib.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 0000000002e40000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\wx._core_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 0000000002f00000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\wxbase30u_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672] (wxWidgets base library/wxWidgets development team)(2015-09-02 21:39:15) 0000000003030000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\wxbase30u_net_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672] (wxWidgets network library/wxWidgets development team)(2015-09-02 21:39:15) 00000000004d0000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\wxmsw30u_core_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672] (wxWidgets core library/wxWidgets development team)(2015-09-02 21:39:15) 0000000003230000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\wxmsw30u_adv_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672] (wxWidgets advanced library/wxWidgets development team)(2015-09-02 21:39:15) 0000000003700000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\wx._gdi_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 0000000003940000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\wx._windows_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 00000000042e0000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\wxmsw30u_html_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672] (wxWidgets html library/wxWidgets development team)(2015-09-02 21:39:17) 0000000003a10000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\wx._controls_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 00000000045d0000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\wx._misc_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 00000000046e0000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\pysqlite2._sqlite.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 00000000047a0000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\_ctypes.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:14) 000000001d1a0000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\win32file.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 000000001ea10000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\win32security.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 000000001ec80000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\hashobjs_ext.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 0000000001d60000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\usb_ext.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 0000000001d70000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\win32gui.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 000000001ea40000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\win32event.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 000000001e9b0000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\_elementtree.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 000000001d100000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\pyexpat.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 0000000001d90000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\common.time34.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 0000000001dc0000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\_psutil_windows.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 0000000003ab0000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\win32inet.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 000000001eaa0000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\win32crypt.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 000000001e980000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\wx._html2.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 00000000043f0000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\wxmsw30u_webview_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672] (wxWidgets webview library/wxWidgets development team)(2015-09-02 21:39:17) 0000000004410000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\_multiprocessing.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 0000000004430000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\_yappi.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 0000000005920000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\win32process.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 000000001ebf0000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\unicodedata.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 0000000005a40000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\wx._wizard.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 0000000005930000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\win32pipe.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 000000001eb90000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\select.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 0000000005970000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\win32pdh.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 000000001eb60000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\win32profile.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 000000001ec20000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\win32ts.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 000000001ed40000
Library C:\Users\Emil\AppData\Local\Temp\_MEI23282\wx._animate.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2672](2015-09-02 21:39:15) 00000000059d0000
---- EOF - GMER 2.1 ----
defrogger ok, kein protokoll würde mich freuen wenn ihr mir weiterhelfen könntet. lg Geändert von winfan (03.09.2015 um 20:44 Uhr) |
|
03.09.2015, 20:27
| #2 |
| | Win 7 extrem verlangsamt weiter gehts
__________________Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:31-08-2015
durchgeführt von Emil (2015-09-03 20:22:42)
Gestartet von D:\Downloads
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-523548968-1357001120-3005945389-500 - Administrator - Disabled)
Emil (S-1-5-21-523548968-1357001120-3005945389-1000 - Administrator - Enabled) => C:\Users\Emil
Erina (S-1-5-21-523548968-1357001120-3005945389-1004 - Limited - Enabled) => C:\Users\Erina
Gast (S-1-5-21-523548968-1357001120-3005945389-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-523548968-1357001120-3005945389-1003 - Limited - Enabled)
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Avira Antivirus (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: ESET NOD32 Antivirus 8.0 (Enabled - Up to date) {19259FAE-8396-A113-46DB-15B0E7DFA289}
AS: Avira Antivirus (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: ESET NOD32 Antivirus 8.0 (Enabled - Up to date) {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
Adobe Flash Player 18 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 18.0.0.232 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.232 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.12) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.12 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{8DF1EF50-AEB6-902C-F68C-4683C45784E6}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
Anleitung für Epson Connect (HKLM-x32\...\Epson Connect Guide) (Version: - )
Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.14.3.0 - Asmedia Technology)
Autostart-Manager (HKLM-x32\...\{5C2C73F6-CE73-4A01-868E-7045B7805334}) (Version: 6.02.0000 - Wirth IT Design )
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.12.420 - Avira Operations GmbH & Co. KG)
BitComet 1.37 64-bit (HKLM-x32\...\BitComet_x64) (Version: 1.37 - CometNetwork)
Bluetooth Stack for Windows by Toshiba (HKLM\...\{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}) (Version: v7.00.05 - TOSHIBA CORPORATION)
CameraHelperMsi (x32 Version: 13.51.815.0 - Logitech) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.08 - Piriform)
Content Manager (HKLM-x32\...\Content Manager) (Version: 3.18.4.510611 - NNG Llc.)
Creative ALchemy (HKLM-x32\...\ALchemy) (Version: 1.43 - Creative Technology Limited)
Creative Audio-Systemsteuerung (HKLM-x32\...\AudioCS) (Version: 3.00 - Creative Technology Limited)
Creative Media Toolbox 6 (HKLM-x32\...\{F1A14CB2-A048-45A6-AFDA-3571296E1D76}) (Version: 6.02 - Creative Technology Limited)
Creative Media Toolbox 6 (Shared Components) (HKLM-x32\...\Uninstaller_B4736000_Creative Media Toolbox 6) (Version: 2.80.12 - Creative Labs)
Creative MediaSource 5 (HKLM-x32\...\{BEEFC4F8-2909-48B3-AFAA-55D3533FDEDD}) (Version: 5.00 - Creative Technology Limited)
Creative Software AutoUpdate (HKLM-x32\...\Creative Software AutoUpdate) (Version: 1.41 - Creative Technology Limited)
Creative Sound Blaster Properties x64 Edition (HKLM-x32\...\Creative Sound Blaster Properties x64 Edition) (Version: 1.03 - Creative Technology Limited)
Creative WaveStudio 7 (HKLM-x32\...\WaveStudio 7) (Version: 7.14 - Creative Technology Limited)
Creative-Diagnose (HKLM-x32\...\Diagnostics 4_5) (Version: 5.11 - Creative Technology Limited)
Epson Benutzerhandbuch WF-2510 Series (HKLM-x32\...\WF-2510 Series Useg) (Version: - )
Epson Event Manager (HKLM-x32\...\{8F01524C-0676-4CC1-B4AE-64753C723391}) (Version: 3.01.0005 - Seiko Epson Corporation)
Epson FAX Utility (HKLM-x32\...\{0CBE6C93-CB2E-4378-91EE-12BE6D4E2E4A}) (Version: 1.30.00 - SEIKO EPSON CORPORATION)
Epson Netzwerkhandbuch WF-2510 Series (HKLM-x32\...\WF-2510 Series Netg) (Version: - )
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - Seiko Epson Corporation)
EPSON WF-2510 Series Printer Uninstall (HKLM\...\EPSON WF-2510 Series) (Version: - SEIKO EPSON Corporation)
EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.6.0 - SEIKO EPSON CORPORATION)
erLT (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
ESET NOD32 Antivirus (HKLM\...\{5F2AE448-CD4B-40BD-B245-5F0CD06A09B0}) (Version: 8.0.319.0 - ESET, spol s r. o.)
Evernote Sticky Notes (HKLM-x32\...\{9A0511EA-07AC-4F48-91DE-5D819A4842AE}) (Version: 1.5.8 - Evernote Sticky Notes)
FFB Racing Wheel drivers (HKLM-x32\...\{28B758EA-5C83-48B1-B352-C70F12C73F5A}) (Version: 3.TTRS.2014 - Thrustmaster)
File Shredder 2.5 (HKLM\...\File Shredder_is1) (Version: - Pow Tools)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 45.0.2454.85 - Google Inc.)
Google Drive (HKLM-x32\...\{12ADFB82-D5A3-43E4-B2F4-FCD9B690315B}) (Version: 1.24.9931.5480 - Google, Inc.)
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.28.13 - Google Inc.) Hidden
Host OpenAL (HKLM-x32\...\Host OpenAL) (Version: 2.02 - Creative Technology Limited)
IZArc 4.1.2 (HKLM-x32\...\{97C82B44-D408-4F14-9252-47FC1636D23E}_is1) (Version: 4.1.2 - Ivan Zahariev)
Java 8 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218051F0}) (Version: 8.0.510 - Oracle Corporation)
KeePass Password Safe 1.29 (HKLM-x32\...\KeePass Password Safe_is1) (Version: 1.29 - Dominik Reichl)
KeePass Password Safe 2.29 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.29 - Dominik Reichl)
K-Lite Codec Pack 9.9.0 (64-bit) (HKLM\...\KLiteCodecPack64_is1) (Version: 9.9.0 - )
Logitech Webcam-Software (HKLM-x32\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.51 - Logitech Inc.)
Malwarebytes Anti-Malware Version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)
Microsoft Sync Framework 2.0 Core Components (x64) ENU (HKLM\...\{8CCBEC22-D2DB-4DC9-A58A-E1A1F3A38C8A}) (Version: 2.0.1578.0 - Microsoft Corporation)
Microsoft Sync Framework 2.0 Provider Services (x64) ENU (HKLM\...\{03AC245F-4C64-425C-89CF-7783C1D3AB2C}) (Version: 2.0.1578.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Motorola Bluetooth (HKLM\...\1DF1F719-D43A-46E8-950F-65A8D96C678A.MBT_is1) (Version: 3.0.02.285 - Motorola, Inc.)
Mozilla Firefox 40.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 40.0.3 (x86 de)) (Version: 40.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 40.0.3.5716 - Mozilla)
Mozilla Thunderbird 31.7.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.7.0 (x86 de)) (Version: 31.7.0 - Mozilla)
Mp3tag v2.66 (HKLM-x32\...\Mp3tag) (Version: v2.66 - Florian Heidenreich)
MusicBee 2.1 (HKLM-x32\...\MusicBee) (Version: 2.1 - Steven Mayall)
Naviextras Toolbox Prerequesities (HKLM-x32\...\{537575D6-3B96-474C-BD8F-DFF667363DBD}) (Version: 1.0.0 - NNG Llc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.86.508.2014 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7373 - Realtek Semiconductor Corp.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Shark007 Standard Codecs (HKLM-x32\...\{898E81AD-6DB9-4750-866B-B8958C5DC7AA}) (Version: 2.4.2 - Shark007)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
SlimDrivers (HKLM-x32\...\{5AD12E7A-D739-4451-9BD1-3610EC56D8F5}) (Version: 2.2.45206 - SlimWare Utilities, Inc.)
Sound Blaster X-Fi (HKLM-x32\...\{0C9D0200-FA32-44B7-BBB3-7C03F700C4A0}) (Version: 1.0 - )
SyncToy 2.1 (x64) (HKLM\...\{88DAAF05-5A72-46D2-A7C5-C3759697E943}) (Version: 2.1.0 - Microsoft)
TP-LINK TL-WN781ND Driver (HKLM-x32\...\{87C7B472-9BC2-43C8-9F03-86D2908E1A51}) (Version: 1.2.1 - TP-LINK)
TP-LINK Wireless Configuration Utility (HKLM-x32\...\{319D91C6-3D44-436C-9F79-36C0D22372DC}) (Version: 1.2.1 - TP-LINK)
VeraCrypt (HKLM-x32\...\VeraCrypt) (Version: 1.0e - IDRIX)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Wise Registry Cleaner 8.61 (HKLM-x32\...\Wise Registry Cleaner_is1) (Version: 8.61 - WiseCleaner.com, Inc.)
x64Components v2.4.2 (HKLM\...\Standard x64Components_is1) (Version: 2.4.2 - Shark007)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Wiederherstellungspunkte =========================
02-09-2015 07:08:40 Removed AVG 2015
02-09-2015 07:16:21 Removed AVG 2015
02-09-2015 21:04:35 Windows Update
==================== Hosts Inhalt: ===============================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {12864893-DA00-475F-B90A-581312278C54} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-31] (Google Inc.)
Task: {1EDCFB87-E2FC-495A-88A7-0EA4988DF163} - System32\Tasks\Synctoy Keepass => C:\Program Files\SyncToy 2.1\SyncToyCmd.exe [2009-10-19] (Microsoft Corporation)
Task: {2B51C661-DBD6-4FD3-AD9E-8299A602A88C} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)
Task: {4BB570A3-7840-47AF-B895-2B056E24A8BA} - System32\Tasks\{AC210AA5-0AD7-446E-9567-80CC8B7164FB} => pcalua.exe -a C:\Windows\SysWOW64\Samsung_USB_Drivers\6\SSBCUninstall.exe
Task: {52525555-1898-46FC-83E3-76B159619670} - System32\Tasks\SyncToy Sicherheitskopien => C:\Program Files\SyncToy 2.1\SyncToyCmd.exe [2009-10-19] (Microsoft Corporation)
Task: {5D576EBF-072D-4F49-8687-0AA17A66DEDB} - System32\Tasks\Synctoy Thunderbird => C:\Program Files\SyncToy 2.1\SyncToyCmd.exe [2009-10-19] (Microsoft Corporation)
Task: {88FD7AE1-2FF8-4CD7-AFB8-1D08E13C97A1} - System32\Tasks\synchtoy musik => C:\Program Files\SyncToy 2.1\SyncToyCmd.exe [2009-10-19] (Microsoft Corporation)
Task: {8B128E61-BF83-4D22-A7E0-2DEF5E32C171} - System32\Tasks\{6C84E4A1-29D0-40EE-9949-91B6F12F5759} => pcalua.exe -a C:\Windows\SysWOW64\Samsung_USB_Drivers\3\SSCDUninstall.exe
Task: {8B81AE57-98D0-4308-9B61-FD1DBDAA34F1} - System32\Tasks\Synchtoy dokumente => C:\Program Files\SyncToy 2.1\SyncToyCmd.exe [2009-10-19] (Microsoft Corporation)
Task: {8BE7B938-A491-4F9D-965D-DA54445ED0C7} - System32\Tasks\ASUS\RunDAOD => C:\Windows\DAODx.exe [2009-03-30] ()
Task: {93E0096F-896D-4D90-B73B-90F056C2D936} - System32\Tasks\{18D21600-D2D0-497D-8651-FABBBF208D49} => pcalua.exe -a "C:\Program Files (x86)\RAMRush\unins000.exe"
Task: {AF925365-89A3-4FEB-A9BB-08D8E42803E8} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-08-12] (Adobe Systems Incorporated)
Task: {C336EDDE-602E-4124-8668-B25F47621873} - System32\Tasks\Synctoy Firefox Mozilla => C:\Program Files\SyncToy 2.1\SyncToyCmd.exe [2009-10-19] (Microsoft Corporation)
Task: {D1F4C747-0802-4232-A4A4-8DF597C8B965} - System32\Tasks\synctoy bilder => C:\Program Files\SyncToy 2.1\SyncToyCmd.exe [2009-10-19] (Microsoft Corporation)
Task: {D2FDC142-C94E-4129-B1A9-DE9622911180} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Rundll32.exe invagent.dll,RunUpdate -noappraiser
Task: {DAF48EBA-81DF-4740-AC06-E6B1D34B1FAD} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-07-17] (Piriform Ltd)
Task: {DB160A3B-4EB3-4265-BEEE-CBCF490AEB5D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-31] (Google Inc.)
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2015-07-15 21:39 - 2015-07-15 21:39 - 00214528 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Container.PerformanceTuning.dll
2014-02-11 07:08 - 2014-02-11 07:08 - 00817152 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Device.dll
2014-02-11 07:08 - 2014-02-11 07:08 - 03650560 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Platform.dll
2009-03-30 08:32 - 2009-03-30 08:32 - 00032768 ____R () C:\Windows\DAODx.exe
2015-05-18 15:50 - 2010-11-30 19:31 - 21705296 _____ () C:\Program Files\Motorola\Bluetooth\btmshell.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 00264040 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
2015-07-15 21:38 - 2015-07-15 21:38 - 00102400 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2015-06-01 19:28 - 2015-06-01 19:28 - 00057344 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2013-06-10 16:34 - 2009-02-06 18:52 - 00073728 _____ () C:\Windows\SysWOW64\CmdRtr.DLL
2013-06-10 16:34 - 2009-03-26 14:46 - 00148480 _____ () C:\Windows\SysWOW64\APOMngr.DLL
2009-03-17 11:39 - 2009-03-17 11:39 - 00148992 _____ () C:\Windows\SysWOW64\OemSpiE.dll
2014-05-26 20:44 - 2014-04-01 14:37 - 00371712 _____ () C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\DAQExp.dll
2014-04-22 17:17 - 2013-07-24 09:24 - 00137728 _____ () C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\CBSCreateVC.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 02144104 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtCore4.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 07955304 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtGui4.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 00341352 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtXml4.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 00028008 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QGif4.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 00127336 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QJpeg4.dll
2012-09-13 00:39 - 2012-09-13 00:39 - 00336232 _____ () C:\Program Files (x86)\Common Files\logishrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll
2015-09-02 23:39 - 2015-09-02 23:39 - 00098816 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\win32api.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00110080 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\pywintypes27.dll
2015-09-02 23:39 - 2015-09-02 23:39 - 00364544 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\pythoncom27.dll
2015-09-02 23:39 - 2015-09-02 23:39 - 00045568 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\_socket.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 01161216 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\_ssl.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00320512 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\win32com.shell.shell.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00713216 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\_hashlib.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 01176576 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\wx._core_.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00806400 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\wx._gdi_.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00816128 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\wx._windows_.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 01067008 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\wx._controls_.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00733184 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\wx._misc_.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00682496 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\pysqlite2._sqlite.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00087552 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\_ctypes.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00119808 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\win32file.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00108544 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\win32security.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00007168 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\hashobjs_ext.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00068096 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\usb_ext.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00167936 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\win32gui.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00018432 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\win32event.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00128512 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\_elementtree.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00127488 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\pyexpat.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00013824 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\common.time34.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00036864 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\_psutil_windows.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00038912 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\win32inet.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00011264 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\win32crypt.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00077312 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\wx._html2.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00027136 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\_multiprocessing.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00020480 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\_yappi.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00035840 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\win32process.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00686080 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\unicodedata.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00123392 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\wx._wizard.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00024064 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\win32pipe.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00010240 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\select.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00025600 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\win32pdh.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00525640 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\windows._lib_cacheinvalidation.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00017408 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\win32profile.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00022528 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\win32ts.pyd
2015-09-02 23:39 - 2015-09-02 23:39 - 00078848 _____ () C:\Users\Emil\AppData\Local\Temp\_MEI23282\wx._animate.pyd
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-523548968-1357001120-3005945389-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Desktop-Hintergrund.bmp
HKU\S-1-5-21-523548968-1357001120-3005945389-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Desktop-Hintergrund.bmp
HKU\S-1-5-21-523548968-1357001120-3005945389-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\Control Panel\Desktop\\Wallpaper -> C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Desktop-Hintergrund.bmp
HKU\S-1-5-21-523548968-1357001120-3005945389-1004\Control Panel\Desktop\\Wallpaper -> C:\Users\Erina\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\S-1-5-21-523548968-1357001120-3005945389-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> C:\Users\Erina\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\S-1-5-21-523548968-1357001120-3005945389-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\Control Panel\Desktop\\Wallpaper -> C:\Users\Erina\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 195.34.133.21 - 212.186.211.21
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: asComSvc => 2
MSCONFIG\Services: asHmComSvc => 2
MSCONFIG\Services: AsSysCtrlService => 2
MSCONFIG\Services: AsusFanControlService => 2
MSCONFIG\Services: BITCOMET_HELPER_SERVICE => 3
MSCONFIG\Services: Creative ALchemy AL6 Licensing Service => 3
MSCONFIG\Services: Creative Audio Engine Licensing Service => 3
MSCONFIG\Services: Creative Media Toolbox 6 Licensing Service => 3
MSCONFIG\Services: CTAudSvcService => 2
MSCONFIG\Services: SkypeUpdate => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^TP-LINK Wireless Configuration Utility.lnk => C:\Windows\pss\TP-LINK Wireless Configuration Utility.lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: ASUS AiChargerPlus Execute => C:\Program Files (x86)\InstallShield Installation Information\{E6931688-DA2B-4E16-8539-3D323D69C677}\AiChargerPlus.exe
MSCONFIG\startupreg: ASUS WiFi GO! FileTransfer Execute => C:\Program Files (x86)\ASUS\AI Suite II\Remote GO!\AssistTools\WiFile\WiFileTransfer.exe
MSCONFIG\startupreg: Creative MediaSource Go => "C:\Program Files (x86)\Creative\MediaSource5\Go\CTCMSGoU.exe" /SCB
MSCONFIG\startupreg: CreativeTaskScheduler => "C:\Program Files (x86)\Creative\Shared Files\CTSched.exe" /logon
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{ED2DB12B-26F4-43AC-950C-466D0785E949}] => (Allow) LPort=2869
FirewallRules: [{372C9D2E-ED4B-46B1-BD0E-D4CAC3CBA29A}] => (Allow) LPort=1900
FirewallRules: [{CA75F9C9-D8FE-41CC-A47D-1E2447C8E38B}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{CBC0E32C-B09E-4088-8E31-2853A73E435E}] => (Allow) LPort=2869
FirewallRules: [{D456E585-8A8E-4177-92E9-11FF7F150C5E}] => (Allow) LPort=1900
FirewallRules: [{A1BDB005-C55F-4587-8A65-C8547AF5A173}] => (Allow) E:\Network\EpsonNetSetup\ENEasyApp.exe
FirewallRules: [{47A9FBB8-0B3A-443B-855C-A388FE9EBF73}] => (Allow) E:\Network\EpsonNetSetup\ENEasyApp.exe
FirewallRules: [TCP Query User{6E3859F6-4BC8-41ED-830A-9987EB57D883}C:\program files (x86)\epson software\event manager\eeventmanager.exe] => (Allow) C:\program files (x86)\epson software\event manager\eeventmanager.exe
FirewallRules: [UDP Query User{C35991D9-306E-4DDA-A820-5823BB40CD4E}C:\program files (x86)\epson software\event manager\eeventmanager.exe] => (Allow) C:\program files (x86)\epson software\event manager\eeventmanager.exe
FirewallRules: [TCP Query User{41E14979-C74A-46B6-856A-BF20A631FA15}C:\program files (x86)\epson software\event manager\eeventmanager.exe] => (Allow) C:\program files (x86)\epson software\event manager\eeventmanager.exe
FirewallRules: [UDP Query User{BFD47FA6-A80D-4545-9066-86D8C449093E}C:\program files (x86)\epson software\event manager\eeventmanager.exe] => (Allow) C:\program files (x86)\epson software\event manager\eeventmanager.exe
FirewallRules: [{52EF4294-5B2B-4EE8-8D88-BCEB6A699338}] => (Allow) D:\Programme D\BitComet\BitComet.exe
FirewallRules: [{4AAD1CF5-6FDD-4D20-A6F8-B60182A01893}] => (Allow) D:\Programme D\BitComet\BitComet.exe
FirewallRules: [{AE3BD03E-D23B-4FB3-B306-4ED54FB302D9}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{789615A4-86AC-4F8E-A75C-F9B0D8CDDC6B}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{6EBB0CC2-B8DF-4014-9379-7185BCAEE719}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{D27DE562-2B54-4B2B-9B93-A3AD370DD986}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{C28443B0-A0C8-439F-804D-29511DAEBDA9}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{A3036EFE-137F-4E59-93EA-284C395B0828}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{E9E649EB-EB42-4CAD-8986-03DF18F629CB}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe
FirewallRules: [{3E4741AC-2876-4C96-B65A-94879ABCCF38}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe
FirewallRules: [{8D248070-896A-449A-A1A8-579C793BBCEB}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{3554766B-C86D-456D-90A5-76E75604167E}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{1708BAEF-637A-40FE-8262-0118D2F98F2C}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Fehlerhafte Geräte im Gerätemanager =============
Name: TP-LINK 150Mbps Wireless N PCI Express Adapter
Description: TP-LINK 150Mbps Wireless N PCI Express Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: TP-LINK
Service: athr
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (09/02/2015 11:41:09 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/02/2015 07:30:05 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/02/2015 07:16:31 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddLegacyDriverFiles: Unable to back up image of binary AVGIDSDriver.
System Error:
Das System kann die angegebene Datei nicht finden.
.
Error: (09/01/2015 11:44:19 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/31/2015 08:12:45 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/31/2015 08:12:38 AM) (Source: Avira Antivirus) (EventID: 4117) (User: NT-AUTORITÄT)
Description: Die Lizenzdatei enthält keine gültige Lizenz. Der Dienst wird beendet!
Error: (08/30/2015 10:52:29 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: vlc.exe, Version: 2.1.5.0, Zeitstempel: 0x00000000
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18933, Zeitstempel: 0x55a6a196
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000001889d
ID des fehlerhaften Prozesses: 0x54c
Startzeit der fehlerhaften Anwendung: 0xvlc.exe0
Pfad der fehlerhaften Anwendung: vlc.exe1
Pfad des fehlerhaften Moduls: vlc.exe2
Berichtskennung: vlc.exe3
Error: (08/30/2015 10:51:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: vlc.exe, Version: 2.1.5.0, Zeitstempel: 0x00000000
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18933, Zeitstempel: 0x55a6a196
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000001889d
ID des fehlerhaften Prozesses: 0x17e0
Startzeit der fehlerhaften Anwendung: 0xvlc.exe0
Pfad der fehlerhaften Anwendung: vlc.exe1
Pfad des fehlerhaften Moduls: vlc.exe2
Berichtskennung: vlc.exe3
Error: (08/30/2015 10:50:57 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: vlc.exe, Version: 2.1.5.0, Zeitstempel: 0x00000000
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18933, Zeitstempel: 0x55a6a196
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000001889d
ID des fehlerhaften Prozesses: 0xd9c
Startzeit der fehlerhaften Anwendung: 0xvlc.exe0
Pfad der fehlerhaften Anwendung: vlc.exe1
Pfad des fehlerhaften Moduls: vlc.exe2
Berichtskennung: vlc.exe3
Error: (08/30/2015 10:49:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: vlc.exe, Version: 2.1.5.0, Zeitstempel: 0x00000000
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18933, Zeitstempel: 0x55a6a196
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000001889d
ID des fehlerhaften Prozesses: 0xbe4
Startzeit der fehlerhaften Anwendung: 0xvlc.exe0
Pfad der fehlerhaften Anwendung: vlc.exe1
Pfad des fehlerhaften Moduls: vlc.exe2
Berichtskennung: vlc.exe3
Systemfehler:
=============
Error: (09/03/2015 07:01:09 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Wlansvc erreicht.
Error: (09/03/2015 07:01:05 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Schedule erreicht.
Error: (09/02/2015 06:18:45 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "ESET Service" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (09/02/2015 07:34:28 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst WMPNetworkSvc erreicht.
Error: (09/02/2015 07:26:33 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
Error: (09/02/2015 07:05:29 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
Error: (09/02/2015 07:05:24 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows-Fehlerberichterstattungsdienst erreicht.
Error: (09/01/2015 11:40:30 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
Error: (09/01/2015 11:37:01 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst avgsvc erreicht.
Error: (09/01/2015 12:19:32 AM) (Source: volsnap) (EventID: 25) (User: )
Description: Die Schattenkopien von Volume "C:" wurden gelöscht, weil der Schattenkopiespeicher nicht rechtzeitig vergrößert wurde. Sie sollten die E/A-Last auf dem System verringern oder ein Schattenkopie-Speichervolume, von dem keine Schattenkopie erstellt wird, auswählen.
Microsoft Office:
=========================
Error: (09/02/2015 11:41:09 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/02/2015 07:30:05 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/02/2015 07:16:31 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Details:
AddLegacyDriverFiles: Unable to back up image of binary AVGIDSDriver.
System Error:
Das System kann die angegebene Datei nicht finden.
Error: (09/01/2015 11:44:19 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/31/2015 08:12:45 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/31/2015 08:12:38 AM) (Source: Avira Antivirus) (EventID: 4117) (User: NT-AUTORITÄT)
Description: 0x0
Error: (08/30/2015 10:52:29 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: vlc.exe2.1.5.000000000ntdll.dll6.1.7601.1893355a6a196c0000005000000000001889d54c01d0e365bf4a36b3D:\Programme D\VLC\vlc.exeC:\Windows\SYSTEM32\ntdll.dll063d116f-4f59-11e5-a88a-60a44c300d64
Error: (08/30/2015 10:51:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: vlc.exe2.1.5.000000000ntdll.dll6.1.7601.1893355a6a196c0000005000000000001889d17e001d0e365a28cc488D:\Programme D\VLC\vlc.exeC:\Windows\SYSTEM32\ntdll.dlle993007d-4f58-11e5-a88a-60a44c300d64
Error: (08/30/2015 10:50:57 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: vlc.exe2.1.5.000000000ntdll.dll6.1.7601.1893355a6a196c0000005000000000001889dd9c01d0e36578e9bdc5D:\Programme D\VLC\vlc.exeC:\Windows\SYSTEM32\ntdll.dllcfae0d5d-4f58-11e5-a88a-60a44c300d64
Error: (08/30/2015 10:49:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: vlc.exe2.1.5.000000000ntdll.dll6.1.7601.1893355a6a196c0000005000000000001889dbe401d0e3654ab07be1D:\Programme D\VLC\vlc.exeC:\Windows\SYSTEM32\ntdll.dll9df77e84-4f58-11e5-a88a-60a44c300d64
CodeIntegrity:
===================================
Date: 2013-07-05 18:27:56.665
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Users\Emil\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-07-05 18:27:56.635
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Users\Emil\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-07-05 18:27:56.514
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Programme D\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-07-05 18:27:56.484
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Programme D\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Speicherinformationen ===========================
Prozessor: AMD FX(tm)-4100 Quad-Core Processor
Prozentuale Nutzung des RAM: 56%
Installierter physikalischer RAM: 3997.59 MB
Verfügbarer physikalischer RAM: 1740.3 MB
Summe virtueller Speicher: 14137.38 MB
Verfügbarer virtueller Speicher: 9856.16 MB
==================== Laufwerke ================================
Drive c: (Volume ) (Fixed) (Total:458.92 GB) (Free:260.75 GB) NTFS
Drive d: (Volume) (Fixed) (Total:465.66 GB) (Free:223.91 GB) NTFS
Drive i: (TOSHIBA EXT) (Fixed) (Total:931.51 GB) (Free:620.8 GB) NTFS
Drive z: (V-Ram) (Fixed) (Total:6.83 GB) (Free:0.74 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 6DD3B5EF)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465.7 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: E0C3F2EB)
Partition 1: (Not Active) - (Size=458.9 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=6.8 GB) - (Type=07 NTFS)
========================================================
Disk: 2 (Size: 931.5 GB) (Disk ID: 45C185B6)
Partition 1: (Active) - (Size=931.5 GB) - (Type=07 NTFS)
==================== Ende von Addition.txt ============================
|
|
03.09.2015, 20:49
| #3 |
| /// the machine /// TB-Ausbilder    | Win 7 extrem verlangsamt Hi,
__________________Downloade dir bitte  Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers
__________________ |
|
04.09.2015, 21:01
| #4 |
| | Win 7 extrem verlangsamt no malware found Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.9.2.1008
www.malwarebytes.org
Database version:
main: v2015.09.04.05
rootkit: v2015.08.16.01
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.17959
Emil :: EMIL-PC [administrator]
4/09/2015 5:06:25 PM
mbar-log-2015-09-04 (17-06-25).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 420892
Time elapsed: 43 minute(s), 45 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)
woher kommt das nun plötzlich? ist erst jetzt nach dem ich malware bytes hab rennen lassen. |
|
05.09.2015, 15:08
| #5 | |
| /// the machine /// TB-Ausbilder | Win 7 extrem verlangsamtZitat:
Scan mit Combofix
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
05.09.2015, 20:53
| #6 |
| | Win 7 extrem verlangsamt danke, und büdde schön Code:
ATTFilter ComboFix 15-09-03.01 - Emil 05/09/2015 21:22:08.1.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.3998.1961 [GMT 2:00]
ausgeführt von:: c:\users\Emil\Desktop\ComboFix.exe
AV: Avira Antivirus *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
AV: ESET NOD32 Antivirus 8.0 *Disabled/Outdated* {19259FAE-8396-A113-46DB-15B0E7DFA289}
SP: Avira Antivirus *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: ESET NOD32 Antivirus 8.0 *Disabled/Outdated* {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Emil\AppData\Local\Temp\_MEI48962\_ctypes.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\_elementtree.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\_hashlib.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\_multiprocessing.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\_psutil_windows.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\_socket.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\_ssl.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\_yappi.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\common.time34.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\hashobjs_ext.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\pyexpat.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\pysqlite2._sqlite.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\python27.dll
c:\users\Emil\AppData\Local\Temp\_MEI48962\pythoncom27.dll
c:\users\Emil\AppData\Local\Temp\_MEI48962\PyWinTypes27.dll
c:\users\Emil\AppData\Local\Temp\_MEI48962\select.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\unicodedata.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\usb_ext.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\win32api.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\win32com.shell.shell.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\win32crypt.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\win32event.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\win32file.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\win32gui.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\win32inet.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\win32pdh.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\win32pipe.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\win32process.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\win32profile.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\win32security.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\win32ts.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\windows._lib_cacheinvalidation.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\wx._animate.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\wx._controls_.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\wx._core_.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\wx._gdi_.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\wx._html2.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\wx._misc_.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\wx._windows_.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\wx._wizard.pyd
c:\users\Emil\AppData\Local\Temp\_MEI48962\wxbase30u_net_vc90.dll
c:\users\Emil\AppData\Local\Temp\_MEI48962\wxbase30u_vc90.dll
c:\users\Emil\AppData\Local\Temp\_MEI48962\wxmsw30u_adv_vc90.dll
c:\users\Emil\AppData\Local\Temp\_MEI48962\wxmsw30u_core_vc90.dll
c:\users\Emil\AppData\Local\Temp\_MEI48962\wxmsw30u_html_vc90.dll
c:\users\Emil\AppData\Local\Temp\_MEI48962\wxmsw30u_webview_vc90.dll
c:\users\Erina\AppData\Local\Microsoft\Windows\Temporary Internet Files\{03962D52-FA4C-47EF-A165-4C1AB3528C14}.xps
c:\users\Erina\AppData\Local\Microsoft\Windows\Temporary Internet Files\{26C719AC-E390-482F-A9CB-3121E4B33C6D}.xps
c:\users\Erina\AppData\Local\Microsoft\Windows\Temporary Internet Files\{7A5815CA-C6AD-4F2F-953E-4969ED803DC2}.xps
c:\users\Erina\AppData\Local\Microsoft\Windows\Temporary Internet Files\{7F4D2394-000D-415C-878A-AC1E681D7CDB}.xps
c:\users\Erina\AppData\Local\Microsoft\Windows\Temporary Internet Files\{A081409A-058F-4484-B625-9D4A7F1B5E1B}.xps
c:\users\Erina\AppData\Local\Microsoft\Windows\Temporary Internet Files\{C10EF239-ADF8-497A-8B12-64995E3A15DD}.xps
c:\users\Erina\AppData\Local\Microsoft\Windows\Temporary Internet Files\{E16BF927-869A-4DD0-95DE-185B5C2F7908}.xps
c:\users\Erina\AppData\Local\Microsoft\Windows\Temporary Internet Files\{E6FA027C-791D-45E3-AF6E-94EA8A77BDFE}.xps
c:\windows\wininit.ini
.
.
((((((((((((((((((((((( Dateien erstellt von 2015-08-05 bis 2015-09-05 ))))))))))))))))))))))))))))))
.
.
2015-09-05 09:52 . 2015-09-05 09:52 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{84EBE326-34D0-4867-92CC-F7F07D4E8B52}\offreg.5524.dll
2015-09-04 15:05 . 2015-08-20 02:18 11745192 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{84EBE326-34D0-4867-92CC-F7F07D4E8B52}\mpengine.dll
2015-09-03 18:16 . 2015-09-03 18:44 -------- d-----w- C:\FRST
2015-09-03 18:08 . 2015-09-04 18:20 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2015-09-02 21:45 . 2015-05-29 07:43 307352 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2015-09-02 21:05 . 2015-09-02 21:05 -------- d-----w- c:\users\Emil\AppData\Local\ESET
2015-09-02 16:18 . 2015-09-02 16:18 -------- d-----w- c:\program files\ESET
2015-08-31 07:10 . 2015-08-31 07:10 -------- d-----w- c:\users\Erina\AppData\Local\Avg
2015-08-31 05:23 . 2015-08-31 05:23 -------- d-----w- c:\programdata\Kaspersky Lab Setup Files
2015-08-30 13:56 . 2015-09-02 05:25 -------- d-----w- c:\program files\Common Files\AV
2015-08-30 13:56 . 2015-08-30 13:56 -------- d-----w- c:\users\Emil\AppData\Roaming\TuneUp Software
2015-08-30 13:52 . 2015-09-02 05:28 -------- d-----w- c:\programdata\MFAData
2015-08-30 13:52 . 2015-08-30 13:52 -------- d-----w- c:\users\Emil\AppData\Local\MFAData
2015-08-30 13:51 . 2015-09-02 05:43 -------- d-----w- c:\programdata\Avg
2015-08-30 13:51 . 2015-08-30 13:51 -------- d--h--w- c:\programdata\Common Files
2015-08-30 13:51 . 2015-08-30 13:51 -------- d-----w- c:\users\Emil\AppData\Local\Avg
2015-08-30 10:51 . 2015-08-30 11:45 -------- d-----w- c:\programdata\HitmanPro
2015-08-30 10:49 . 2015-09-05 16:35 113880 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-08-30 10:49 . 2015-09-04 15:04 109272 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-08-30 10:49 . 2015-06-18 06:41 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2015-08-30 10:49 . 2015-06-18 06:41 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2015-08-30 10:49 . 2015-08-30 10:49 -------- d-----w- c:\program files (x86)\ Malwarebytes Anti-Malware
2015-08-30 10:49 . 2015-08-30 10:49 -------- d-----w- c:\programdata\Malwarebytes
2015-08-30 10:39 . 2015-08-30 10:41 -------- d-----w- C:\AdwCleaner
2015-08-30 10:38 . 2015-08-31 21:36 -------- d-----w- c:\program files (x86)\VS Revo Group
2015-08-20 01:03 . 2015-08-11 01:20 25191936 ----a-w- c:\windows\system32\mshtml.dll
2015-08-20 01:03 . 2015-08-11 01:14 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2015-08-20 01:03 . 2015-08-11 00:33 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb
2015-08-13 01:29 . 2015-07-30 13:13 103120 ----a-w- c:\windows\SysWow64\PresentationCFFRasterizerNative_v0300.dll
2015-08-13 01:29 . 2015-07-30 13:13 124624 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-08-12 07:17 . 2015-07-15 03:19 52736 ----a-w- c:\windows\system32\basesrv.dll
2015-08-12 07:16 . 2015-07-30 16:56 3208192 ----a-w- c:\windows\system32\win32k.sys
2015-08-09 19:39 . 2015-08-09 19:39 5806 ----a-w- c:\windows\system32\cc_20150809_213913.reg
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-08-13 01:05 . 2013-06-12 16:06 132483416 ----a-w- c:\windows\system32\MRT.exe
2015-08-12 06:05 . 2013-06-10 17:29 778440 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-08-12 06:05 . 2013-06-10 17:29 142536 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-08-02 11:45 . 2014-08-12 20:38 97888 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2015-07-29 18:36 . 2013-06-12 17:14 162528 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2015-07-29 18:36 . 2013-06-12 17:14 141416 ----a-w- c:\windows\system32\drivers\avipbb.sys
2015-07-16 02:12 . 2015-07-16 02:12 78432 ----a-w- c:\windows\system32\atimpc64.dll
2015-07-16 02:12 . 2015-07-16 02:12 78432 ----a-w- c:\windows\system32\amdpcom64.dll
2015-07-16 02:12 . 2015-07-16 02:12 71704 ----a-w- c:\windows\SysWow64\atimpc32.dll
2015-07-16 02:12 . 2015-07-16 02:12 71704 ----a-w- c:\windows\SysWow64\amdpcom32.dll
2015-07-16 02:11 . 2015-06-23 02:08 152056 ----a-w- c:\windows\system32\atiuxp64.dll
2015-07-16 02:11 . 2014-11-21 02:44 133016 ----a-w- c:\windows\SysWow64\atiuxpag.dll
2015-07-16 02:11 . 2012-09-28 01:11 120144 ----a-w- c:\windows\system32\atiu9p64.dll
2015-07-16 02:11 . 2012-09-28 01:10 102616 ----a-w- c:\windows\SysWow64\atiu9pag.dll
2015-07-16 02:11 . 2012-09-28 01:41 1445224 ----a-w- c:\windows\system32\aticfx64.dll
2015-07-16 02:11 . 2012-09-28 01:43 1193904 ----a-w- c:\windows\SysWow64\aticfx32.dll
2015-07-16 02:11 . 2015-06-23 02:08 11948704 ----a-w- c:\windows\system32\atidxx64.dll
2015-07-16 02:11 . 2014-11-21 02:44 10094152 ----a-w- c:\windows\SysWow64\atidxx32.dll
2015-07-16 02:11 . 2012-09-28 01:22 7929616 ----a-w- c:\windows\SysWow64\atiumdva.dll
2015-07-16 02:11 . 2012-09-28 02:23 7408936 ----a-w- c:\windows\SysWow64\atiumdag.dll
2015-07-16 02:11 . 2012-09-28 01:31 8893160 ----a-w- c:\windows\system32\atiumd6a.dll
2015-07-16 02:11 . 2012-09-28 01:25 8779872 ----a-w- c:\windows\system32\atiumd64.dll
2015-07-16 02:09 . 2015-07-16 02:09 297672 ----a-w- c:\windows\system32\drivers\amdacpksd.sys
2015-07-16 02:06 . 2015-07-16 02:06 21622272 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2015-07-16 02:01 . 2015-07-16 02:01 235008 ----a-w- c:\windows\system32\clinfo.exe
2015-07-16 02:01 . 2015-07-16 02:01 47785472 ----a-w- c:\windows\system32\amdocl64.dll
2015-07-16 02:00 . 2014-11-21 02:32 39714816 ----a-w- c:\windows\SysWow64\amdocl.dll
2015-07-16 01:59 . 2015-07-16 01:59 65024 ----a-w- c:\windows\system32\OpenCL.dll
2015-07-16 01:59 . 2015-07-16 01:59 59392 ----a-w- c:\windows\SysWow64\OpenCL.dll
2015-07-16 01:58 . 2015-07-16 01:58 27535872 ----a-w- c:\windows\system32\amdocl12cl64.dll
2015-07-16 01:57 . 2015-06-23 01:55 22318592 ----a-w- c:\windows\SysWow64\amdocl12cl.dll
2015-07-16 01:35 . 2015-07-16 01:35 127488 ----a-w- c:\windows\system32\mantle64.dll
2015-07-16 01:35 . 2015-07-16 01:35 113664 ----a-w- c:\windows\SysWow64\mantle32.dll
2015-07-16 01:35 . 2015-07-16 01:35 6477312 ----a-w- c:\windows\system32\amdmantle64.dll
2015-07-16 01:30 . 2015-07-16 01:30 5068288 ----a-w- c:\windows\SysWow64\amdmantle32.dll
2015-07-16 01:28 . 2015-07-16 01:28 30752256 ----a-w- c:\windows\system32\atio6axx.dll
2015-07-16 01:26 . 2015-07-16 01:26 93184 ----a-w- c:\windows\system32\mantleaxl64.dll
2015-07-16 01:26 . 2015-07-16 01:26 86528 ----a-w- c:\windows\SysWow64\mantleaxl32.dll
2015-07-16 01:25 . 2015-07-16 01:25 50688 ----a-w- c:\windows\system32\amdmmcl6.dll
2015-07-16 01:25 . 2015-07-16 01:25 39424 ----a-w- c:\windows\SysWow64\amdmmcl.dll
2015-07-16 01:22 . 2015-07-16 01:22 25299968 ----a-w- c:\windows\SysWow64\atioglxx.dll
2015-07-16 01:21 . 2015-07-16 01:21 367104 ----a-w- c:\windows\system32\atiapfxx.exe
2015-07-16 01:21 . 2015-07-16 01:21 62464 ----a-w- c:\windows\system32\aticalrt64.dll
2015-07-16 01:21 . 2015-07-16 01:21 52224 ----a-w- c:\windows\SysWow64\aticalrt.dll
2015-07-16 01:21 . 2015-07-16 01:21 55808 ----a-w- c:\windows\system32\aticalcl64.dll
2015-07-16 01:21 . 2015-07-16 01:21 49152 ----a-w- c:\windows\SysWow64\aticalcl.dll
2015-07-16 01:21 . 2015-07-16 01:21 15716864 ----a-w- c:\windows\system32\aticaldd64.dll
2015-07-16 01:20 . 2015-07-16 01:20 14302208 ----a-w- c:\windows\SysWow64\aticaldd.dll
2015-07-16 01:17 . 2015-07-16 01:17 442368 ----a-w- c:\windows\system32\atidemgy.dll
2015-07-16 01:17 . 2015-07-16 01:17 160256 ----a-w- c:\windows\system32\atieah64.exe
2015-07-16 01:17 . 2015-07-16 01:17 204800 ----a-w- c:\windows\system32\amdgfxinfo64.dll
2015-07-16 01:17 . 2015-07-16 01:17 143872 ----a-w- c:\windows\SysWow64\atieah32.exe
2015-07-16 01:17 . 2015-07-16 01:17 29696 ----a-w- c:\windows\system32\atimuixx.dll
2015-07-16 01:17 . 2015-07-16 01:17 189952 ----a-w- c:\windows\SysWow64\amdgfxinfo32.dll
2015-07-16 01:17 . 2015-07-16 01:17 672768 ----a-w- c:\windows\system32\atieclxx.exe
2015-07-16 01:17 . 2015-07-16 01:17 246784 ----a-w- c:\windows\system32\atiesrxx.exe
2015-07-16 01:17 . 2015-07-16 01:17 190976 ----a-w- c:\windows\system32\atitmm64.dll
2015-07-16 01:14 . 2015-07-16 01:14 43520 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2015-07-16 01:13 . 2015-07-16 01:13 1247744 ----a-w- c:\windows\system32\atiadlxx.dll
2015-07-16 01:13 . 2015-07-16 01:13 926720 ----a-w- c:\windows\SysWow64\atiadlxx.dll
2015-07-16 01:13 . 2014-11-21 02:09 926720 ----a-w- c:\windows\SysWow64\atiadlxy.dll
2015-07-16 01:13 . 2015-07-16 01:13 75264 ----a-w- c:\windows\system32\atig6pxx.dll
2015-07-16 01:13 . 2015-07-16 01:13 69632 ----a-w- c:\windows\SysWow64\atiglpxx.dll
2015-07-16 01:13 . 2015-07-16 01:13 69632 ----a-w- c:\windows\system32\atiglpxx.dll
2015-07-16 01:13 . 2015-07-16 01:13 156672 ----a-w- c:\windows\system32\atig6txx.dll
2015-07-16 01:13 . 2014-11-21 02:08 141824 ----a-w- c:\windows\SysWow64\atigktxx.dll
2015-07-16 01:13 . 2015-07-16 01:13 665088 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2015-07-16 01:12 . 2015-06-23 01:21 865792 ----a-w- c:\windows\system32\coinst_15.20.dll
2015-07-16 01:12 . 2015-07-16 01:12 102912 ----a-w- c:\windows\system32\hsa-thunk64.dll
2015-07-16 01:12 . 2015-07-16 01:12 102400 ----a-w- c:\windows\SysWow64\hsa-thunk.dll
2015-07-15 17:54 . 2015-08-12 07:18 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2015-07-15 10:20 . 2015-07-15 10:20 96256 ----a-w- c:\windows\system32\drivers\AtihdW76.sys
2015-07-15 10:20 . 2015-07-15 10:20 103424 ----a-w- c:\windows\system32\DelayAPO.dll
2015-07-13 05:14 . 2015-07-13 05:14 255240 ----a-w- c:\windows\system32\drivers\eamonm.sys
2015-07-13 05:14 . 2015-07-13 05:14 251632 ----a-w- c:\windows\system32\drivers\edevmon.sys
2015-07-13 05:14 . 2015-07-13 05:14 178520 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2015-07-13 05:14 . 2015-07-13 05:14 168208 ----a-w- c:\windows\system32\drivers\epfwwfpr.sys
2015-07-05 11:01 . 2015-07-05 11:01 1602 ----a-w- c:\windows\system32\cc_20150705_130104.reg
2015-07-04 18:07 . 2015-07-15 07:24 2087424 ----a-w- c:\windows\system32\ole32.dll
2015-07-04 17:48 . 2015-07-15 07:24 1414656 ----a-w- c:\windows\SysWow64\ole32.dll
2015-06-23 23:29 . 2015-06-23 23:29 1217192 ----a-w- c:\windows\SysWow64\FM20.DLL
2015-06-23 11:30 . 2010-11-21 03:27 300704 ------w- c:\windows\system32\MpSigStub.exe
2015-06-17 17:47 . 2015-07-15 07:24 404992 ----a-w- c:\windows\system32\gdi32.dll
2015-06-17 17:37 . 2015-07-15 07:24 312320 ----a-w- c:\windows\SysWow64\gdi32.dll
2015-06-15 21:50 . 2015-07-15 07:23 112064 ----a-w- c:\windows\system32\consent.exe
2015-06-15 21:45 . 2015-07-15 07:23 3242496 ----a-w- c:\windows\system32\msi.dll
2015-06-15 21:45 . 2015-07-15 07:23 504320 ----a-w- c:\windows\system32\msihnd.dll
2015-06-15 21:45 . 2015-07-15 07:23 1941504 ----a-w- c:\windows\system32\authui.dll
2015-06-15 21:45 . 2015-07-15 07:23 70656 ----a-w- c:\windows\system32\appinfo.dll
2015-06-15 21:44 . 2015-07-15 07:23 128000 ----a-w- c:\windows\system32\msiexec.exe
2015-06-15 21:43 . 2015-07-15 07:23 337408 ----a-w- c:\windows\SysWow64\msihnd.dll
2015-06-15 21:43 . 2015-07-15 07:23 2364416 ----a-w- c:\windows\SysWow64\msi.dll
2015-06-15 21:43 . 2015-07-15 07:23 1805824 ----a-w- c:\windows\SysWow64\authui.dll
2015-06-15 21:42 . 2015-07-15 07:23 73216 ----a-w- c:\windows\SysWow64\msiexec.exe
2015-06-15 21:42 . 2015-07-15 07:23 25088 ----a-w- c:\windows\system32\msimsg.dll
2015-06-15 21:37 . 2015-07-15 07:23 25088 ----a-w- c:\windows\SysWow64\msimsg.dll
2015-06-15 16:35 . 2015-06-15 16:35 2730 ----a-w- c:\windows\system32\cc_20150615_183521.reg
2015-06-11 12:38 . 2015-06-11 12:38 75978 ----a-w- c:\windows\system32\cc_20150611_143827.reg
2015-06-10 17:27 . 2015-06-10 17:27 295974 ----a-w- c:\windows\system32\cc_20150610_192721.reg
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"EDO-Soft Sticky Notes"="c:\program files (x86)\Evernote Sticky Notes\StickyNotes.Wpf.exe" [2013-12-05 373760]
"EPLTarget\P0000000000000000"="c:\windows\system32\spool\DRIVERS\x64\3\E_YATIIXE.EXE" [2012-02-28 283232]
"EPLTarget\P0000000000000001"="c:\windows\system32\spool\DRIVERS\x64\3\E_YATIIXE.EXE" [2012-02-28 283232]
"GoogleDriveSync"="c:\program files (x86)\Google\Drive\googledrivesync.exe" [2015-07-29 22344224]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner64.exe" [2015-06-01 8358680]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"VolPanel"="c:\program files (x86)\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2007-04-17 184320]
"SPIRunE"="SPIRunE.dll" [2009-03-05 18432]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2015-08-31 782008]
"FUFAXRCV"="c:\program files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe" [2012-04-03 502912]
"FUFAXSTM"="c:\program files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe" [2012-04-03 863360]
"EEventManager"="c:\program files (x86)\Epson Software\Event Manager\EEventManager.exe" [2012-04-02 1058912]
"Wondershare Helper Compact.exe"="c:\program files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe" [2014-04-01 2007392]
"KeePass 2 PreLoad"="d:\keepass password safe 2\KeePass.exe" [2015-04-10 2715536]
"LWS"="c:\program files (x86)\Logitech\LWS\Webcam Software\LWS.exe" [2012-09-12 204136]
"StartCCC"="c:\program files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe" [2015-07-15 767176]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2015-06-08 334896]
.
c:\users\Emil\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files (x86)\Microsoft Office\Office14\ONENOTEM.EXE /tsr [2013-6-25 228552]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - c:\program files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2009-7-31 2680160]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
R2 AntiVirMailService;Avira Email-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avmailc7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avmailc7.exe [x]
R2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 AiChargerPlus;AiChargerPlus;SysWow64\drivers\AiChargerPlus.sys;SysWow64\drivers\AiChargerPlus.sys [x]
R3 ASUSFILTER;ASUSFILTER;SysWow64\drivers\ASUSFILTER.sys;SysWow64\drivers\ASUSFILTER.sys [x]
R3 ASUSstpt;ASUS USB 3.0 Boost Storage Driver (Storage Driver);c:\windows\system32\DRIVERS\ASUSstpt.sys;c:\windows\SYSNATIVE\DRIVERS\ASUSstpt.sys [x]
R3 ASUSumsc;ASUS USB 3.0 Boost Storage Driver (WDM);c:\windows\system32\DRIVERS\ASUSumsc.sys;c:\windows\SYSNATIVE\DRIVERS\ASUSumsc.sys [x]
R3 BITCOMET_HELPER_SERVICE;BitComet Disk Boost Service;d:\programme d\BitComet\tools\BitCometService.exe;d:\programme d\BitComet\tools\BitCometService.exe [x]
R3 BTMCOM;Bluetooth Serial Port;c:\windows\system32\Drivers\btmcom.sys;c:\windows\SYSNATIVE\Drivers\btmcom.sys [x]
R3 BTMUSB;Motorola Bluetooth Radio Service;c:\windows\system32\Drivers\btmusb.sys;c:\windows\SYSNATIVE\Drivers\btmusb.sys [x]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 gfiark;gfiark;c:\windows\system32\drivers\gfiark.sys;c:\windows\SYSNATIVE\drivers\gfiark.sys [x]
R3 HtcVCom32;HTC Diagnostic Port;c:\windows\system32\DRIVERS\HtcVComV64.sys;c:\windows\SYSNATIVE\DRIVERS\HtcVComV64.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys;c:\windows\SYSNATIVE\drivers\nusb3hub.sys [x]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys;c:\windows\SYSNATIVE\drivers\nusb3xhc.sys [x]
R3 tmbulk;Thrustmaster Series Bulk Driver (tmbulk);c:\windows\system32\Drivers\tmbulk.sys;c:\windows\SYSNATIVE\Drivers\tmbulk.sys [x]
R3 tmhidusb;Thrustmaster HID USB Driver;c:\windows\system32\DRIVERS\tmhidusb.sys;c:\windows\SYSNATIVE\DRIVERS\tmhidusb.sys [x]
R3 tmResetMin;tmResetMin;c:\windows\system32\Drivers\tmResetMin.sys;c:\windows\SYSNATIVE\Drivers\tmResetMin.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 asComSvc;ASUS Com Service;c:\program files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe;c:\program files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe [x]
R4 asHmComSvc;ASUS HM Com Service;c:\program files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe;c:\program files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe [x]
R4 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe [x]
R4 AsusFanControlService;AsusFanControlService;c:\program files (x86)\ASUS\AsusFanControlService\1.01.10\AsusFanControlService.exe;c:\program files (x86)\ASUS\AsusFanControlService\1.01.10\AsusFanControlService.exe [x]
R4 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [x]
R4 Creative Media Toolbox 6 Licensing Service;Creative Media Toolbox 6 Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\MT6Licensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\MT6Licensing.exe [x]
R4 MBAMScheduler;MBAMScheduler;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [x]
S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_sata.sys [x]
S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_xata.sys [x]
S0 gfibto;gfibto;c:\windows\system32\drivers\gfibto.sys;c:\windows\SYSNATIVE\drivers\gfibto.sys [x]
S1 AsUpIO;AsUpIO;SysWow64\drivers\AsUpIO.sys;SysWow64\drivers\AsUpIO.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys;c:\windows\SYSNATIVE\DRIVERS\eamonm.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys;c:\windows\SYSNATIVE\DRIVERS\ehdrv.sys [x]
S1 veracrypt;veracrypt;c:\windows\system32\drivers\veracrypt.sys;c:\windows\SYSNATIVE\drivers\veracrypt.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\AMD\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AODDriver4.3;AODDriver4.3;c:\program files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys;c:\windows\SYSNATIVE\DRIVERS\avnetflt.sys [x]
S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files\Motorola\Bluetooth\obexsrv.exe;c:\program files\Motorola\Bluetooth\obexsrv.exe [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [x]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys;c:\windows\SYSNATIVE\DRIVERS\epfwwfpr.sys [x]
S2 EpsonScanSvc;Epson Scanner Service;c:\windows\system32\EscSvc64.exe;c:\windows\SYSNATIVE\EscSvc64.exe [x]
S2 tmInstall;Thrustmaster Device Driver Installer;d:\drivers\amd64\tmInstall.exe;d:\drivers\amd64\tmInstall.exe [x]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 Bluetooth Device Manager;Bluetooth Device Manager;c:\program files\Motorola\Bluetooth\devmgrsrv.exe;c:\program files\Motorola\Bluetooth\devmgrsrv.exe [x]
S3 Bluetooth Media Service;Bluetooth Media Service;c:\program files\Motorola\Bluetooth\audiosrv.exe;c:\program files\Motorola\Bluetooth\audiosrv.exe [x]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [x]
S3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys;c:\windows\SYSNATIVE\DRIVERS\lvrs64.sys [x]
S3 LVUVC64;Logitech HD Webcam C270(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys;c:\windows\SYSNATIVE\DRIVERS\lvuvc64.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 t3;Sound Blaster X-Fi Xtreme Audio;c:\windows\system32\drivers\t3.sys;c:\windows\SYSNATIVE\drivers\t3.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-09-02 10:16 997704 ----a-w- c:\program files (x86)\Google\Chrome\Application\45.0.2454.85\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2015-09-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-10 06:06]
.
2015-09-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-06-19 11:08]
.
2015-09-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-06-19 11:08]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ GoogleDriveBlacklisted]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2015-07-29 07:23 775496 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ GoogleDriveSynced]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2015-07-29 07:23 775496 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ GoogleDriveSyncing]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2015-07-29 07:23 775496 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2000-01-01 7660760]
"BTMTrayAgent"="c:\program files\Motorola\Bluetooth\btmshell.dll" [2010-11-30 21705296]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2015-07-08 5595848]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = https://www.yahoo.com/?fr=yset_ie_syc_oracle&type=orcl_hpset
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: &Alles mit BitComet herunterladen - d:\programme d\BitComet\BitComet.exe/AddAllLink.htm
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Free YouTube Download - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm
IE: Free YouTube to MP3 Converter - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
IE: Mit BitComet herunter&laden - d:\programme d\BitComet\BitComet.exe/AddLink.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: {{bd707fe6-39f6-4bda-9265-86a76719bdc5} - c:\program files\Motorola\Bluetooth\btmiesend.htm
TCP: DhcpNameServer = 195.34.133.21 212.186.211.21
DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
FF - ProfilePath - c:\users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - chrome://speeddial/content/speeddial.xul
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKU-Default-Run-KSS - c:\program files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-523548968-1357001120-3005945389-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*¯]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-523548968-1357001120-3005945389-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*¯\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_18_0_0_232_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_18_0_0_232_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_18_0_0_232_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_18_0_0_232_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_18_0_0_232.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.18"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_18_0_0_232.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_18_0_0_232.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_18_0_0_232.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Creative\Shared Files\CTAudSvc.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\windows\DAODx.exe
c:\windows\SysWOW64\rundll32.exe
c:\program files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
c:\program files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\program files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
c:\program files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
c:\program files\Motorola\Bluetooth\btplayerctrl.exe
c:\program files (x86)\Toshiba\Bluetooth Toshiba Stack\TosHdpProc.exe
c:\program files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
c:\program files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtKbd.exe
c:\program files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtBty.exe
c:\program files (x86)\Common Files\Java\Java Update\jucheck.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2015-09-05 21:50:30 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2015-09-05 19:50
.
Vor Suchlauf: 20 Verzeichnis(se), 280,377,982,976 Bytes frei
Nach Suchlauf: 25 Verzeichnis(se), 281,928,564,736 Bytes frei
.
- - End Of File - - 3900F45481FEB0D834A860EEDDDE0306
A36C5E4F47E84449FF07ED3517B43A31
|
|
06.09.2015, 18:50
| #7 |
| /// the machine /// TB-Ausbilder | Win 7 extrem verlangsamt Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
07.09.2015, 17:45
| #8 |
| | Win 7 extrem verlangsamt danke, here we go ... Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlaufdatum: 6/09/2015 Suchlaufzeit: 9:56 PM Protokolldatei: mbam.txt Administrator: Ja Version: 2.1.8.1057 Malware-Datenbank: v2015.09.06.05 Rootkit-Datenbank: v2015.08.16.01 Lizenz: Testversion Malware-Schutz: Aktiviert Schutz vor bösartigen Websites: Aktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Emil Suchlauftyp: Bedrohungssuchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 429814 Abgelaufene Zeit: 21 Min., 32 Sek. Speicher: Aktiviert Start: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (keine bösartigen Elemente erkannt) Module: 0 (keine bösartigen Elemente erkannt) Registrierungsschlüssel: 0 (keine bösartigen Elemente erkannt) Registrierungswerte: 0 (keine bösartigen Elemente erkannt) Registrierungsdaten: 0 (keine bösartigen Elemente erkannt) Ordner: 0 (keine bösartigen Elemente erkannt) Dateien: 0 (keine bösartigen Elemente erkannt) Physische Sektoren: 0 (keine bösartigen Elemente erkannt) (end) Code:
ATTFilter # AdwCleaner v5.005 - Bericht erstellt am 06/09/2015 um 22:46:15
# Aktualisiert am 31/08/2015 von Xplode
# Datenbank : 2015-09-04.4 [Server]
# Betriebssystem : Windows 7 Professional Service Pack 1 (x64)
# Benutzername : Emil - EMIL-PC
# Gestartet von : D:\Downloads\AdwCleaner_5.005.exe
# Option : Löschen
# Unterstützung : hxxp://toolslib.net/forum
***** [ Dienste ] *****
***** [ Ordner ] *****
***** [ Dateien ] *****
***** [ Verknüpfungen ] *****
***** [ Geplante Tasks ] *****
***** [ Registrierungsdatenbank ] *****
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\SlimWare Utilities Inc
***** [ Internetbrowser ] *****
*************************
:: Proxy Einstellungen zurückgesetzt
:: Winsock Einstellungen zurückgesetzt
:: Internet Explorer Richtlinien gelöscht
:: Chrome Richtlinien gelöscht
########## EOF - C:\AdwCleaner\AdwCleaner[C2].txt - [845 Bytes] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.6.0 (08.31.2015:1)
OS: Windows 7 Professional x64
Ran by Emil on Sun 06/09/2015 at 22:56:50.16
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Tasks
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer
~~~ Files
~~~ Folders
~~~ Chrome
[C:\Users\Emil\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - default search provider reset
[C:\Users\Emil\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:
[C:\Users\Emil\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset
[C:\Users\Emil\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sun 06/09/2015 at 23:01:23.52
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:06-09-2015 01
durchgeführt von Emil (Administrator) auf EMIL-PC (06-09-2015 23:18:41)
Gestartet von D:\Downloads
Geladene Profile: Emil (Verfügbare Profile: Emil & Erina)
Platform: Windows 7 Professional Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7660760 2000-01-01] (Realtek Semiconductor)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files\Motorola\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [5595848 2015-07-08] (ESET)
HKLM-x32\...\Run: [VolPanel] => C:\Program Files (x86)\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe [184320 2007-04-17] (Creative Technology Ltd)
HKLM-x32\...\Run: [SPIRunE] => Rundll32 SPIRunE.dll,RunDLLEntry
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [782008 2015-08-31] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [FUFAXRCV] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe [502912 2012-04-03] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [FUFAXSTM] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe [863360 2012-04-03] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1058912 2012-04-02] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2007392 2014-04-01] (Wondershare)
HKLM-x32\...\Run: [KeePass 2 PreLoad] => D:\KeePass Password Safe 2\KeePass.exe [2715536 2015-04-10] (Dominik Reichl)
HKLM-x32\...\Run: [LWS] => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [204136 2012-09-13] (Logitech Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-07-15] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-06-08] (Oracle Corporation)
HKU\S-1-5-21-523548968-1357001120-3005945389-1000\...\Run: [EDO-Soft Sticky Notes] => C:\Program Files (x86)\Evernote Sticky Notes\StickyNotes.Wpf.exe [373760 2013-12-05] (Microsoft)
HKU\S-1-5-21-523548968-1357001120-3005945389-1000\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIIXE.EXE [283232 2012-02-28] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-523548968-1357001120-3005945389-1000\...\Run: [EPLTarget\P0000000000000001] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIIXE.EXE [283232 2012-02-28] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-523548968-1357001120-3005945389-1000\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22344224 2015-07-29] (Google)
HKU\S-1-5-21-523548968-1357001120-3005945389-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8358680 2015-06-01] (Piriform Ltd)
ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-07-29] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-07-29] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-07-29] (Google)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth Manager.lnk [2013-06-18]
ShortcutTarget: Bluetooth Manager.lnk -> C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)
Startup: C:\Users\Emil\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk [2015-02-05]
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt..)
Tcpip\Parameters: [DhcpNameServer] 195.34.133.21 212.186.211.21
Tcpip\..\Interfaces\{1DD6E913-165C-428A-A428-E63291A96F3D}: [DhcpNameServer] 195.34.133.21 212.186.211.21
Tcpip\..\Interfaces\{D4C89ACE-0B25-4927-94B9-343A174CD91A}: [DhcpNameServer] 195.34.133.21 212.186.211.21
Internet Explorer:
==================
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-523548968-1357001120-3005945389-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-523548968-1357001120-3005945389-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.yahoo.com/?fr=yset_ie_syc_oracle&type=orcl_hpset
SearchScopes: HKU\S-1-5-21-523548968-1357001120-3005945389-1000 -> {22E06A81-68EE-4FF1-A05C-7E542584F957} URL = hxxps://at.search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: BitComet Helper -> {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} -> D:\Programme D\BitComet\tools\BitCometBHO_1.5.4.11.dll [2013-11-29] (BitComet)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\ssv.dll [2015-08-02] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\jp2ssv.dll [2015-08-02] (Oracle Corporation)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: HKLM-x32 {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab
FireFox:
========
FF ProfilePath: C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default
FF SelectedSearchEngine: Google
FF Homepage: chrome://speeddial/content/speeddial.xul
FF NetworkProxy: "no_proxies_on", "127.0.0.1"
FF NetworkProxy: "socks", "127.0.0.1"
FF NetworkProxy: "socks_port", 9050
FF NetworkProxy: "socks_remote_dns", true
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_232.dll [2015-08-12] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.8 -> D:\Programme D\VLC\npvlc.dll [2014-07-30] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> D:\Programme D\VLC\npvlc.dll [2014-07-30] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-12] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.51.2 -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\dtplugin\npDeployJava1.dll [2015-08-02] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.51.2 -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\plugin2\npjp2.dll [2015-08-02] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-08-31] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-08-31] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npBitCometAgent.dll [2012-01-12] (BitComet)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\searchplugins\anonymouseorg---scroogleorg---any.xml [2012-02-29]
FF SearchPlugin: C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\searchplugins\scroogle-at.xml [2012-02-29]
FF SearchPlugin: C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\searchplugins\scroogle-ssl.xml [2012-02-29]
FF Extension: Flash Video Downloader - YouTube HD Download [4K] - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\artur.dubovoy@gmail.com [2015-08-14]
FF Extension: HTTPS-Everywhere - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\https-everywhere-eff@eff.org [2015-08-20]
FF Extension: ColorfulTabs - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe} [2015-08-25]
FF Extension: Flashblock - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} [2015-05-29]
FF Extension: FEBE - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3} [2015-05-29]
FF Extension: All-in-One Gestures - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{8b86149f-01fb-4842-9dd8-4d7eb02fd055} [2015-05-29]
FF Extension: BitComet Video Downloader - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB} [2014-11-24]
FF Extension: Adblock Plus Pop-up Addon - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\adblockpopups@jessehakanen.net.xpi [2014-11-22]
FF Extension: Element Hiding Helper for Adblock Plus - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\elemhidehelper@adblockplus.org.xpi [2014-11-22]
FF Extension: GlassMyFox - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\GlassMyFox@ArisT2_Noia4dev.xpi [2014-11-22]
FF Extension: NO Google Analytics - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\jid1-JcGokIiQyjoBAQ@jetpack.xpi [2014-12-28]
FF Extension: YesScript - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\yesscript@userstyles.org.xpi [2015-06-10]
FF Extension: Flagfox - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}.xpi [2014-11-22]
FF Extension: Cookie Cutter - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{4d14a68e-9a97-4358-8603-ed67b332cef1}.xpi [2014-11-22]
FF Extension: SmoothWheel (mozdev.org) - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{5F590AA2-1221-4113-A6F4-A4BB62414FAC}.xpi [2014-11-22]
FF Extension: Speed Dial - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi [2014-11-22]
FF Extension: Binnen-I be gone - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{b65d7d9a-4ec0-4974-b07f-83e30f6e973f}.xpi [2014-11-22]
FF Extension: Adblock Plus - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-11-22]
FF Extension: BetterPrivacy - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2014-11-22]
FF Extension: DownThemAll! - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2014-11-22]
Chrome:
=======
CHR Plugin: (Web Store) - C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.132\resources\web_store Keine Datei
CHR Plugin: (Google Drive) - apdfllckaahabafndbhieahigkjlhalf\6.3_0 Keine Datei
CHR Plugin: (Bookmark Manager) - C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.132\resources\chrome_app Keine Datei
CHR Profile: C:\Users\Emil\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Emil\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-07-12]
CHR Extension: (Avira Browser Safety) - C:\Users\Emil\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2015-07-12]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\Emil\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2015-07-12]
CHR Extension: (Google Wallet) - C:\Users\Emil\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-16]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-523548968-1357001120-3005945389-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Emil\AppData\Local\Google\Drive\user_default\apdfllckaahabafndbhieahigkjlhalf_live.crx [2015-03-21]
CHR HKU\S-1-5-21-523548968-1357001120-3005945389-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [phegaokedjdajgnfphbnpkcfdgjbidko] - C:\ProgramData\adawaretb\toolbar\chrome\toolbar.crx <nicht gefunden>
==================== Dienste (Nicht auf der Ausnahmeliste) ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
S2 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2015-07-15] (Advanced Micro Devices, Inc.) [Datei ist nicht signiert]
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [887128 2015-07-29] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [461672 2015-08-31] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [461672 2015-08-31] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1213072 2015-08-31] (Avira Operations GmbH & Co. KG)
S4 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe [920736 2012-06-01] ()
S4 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe [951936 2012-06-01] (ASUSTeK Computer Inc.)
S4 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe [149120 2012-02-17] (ASUSTeK Computer Inc.)
S4 AsusFanControlService; C:\Program Files (x86)\ASUS\AsusFanControlService\1.01.10\AsusFanControlService.exe [1475744 2012-05-25] (ASUSTeK Computer Inc.)
S3 BITCOMET_HELPER_SERVICE; D:\Programme D\BitComet\tools\BitCometService.exe [1296728 2013-11-29] (www.BitComet.com)
S4 Creative ALchemy AL6 Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2013-06-13] (Creative Labs) [Datei ist nicht signiert]
S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2013-06-13] (Creative Labs) [Datei ist nicht signiert]
S4 Creative Media Toolbox 6 Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\MT6Licensing.exe [79360 2013-06-13] (Creative Labs) [Datei ist nicht signiert]
S2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [286720 2010-02-12] (Creative Technology Ltd) [Datei ist nicht signiert]
R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [1353720 2015-07-08] (ESET)
S2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation)
S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [647680 2015-05-18] (Macrovision Europe Ltd.) [Datei ist nicht signiert]
S3 FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [1028096 2015-05-18] (Macrovision Europe Ltd.) [Datei ist nicht signiert]
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
S2 tmInstall; D:\drivers\amd64\tmInstall.exe [45296 2014-07-22] (Thrustmaster®)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
S3 AiChargerPlus; C:\Windows\SysWow64\drivers\AiChargerPlus.sys [14848 2012-04-19] (ASUSTek Computer Inc.)
R2 AODDriver4.3; C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2012-08-22] ()
R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [14464 2012-09-14] ()
S3 ASUSFILTER; C:\Windows\SysWow64\drivers\ASUSFILTER.sys [46152 2011-09-20] (MCCI Corporation)
S3 ASUSstpt; C:\Windows\System32\DRIVERS\ASUSstpt.sys [24648 2011-09-15] (MCCI Corporation)
S3 ASUSumsc; C:\Windows\System32\DRIVERS\ASUSumsc.sys [141896 2011-09-15] (MCCI Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [162528 2015-07-29] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [141416 2015-07-29] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-05] (Avira Operations GmbH & Co. KG)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [255240 2015-07-13] (ESET)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
U5 edevmon; C:\Windows\System32\Drivers\edevmon.sys [251632 2015-07-13] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [178520 2015-07-13] (ESET)
R2 epfwwfpr; C:\Windows\System32\DRIVERS\epfwwfpr.sys [168208 2015-07-13] (ESET)
S3 gfiark; C:\Windows\System32\drivers\gfiark.sys [39504 2013-04-11] (ThreatTrack Security)
R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-06-10] (GFI Software)
S3 HtcVCom32; C:\Windows\System32\DRIVERS\HtcVComV64.sys [121800 2010-03-09] (QUALCOMM Incorporated)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [113880 2015-09-06] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited)
S4 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2006-07-24] ()
S3 tmbulk; C:\Windows\System32\Drivers\tmbulk.sys [129264 2014-06-20] (© Guillemot R&D, 2014. All rights reserved.)
S3 tmhidusb; C:\Windows\System32\DRIVERS\tmhidusb.sys [166640 2014-07-22] (Thrustmaster)
S3 tmResetMin; C:\Windows\System32\Drivers\tmResetMin.sys [36080 2014-07-22] (© Guillemot R&D, 2013. All rights reserved.)
S3 toshidpt; C:\Windows\System32\drivers\Toshidpt.sys [9608 2009-06-19] (TOSHIBA Corporation.)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [Datei ist nicht signiert]
R1 veracrypt; C:\Windows\System32\drivers\veracrypt.sys [185688 2014-12-16] (IDRIX)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-09-06 23:01 - 2015-09-06 23:02 - 00001166 _____ C:\Users\Emil\Desktop\JRT.txt
2015-09-06 22:55 - 2015-09-06 22:55 - 00000923 _____ C:\Users\Emil\Desktop\AdwCleaner[C2].txt
2015-09-06 22:28 - 2015-09-06 22:28 - 00001199 _____ C:\Users\Emil\Desktop\mbam.txt
2015-09-05 21:51 - 2015-09-05 21:51 - 00039459 _____ C:\Users\Emil\Desktop\1.txt
2015-09-05 21:50 - 2015-09-05 21:50 - 00039459 _____ C:\ComboFix.txt
2015-09-05 21:17 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2015-09-05 21:17 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2015-09-05 21:17 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-09-05 21:17 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-09-05 21:17 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-09-05 21:17 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2015-09-05 21:17 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2015-09-05 21:17 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2015-09-05 21:11 - 2015-09-05 21:50 - 00000000 ____D C:\Qoobox
2015-09-05 21:09 - 2015-09-05 21:46 - 00000000 ____D C:\Windows\erdnt
2015-09-05 21:09 - 2015-09-05 21:08 - 05635231 ____R (Swearware) C:\Users\Emil\Desktop\ComboFix.exe
2015-09-03 21:13 - 2015-09-03 21:13 - 00017872 _____ C:\Users\Emil\Desktop\gmer.txt
2015-09-03 20:45 - 2015-09-03 20:45 - 00000000 _____ C:\Users\Emil\defogger_reenable
2015-09-03 20:21 - 2015-09-03 20:41 - 00077071 _____ C:\Users\Emil\Desktop\FRST.txt
2015-09-03 20:21 - 2015-09-03 20:40 - 00043040 _____ C:\Users\Emil\Desktop\Addition.txt
2015-09-03 20:16 - 2015-09-06 23:18 - 00000000 ____D C:\FRST
2015-09-03 20:08 - 2015-09-04 20:20 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-09-03 20:06 - 2015-09-04 20:19 - 00000000 ____D C:\Users\Emil\Desktop\mbar
2015-09-03 10:21 - 2015-09-03 10:21 - 01572412 _____ C:\Users\Emil\AppData\Local\census.cache
2015-09-03 10:21 - 2015-09-03 10:21 - 00216292 _____ C:\Users\Emil\AppData\Local\ars.cache
2015-09-02 23:56 - 2015-09-02 23:56 - 00000010 _____ C:\Users\Emil\AppData\Local\sponge.last.runtime.cache
2015-09-02 23:45 - 2015-05-29 09:43 - 00307352 _____ (Trend Micro Inc.) C:\Windows\system32\Drivers\tmcomm.sys
2015-09-02 23:09 - 2015-09-02 23:09 - 00000036 _____ C:\Users\Emil\AppData\Local\housecall.guid.cache
2015-09-02 23:05 - 2015-09-02 23:05 - 00000000 ____D C:\Users\Emil\AppData\Local\ESET
2015-09-02 18:18 - 2015-09-02 18:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
2015-09-02 18:18 - 2015-09-02 18:18 - 00000000 ____D C:\ProgramData\ESET
2015-09-02 18:18 - 2015-09-02 18:18 - 00000000 ____D C:\Program Files\ESET
2015-08-31 09:24 - 2015-08-31 09:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-08-31 09:10 - 2015-08-31 09:10 - 00000000 ____D C:\Users\Erina\AppData\Local\Avg
2015-08-31 08:06 - 2015-08-31 08:06 - 00001199 _____ C:\Users\Public\Desktop\Avira Antivirus.lnk
2015-08-31 07:23 - 2015-08-31 07:23 - 00000000 ____D C:\ProgramData\Kaspersky Lab Setup Files
2015-08-30 15:56 - 2015-09-02 07:25 - 00000000 ____D C:\Program Files\Common Files\AV
2015-08-30 15:56 - 2015-08-30 15:56 - 00000000 ____D C:\Users\Emil\AppData\Roaming\TuneUp Software
2015-08-30 15:52 - 2015-09-02 07:28 - 00000000 ____D C:\ProgramData\MFAData
2015-08-30 15:52 - 2015-08-30 15:52 - 00000000 ____D C:\Users\Emil\AppData\Local\MFAData
2015-08-30 15:51 - 2015-09-02 07:43 - 00000000 ____D C:\ProgramData\Avg
2015-08-30 15:51 - 2015-09-02 07:42 - 00000000 ____D C:\Users\Emil\AppData\Local\AvgSetupLog
2015-08-30 15:51 - 2015-08-30 15:51 - 00000000 ____D C:\Users\Emil\AppData\Local\Avg
2015-08-30 13:04 - 2015-08-30 15:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-08-30 12:51 - 2015-08-30 13:45 - 00000000 ____D C:\ProgramData\HitmanPro
2015-08-30 12:49 - 2015-09-06 21:19 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-08-30 12:49 - 2015-09-06 21:18 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-08-30 12:49 - 2015-09-06 21:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-08-30 12:49 - 2015-09-06 21:18 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-08-30 12:49 - 2015-08-30 12:49 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-08-30 12:49 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-08-30 12:49 - 2015-06-18 08:41 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-08-30 12:49 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-08-30 12:39 - 2015-09-06 22:46 - 00000000 ____D C:\AdwCleaner
2015-08-30 12:38 - 2015-08-31 23:36 - 00000000 ____D C:\Program Files (x86)\VS Revo Group
2015-08-30 10:50 - 2015-08-30 10:50 - 00650657 _____ C:\Users\Emil\Downloads\lame3.99.5.zip
2015-08-20 03:03 - 2015-08-11 03:20 - 25191936 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-08-20 03:03 - 2015-08-11 03:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-08-20 03:03 - 2015-08-11 02:33 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-08-20 03:03 - 2015-08-11 02:20 - 19871232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-08-13 06:50 - 2015-09-05 21:39 - 00012420 _____ C:\Windows\PFRO.log
2015-08-13 03:29 - 2015-07-30 15:13 - 00124624 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-08-13 03:29 - 2015-07-30 15:13 - 00103120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-08-12 09:18 - 2015-07-28 22:09 - 00017344 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2015-08-12 09:18 - 2015-07-28 22:05 - 01116672 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-08-12 09:18 - 2015-07-28 22:05 - 00774656 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-08-12 09:18 - 2015-07-28 22:05 - 00743424 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-08-12 09:18 - 2015-07-28 22:05 - 00437760 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-08-12 09:18 - 2015-07-28 22:05 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-08-12 09:18 - 2015-07-28 22:05 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-08-12 09:18 - 2015-07-28 21:55 - 01148416 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-08-12 09:18 - 2015-07-15 20:15 - 05568960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-08-12 09:18 - 2015-07-15 20:15 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-08-12 09:18 - 2015-07-15 20:15 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-08-12 09:18 - 2015-07-15 20:15 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-08-12 09:18 - 2015-07-15 20:12 - 01730496 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-08-12 09:18 - 2015-07-15 20:11 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-08-12 09:18 - 2015-07-15 20:11 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-08-12 09:18 - 2015-07-15 20:11 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-08-12 09:18 - 2015-07-15 20:11 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-08-12 09:18 - 2015-07-15 20:11 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-08-12 09:18 - 2015-07-15 20:10 - 01743360 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll
2015-08-12 09:18 - 2015-07-15 20:10 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-08-12 09:18 - 2015-07-15 20:10 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-08-12 09:18 - 2015-07-15 20:10 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-08-12 09:18 - 2015-07-15 20:10 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-08-12 09:18 - 2015-07-15 20:10 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-08-12 09:18 - 2015-07-15 20:10 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-08-12 09:18 - 2015-07-15 20:10 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-08-12 09:18 - 2015-07-15 20:10 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-08-12 09:18 - 2015-07-15 20:10 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-08-12 09:18 - 2015-07-15 20:10 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-08-12 09:18 - 2015-07-15 20:10 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-08-12 09:18 - 2015-07-15 20:10 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-08-12 09:18 - 2015-07-15 20:10 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-08-12 09:18 - 2015-07-15 20:10 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-08-12 09:18 - 2015-07-15 20:10 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-08-12 09:18 - 2015-07-15 20:10 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-08-12 09:18 - 2015-07-15 20:10 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-08-12 09:18 - 2015-07-15 20:10 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-08-12 09:18 - 2015-07-15 20:10 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-08-12 09:18 - 2015-07-15 20:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-08-12 09:18 - 2015-07-15 20:10 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-08-12 09:18 - 2015-07-15 20:10 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-08-12 09:18 - 2015-07-15 20:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-08-12 09:18 - 2015-07-15 20:09 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-08-12 09:18 - 2015-07-15 20:05 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-08-12 09:18 - 2015-07-15 20:05 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-08-12 09:18 - 2015-07-15 20:00 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-08-12 09:18 - 2015-07-15 20:00 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-08-12 09:18 - 2015-07-15 20:00 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 20:00 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 20:00 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 20:00 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 20:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 20:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 20:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 20:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 19:59 - 03989952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-08-12 09:18 - 2015-07-15 19:59 - 03934656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-08-12 09:18 - 2015-07-15 19:56 - 01311768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-08-12 09:18 - 2015-07-15 19:55 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-08-12 09:18 - 2015-07-15 19:55 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-08-12 09:18 - 2015-07-15 19:55 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-08-12 09:18 - 2015-07-15 19:55 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-08-12 09:18 - 2015-07-15 19:55 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-08-12 09:18 - 2015-07-15 19:54 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-08-12 09:18 - 2015-07-15 19:54 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-08-12 09:18 - 2015-07-15 19:54 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-08-12 09:18 - 2015-07-15 19:54 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-08-12 09:18 - 2015-07-15 19:54 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-08-12 09:18 - 2015-07-15 19:54 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-08-12 09:18 - 2015-07-15 19:54 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-08-12 09:18 - 2015-07-15 19:53 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-08-12 09:18 - 2015-07-15 19:53 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-08-12 09:18 - 2015-07-15 19:53 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-08-12 09:18 - 2015-07-15 19:53 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-08-12 09:18 - 2015-07-15 19:53 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-08-12 09:18 - 2015-07-15 19:53 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-08-12 09:18 - 2015-07-15 19:49 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-08-12 09:18 - 2015-07-15 19:48 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-08-12 09:18 - 2015-07-15 19:44 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-08-12 09:18 - 2015-07-15 19:44 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-08-12 09:18 - 2015-07-15 19:44 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 19:44 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 18:46 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-08-12 09:18 - 2015-07-15 18:46 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-08-12 09:18 - 2015-07-15 18:46 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-08-12 09:18 - 2015-07-15 18:37 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-08-12 09:18 - 2015-07-15 18:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-08-12 09:18 - 2015-07-15 18:34 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 18:34 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 18:34 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-08-12 09:18 - 2015-07-15 18:34 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-08-12 09:18 - 2015-07-10 19:51 - 03722752 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-08-12 09:18 - 2015-07-10 19:51 - 00158720 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2015-08-12 09:18 - 2015-07-10 19:51 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2015-08-12 09:18 - 2015-07-10 19:34 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-08-12 09:18 - 2015-07-10 19:34 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2015-08-12 09:18 - 2015-07-10 19:33 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2015-08-12 09:17 - 2015-07-30 20:06 - 01648128 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-08-12 09:17 - 2015-07-30 20:06 - 01180160 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-08-12 09:17 - 2015-07-30 19:57 - 01251328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-08-12 09:17 - 2015-07-21 02:39 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-08-12 09:17 - 2015-07-21 02:12 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-08-12 09:17 - 2015-07-16 22:54 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-08-12 09:17 - 2015-07-16 22:37 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-08-12 09:17 - 2015-07-16 22:36 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-08-12 09:17 - 2015-07-16 22:36 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-08-12 09:17 - 2015-07-16 22:36 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-08-12 09:17 - 2015-07-16 22:35 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-08-12 09:17 - 2015-07-16 22:35 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-08-12 09:17 - 2015-07-16 22:27 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-08-12 09:17 - 2015-07-16 22:26 - 05923328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-08-12 09:17 - 2015-07-16 22:26 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-08-12 09:17 - 2015-07-16 22:23 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-08-12 09:17 - 2015-07-16 22:21 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-08-12 09:17 - 2015-07-16 22:21 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-08-12 09:17 - 2015-07-16 22:21 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-08-12 09:17 - 2015-07-16 22:21 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-08-12 09:17 - 2015-07-16 22:12 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-08-12 09:17 - 2015-07-16 22:08 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-08-12 09:17 - 2015-07-16 22:00 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-08-12 09:17 - 2015-07-16 21:55 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-08-12 09:17 - 2015-07-16 21:54 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-08-12 09:17 - 2015-07-16 21:51 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-08-12 09:17 - 2015-07-16 21:51 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-08-12 09:17 - 2015-07-16 21:51 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-08-12 09:17 - 2015-07-16 21:50 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-08-12 09:17 - 2015-07-16 21:50 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-08-12 09:17 - 2015-07-16 21:49 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-08-12 09:17 - 2015-07-16 21:45 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-08-12 09:17 - 2015-07-16 21:43 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-08-12 09:17 - 2015-07-16 21:43 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-08-12 09:17 - 2015-07-16 21:41 - 00479232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-08-12 09:17 - 2015-07-16 21:39 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-08-12 09:17 - 2015-07-16 21:39 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-08-12 09:17 - 2015-07-16 21:38 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-08-12 09:17 - 2015-07-16 21:36 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-08-12 09:17 - 2015-07-16 21:35 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-08-12 09:17 - 2015-07-16 21:34 - 14451200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-08-12 09:17 - 2015-07-16 21:33 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-08-12 09:17 - 2015-07-16 21:32 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-08-12 09:17 - 2015-07-16 21:29 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-08-12 09:17 - 2015-07-16 21:24 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-08-12 09:17 - 2015-07-16 21:20 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-08-12 09:17 - 2015-07-16 21:19 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-08-12 09:17 - 2015-07-16 21:17 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-08-12 09:17 - 2015-07-16 21:12 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-08-12 09:17 - 2015-07-16 21:12 - 02427904 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-08-12 09:17 - 2015-07-16 21:10 - 12856832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-08-12 09:17 - 2015-07-16 21:06 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-08-12 09:17 - 2015-07-16 21:06 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-08-12 09:17 - 2015-07-16 21:05 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-08-12 09:17 - 2015-07-16 21:01 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-08-12 09:17 - 2015-07-16 20:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-08-12 09:17 - 2015-07-16 20:42 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-08-12 09:17 - 2015-07-16 20:38 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-08-12 09:17 - 2015-07-16 20:37 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-08-12 09:17 - 2015-07-15 05:19 - 02004992 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2015-08-12 09:17 - 2015-07-15 05:19 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-08-12 09:17 - 2015-07-15 05:19 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\basesrv.dll
2015-08-12 09:17 - 2015-07-15 05:14 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2015-08-12 09:17 - 2015-07-15 05:13 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-08-12 09:17 - 2015-07-15 04:55 - 01390592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2015-08-12 09:17 - 2015-07-15 04:55 - 01241088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-08-12 09:17 - 2015-07-15 04:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2015-08-12 09:17 - 2015-07-15 04:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2015-08-12 09:17 - 2015-07-01 22:49 - 00260096 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2015-08-12 09:17 - 2015-07-01 22:48 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2015-08-12 09:17 - 2015-07-01 22:30 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2015-08-12 09:17 - 2015-07-01 22:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2015-08-12 09:16 - 2015-07-30 20:06 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2015-08-12 09:16 - 2015-07-30 20:06 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-08-12 09:16 - 2015-07-30 20:06 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-08-12 09:16 - 2015-07-30 20:06 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-08-12 09:16 - 2015-07-30 20:06 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-08-12 09:16 - 2015-07-30 19:57 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2015-08-12 09:16 - 2015-07-30 19:57 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-08-12 09:16 - 2015-07-30 19:57 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-08-12 09:16 - 2015-07-30 19:57 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-08-12 09:16 - 2015-07-30 19:55 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-08-12 09:16 - 2015-07-30 18:56 - 03208192 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-08-12 09:16 - 2015-07-30 18:52 - 00372736 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-08-12 09:16 - 2015-07-30 18:49 - 00299520 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-08-12 09:16 - 2015-07-20 20:12 - 03154944 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-08-12 09:16 - 2015-07-20 20:12 - 02606080 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-08-12 09:16 - 2015-07-20 20:12 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-08-12 09:16 - 2015-07-20 20:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-08-12 09:16 - 2015-07-20 20:12 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-08-12 09:16 - 2015-07-20 20:12 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-08-12 09:16 - 2015-07-20 20:12 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-08-12 09:16 - 2015-07-20 20:12 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-08-12 09:16 - 2015-07-20 20:12 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-08-12 09:16 - 2015-07-20 20:12 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-08-12 09:16 - 2015-07-20 20:12 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-08-12 09:16 - 2015-07-20 19:56 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-08-12 09:16 - 2015-07-20 19:56 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-08-12 09:16 - 2015-07-20 19:56 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-08-12 09:16 - 2015-07-20 19:56 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-08-12 09:16 - 2015-07-20 19:56 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-08-12 09:16 - 2015-07-10 19:51 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-08-12 09:16 - 2015-07-10 19:34 - 12875776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-08-12 09:16 - 2015-07-09 19:57 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\notepad.exe
2015-08-12 09:16 - 2015-07-09 19:57 - 00193536 _____ (Microsoft Corporation) C:\Windows\notepad.exe
2015-08-12 09:16 - 2015-07-09 19:42 - 00179712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
2015-08-12 09:16 - 2015-05-09 20:26 - 00493504 _____ (Microsoft Corporation) C:\Windows\system32\mcupdate_GenuineIntel.dll
2015-08-09 21:39 - 2015-08-09 21:39 - 00005806 _____ C:\Windows\system32\cc_20150809_213913.reg
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-09-06 23:14 - 2013-06-19 20:46 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-09-06 23:06 - 2013-06-10 15:18 - 01102997 _____ C:\Windows\WindowsUpdate.log
2015-09-06 23:05 - 2013-06-10 19:29 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-09-06 23:04 - 2009-07-14 06:45 - 00036176 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-09-06 23:04 - 2009-07-14 06:45 - 00036176 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-09-06 22:51 - 2015-03-21 22:56 - 00000000 ___RD C:\Users\Emil\Google Drive
2015-09-06 22:50 - 2013-06-19 20:46 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-09-06 22:49 - 2015-07-13 19:40 - 00003635 _____ C:\Windows\setupact.log
2015-09-06 22:49 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-09-06 14:38 - 2014-11-22 15:44 - 00000000 ____D C:\Users\Emil\AppData\Roaming\KeePass
2015-09-06 14:22 - 2015-05-20 09:22 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2015-09-05 21:50 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2015-09-05 21:40 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2015-09-05 15:19 - 2013-06-11 01:06 - 00699416 _____ C:\Windows\system32\perfh007.dat
2015-09-05 15:19 - 2013-06-11 01:06 - 00149556 _____ C:\Windows\system32\perfc007.dat
2015-09-05 15:19 - 2009-07-14 07:13 - 01620612 _____ C:\Windows\system32\PerfStringBackup.INI
2015-09-04 09:45 - 2013-06-11 22:28 - 00000000 ____D C:\Users\Public\Documents\Dokumente Eri
2015-09-03 20:45 - 2013-06-10 15:18 - 00000000 ____D C:\Users\Emil
2015-09-02 12:17 - 2013-07-23 22:26 - 00002182 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-09-02 07:46 - 2015-05-18 15:21 - 00000000 ____D C:\Users\Emil\AppData\Roaming\Raptr
2015-09-02 07:46 - 2015-05-18 15:21 - 00000000 ____D C:\Program Files (x86)\Raptr
2015-09-01 23:35 - 2015-05-18 20:48 - 00000000 ____D C:\Users\Erina\AppData\Roaming\Raptr
2015-08-31 23:04 - 2013-06-12 19:27 - 00000000 ____D C:\Users\Emil\AppData\Roaming\vlc
2015-08-31 22:31 - 2014-08-14 20:50 - 00000000 ____D C:\ProgramData\Package Cache
2015-08-31 13:09 - 2013-06-19 20:46 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-08-31 13:09 - 2013-06-19 20:46 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-08-31 08:06 - 2013-06-12 19:14 - 00000000 ____D C:\ProgramData\Avira
2015-08-31 08:06 - 2013-06-12 19:14 - 00000000 ____D C:\Program Files (x86)\Avira
2015-08-30 15:16 - 2013-06-15 00:26 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-08-30 12:52 - 2013-06-12 22:59 - 00000000 ____D C:\Users\Erina
2015-08-30 12:18 - 2015-04-05 03:01 - 00000000 ___SD C:\Windows\system32\GWX
2015-08-30 12:18 - 2013-07-22 18:12 - 00000000 ____D C:\Users\Emil\AppData\Roaming\MusicBee
2015-08-30 12:18 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2015-08-24 19:12 - 2013-06-11 22:28 - 00000000 ____D C:\Users\Public\Documents\Dokumente Emi
2015-08-19 06:57 - 2014-07-29 22:49 - 00002049 _____ C:\Users\Public\Desktop\Google Slides.lnk
2015-08-19 06:57 - 2014-07-29 22:49 - 00002047 _____ C:\Users\Public\Desktop\Google Sheets.lnk
2015-08-19 06:57 - 2014-07-29 22:49 - 00002037 _____ C:\Users\Public\Desktop\Google Docs.lnk
2015-08-19 06:57 - 2014-07-29 22:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2015-08-13 09:31 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-08-13 06:50 - 2014-06-20 23:16 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-08-13 06:50 - 2014-06-20 23:16 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2015-08-13 06:50 - 2009-07-14 06:45 - 00341880 _____ C:\Windows\system32\FNTCACHE.DAT
2015-08-13 06:47 - 2014-12-10 19:19 - 00000000 ____D C:\Windows\system32\appraiser
2015-08-13 06:47 - 2014-05-07 03:01 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-08-13 03:29 - 2014-06-20 23:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-08-13 03:25 - 2013-06-12 18:39 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-08-13 03:18 - 2013-08-15 03:01 - 00000000 ____D C:\Windows\system32\MRT
2015-08-13 03:05 - 2013-06-12 18:06 - 132483416 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-08-12 08:06 - 2013-06-10 19:29 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-08-12 08:05 - 2013-06-10 19:29 - 00778440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-08-12 08:05 - 2013-06-10 19:29 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-08-09 21:34 - 2013-06-10 20:07 - 00000000 ____D C:\Sicherheit
2015-08-09 21:32 - 2013-06-10 19:56 - 00000000 ____D C:\Program Files\CCleaner
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2014-11-28 14:19 - 2014-11-28 14:20 - 0047104 ___SH () C:\Users\Emil\AppData\Roaming\Thumbs.db
2015-09-03 10:21 - 2015-09-03 10:21 - 0216292 _____ () C:\Users\Emil\AppData\Local\ars.cache
2015-09-03 10:21 - 2015-09-03 10:21 - 1572412 _____ () C:\Users\Emil\AppData\Local\census.cache
2015-09-02 23:09 - 2015-09-02 23:09 - 0000036 _____ () C:\Users\Emil\AppData\Local\housecall.guid.cache
2015-06-07 21:09 - 2015-06-07 21:09 - 0007605 _____ () C:\Users\Emil\AppData\Local\Resmon.ResmonCfg
2015-09-02 23:56 - 2015-09-02 23:56 - 0000010 _____ () C:\Users\Emil\AppData\Local\sponge.last.runtime.cache
2015-05-18 15:46 - 2015-05-18 15:46 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2013-10-01 22:39 - 2013-10-01 22:39 - 0001534 _____ () C:\ProgramData\ss.ini
Einige Dateien in TEMP:
====================
C:\Users\Emil\AppData\Local\Temp\avgnt.exe
C:\Users\Emil\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap =================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2015-09-01 07:29
==================== Ende von FRST.txt ============================
vorallem firefox hängt sich jetzt oft auf. |
|
08.09.2015, 15:52
| #9 |
| /// the machine /// TB-Ausbilder | Win 7 extrem verlangsamt Jetzt versuchen wir erstmal nen Clean Boot. http://support2.microsoft.com/kb/929135/de Bitte einen Clean Boot machen. Wenn das Problem dann weg ist, einzeln wieder Dienste aktivieren, dazwischen immer einen Reboot machen. Solange bis Du weißt welcher Dienst die Probleme macht. Diesen dann hier benennen.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
08.09.2015, 20:48
| #10 |
| | Win 7 extrem verlangsamt hallo, ufff, hab ne gue std. zugebracht damit. ergebnis: einen einzelnen dienst konnte ich nicht ermitteln. je mehr ich aktiviere desto langsamer wird das system u vice versa. für nen firefox start habe ich zw. 0:25 und 0: 59 min benötigt. eingefallen ist mir noch dass ich vor dem virus öfters bluescreens hatte weil usb driver gecrasht sind. vielleicht hats damit zu tun? |
|
09.09.2015, 07:50
| #11 |
| /// the machine /// TB-Ausbilder | Win 7 extrem verlangsamt Aktualisiere mal alle Treiber des Mainboards, als ersten Schritt.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
09.09.2015, 19:47
| #12 |
| | Win 7 extrem verlangsamt ich halte meine treiber mit slim drivers aktuell. wenn s nen besseren weg gibt bitte um link. was hat mein letzter scan eigtl. gesagt? wo liegt mein problem? |
|
10.09.2015, 19:08
| #13 |
| /// the machine /// TB-Ausbilder | Win 7 extrem verlangsamt Bissl Adware. Deswegen das mit den Treibern. Automatisierte Software zum Treiber-Update ist grundsätzlich Müll. Herstellerseite aufrufen, manuell nach Treibern suchen. ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
12.09.2015, 09:06
| #14 | |
| | Win 7 extrem verlangsamt moin, eset hat 2 bedrohungen gefunden Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=b267e4fffde70c4196481344de713e51
# end=init
# utc_time=2015-09-11 07:37:28
# local_time=2015-09-11 09:37:28 (+0100, Mitteleuropäische Sommerzeit)
# country="Australia"
# osver=6.1.7601 NT Service Pack 1
# nod_component=V3 Build:0x30000000
Update Init
Update Download
Update Finalize
Updated modules version: 25720
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=b267e4fffde70c4196481344de713e51
# end=updated
# utc_time=2015-09-11 07:38:51
# local_time=2015-09-11 09:38:51 (+0100, Mitteleuropäische Sommerzeit)
# country="Australia"
# osver=6.1.7601 NT Service Pack 1
# nod_component=V3 Build:0x30000000
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=b267e4fffde70c4196481344de713e51
# engine=25720
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-09-11 10:13:11
# local_time=2015-09-12 12:13:11 (+0100, Mitteleuropäische Sommerzeit)
# country="Australia"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 60880 193639441 0 0
# compatibility_mode_1='ESET NOD32 Antivirus 8.0'
# compatibility_mode=8229 16777213 100 100 798825 6085665 0 0
# scanned=437234
# found=2
# cleaned=0
# scan_time=9259
# nod_component=V3 Build:0x30000000
sh=A1E9FA4DFA31937138780E41ADAC9980C32CAF82 ft=0 fh=0000000000000000 vn="NSIS/TrojanDownloader.Agent.NBS.Gen Trojaner" ac=I fn="I:\Sync Toy Backup\Dokumente\Dokumente Emi\Sonstiges\Englische Bücher\English Grammar In Use 3rd (Cambridge).rar"
sh=7302C614ACFAD485CBE0073FB158A1E19A02E7BC ft=0 fh=0000000000000000 vn="NSIS/TrojanDownloader.Agent.NBS.Gen Trojaner" ac=I fn="I:\Sync Toy Backup\Dokumente\Dokumente Emi\Sonstiges\Englische Bücher\English Grammar in Use.iso"
Code:
ATTFilter Results of screen317's Security Check version 1.008
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
ESET NOD32 Antivirus 8.0
Antivirus out of date!
`````````Anti-malware/Other Utilities Check:`````````
Wise Registry Cleaner 8.61
Java 8 Update 51
Java version 32-bit out of Date!
Adobe Flash Player 18.0.0.232
Adobe Reader XI
Mozilla Firefox (40.0.3)
Mozilla Thunderbird (38.2.0)
Google Chrome (44.0.2403.157)
Google Chrome (45.0.2454.85)
````````Process Check: objlist.exe by Laurent````````
ESET NOD32 Antivirus egui.exe
ESET NOD32 Antivirus ekrn.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:10-09-2015 01
durchgeführt von Emil (Administrator) auf EMIL-PC (12-09-2015 09:59:07)
Gestartet von D:\Downloads
Geladene Profile: Emil & Erina (Verfügbare Profile: Emil & Erina)
Platform: Windows 7 Professional Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(AMD) C:\Windows\System32\atiesrxx.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe
() C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsusFanControlService\1.01.10\AsusFanControlService.exe
(Motorola, Inc.) C:\Program Files\Motorola\Bluetooth\devmgrsrv.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
(Thrustmaster®) D:\drivers\amd64\tmInstall.exe
(Motorola, Inc.) C:\Program Files\Motorola\Bluetooth\obexsrv.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(Macrovision Europe Ltd.) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
(AMD) C:\Windows\System32\atieclxx.exe
() C:\Windows\DAODx.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(AMD) C:\Windows\System32\atieclxx.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\MediaSource5\Go\CTCMSGoU.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft) C:\Program Files (x86)\Evernote Sticky Notes\StickyNotes.Wpf.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Steven Mayall) C:\Program Files (x86)\Musicbee\MusicBee.exe
(Farbar) D:\Downloads\FRST64(1).exe
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [5595848 2015-07-08] (ESET)
HKU\S-1-5-21-523548968-1357001120-3005945389-1004\...\Run: [ftweak_RAMRush] => C:\Program Files (x86)\RAMRush\RAMRush.exe
HKU\S-1-5-21-523548968-1357001120-3005945389-1004\...\Run: [Creative MediaSource Go] => C:\Program Files (x86)\Creative\MediaSource5\Go\CTCMSGoU.exe [204800 2006-11-09] (Creative Technology Ltd)
HKU\S-1-5-21-523548968-1357001120-3005945389-1004\...\Run: [EDO-Soft Sticky Notes] => D:\Programme D\StickyNotes.Wpf.exe
ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-07-29] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-07-29] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-07-29] (Google)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt..)
Tcpip\Parameters: [DhcpNameServer] 195.34.133.21 212.186.211.21
Tcpip\..\Interfaces\{1DD6E913-165C-428A-A428-E63291A96F3D}: [DhcpNameServer] 195.34.133.21 212.186.211.21
Tcpip\..\Interfaces\{D4C89ACE-0B25-4927-94B9-343A174CD91A}: [DhcpNameServer] 195.34.133.21 212.186.211.21
Internet Explorer:
==================
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-523548968-1357001120-3005945389-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-523548968-1357001120-3005945389-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.yahoo.com/?fr=yset_ie_syc_oracle&type=orcl_hpset
HKU\S-1-5-21-523548968-1357001120-3005945389-1004\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.dell.com
HKU\S-1-5-21-523548968-1357001120-3005945389-1004\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com
URLSearchHook: HKU\S-1-5-21-523548968-1357001120-3005945389-1004 - (Kein Name) - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - Keine Datei
SearchScopes: HKU\S-1-5-21-523548968-1357001120-3005945389-1000 -> {22E06A81-68EE-4FF1-A05C-7E542584F957} URL = hxxps://at.search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: BitComet Helper -> {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} -> D:\Programme D\BitComet\tools\BitCometBHO_1.5.4.11.dll [2013-11-29] (BitComet)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\ssv.dll [2015-08-02] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\jp2ssv.dll [2015-08-02] (Oracle Corporation)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: HKLM-x32 {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab
FireFox:
========
FF ProfilePath: C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default
FF SelectedSearchEngine: Google
FF Homepage: chrome://speeddial/content/speeddial.xul
FF NetworkProxy: "no_proxies_on", "127.0.0.1"
FF NetworkProxy: "socks", "127.0.0.1"
FF NetworkProxy: "socks_port", 9050
FF NetworkProxy: "socks_remote_dns", true
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_232.dll [2015-08-12] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.8 -> D:\Programme D\VLC\npvlc.dll [2014-07-30] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> D:\Programme D\VLC\npvlc.dll [2014-07-30] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-12] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.51.2 -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\dtplugin\npDeployJava1.dll [2015-08-02] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.51.2 -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\plugin2\npjp2.dll [2015-08-02] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-08-31] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-08-31] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npBitCometAgent.dll [2012-01-12] (BitComet)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\searchplugins\anonymouseorg---scroogleorg---any.xml [2012-02-29]
FF SearchPlugin: C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\searchplugins\scroogle-at.xml [2012-02-29]
FF SearchPlugin: C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\searchplugins\scroogle-ssl.xml [2012-02-29]
FF Extension: Flash Video Downloader - YouTube HD Download [4K] - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\artur.dubovoy@gmail.com [2015-09-07]
FF Extension: HTTPS-Everywhere - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\https-everywhere-eff@eff.org [2015-08-20]
FF Extension: ColorfulTabs - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe} [2015-09-08]
FF Extension: Flashblock - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} [2015-05-29]
FF Extension: FEBE - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3} [2015-05-29]
FF Extension: All-in-One Gestures - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{8b86149f-01fb-4842-9dd8-4d7eb02fd055} [2015-05-29]
FF Extension: BitComet Video Downloader - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB} [2014-11-24]
FF Extension: Adblock Plus Pop-up Addon - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\adblockpopups@jessehakanen.net.xpi [2014-11-22]
FF Extension: Element Hiding Helper for Adblock Plus - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\elemhidehelper@adblockplus.org.xpi [2014-11-22]
FF Extension: GlassMyFox - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\GlassMyFox@ArisT2_Noia4dev.xpi [2014-11-22]
FF Extension: NO Google Analytics - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\jid1-JcGokIiQyjoBAQ@jetpack.xpi [2014-12-28]
FF Extension: YesScript - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\yesscript@userstyles.org.xpi [2015-06-10]
FF Extension: Flagfox - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}.xpi [2014-11-22]
FF Extension: Cookie Cutter - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{4d14a68e-9a97-4358-8603-ed67b332cef1}.xpi [2014-11-22]
FF Extension: SmoothWheel (mozdev.org) - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{5F590AA2-1221-4113-A6F4-A4BB62414FAC}.xpi [2014-11-22]
FF Extension: Speed Dial - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi [2014-11-22]
FF Extension: Binnen-I be gone - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{b65d7d9a-4ec0-4974-b07f-83e30f6e973f}.xpi [2014-11-22]
FF Extension: Adblock Plus - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-11-22]
FF Extension: BetterPrivacy - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2014-11-22]
FF Extension: DownThemAll! - C:\Users\Emil\AppData\Roaming\Mozilla\Firefox\Profiles\55f2g44k.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2014-11-22]
Chrome:
=======
CHR Profile: C:\Users\Emil\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Emil\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-07-12]
CHR Extension: (Avira Browser Safety) - C:\Users\Emil\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2015-07-12]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\Emil\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2015-07-12]
CHR Extension: (Google Wallet) - C:\Users\Emil\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-16]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-523548968-1357001120-3005945389-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Emil\AppData\Local\Google\Drive\user_default\apdfllckaahabafndbhieahigkjlhalf_live.crx [2015-03-21]
CHR HKU\S-1-5-21-523548968-1357001120-3005945389-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [phegaokedjdajgnfphbnpkcfdgjbidko] - C:\ProgramData\adawaretb\toolbar\chrome\toolbar.crx <nicht gefunden>
==================== Dienste (Nicht auf der Ausnahmeliste) ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2015-07-15] (Advanced Micro Devices, Inc.) [Datei ist nicht signiert]
R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe [920736 2012-06-01] ()
R2 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe [951936 2012-06-01] (ASUSTeK Computer Inc.)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe [149120 2012-02-17] (ASUSTeK Computer Inc.)
R2 AsusFanControlService; C:\Program Files (x86)\ASUS\AsusFanControlService\1.01.10\AsusFanControlService.exe [1475744 2012-05-25] (ASUSTeK Computer Inc.)
S3 BITCOMET_HELPER_SERVICE; D:\Programme D\BitComet\tools\BitCometService.exe [1296728 2013-11-29] (www.BitComet.com)
S3 Creative ALchemy AL6 Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2013-06-13] (Creative Labs) [Datei ist nicht signiert]
S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2013-06-13] (Creative Labs) [Datei ist nicht signiert]
S3 Creative Media Toolbox 6 Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\MT6Licensing.exe [79360 2013-06-13] (Creative Labs) [Datei ist nicht signiert]
R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [286720 2010-02-12] (Creative Technology Ltd) [Datei ist nicht signiert]
R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [1353720 2015-07-08] (ESET)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation)
S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [647680 2015-05-18] (Macrovision Europe Ltd.) [Datei ist nicht signiert]
R3 FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [1028096 2015-05-18] (Macrovision Europe Ltd.) [Datei ist nicht signiert]
S4 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 tmInstall; D:\drivers\amd64\tmInstall.exe [45296 2014-07-22] (Thrustmaster®)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
S3 AiChargerPlus; C:\Windows\SysWow64\drivers\AiChargerPlus.sys [14848 2012-04-19] (ASUSTek Computer Inc.)
R2 AODDriver4.3; C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2012-08-22] ()
R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [14464 2012-09-14] ()
S3 ASUSFILTER; C:\Windows\SysWow64\drivers\ASUSFILTER.sys [46152 2011-09-20] (MCCI Corporation)
S3 ASUSstpt; C:\Windows\System32\DRIVERS\ASUSstpt.sys [24648 2011-09-15] (MCCI Corporation)
S3 ASUSumsc; C:\Windows\System32\DRIVERS\ASUSumsc.sys [141896 2011-09-15] (MCCI Corporation)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [255240 2015-07-13] (ESET)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
U5 edevmon; C:\Windows\System32\Drivers\edevmon.sys [251632 2015-07-13] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [178520 2015-07-13] (ESET)
R2 epfwwfpr; C:\Windows\System32\DRIVERS\epfwwfpr.sys [168208 2015-07-13] (ESET)
S3 gfiark; C:\Windows\System32\drivers\gfiark.sys [39504 2013-04-11] (ThreatTrack Security)
R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-06-10] (GFI Software)
S3 HtcVCom32; C:\Windows\System32\DRIVERS\HtcVComV64.sys [121800 2010-03-09] (QUALCOMM Incorporated)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [113880 2015-09-09] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited)
S4 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2006-07-24] ()
S3 tmbulk; C:\Windows\System32\Drivers\tmbulk.sys [129264 2014-06-20] (© Guillemot R&D, 2014. All rights reserved.)
S3 tmhidusb; C:\Windows\System32\DRIVERS\tmhidusb.sys [166640 2014-07-22] (Thrustmaster)
S3 tmResetMin; C:\Windows\System32\Drivers\tmResetMin.sys [36080 2014-07-22] (© Guillemot R&D, 2013. All rights reserved.)
S3 toshidpt; C:\Windows\System32\drivers\Toshidpt.sys [9608 2009-06-19] (TOSHIBA Corporation.)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [Datei ist nicht signiert]
R1 veracrypt; C:\Windows\System32\drivers\veracrypt.sys [185688 2014-12-16] (IDRIX)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-09-12 09:55 - 2015-09-12 09:55 - 00000960 _____ C:\Users\Emil\Desktop\checkup sc.txt
2015-09-11 21:37 - 2015-09-11 21:37 - 00000000 ____D C:\Program Files (x86)\ESET
2015-09-09 18:53 - 2015-09-09 18:53 - 00000876 _____ C:\Users\Public\Desktop\CPUID CPU-Z.lnk
2015-09-09 18:53 - 2015-09-09 18:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CPUID
2015-09-09 18:53 - 2015-09-09 18:53 - 00000000 ____D C:\Program Files\CPUID
2015-09-09 07:23 - 2015-08-18 03:42 - 00393304 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-09-09 07:23 - 2015-08-18 03:14 - 00344168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-09-09 07:23 - 2015-08-15 08:48 - 25190400 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-09-09 07:23 - 2015-08-15 08:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-09-09 07:23 - 2015-08-15 08:33 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-09-09 07:23 - 2015-08-15 08:18 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-09-09 07:23 - 2015-08-15 08:18 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-09-09 07:23 - 2015-08-15 08:17 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-09-09 07:23 - 2015-08-15 08:17 - 00585216 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-09-09 07:23 - 2015-08-15 08:17 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-09-09 07:23 - 2015-08-15 08:17 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-09-09 07:23 - 2015-08-15 08:10 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-09-09 07:23 - 2015-08-15 08:09 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-09-09 07:23 - 2015-08-15 08:06 - 19856896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-09-09 07:23 - 2015-08-15 08:06 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-09-09 07:23 - 2015-08-15 08:04 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-09-09 07:23 - 2015-08-15 08:04 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-09-09 07:23 - 2015-08-15 08:04 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-09-09 07:23 - 2015-08-15 08:04 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-09-09 07:23 - 2015-08-15 08:00 - 05923328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-09-09 07:23 - 2015-08-15 07:57 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-09-09 07:23 - 2015-08-15 07:53 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-09-09 07:23 - 2015-08-15 07:53 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-09-09 07:23 - 2015-08-15 07:46 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-09-09 07:23 - 2015-08-15 07:42 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-09-09 07:23 - 2015-08-15 07:41 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-09-09 07:23 - 2015-08-15 07:40 - 00504832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-09-09 07:23 - 2015-08-15 07:40 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-09-09 07:23 - 2015-08-15 07:39 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-09-09 07:23 - 2015-08-15 07:39 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-09-09 07:23 - 2015-08-15 07:39 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-09-09 07:23 - 2015-08-15 07:38 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-09-09 07:23 - 2015-08-15 07:35 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-09-09 07:23 - 2015-08-15 07:33 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-09-09 07:23 - 2015-08-15 07:32 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-09-09 07:23 - 2015-08-15 07:30 - 00479232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-09-09 07:23 - 2015-08-15 07:29 - 00665600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-09-09 07:23 - 2015-08-15 07:29 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-09-09 07:23 - 2015-08-15 07:29 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-09-09 07:23 - 2015-08-15 07:24 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-09-09 07:23 - 2015-08-15 07:23 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-09-09 07:23 - 2015-08-15 07:22 - 02126336 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-09-09 07:23 - 2015-08-15 07:22 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-09-09 07:23 - 2015-08-15 07:21 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-09-09 07:23 - 2015-08-15 07:16 - 14451712 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-09-09 07:23 - 2015-08-15 07:16 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-09-09 07:23 - 2015-08-15 07:14 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-09-09 07:23 - 2015-08-15 07:12 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-09-09 07:23 - 2015-08-15 07:11 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-09-09 07:23 - 2015-08-15 07:10 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-09-09 07:23 - 2015-08-15 07:07 - 02427392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-09-09 07:23 - 2015-08-15 07:04 - 12857344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-09-09 07:23 - 2015-08-15 07:02 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-09-09 07:23 - 2015-08-15 07:01 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-09-09 07:23 - 2015-08-15 07:01 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-09-09 07:23 - 2015-08-15 06:55 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-09-09 07:23 - 2015-08-15 06:43 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-09-09 07:23 - 2015-08-15 06:43 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-09-09 07:23 - 2015-08-15 06:39 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-09-09 07:23 - 2015-08-15 06:37 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-09-09 07:23 - 2015-08-05 19:56 - 01110016 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2015-09-09 07:23 - 2015-08-05 19:56 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-09-09 07:23 - 2015-08-05 19:56 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-09-09 07:23 - 2015-08-05 19:40 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-09-09 07:23 - 2015-07-23 02:06 - 05568960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-09-09 07:23 - 2015-07-23 02:06 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-09-09 07:23 - 2015-07-23 02:06 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-09-09 07:23 - 2015-07-23 02:03 - 01730496 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-09-09 07:23 - 2015-07-23 02:03 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-09-09 07:23 - 2015-07-23 02:03 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-09-09 07:23 - 2015-07-23 02:03 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-09-09 07:23 - 2015-07-23 02:03 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-09-09 07:23 - 2015-07-23 02:02 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-09-09 07:23 - 2015-07-23 02:02 - 01390592 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-09-09 07:23 - 2015-07-23 02:02 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-09-09 07:23 - 2015-07-23 02:02 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-09-09 07:23 - 2015-07-23 02:02 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-09-09 07:23 - 2015-07-23 02:02 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-09-09 07:23 - 2015-07-23 02:02 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-09-09 07:23 - 2015-07-23 02:02 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-09-09 07:23 - 2015-07-23 02:02 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-09-09 07:23 - 2015-07-23 02:02 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-09-09 07:23 - 2015-07-23 02:02 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-09-09 07:23 - 2015-07-23 02:02 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-09-09 07:23 - 2015-07-23 02:02 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-09-09 07:23 - 2015-07-23 02:02 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-09-09 07:23 - 2015-07-23 02:02 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-09-09 07:23 - 2015-07-23 02:02 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-09-09 07:23 - 2015-07-23 02:02 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-09-09 07:23 - 2015-07-23 02:02 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-09-09 07:23 - 2015-07-23 02:02 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-09-09 07:23 - 2015-07-23 02:02 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-09-09 07:23 - 2015-07-23 02:02 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-09-09 07:23 - 2015-07-23 02:02 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-09-09 07:23 - 2015-07-23 02:02 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-09-09 07:23 - 2015-07-23 02:02 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-09-09 07:23 - 2015-07-23 02:01 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-09-09 07:23 - 2015-07-23 02:01 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-09-09 07:23 - 2015-07-23 02:01 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-09-09 07:23 - 2015-07-23 01:52 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-09-09 07:23 - 2015-07-23 01:52 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-09-09 07:23 - 2015-07-23 01:52 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-09-09 07:23 - 2015-07-23 01:52 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-09-09 07:23 - 2015-07-23 01:52 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-09-09 07:23 - 2015-07-23 01:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-09-09 07:23 - 2015-07-23 01:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-09-09 07:23 - 2015-07-23 01:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-09-09 07:23 - 2015-07-23 01:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-09-09 07:23 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-09-09 07:23 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-09-09 07:23 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-09-09 07:23 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-09-09 07:23 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-09-09 07:23 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-09-09 07:23 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-09-09 07:23 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-09-09 07:23 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-09-09 07:23 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-09-09 07:23 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-09-09 07:23 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-09-09 07:23 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-09-09 07:23 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-09-09 07:23 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-09-09 07:23 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-09-09 07:23 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-09-09 07:23 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-09-09 07:23 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-09-09 07:23 - 2015-07-22 19:57 - 03989952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-09-09 07:23 - 2015-07-22 19:57 - 03934656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-09-09 07:23 - 2015-07-22 19:54 - 01311768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-09-09 07:23 - 2015-07-22 19:53 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-09-09 07:23 - 2015-07-22 19:53 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-09-09 07:23 - 2015-07-22 19:53 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-09-09 07:23 - 2015-07-22 19:53 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-09-09 07:23 - 2015-07-22 19:53 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-09-09 07:23 - 2015-07-22 19:53 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-09-09 07:23 - 2015-07-22 19:53 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-09-09 07:23 - 2015-07-22 19:53 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-09-09 07:23 - 2015-07-22 19:53 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-09-09 07:23 - 2015-07-22 19:53 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-09-09 07:23 - 2015-07-22 19:53 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-09-09 07:23 - 2015-07-22 19:53 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-09-09 07:23 - 2015-07-22 19:53 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-09-09 07:23 - 2015-07-22 19:52 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-09-09 07:23 - 2015-07-22 19:52 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-09-09 07:23 - 2015-07-22 19:52 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-09-09 07:23 - 2015-07-22 19:52 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-09-09 07:23 - 2015-07-22 19:52 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-09-09 07:23 - 2015-07-22 19:52 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-09-09 07:23 - 2015-07-22 19:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-09-09 07:23 - 2015-07-22 19:42 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-09-09 07:23 - 2015-07-22 19:42 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-09-09 07:23 - 2015-07-22 19:42 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-09-09 07:23 - 2015-07-22 19:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-09-09 07:23 - 2015-07-22 19:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-09-09 07:23 - 2015-07-22 19:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-09-09 07:23 - 2015-07-22 19:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-09-09 07:23 - 2015-07-22 19:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-09-09 07:23 - 2015-07-22 19:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-09-09 07:23 - 2015-07-22 19:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-09-09 07:23 - 2015-07-22 19:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-09-09 07:23 - 2015-07-22 19:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-09-09 07:23 - 2015-07-22 19:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-09-09 07:23 - 2015-07-22 19:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-09-09 07:23 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-09-09 07:23 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-09-09 07:23 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-09-09 07:23 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-09-09 07:23 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-09-09 07:23 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-09-09 07:23 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-09-09 07:23 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-09-09 07:23 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-09-09 07:23 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-09-09 07:23 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-09-09 07:23 - 2015-07-22 18:48 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-09-09 07:23 - 2015-07-22 18:45 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-09-09 07:23 - 2015-07-22 18:44 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-09-09 07:23 - 2015-07-22 18:44 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-09-09 07:23 - 2015-07-22 18:34 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-09-09 07:23 - 2015-07-22 18:31 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-09-09 07:23 - 2015-07-22 18:31 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-09-09 07:23 - 2015-07-22 18:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-09-09 07:23 - 2015-07-22 18:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-09-09 07:23 - 2015-07-15 05:17 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2015-09-09 07:23 - 2015-07-15 04:54 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2015-09-09 07:23 - 2015-07-09 19:58 - 01632256 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-09-09 07:23 - 2015-07-09 19:58 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2015-09-09 07:23 - 2015-07-09 19:42 - 01372160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-09-09 07:23 - 2015-07-09 19:42 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll
2015-09-09 07:22 - 2015-09-02 05:04 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-09-09 07:22 - 2015-09-02 05:04 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-09-09 07:22 - 2015-09-02 05:04 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-09-09 07:22 - 2015-09-02 05:04 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-09-09 07:22 - 2015-09-02 04:48 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-09-09 07:22 - 2015-09-02 04:48 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-09-09 07:22 - 2015-09-02 04:48 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-09-09 07:22 - 2015-09-02 04:47 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-09-09 07:22 - 2015-09-02 03:51 - 03209216 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-09-09 07:22 - 2015-09-02 03:47 - 00372736 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-09-09 07:22 - 2015-09-02 03:33 - 00299520 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-09-09 07:22 - 2015-08-27 20:18 - 02004480 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2015-09-09 07:22 - 2015-08-27 20:18 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-09-09 07:22 - 2015-08-27 20:13 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2015-09-09 07:22 - 2015-08-27 20:13 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-09-09 07:22 - 2015-08-27 19:58 - 01391104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2015-09-09 07:22 - 2015-08-27 19:58 - 01241088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-09-09 07:22 - 2015-08-27 19:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2015-09-09 07:22 - 2015-08-27 19:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2015-09-09 07:22 - 2015-08-26 20:07 - 03165696 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-09-09 07:22 - 2015-08-26 20:07 - 02606080 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-09-09 07:22 - 2015-08-26 20:07 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-09-09 07:22 - 2015-08-26 20:07 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-09-09 07:22 - 2015-08-26 20:07 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-09-09 07:22 - 2015-08-26 20:07 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-09-09 07:22 - 2015-08-26 20:07 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-09-09 07:22 - 2015-08-26 20:06 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-09-09 07:22 - 2015-08-26 20:06 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-09-09 07:22 - 2015-08-26 20:06 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-09-09 07:22 - 2015-08-26 20:06 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-09-09 07:22 - 2015-08-26 19:56 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-09-09 07:22 - 2015-08-26 19:56 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-09-09 07:22 - 2015-08-26 19:56 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-09-09 07:22 - 2015-08-26 19:56 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-09-09 07:22 - 2015-08-26 19:55 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-09-09 07:22 - 2015-08-04 20:03 - 00692672 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-09-09 07:22 - 2015-08-04 20:00 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-09-09 07:22 - 2015-08-04 19:56 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-09-09 07:22 - 2015-08-04 19:56 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-09-09 07:22 - 2015-08-04 19:56 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-09-09 07:22 - 2015-08-04 19:55 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-09-09 07:22 - 2015-08-04 19:55 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-09-09 07:22 - 2015-08-04 19:47 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-09-09 07:22 - 2015-08-04 18:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-09-09 07:22 - 2015-07-23 01:58 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-09-09 07:22 - 2015-07-23 01:57 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-09-09 07:22 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-09-09 07:22 - 2015-07-23 01:51 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-09-09 07:22 - 2015-07-22 19:47 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-09-09 07:22 - 2015-07-22 19:46 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-09-09 07:22 - 2015-07-22 19:42 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-09-09 07:22 - 2015-07-22 18:34 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-09-09 07:22 - 2015-06-25 12:06 - 00115136 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-09-09 07:22 - 2015-06-25 12:01 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-09-09 07:22 - 2015-06-25 12:01 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2015-09-09 07:22 - 2015-06-25 11:44 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-09-06 14:21 - 2015-09-08 19:21 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2015-09-05 21:50 - 2015-09-05 21:50 - 00039459 _____ C:\ComboFix.txt
2015-09-05 21:17 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2015-09-05 21:17 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2015-09-05 21:17 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-09-05 21:17 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-09-05 21:17 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-09-05 21:17 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2015-09-05 21:17 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2015-09-05 21:17 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2015-09-05 21:11 - 2015-09-05 21:50 - 00000000 ____D C:\Qoobox
2015-09-05 21:09 - 2015-09-05 21:46 - 00000000 ____D C:\Windows\erdnt
2015-09-05 21:09 - 2015-09-05 21:08 - 05635231 ____R (Swearware) C:\Users\Emil\Desktop\ComboFix.exe
2015-09-03 20:45 - 2015-09-03 20:45 - 00000000 _____ C:\Users\Emil\defogger_reenable
2015-09-03 20:16 - 2015-09-12 09:59 - 00000000 ____D C:\FRST
2015-09-03 20:08 - 2015-09-04 20:20 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-09-03 20:06 - 2015-09-04 20:19 - 00000000 ____D C:\Users\Emil\Desktop\mbar
2015-09-03 10:21 - 2015-09-03 10:21 - 01572412 _____ C:\Users\Emil\AppData\Local\census.cache
2015-09-03 10:21 - 2015-09-03 10:21 - 00216292 _____ C:\Users\Emil\AppData\Local\ars.cache
2015-09-02 23:56 - 2015-09-02 23:56 - 00000010 _____ C:\Users\Emil\AppData\Local\sponge.last.runtime.cache
2015-09-02 23:45 - 2015-05-29 09:43 - 00307352 _____ (Trend Micro Inc.) C:\Windows\system32\Drivers\tmcomm.sys
2015-09-02 23:09 - 2015-09-02 23:09 - 00000036 _____ C:\Users\Emil\AppData\Local\housecall.guid.cache
2015-09-02 23:05 - 2015-09-02 23:05 - 00000000 ____D C:\Users\Emil\AppData\Local\ESET
2015-09-02 18:18 - 2015-09-02 18:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
2015-09-02 18:18 - 2015-09-02 18:18 - 00000000 ____D C:\ProgramData\ESET
2015-09-02 18:18 - 2015-09-02 18:18 - 00000000 ____D C:\Program Files\ESET
2015-08-31 09:10 - 2015-08-31 09:10 - 00000000 ____D C:\Users\Erina\AppData\Local\Avg
2015-08-31 07:23 - 2015-08-31 07:23 - 00000000 ____D C:\ProgramData\Kaspersky Lab Setup Files
2015-08-30 15:56 - 2015-09-02 07:25 - 00000000 ____D C:\Program Files\Common Files\AV
2015-08-30 15:56 - 2015-08-30 15:56 - 00000000 ____D C:\Users\Emil\AppData\Roaming\TuneUp Software
2015-08-30 15:52 - 2015-09-02 07:28 - 00000000 ____D C:\ProgramData\MFAData
2015-08-30 15:52 - 2015-08-30 15:52 - 00000000 ____D C:\Users\Emil\AppData\Local\MFAData
2015-08-30 15:51 - 2015-09-02 07:43 - 00000000 ____D C:\ProgramData\Avg
2015-08-30 15:51 - 2015-09-02 07:42 - 00000000 ____D C:\Users\Emil\AppData\Local\AvgSetupLog
2015-08-30 15:51 - 2015-08-30 15:51 - 00000000 ____D C:\Users\Emil\AppData\Local\Avg
2015-08-30 13:04 - 2015-08-30 15:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-08-30 12:51 - 2015-08-30 13:45 - 00000000 ____D C:\ProgramData\HitmanPro
2015-08-30 12:49 - 2015-09-09 07:38 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-08-30 12:49 - 2015-09-06 21:18 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-08-30 12:49 - 2015-09-06 21:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-08-30 12:49 - 2015-09-06 21:18 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-08-30 12:49 - 2015-08-30 12:49 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-08-30 12:49 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-08-30 12:49 - 2015-06-18 08:41 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-08-30 12:49 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-08-30 12:39 - 2015-09-06 22:46 - 00000000 ____D C:\AdwCleaner
2015-08-30 12:38 - 2015-09-08 20:52 - 00000000 ____D C:\Program Files (x86)\VS Revo Group
2015-08-30 10:50 - 2015-08-30 10:50 - 00650657 _____ C:\Users\Emil\Downloads\lame3.99.5.zip
2015-08-13 06:50 - 2015-09-08 21:00 - 00020414 _____ C:\Windows\PFRO.log
2015-08-13 03:29 - 2015-07-30 15:13 - 00124624 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-08-13 03:29 - 2015-07-30 15:13 - 00103120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-09-12 09:31 - 2009-07-14 06:45 - 00036176 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-09-12 09:31 - 2009-07-14 06:45 - 00036176 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-09-12 09:14 - 2013-06-19 20:46 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-09-12 09:05 - 2013-06-10 19:29 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-09-12 08:41 - 2013-06-10 15:18 - 01630727 _____ C:\Windows\WindowsUpdate.log
2015-09-11 21:39 - 2014-11-22 15:44 - 00000000 ____D C:\Users\Emil\AppData\Roaming\KeePass
2015-09-11 13:14 - 2013-06-19 20:46 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-09-10 07:30 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-09-10 06:54 - 2013-06-11 01:06 - 00699416 _____ C:\Windows\system32\perfh007.dat
2015-09-10 06:54 - 2013-06-11 01:06 - 00149556 _____ C:\Windows\system32\perfc007.dat
2015-09-10 06:54 - 2009-07-14 07:13 - 01620612 _____ C:\Windows\system32\PerfStringBackup.INI
2015-09-10 06:48 - 2015-07-13 19:40 - 00004755 _____ C:\Windows\setupact.log
2015-09-10 06:48 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-09-10 06:48 - 2009-07-14 06:45 - 00341880 _____ C:\Windows\system32\FNTCACHE.DAT
2015-09-10 06:45 - 2010-11-21 09:17 - 00000000 ____D C:\Program Files\Windows Journal
2015-09-10 06:45 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-09-09 23:48 - 2013-06-12 18:39 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-09-09 23:46 - 2013-08-15 03:01 - 00000000 ____D C:\Windows\system32\MRT
2015-09-09 18:44 - 2013-06-10 20:55 - 00000000 ____D C:\AMD
2015-09-08 21:00 - 2013-06-12 19:14 - 00000000 ____D C:\ProgramData\Avira
2015-09-08 20:58 - 2013-06-12 19:14 - 00000000 ____D C:\Program Files (x86)\Avira
2015-09-08 20:57 - 2013-06-10 20:07 - 00000000 ____D C:\Sicherheit
2015-09-08 19:58 - 2015-05-18 15:51 - 00000000 ____D C:\ProgramData\FLEXnet
2015-09-08 19:58 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-09-08 19:35 - 2013-06-15 00:26 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-09-08 19:28 - 2013-06-11 11:27 - 00000000 ____D C:\Windows\pss
2015-09-08 19:17 - 2013-06-12 19:27 - 00000000 ____D C:\Users\Emil\AppData\Roaming\vlc
2015-09-07 18:33 - 2015-03-21 22:56 - 00000000 ___RD C:\Users\Emil\Google Drive
2015-09-05 21:50 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2015-09-05 21:40 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2015-09-04 09:45 - 2013-06-11 22:28 - 00000000 ____D C:\Users\Public\Documents\Dokumente Eri
2015-09-03 20:45 - 2013-06-10 15:18 - 00000000 ____D C:\Users\Emil
2015-09-02 12:17 - 2013-07-23 22:26 - 00002182 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-09-02 07:46 - 2015-05-18 15:21 - 00000000 ____D C:\Users\Emil\AppData\Roaming\Raptr
2015-09-02 07:46 - 2015-05-18 15:21 - 00000000 ____D C:\Program Files (x86)\Raptr
2015-09-01 23:35 - 2015-05-18 20:48 - 00000000 ____D C:\Users\Erina\AppData\Roaming\Raptr
2015-08-31 22:31 - 2014-08-14 20:50 - 00000000 ____D C:\ProgramData\Package Cache
2015-08-31 13:09 - 2013-06-19 20:46 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-08-31 13:09 - 2013-06-19 20:46 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-08-30 12:52 - 2013-06-12 22:59 - 00000000 ____D C:\Users\Erina
2015-08-30 12:18 - 2015-04-05 03:01 - 00000000 ___SD C:\Windows\system32\GWX
2015-08-30 12:18 - 2013-07-22 18:12 - 00000000 ____D C:\Users\Emil\AppData\Roaming\MusicBee
2015-08-30 12:18 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2015-08-26 18:37 - 2013-06-12 18:06 - 134753440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-08-24 19:12 - 2013-06-11 22:28 - 00000000 ____D C:\Users\Public\Documents\Dokumente Emi
2015-08-19 06:57 - 2014-07-29 22:49 - 00002049 _____ C:\Users\Public\Desktop\Google Slides.lnk
2015-08-19 06:57 - 2014-07-29 22:49 - 00002047 _____ C:\Users\Public\Desktop\Google Sheets.lnk
2015-08-19 06:57 - 2014-07-29 22:49 - 00002037 _____ C:\Users\Public\Desktop\Google Docs.lnk
2015-08-19 06:57 - 2014-07-29 22:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2015-08-13 06:50 - 2014-06-20 23:16 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-08-13 06:50 - 2014-06-20 23:16 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2015-08-13 06:47 - 2014-12-10 19:19 - 00000000 ____D C:\Windows\system32\appraiser
2015-08-13 06:47 - 2014-05-07 03:01 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-08-13 03:29 - 2014-06-20 23:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2014-11-28 14:19 - 2014-11-28 14:20 - 0047104 ___SH () C:\Users\Emil\AppData\Roaming\Thumbs.db
2015-09-03 10:21 - 2015-09-03 10:21 - 0216292 _____ () C:\Users\Emil\AppData\Local\ars.cache
2015-09-03 10:21 - 2015-09-03 10:21 - 1572412 _____ () C:\Users\Emil\AppData\Local\census.cache
2015-09-02 23:09 - 2015-09-02 23:09 - 0000036 _____ () C:\Users\Emil\AppData\Local\housecall.guid.cache
2015-06-07 21:09 - 2015-06-07 21:09 - 0007605 _____ () C:\Users\Emil\AppData\Local\Resmon.ResmonCfg
2015-09-02 23:56 - 2015-09-02 23:56 - 0000010 _____ () C:\Users\Emil\AppData\Local\sponge.last.runtime.cache
2015-05-18 15:46 - 2015-05-18 15:46 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2013-10-01 22:39 - 2013-10-01 22:39 - 0001534 _____ () C:\ProgramData\ss.ini
Einige Dateien in TEMP:
====================
C:\Users\Emil\AppData\Local\Temp\avgnt.exe
C:\Users\Emil\AppData\Local\Temp\sqlite3.dll
C:\Users\Erina\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap =================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2015-09-11 07:18
==================== Ende von FRST.txt ============================
Zitat:
ich weiß gerade mal, dass ich nen amd prozessor habe. du meinst ich gehe auf die amd seite u lade den treiber für meine chip version runter? ist es das dann od. gibts da andere treiber auch noch, ausser dem prozessor? |
|
13.09.2015, 08:59
| #15 |
| /// the machine /// TB-Ausbilder | Win 7 extrem verlangsamt Java updaten. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter FF Homepage: chrome://speeddial/content/speeddial.xul
FF NetworkProxy: "no_proxies_on", "127.0.0.1"
FF NetworkProxy: "socks", "127.0.0.1"
FF NetworkProxy: "socks_port", 9050
FF NetworkProxy: "socks_remote_dns", true
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Der Prozessor ist da egal, welches Mainboard ist drin? Oder ist der ganze PC von einem Hersteller, und nicht selbst zusammen geschraubt? Dann die Seite des PC Herstellers.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Win 7 extrem verlangsamt |
| antivirus, avira, computer, desktop, dnsapi.dll, downloader, fehler, firefox, flash player, google, google analytics, helper, homepage, kaspersky, malware, mozilla, mp3, popup, prozesse, realtek, registry, rundll, security, software, svchost.exe, system, windows |
WARNUNG an die MITLESER: 
Linear-Darstellung
