| |
| |||||||
Log-Analyse und Auswertung: CryptXXX 3.0: Alle Files auf .crypz verschlüsseltWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
30.06.2016, 20:55
| #1 |
| |  CryptXXX 3.0: Alle Files auf .crypz verschlüsselt Hallo zusammen, auch ich habe mir offensichtlich den Trojaner CryptXXX 3.0 eingefangen, der mir alle Dateien mit RSA-4096 verschlüsselt hat. Dateiendung <Originalname>.crypt. Habe bereits mehrere Maßnahmen unternommen, wobei Microsoft Security Essentials der Meinung ist, dass der Trojaner erfolgreich entfernt wurde. In der Tat habe ich bis auf die verschlüsselten Dateien keine Hinweise mehr entdecken können. Mein Anliegen ist nun folgendes: 1. Ist mein Rechner wirklich sauber? 2. Wie kann ich die Dateien wieder entschlüsseln? Zu 1. habe ich die Logfiles angehängt, die ihr immer anfordert (siehe unten). Zu 2. konnte ich mit dem Tool Ransomware File Decryptor von Trendmicro zwar die Dateien entschlüsseln, leider sind sie jedoch unlesbar. Die Filegröße nach der Entschlüsselung ist identisch mit der originalen Datei (einer der wenigen Files, die ich gesichert habe), öffnen lassen sie sich aber nicht. Werde die oftmals gewünschten Logs in den folgenden Beiträgen posten. Ich hoffe ihr könnt mir helfen!! Danke schon mal im Voraus, Emroi Verschlüsselungstrojaner: CryptXXX 3.0 Decryptor gibt es aktuell wohl noch nicht. Output FRST.txt: Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 29-06-2016
durchgeführt von MEmroi (Administrator) auf Emroi (30-06-2016 21:19:59)
Gestartet von C:\Users\MEmroi\Desktop
Geladene Profile: MEmroi (Verfügbare Profile: MEmroi)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: IE)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Ralink\Common\RaRegistry.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Ralink\Common\RaRegistry64.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Hewlett-Packard ) C:\Program Files\IDT\WDM\Beats64.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe
() C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Suunto Oy) C:\Program Files (x86)\Suunto\Moveslink for Movestick Mini\Moveslink.exe
(Ralink Technology, Inc.) C:\Program Files (x86)\Ralink\Common\RaWiFi.exe
(PIXELA CORPORATION) C:\Program Files (x86)\Canon Pixela VideoBrowser\CameraMonitor.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_18_0_0_209_ActiveX.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Trend Micro Inc.) C:\Users\MEmroi\Desktop\RansomwareFileDecryptor 1.0.1595 MUI\RansomwareFileDecryptor 1.0.1595 MUI.exe
(Trend Micro Inc.) C:\Users\MEmroi\AppData\Local\Temp\TMRDTSelfExtract\TMRDT.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1425408 2012-03-30] (IDT, Inc.)
HKLM\...\Run: [BeatsOSDApp] => C:\Program Files\IDT\WDM\beats64.exe [37888 2012-03-30] (Hewlett-Packard )
HKLM\...\Run: [HPSYSDRV] => C:\Program Files (x86)\Hewlett-Packard\HP Odometer\HPSYSDRV.EXE [62768 2008-11-20] (Hewlett-Packard)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-10-16] (Apple Inc.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1340192 2016-01-29] (Microsoft Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [641664 2012-04-08] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AMD AVT] => C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe [10752 2012-02-21] ()
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-02] (Symantec Corporation)
HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [926896 2012-09-23] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60688 2015-10-13] (Apple Inc.)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [3524536 2012-08-31] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [Magic Desktop for HP notification] => C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [1444880 2015-11-26] (Easybits)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [23496872 2016-05-17] (Google)
HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\...\Run: [KiesPreload] => C:\Program Files (x86)\Samsung\Kies\Kies.exe [964024 2012-08-31] (Samsung)
HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\...\Run: [KiesAirMessage] => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\...\Run: [KiesPDLR] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [21432 2012-08-31] ()
HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\...\Policies\system: [DisableChangePassword] 0
ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-05-17] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-05-17] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-05-17] (Google)
ShellIconOverlayIdentifiers: [ OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton Internet Security\Engine64\22.7.0.76\buShell.dll [2016-06-09] (Symantec Corporation)
ShellIconOverlayIdentifiers: [ OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton Internet Security\Engine64\22.7.0.76\buShell.dll [2016-06-09] (Symantec Corporation)
ShellIconOverlayIdentifiers: [ OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton Internet Security\Engine64\22.7.0.76\buShell.dll [2016-06-09] (Symantec Corporation)
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => Keine Datei
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Moveslink for Movestick Mini.lnk [2016-02-01]
ShortcutTarget: Moveslink for Movestick Mini.lnk -> C:\Windows\Installer\{4D036ACA-DFDF-41B2-A680-E0D736F3E947}\_22A9010B636AF7A61D8E03.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk [2014-11-18]
ShortcutTarget: Ralink Wireless Utility.lnk -> C:\Program Files (x86)\Ralink\Common\RaWiFi.exe (Ralink Technology, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VideoBrowser Camera Monitor.lnk [2015-09-11]
ShortcutTarget: VideoBrowser Camera Monitor.lnk -> C:\Program Files (x86)\Canon Pixela VideoBrowser\CameraMonitor.exe (PIXELA CORPORATION)
Startup: C:\Users\MEmroi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk [2016-05-23]
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 192.168.0.2
Tcpip\..\Interfaces\{700E6166-4808-4F00-BEC5-94704CC93633}: [DhcpNameServer] 192.168.0.1 192.168.0.2
Tcpip\..\Interfaces\{9F1850AC-45C5-4E34-A0DF-938B166300BB}: [DhcpNameServer] 192.168.0.1 192.168.0.2
Internet Explorer:
==================
HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPDSK/4
HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://www.claro-search.com/?affID=114506&tt=0413_2&babsrc=HP_clro&mntrId=742bfa5200000000000074e543100086
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
SearchScopes: HKLM -> {9C119A54-6B53-4C54-B208-43352455E521} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
SearchScopes: HKLM -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://www.ebay.de/sch/i.html?_nkw={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
SearchScopes: HKLM-x32 -> {9C119A54-6B53-4C54-B208-43352455E521} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://www.ebay.de/sch/i.html?_nkw={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL =
SearchScopes: HKU\S-1-5-21-1078291597-1949154093-2174115440-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1078291597-1949154093-2174115440-1001 -> bProtectorDefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
SearchScopes: HKU\S-1-5-21-1078291597-1949154093-2174115440-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1078291597-1949154093-2174115440-1001 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.claro-search.com/?q={searchTerms}&affID=114506&tt=0413_2&babsrc=SP_clro&mntrId=742bfa5200000000000074e543100086
SearchScopes: HKU\S-1-5-21-1078291597-1949154093-2174115440-1001 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
SearchScopes: HKU\S-1-5-21-1078291597-1949154093-2174115440-1001 -> {9C119A54-6B53-4C54-B208-43352455E521} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-1078291597-1949154093-2174115440-1001 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
SearchScopes: HKU\S-1-5-21-1078291597-1949154093-2174115440-1001 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKU\S-1-5-21-1078291597-1949154093-2174115440-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://www.ebay.de/sch/i.html?_nkw={searchTerms}
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine64\22.7.0.76\coIEPlg.dll [2016-05-31] (Symantec Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\22.7.0.76\coIEPlg.dll [2016-05-31] (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\IPS\IPSBHO.DLL => Keine Datei
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\22.7.0.76\coIEPlg.dll [2016-05-31] (Symantec Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\22.7.0.76\coIEPlg.dll [2016-05-31] (Symantec Corporation)
FireFox:
========
FF ProfilePath: C:\Users\MEmroi\AppData\Roaming\Mozilla\Firefox\Profiles\vjtlm2h6.default
FF NewTab: hxxp://www.claro-search.com/?affID=114506&tt=0413_2&babsrc=NT_clro&mntrId=742bfa5200000000000074e543100086
FF SelectedSearchEngine: Claro Search
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_11_5_502_135.dll [2013-01-03] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll [2013-01-03] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-10-08] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-14] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-14] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-21] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-21] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2012-09-23] (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\MEmroi\AppData\Roaming\Mozilla\Firefox\Profiles\vjtlm2h6.default\user.js [2013-01-21]
FF SearchPlugin: C:\Users\MEmroi\AppData\Roaming\Mozilla\Firefox\Profiles\vjtlm2h6.default\searchplugins\claro.xml [2013-01-21]
FF Extension: Yahoo! Toolbar - C:\Users\MEmroi\AppData\Roaming\Mozilla\Firefox\Profiles\vjtlm2h6.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2015-05-25] [ist nicht signiert]
FF Extension: SaveByclick - C:\Users\MEmroi\AppData\Roaming\Mozilla\Firefox\Profiles\vjtlm2h6.default\Extensions\50e5dde6b181e@50e5dde6b1857.com [2016-01-13] [ist nicht signiert]
FF HKLM\...\Firefox\Extensions: [{C1A2A613-35F1-4FCF-B27F-2840527B6556}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_22.7.0.76\coFFAddon
FF Extension: Norton Identity Safe - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_22.7.0.76\coFFAddon [2016-06-27]
FF HKLM-x32\...\Firefox\Extensions: [{C1A2A613-35F1-4FCF-B27F-2840527B6556}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_22.7.0.76\coFFAddon
FF HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\...\Firefox\Extensions: [{58bd07eb-0ee0-4df0-8121-dc9b693373df}] - C:\ProgramData\BrowserProtect\2.6.1095.52\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension => nicht gefunden
Chrome:
=======
CHR Profile: C:\Users\MEmroi\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (SaveByclick) - C:\Users\MEmroi\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakgcbilhdnlpcplelkckgfcfbhmpjoa [2013-01-03]
CHR HKLM\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Internet Security\Engine\22.7.0.76\Exts\Chrome.crx [2016-06-27]
CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Internet Security\Engine\22.7.0.76\Exts\Chrome.crx [2016-06-27]
CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [pgafcinpmmpklohkojmllohdhomoefph] - C:\ProgramData\BrowserProtect\2.6.1095.52\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.crx <nicht gefunden>
==================== Dienste (Nicht auf der Ausnahmeliste) ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-10-07] (Apple Inc.)
R2 EpsonScanSvc; C:\windows\system32\EscSvc64.exe [144560 2012-05-17] (Seiko Epson Corporation)
R2 ezSharedSvc; C:\windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [Datei ist nicht signiert]
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2016-01-29] (Microsoft Corporation)
S2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\22.7.0.76\NIS.exe [289080 2016-06-17] (Symantec Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [374344 2016-01-29] (Microsoft Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation)
R2 RalinkRegistryWriter; C:\Program Files (x86)\Ralink\Common\RaRegistry.exe [372736 2012-01-13] (Ralink Technology, Corp.) [Datei ist nicht signiert]
R2 RalinkRegistryWriter64; C:\Program Files (x86)\Ralink\Common\RaRegistry64.exe [447488 2012-01-13] (Ralink Technology, Corp.) [Datei ist nicht signiert]
S2 RaMediaServer; C:\Program Files (x86)\Ralink\Common\RaMediaServer.exe [625728 2011-08-19] ()
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [311296 2012-03-30] (IDT, Inc.) [Datei ist nicht signiert]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 HP Support Assistant Service; "C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe" [X]
S3 hpqwmiex; "C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe" [X]
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\22.7.0.76\Definitions\BASHDefs\20160621.003\BHDrvx64.sys [1832176 2016-06-02] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1607000.04C\ccSetx64.sys [174328 2016-06-02] (Symantec Corporation)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [497392 2016-06-11] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [156912 2016-06-11] (Symantec Corporation)
R1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\22.7.0.76\Definitions\IPSDefs\20160627.005\IDSvia64.sys [876248 2016-06-24] (Symantec Corporation)
S3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [43456 2011-02-02] (hxxp://libusb-win32.sourceforge.net)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [289120 2015-11-13] (Microsoft Corporation)
R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133816 2015-11-13] (Microsoft Corporation)
R1 SRTSP; C:\Windows\System32\Drivers\NISx64\1607000.04C\SRTSP64.SYS [773360 2016-06-02] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1607000.04C\SRTSPX64.SYS [48888 2016-06-02] (Symantec Corporation)
S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2006-07-24] () [Datei ist nicht signiert]
R0 SymEFASI; C:\Windows\System32\drivers\NISx64\1607000.04C\SYMEFASI64.SYS [1627352 2016-06-02] (Symantec Corporation)
R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [101112 2016-06-27] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1607000.04C\Ironx64.SYS [291056 2016-06-02] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1607000.04C\SYMNETS.SYS [567536 2016-06-02] (Symantec Corporation)
S3 NAVENG; \??\C:\Program Files (x86)\Norton Internet Security\NortonData\22.7.0.76\Definitions\SDSDefs\20160626.018\ENG64.SYS [X]
S3 NAVEX15; \??\C:\Program Files (x86)\Norton Internet Security\NortonData\22.7.0.76\Definitions\SDSDefs\20160626.018\EX64.SYS [X]
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-06-30 21:19 - 2016-06-30 21:20 - 00025374 _____ C:\Users\MEmroi\Desktop\FRST.txt
2016-06-30 21:19 - 2016-06-30 21:19 - 02390016 _____ (Farbar) C:\Users\MEmroi\Desktop\FRST64.exe
2016-06-30 21:19 - 2016-06-30 21:19 - 00000000 ____D C:\FRST
2016-06-30 20:34 - 2016-06-30 20:34 - 01496971 _____ C:\Users\MEmroi\Desktop\jpegsnoop-1-7-5-en-win.zip
2016-06-30 20:34 - 2016-06-30 20:34 - 00000000 ____D C:\Users\MEmroi\AppData\Roaming\JPEGsnoop
2016-06-30 20:30 - 2016-06-30 20:30 - 00000000 ____D C:\Users\MEmroi\Desktop\RansomwareFileDecryptor 1.0.1595 MUI
2016-06-30 20:28 - 2016-06-30 20:28 - 08820004 _____ C:\Users\MEmroi\Desktop\RansomwareFileDecryptor 1.0.1595 MUI.zip
2016-06-29 21:26 - 2016-06-30 21:08 - 00000000 ____D C:\Users\MEmroi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ParetoLogic
2016-06-29 21:26 - 2016-06-30 21:08 - 00000000 ____D C:\ProgramData\ParetoLogic
2016-06-29 21:26 - 2016-06-30 21:08 - 00000000 ____D C:\Program Files (x86)\ParetoLogic
2016-06-27 17:24 - 2016-06-27 17:24 - 00002242 _____ C:\ScraperDecryptor.1.0.0.2_27.06.2016_17.24.01_log.txt
2016-06-27 17:22 - 2016-06-27 17:23 - 00002502 _____ C:\RakhniDecryptor.1.15.10.0_27.06.2016_17.22.05_log.txt
2016-06-27 16:40 - 2016-06-27 17:04 - 63037856 _____ C:\RectorDecryptor.2.7.0.0_27.06.2016_16.40.51_log.txt
2016-06-27 16:32 - 2016-06-27 16:40 - 11183508 _____ C:\XoristDecryptor.2.4.0.0_27.06.2016_16.32.28_log.txt
2016-06-27 16:28 - 2016-06-27 16:28 - 00002222 _____ C:\RannohDecryptor.1.9.1.1_27.06.2016_16.28.04_log.txt
2016-06-27 16:25 - 2016-06-27 16:27 - 00002416 _____ C:\RannohDecryptor.1.9.1.1_27.06.2016_16.25.40_log.txt
2016-06-27 16:19 - 2016-06-27 16:22 - 00002310 _____ C:\RannohDecryptor.1.9.1.1_27.06.2016_16.19.29_log.txt
2016-06-27 16:16 - 2016-06-27 16:18 - 00002494 _____ C:\RannohDecryptor.1.9.1.1_27.06.2016_16.16.26_log.txt
2016-06-27 16:05 - 2016-06-06 18:58 - 00041704 _____ (Microsoft Corporation) C:\windows\system32\CompatTelRunner.exe
2016-06-27 16:05 - 2016-06-06 18:50 - 01204224 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2016-06-27 16:05 - 2016-06-03 15:05 - 01413120 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2016-06-27 16:05 - 2016-05-27 15:06 - 00569856 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2016-06-27 16:05 - 2016-05-27 15:06 - 00544256 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2016-06-27 16:05 - 2016-05-27 15:06 - 00276480 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2016-06-27 16:05 - 2016-05-27 15:06 - 00265216 _____ (Microsoft Corporation) C:\windows\system32\centel.dll
2016-06-27 16:05 - 2016-05-22 15:06 - 00076800 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll
2016-06-27 16:05 - 2016-05-20 23:59 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2016-06-27 16:05 - 2016-05-20 23:57 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2016-06-27 16:05 - 2016-05-20 23:54 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2016-06-27 16:05 - 2016-05-20 23:48 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2016-06-27 16:05 - 2016-05-20 23:26 - 00091136 _____ (Microsoft Corporation) C:\windows\SysWOW64\inseng.dll
2016-06-27 16:05 - 2016-05-18 18:10 - 00312832 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll
2016-06-27 16:05 - 2016-05-18 18:09 - 00405504 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
2016-06-27 16:05 - 2016-05-14 00:15 - 00382184 _____ (Adobe Systems Incorporated) C:\windows\system32\atmfd.dll
2016-06-27 16:05 - 2016-05-14 00:09 - 00100864 _____ (Microsoft Corporation) C:\windows\system32\fontsub.dll
2016-06-27 16:05 - 2016-05-14 00:09 - 00046080 _____ (Adobe Systems) C:\windows\system32\atmlib.dll
2016-06-27 16:05 - 2016-05-14 00:09 - 00041472 _____ (Microsoft Corporation) C:\windows\system32\lpk.dll
2016-06-27 16:05 - 2016-05-14 00:09 - 00014336 _____ (Microsoft Corporation) C:\windows\system32\dciman32.dll
2016-06-27 16:05 - 2016-05-13 23:54 - 00308456 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\atmfd.dll
2016-06-27 16:05 - 2016-05-13 23:50 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\lpk.dll
2016-06-27 16:05 - 2016-05-13 23:49 - 00070656 _____ (Microsoft Corporation) C:\windows\SysWOW64\fontsub.dll
2016-06-27 16:05 - 2016-05-13 23:49 - 00010240 _____ (Microsoft Corporation) C:\windows\SysWOW64\dciman32.dll
2016-06-27 16:05 - 2016-05-13 23:27 - 00034304 _____ (Adobe Systems) C:\windows\SysWOW64\atmlib.dll
2016-06-27 16:05 - 2016-05-12 19:20 - 00154856 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2016-06-27 16:05 - 2016-05-12 19:20 - 00095464 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2016-06-27 16:05 - 2016-05-12 19:15 - 00210432 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2016-06-27 16:05 - 2016-05-12 19:15 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2016-06-27 16:05 - 2016-05-12 19:15 - 00105472 _____ (Microsoft Corporation) C:\windows\system32\winipsec.dll
2016-06-27 16:05 - 2016-05-12 19:15 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2016-06-27 16:05 - 2016-05-12 19:15 - 00028672 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2016-06-27 16:05 - 2016-05-12 19:15 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 01464320 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 01212928 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00794624 _____ (Microsoft Corporation) C:\windows\system32\gpsvc.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00730624 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00690688 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00502272 _____ (Microsoft Corporation) C:\windows\system32\IPSECSVC.DLL
2016-06-27 16:05 - 2016-05-12 19:14 - 00463872 _____ (Microsoft Corporation) C:\windows\system32\certcli.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00373760 _____ (Microsoft Corporation) C:\windows\system32\polstore.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00344064 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00316416 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00312320 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00190464 _____ (Microsoft Corporation) C:\windows\system32\rpchttp.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00096256 _____ (Microsoft Corporation) C:\windows\system32\gpapi.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00075776 _____ (Microsoft Corporation) C:\windows\system32\FwRemoteSvr.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\cryptbase.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00666112 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00553472 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00342528 _____ (Microsoft Corporation) C:\windows\SysWOW64\certcli.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\polstore.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00260608 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00251392 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00223232 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00141312 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpchttp.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00079360 _____ (Microsoft Corporation) C:\windows\SysWOW64\gpapi.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00070144 _____ (Microsoft Corporation) C:\windows\SysWOW64\winipsec.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00044032 _____ (Microsoft Corporation) C:\windows\SysWOW64\FwRemoteSvr.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll
2016-06-27 16:05 - 2016-05-12 17:05 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
2016-06-27 16:05 - 2016-05-12 17:03 - 03217408 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2016-06-27 16:05 - 2016-05-12 16:58 - 00464896 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srv.sys
2016-06-27 16:05 - 2016-05-12 16:58 - 00405504 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srv2.sys
2016-06-27 16:05 - 2016-05-12 16:58 - 00291328 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb10.sys
2016-06-27 16:05 - 2016-05-12 16:58 - 00168960 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srvnet.sys
2016-06-27 16:05 - 2016-05-12 16:58 - 00159744 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb.sys
2016-06-27 16:05 - 2016-05-12 16:58 - 00129536 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys
2016-06-27 16:05 - 2016-05-12 16:57 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2016-06-27 16:05 - 2016-05-12 16:56 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe
2016-06-27 16:05 - 2016-05-12 16:51 - 00036352 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptbase.dll
2016-06-27 16:05 - 2016-05-12 15:05 - 00459640 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
2016-06-27 16:05 - 2016-05-12 15:05 - 00297984 _____ (Microsoft Corporation) C:\windows\system32\bcryptprimitives.dll
2016-06-27 16:05 - 2016-05-12 15:04 - 00249352 _____ (Microsoft Corporation) C:\windows\SysWOW64\bcryptprimitives.dll
2016-06-27 16:05 - 2016-05-11 19:02 - 00483840 _____ (Microsoft Corporation) C:\windows\system32\StructuredQuery.dll
2016-06-27 16:05 - 2016-05-11 19:02 - 00444928 _____ (Microsoft Corporation) C:\windows\system32\winhttp.dll
2016-06-27 16:05 - 2016-05-11 19:02 - 00327168 _____ (Microsoft Corporation) C:\windows\system32\mswsock.dll
2016-06-27 16:05 - 2016-05-11 19:02 - 00296448 _____ (Microsoft Corporation) C:\windows\system32\ws2_32.dll
2016-06-27 16:05 - 2016-05-11 17:19 - 00363520 _____ (Microsoft Corporation) C:\windows\SysWOW64\StructuredQuery.dll
2016-06-27 16:05 - 2016-05-11 17:19 - 00351744 _____ (Microsoft Corporation) C:\windows\SysWOW64\winhttp.dll
2016-06-27 16:05 - 2016-05-11 17:19 - 00231424 _____ (Microsoft Corporation) C:\windows\SysWOW64\mswsock.dll
2016-06-27 16:05 - 2016-05-11 17:19 - 00206336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ws2_32.dll
2016-06-27 16:05 - 2016-05-11 17:11 - 00025088 _____ (Microsoft Corporation) C:\windows\system32\netbtugc.exe
2016-06-27 16:05 - 2016-05-11 17:01 - 00026624 _____ (Microsoft Corporation) C:\windows\SysWOW64\netbtugc.exe
2016-06-27 16:05 - 2016-05-11 16:58 - 00262144 _____ (Microsoft Corporation) C:\windows\system32\Drivers\netbt.sys
2016-06-27 16:05 - 2016-04-14 18:46 - 00114408 _____ (Microsoft Corporation) C:\windows\system32\consent.exe
2016-06-27 16:05 - 2016-04-14 18:42 - 03243520 _____ (Microsoft Corporation) C:\windows\system32\msi.dll
2016-06-27 16:05 - 2016-04-14 18:42 - 01941504 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
2016-06-27 16:05 - 2016-04-14 18:42 - 00504320 _____ (Microsoft Corporation) C:\windows\system32\msihnd.dll
2016-06-27 16:05 - 2016-04-14 18:42 - 00070144 _____ (Microsoft Corporation) C:\windows\system32\appinfo.dll
2016-06-27 16:05 - 2016-04-14 18:42 - 00025088 _____ (Microsoft Corporation) C:\windows\system32\msimsg.dll
2016-06-27 16:05 - 2016-04-14 17:33 - 02365440 _____ (Microsoft Corporation) C:\windows\SysWOW64\msi.dll
2016-06-27 16:05 - 2016-04-14 17:33 - 01806848 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll
2016-06-27 16:05 - 2016-04-14 17:33 - 00337408 _____ (Microsoft Corporation) C:\windows\SysWOW64\msihnd.dll
2016-06-27 16:05 - 2016-04-14 17:33 - 00025088 _____ (Microsoft Corporation) C:\windows\SysWOW64\msimsg.dll
2016-06-27 16:05 - 2016-04-14 17:19 - 00128000 _____ (Microsoft Corporation) C:\windows\system32\msiexec.exe
2016-06-27 16:05 - 2016-04-14 17:11 - 00073216 _____ (Microsoft Corporation) C:\windows\SysWOW64\msiexec.exe
2016-06-27 16:05 - 2016-04-09 08:58 - 14186496 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2016-06-27 16:05 - 2016-04-09 08:57 - 01867776 _____ (Microsoft Corporation) C:\windows\system32\ExplorerFrame.dll
2016-06-27 16:05 - 2016-04-09 08:54 - 12881408 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2016-06-27 16:05 - 2016-04-09 08:54 - 01499648 _____ (Microsoft Corporation) C:\windows\SysWOW64\ExplorerFrame.dll
2016-06-27 16:05 - 2016-04-09 07:53 - 03231232 _____ (Microsoft Corporation) C:\windows\explorer.exe
2016-06-27 16:05 - 2016-04-09 07:44 - 02973184 _____ (Microsoft Corporation) C:\windows\SysWOW64\explorer.exe
2016-06-27 16:05 - 2016-03-09 21:00 - 00396800 _____ (Microsoft Corporation) C:\windows\system32\webio.dll
2016-06-27 16:05 - 2016-03-09 20:40 - 00316416 _____ (Microsoft Corporation) C:\windows\SysWOW64\webio.dll
2016-06-27 16:04 - 2016-05-24 01:37 - 00394960 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2016-06-27 16:04 - 2016-05-24 00:54 - 00346312 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2016-06-27 16:04 - 2016-05-21 19:28 - 25802752 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2016-06-27 16:04 - 2016-05-21 18:57 - 20341248 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2016-06-27 16:04 - 2016-05-21 00:27 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2016-06-27 16:04 - 2016-05-21 00:27 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2016-06-27 16:04 - 2016-05-21 00:14 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2016-06-27 16:04 - 2016-05-21 00:10 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2016-06-27 16:04 - 2016-05-21 00:09 - 00572416 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2016-06-27 16:04 - 2016-05-21 00:09 - 00417792 _____ (Microsoft Corporation) C:\windows\system32\html.iec
2016-06-27 16:04 - 2016-05-21 00:09 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2016-06-27 16:04 - 2016-05-21 00:08 - 02895360 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2016-06-27 16:04 - 2016-05-21 00:08 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2016-06-27 16:04 - 2016-05-21 00:02 - 06051328 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2016-06-27 16:04 - 2016-05-21 00:00 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2016-06-27 16:04 - 2016-05-20 23:57 - 00497664 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2016-06-27 16:04 - 2016-05-20 23:57 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2016-06-27 16:04 - 2016-05-20 23:56 - 00615936 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2016-06-27 16:04 - 2016-05-20 23:56 - 00341504 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec
2016-06-27 16:04 - 2016-05-20 23:55 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2016-06-27 16:04 - 2016-05-20 23:54 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2016-06-27 16:04 - 2016-05-20 23:54 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2016-06-27 16:04 - 2016-05-20 23:54 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2016-06-27 16:04 - 2016-05-20 23:50 - 02287104 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2016-06-27 16:04 - 2016-05-20 23:49 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2016-06-27 16:04 - 2016-05-20 23:45 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2016-06-27 16:04 - 2016-05-20 23:45 - 00476160 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2016-06-27 16:04 - 2016-05-20 23:44 - 00663552 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2016-06-27 16:04 - 2016-05-20 23:44 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2016-06-27 16:04 - 2016-05-20 23:43 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2016-06-27 16:04 - 2016-05-20 23:41 - 00489984 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2016-06-27 16:04 - 2016-05-20 23:33 - 00416256 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2016-06-27 16:04 - 2016-05-20 23:33 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2016-06-27 16:04 - 2016-05-20 23:32 - 00107520 _____ (Microsoft Corporation) C:\windows\system32\inseng.dll
2016-06-27 16:04 - 2016-05-20 23:29 - 13815808 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2016-06-27 16:04 - 2016-05-20 23:28 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2016-06-27 16:04 - 2016-05-20 23:27 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2016-06-27 16:04 - 2016-05-20 23:27 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2016-06-27 16:04 - 2016-05-20 23:25 - 00315392 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2016-06-27 16:04 - 2016-05-20 23:23 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2016-06-27 16:04 - 2016-05-20 23:23 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2016-06-27 16:04 - 2016-05-20 23:22 - 00152064 _____ (Microsoft Corporation) C:\windows\system32\occache.dll
2016-06-27 16:04 - 2016-05-20 23:21 - 00279040 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2016-06-27 16:04 - 2016-05-20 23:19 - 00130048 _____ (Microsoft Corporation) C:\windows\SysWOW64\occache.dll
2016-06-27 16:04 - 2016-05-20 23:14 - 04610048 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2016-06-27 16:04 - 2016-05-20 23:12 - 00230400 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll
2016-06-27 16:04 - 2016-05-20 23:11 - 15420928 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2016-06-27 16:04 - 2016-05-20 23:11 - 00262144 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll
2016-06-27 16:04 - 2016-05-20 23:09 - 00725504 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2016-06-27 16:04 - 2016-05-20 23:09 - 00693248 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2016-06-27 16:04 - 2016-05-20 23:08 - 02055680 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2016-06-27 16:04 - 2016-05-20 23:08 - 00806400 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2016-06-27 16:04 - 2016-05-20 23:07 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2016-06-27 16:04 - 2016-05-20 23:07 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2016-06-27 16:04 - 2016-05-20 23:06 - 02131968 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2016-06-27 16:04 - 2016-05-20 22:46 - 02597888 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2016-06-27 16:04 - 2016-05-20 22:42 - 02121216 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2016-06-27 16:04 - 2016-05-20 22:38 - 01310208 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2016-06-27 16:04 - 2016-05-20 22:38 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2016-06-27 16:04 - 2016-05-20 22:34 - 01544192 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2016-06-27 16:04 - 2016-05-20 22:23 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2016-06-27 15:53 - 2016-06-30 20:54 - 00000000 ____D C:\Users\MEmroi\Desktop\Test
2016-06-27 15:13 - 2016-06-27 15:13 - 00000000 ____D C:\windows\System32\Tasks\Norton Internet Security
2016-06-27 15:06 - 2016-06-27 15:06 - 00003234 _____ C:\windows\System32\Tasks\Norton WSC Integration
2016-06-27 15:06 - 2016-06-27 15:06 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Internet Security
2016-06-27 14:31 - 2016-06-27 14:54 - 00000000 ____D C:\windows\pss
2016-06-27 14:30 - 2016-06-27 16:22 - 00000109 _____ C:\Users\MEmroi\Desktop\todo.txt
2016-06-12 17:10 - 2016-06-12 17:11 - 00000000 ____D C:\Program Files\Microsoft Security Client
2016-06-12 17:10 - 2016-06-12 17:10 - 00002119 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2016-06-12 17:10 - 2016-06-12 17:10 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2016-06-12 17:05 - 2016-06-12 17:11 - 00001912 _____ C:\windows\epplauncher.mif
2016-06-12 16:51 - 2016-06-12 16:52 - 00081278 _____ C:\windows\ntbtlog.txt
2016-06-12 09:52 - 2016-06-12 09:52 - 01078896 ____R C:\Users\MEmroi\Desktop\BoardingPassWAGNERGERLINDE.pdf.crypz
2016-06-12 09:44 - 2016-06-12 09:44 - 01127162 ____R C:\Users\MEmroi\Desktop\BoardingPassEmroiSILKE.pdf.crypz
2016-06-06 21:04 - 2016-06-06 21:27 - 00524995 ____R C:\Users\MEmroi\Desktop\Bild_FamEmroi_Traktor_sepia.jpg.crypz
2016-06-06 21:03 - 2016-06-06 21:25 - 01358425 ____R C:\Users\MEmroi\Desktop\Bild_Juliane+Daniel_Traktor_sepia.jpg.crypz
2016-06-06 20:51 - 2016-06-06 20:51 - 01426406 ____R C:\Users\MEmroi\Desktop\Bild_Juliane+Daniel_Traktor.jpg.crypz
2016-06-02 17:22 - 2016-06-30 20:48 - 00000000 ____D C:\Users\MEmroi\Desktop\Reini
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-06-30 20:52 - 2013-05-01 11:40 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-06-30 20:47 - 2012-06-29 13:10 - 00000000 ____D C:\ProgramData\Temp
2016-06-30 20:38 - 2015-05-25 14:38 - 00000911 _____ C:\windows\Tasks\EPSON XP-520 Series Update {D51EDB2A-D3B9-41AC-A8C8-FD1D1F045EF9}.job
2016-06-30 20:32 - 2016-05-23 20:22 - 00000000 ____D C:\Users\MEmroi\Desktop\Michaela 40
2016-06-30 20:29 - 2013-05-01 11:40 - 00001106 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-06-30 20:28 - 2009-07-14 06:45 - 00024400 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-06-30 20:28 - 2009-07-14 06:45 - 00024400 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-06-30 20:24 - 2009-07-14 05:20 - 00000000 ____D C:\windows\rescache
2016-06-28 03:30 - 2013-06-20 13:02 - 00000000 ___RD C:\Users\MEmroi\Google Drive
2016-06-28 03:28 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2016-06-28 03:28 - 2009-07-14 06:45 - 00409864 _____ C:\windows\system32\FNTCACHE.DAT
2016-06-28 03:27 - 2016-02-25 22:54 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2016-06-28 03:27 - 2016-02-25 22:54 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2016-06-28 03:25 - 2015-04-15 09:04 - 00000000 ____D C:\windows\system32\appraiser
2016-06-28 03:09 - 2013-08-18 03:01 - 00000000 ____D C:\windows\system32\MRT
2016-06-28 03:07 - 2012-11-02 17:20 - 142482544 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2016-06-28 03:06 - 2016-02-25 22:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2016-06-27 15:53 - 2012-06-29 12:49 - 00661764 _____ C:\windows\system32\perfh007.dat
2016-06-27 15:53 - 2012-06-29 12:49 - 00141776 _____ C:\windows\system32\perfc007.dat
2016-06-27 15:53 - 2009-07-14 07:13 - 01529844 _____ C:\windows\system32\PerfStringBackup.INI
2016-06-27 15:53 - 2009-07-14 05:20 - 00000000 ____D C:\windows\inf
2016-06-27 15:19 - 2015-08-03 10:29 - 00000000 ____D C:\windows\System32\Tasks\Remediation
2016-06-27 15:06 - 2012-11-02 10:49 - 00002369 _____ C:\Users\Public\Desktop\Norton Internet Security.lnk
2016-06-27 15:06 - 2012-06-29 13:25 - 00000000 ____D C:\windows\system32\Drivers\NISx64
2016-06-27 14:54 - 2016-04-25 13:10 - 00000000 ____D C:\Users\MEmroi\Desktop\Bilderbestellung
2016-06-27 14:54 - 2016-02-15 13:58 - 00000000 ____D C:\Users\MEmroi\Desktop\Essensplan
2016-06-27 14:54 - 2015-09-02 21:19 - 00000000 ____D C:\Users\MEmroi\Desktop\Silke
2016-06-27 14:54 - 2015-04-10 21:30 - 00000000 ____D C:\Users\MEmroi\Desktop\Annika
2016-06-27 14:54 - 2015-03-05 21:31 - 00000000 ____D C:\Users\MEmroi\Desktop\Haus & Garten
2016-06-27 14:54 - 2014-05-29 13:40 - 00000000 ____D C:\Users\MEmroi\Documents\Silke
2016-06-27 14:54 - 2013-04-20 23:51 - 00000000 ____D C:\Users\MEmroi\Desktop\Sebastian
2016-06-27 14:54 - 2013-04-06 11:24 - 00000000 ____D C:\Users\MEmroi\Downloads\Hotel
2016-06-27 14:54 - 2013-01-21 21:15 - 00000000 ___HD C:\Users\MEmroi\Desktop\[Originaldateien]
2016-06-27 14:54 - 2012-11-09 21:51 - 00000000 ____D C:\Users\MEmroi\Documents\Symantec
2016-06-27 14:54 - 2012-11-04 15:41 - 00000000 ____D C:\Users\MEmroi\Documents\Eigene Scans
2016-06-27 14:31 - 2012-06-29 13:25 - 00000000 ____D C:\ProgramData\Norton
2016-06-27 14:30 - 2012-06-29 13:26 - 00101112 _____ (Symantec Corporation) C:\windows\system32\Drivers\SYMEVENT64x86.SYS
2016-06-27 14:30 - 2012-06-29 13:26 - 00008270 _____ C:\windows\system32\Drivers\SYMEVENT64x86.CAT
2016-06-27 14:28 - 2013-05-11 17:43 - 00000000 ____D C:\Users\Public\Downloads\Norton
2016-06-27 14:23 - 2012-11-02 11:08 - 00000000 ____D C:\e16e42fe9f9fdd8cd9ef
2016-06-27 14:23 - 2011-02-11 18:32 - 00000000 __RHD C:\SYSTEM.SAV
2016-06-27 14:23 - 2011-02-11 18:32 - 00000000 ____D C:\SWSETUP
2016-06-15 22:40 - 2010-11-21 05:27 - 00484008 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2016-06-12 23:27 - 2012-11-04 15:27 - 00000000 ____D C:\Users\MEmroi\AppData\Local\CrashDumps
2016-06-12 22:00 - 2013-04-23 20:57 - 00000000 ____D C:\windows\KJ
2016-06-12 10:16 - 2014-07-04 15:40 - 00000000 ____D C:\Users\MEmroi\Documents\WISO Mein Geld
2016-06-12 10:03 - 2012-12-02 14:14 - 00000000 ____D C:\Users\MEmroi\Documents\Outlook-Dateien
2016-06-07 14:12 - 2016-05-29 20:37 - 00013169 ____R C:\Users\MEmroi\Desktop\PACKLISTE MALLORCA.xlsx.crypz
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2013-01-21 16:01 - 2016-05-23 22:21 - 0014848 _____ () C:\Users\MEmroi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-11-02 11:05 - 2013-09-08 13:12 - 0005439 _____ () C:\ProgramData\hpzinstall.log
2014-05-21 21:24 - 2014-05-25 14:32 - 0000000 _____ () C:\ProgramData\LauncherAccess.dt
==================== Bamital & volsnap =================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\windows\system32\winlogon.exe => Datei ist digital signiert
C:\windows\system32\wininit.exe => Datei ist digital signiert
C:\windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\windows\explorer.exe => Datei ist digital signiert
C:\windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\windows\system32\svchost.exe => Datei ist digital signiert
C:\windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\windows\system32\services.exe => Datei ist digital signiert
C:\windows\system32\User32.dll => Datei ist digital signiert
C:\windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\windows\system32\userinit.exe => Datei ist digital signiert
C:\windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\windows\system32\rpcss.dll => Datei ist digital signiert
C:\windows\system32\dnsapi.dll => Datei ist digital signiert
C:\windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\windows\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2016-06-29 23:19
==================== Ende von FRST.txt ============================
Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 29-06-2016
durchgeführt von MEmroi (2016-06-30 21:24:31)
Gestartet von C:\Users\MEmroi\Desktop
Windows 7 Home Premium Service Pack 1 (X64) (2012-10-27 13:00:04)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-1078291597-1949154093-2174115440-500 - Administrator - Disabled)
Gast (S-1-5-21-1078291597-1949154093-2174115440-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1078291597-1949154093-2174115440-1002 - Limited - Enabled)
MEmroi (S-1-5-21-1078291597-1949154093-2174115440-1001 - Administrator - Enabled) => C:\Users\MEmroi
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Norton Internet Security (Enabled - Up to date) {53C7D717-52E2-B95E-FA61-6F32ECC805DB}
AV: Microsoft Security Essentials (Enabled - Up to date) {768124D7-F5F7-6D2F-DDC2-94DFA4017C95}
AS: Microsoft Security Essentials (Enabled - Up to date) {CDE0C533-D3CD-62A1-E772-AFADDF863628}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norton Internet Security (Enabled - Up to date) {E8A636F3-74D8-B6D0-C0D1-5440974F4F66}
FW: Norton Internet Security (Enabled) {6BFC5632-188D-B806-D13E-C607121B42A0}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
ACDSee Pro 4 (HKLM-x32\...\{88D4FE78-6EA6-4DFB-9FC2-8BC316F0C2FD}) (Version: 4.0.237 - ACD Systems International Inc.)
Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.5.502.135 - Adobe Systems Incorporated)
Adobe Flash Player 18 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 18.0.0.209 - Adobe Systems Incorporated)
Adobe Reader XI - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.00 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{FEAA5D71-B0FB-4EF9-729F-8AE42500AF41}) (Version: 8.0.873.0 - Advanced Micro Devices, Inc.)
Apple Application Support (32-Bit) (HKLM-x32\...\{649A1FD9-5892-46AD-8DF0-C4A43FF61CB7}) (Version: 4.1 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{0DE0A178-AC7B-4650-806C-CF226DE03766}) (Version: 4.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{3540181E-340A-4E7A-B409-31663472B2F7}) (Version: 9.1.0.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
BrowserProtect (HKLM-x32\...\{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693}) (Version: - Bit89 Inc) <==== ACHTUNG
BufferChm (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden
Canon Utilities EOS Utility (HKLM-x32\...\EOS Utility) (Version: 2.9.0.0 - Canon Inc.)
Canon Utilities PhotoStitch (HKLM-x32\...\PhotoStitch) (Version: 3.1.18.42 - )
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Destinations (x32 Version: 140.0.0.0 - Hewlett-Packard) Hidden
DirectX for Managed Code Update (Summer 2004) (x32 Version: 9.02.2904 - Microsoft) Hidden
dm-Fotowelt (HKLM-x32\...\dm-Fotowelt) (Version: 6.1.3 - CEWE Stiftung u Co. KGaA)
DocProc (x32 Version: 140.0.185.000 - Hewlett-Packard) Hidden
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 17.2.19144 - Landesfinanzdirektion Thüringen)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - Seiko Epson Corporation)
EPSON XP-520 Series Printer Uninstall (HKLM\...\EPSON XP-520 Series) (Version: - SEIKO EPSON Corporation)
EpsonNet Print (HKLM\...\{DF5200AB-5AE6-4598-846B-8ABC3AE121B1}) (Version: 3.0.2.0 - SEIKO EPSON Corporation)
FileZilla Client 3.7.0.2 (HKLM-x32\...\FileZilla Client) (Version: 3.7.0.2 - FileZilla Project)
Google Drive (HKLM-x32\...\{709316AD-161C-4D5C-9AE7-0B3A822DA271}) (Version: 1.30.2170.0459 - Google, Inc.)
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.30.3 - Google Inc.) Hidden
Hewlett-Packard ACLM.NET v1.1.2.0 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
HP Imaging Device Functions 14.5 (HKLM\...\HP Imaging Device Functions) (Version: 14.5 - HP)
HP Odometer (HKLM-x32\...\{B8AC1A89-FFD1-4F97-8051-E505A160F562}) (Version: 2.10.0000 - Hewlett-Packard)
HP Scanjet G4050 (HKLM\...\{0A9FC1DA-46F7-4305-A4EF-FDCA8D9B1A5A}) (Version: 14.5 - HP)
HP Support Information (HKLM-x32\...\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 11.00.0001 - Hewlett-Packard)
hpg4050 (x32 Version: 140.000.000.000 - Ihr Firmenname) Hidden
HydraVision (x32 Version: 4.2.236.0 - Advanced Micro Devices, Inc.) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.0.1351 - Intel Corporation)
iTunes (HKLM\...\{E690A491-702F-4DEC-9977-C015D1DBB57C}) (Version: 12.3.1.23 - Apple Inc.)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Professional 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.9.218.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50428.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{e6e75766-da0f-4ba2-9788-6ea593ce702d}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Moveslink for Movestick Mini (HKLM-x32\...\{4D036ACA-DFDF-41B2-A680-E0D736F3E947}) (Version: 1.2.40 - Suunto)
Mozilla Firefox 38.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.1 (x86 de)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.1.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Norton Internet Security (HKLM-x32\...\NIS) (Version: 22.7.0.76 - Symantec Corporation)
Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.1.17869 - Symantec Corporation)
opensource (x32 Version: 1.0.14960.3876 - Your Company Name) Hidden
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.6.1 - pdfforge)
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.6207 - CyberLink Corp.)
Power2Go (x32 Version: 6.1.6207 - CyberLink Corp.) Hidden
Ralink 802.11n Wireless LAN Card (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 3.2.12.0 - Ralink)
Recovery Manager (x32 Version: 5.5.0.5119 - CyberLink Corp.) Hidden
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.3.3.12085_7 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.3.3.12085_7 - Samsung Electronics Co., Ltd.) Hidden
Samsung Mobile phone USB driver Drive Software (HKLM\...\Samsung Mobile phone USB driver Drive) (Version: - )
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.9.0 - SAMSUNG Electronics Co., Ltd.)
Scan (x32 Version: 14.0.1.0 - Hewlett-Packard) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Software Updater (HKLM-x32\...\{FA7EE274-7370-43B7-9A45-A39B17CCCDC5}) (Version: 4.3.3 - SEIKO EPSON CORPORATION)
TI USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{355FBD67-5A4F-44DA-86A1-56EEC4C20EC0}) (Version: 1.12.18.0 - Texas Instruments Inc.)
TI USB3 Host Driver (x32 Version: 1.12.18.0 - Texas Instruments Inc.) Hidden
Tinypic 3.18 (HKLM-x32\...\{E3723A04-A894-4036-A78E-282E18F43C0A}_is1) (Version: Tinypic 3.18 - E. Fiedler)
Total Commander 64-bit (Remove or Repair) (HKLM\...\Totalcmd64) (Version: 8.01 - Ghisler Software GmbH)
TSHostedAppLauncher (x32 Version: 5.1.15.0 - Hewlett-Packard) Hidden
VideoBrowser (HKLM-x32\...\{D79DC615-EC9F-4EFA-9482-5911168D8F32}) (Version: 2.07.272 - PIXELA)
WebReg (x32 Version: 140.0.297.017 - Hewlett-Packard) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
WISO Mein Geld 2014 Professional (HKLM-x32\...\WISO Mein Geld 2014 Professional) (Version: - Buhl Data Service GmbH)
WISO Mein Geld 2014 Professional (x32 Version: 16.0.1.0 - Buhl Data Service GmbH) Hidden
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {12FC4FF9-7B70-4E8E-9742-842DAF7AD37F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {25173BAD-AE80-429D-80AC-0581EAB29E86} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\22.7.0.76\SymErr.exe [2016-05-23] (Symantec Corporation)
Task: {29FD5682-D083-447D-B032-DC706A78BE25} - System32\Tasks\EPSON XP-520 Series Update {D51EDB2A-D3B9-41AC-A8C8-FD1D1F045EF9} => C:\windows\system32\spool\DRIVERS\x64\3\E_YTSNPE.EXE [2013-11-22] (SEIKO EPSON CORPORATION)
Task: {2DD1EF97-2BD9-4192-8C6D-F79C41CD6A67} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
Task: {2E00554E-F38D-4F5D-BC96-F49828EA272D} - System32\Tasks\{4A40F400-9FC1-4E56-A9D4-FDC1DD28E72A} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.6.0.110.396/de/abandoninstall?page=tsMain&installinfo=google-toolbar:notoffered;notincluded,google-chrome:notoffered;disabled
Task: {4B843D9F-15C7-473E-8BAB-E273B201086F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {68EAB01E-F3C7-47A5-B624-2A3FFF84E611} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
Task: {7BF535D5-1045-40EB-B5A9-B65337A20757} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFMsgr.exe
Task: {946DEF4B-1EDE-473F-8F51-B9B734B51B8A} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-27] (Apple Inc.)
Task: {99883B5A-C2B3-43A6-9D03-A72EDED1ACF7} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater\HPSFUpdater.exe [2011-06-14] (Hewlett-Packard)
Task: {A2883FB2-7EC3-4E31-935A-D23C4AF25EB0} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\22.7.0.76\SymErr.exe [2016-05-23] (Symantec Corporation)
Task: {CEB31460-73CF-4356-BB91-B1A3415CA158} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\22.7.0.76\WSCStub.exe [2016-06-17] (Symantec Corporation)
Task: {DD93F5F7-9E53-4001-B178-A4685C8E7315} - System32\Tasks\Remediation\AntimalwareMigrationTask => C:\Program Files\Common Files\AV\Norton Internet Security\Upgrade.exe [2016-06-17] (Symantec Corporation)
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\windows\Tasks\EPSON XP-520 Series Update {D51EDB2A-D3B9-41AC-A8C8-FD1D1F045EF9}.job => C:\windows\system32\spool\DRIVERS\x64\3\E_YTSNPE.EXE:/EXE:{D51EDB2A-D3B9-41AC-A8C8-FD1D1F045EF9} /F:UpdateSYSTEMĊSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2015-09-23 16:47 - 2015-09-23 16:47 - 00085800 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-10-13 06:45 - 2015-10-13 06:45 - 01328912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2012-03-19 19:36 - 2012-03-19 19:36 - 00452472 ____N () C:\Program Files (x86)\Hewlett-Packard\Recovery\Protect.dll
2010-01-02 16:42 - 2010-01-02 16:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2012-08-31 10:52 - 2012-08-31 10:52 - 00021432 _____ () C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
2016-06-27 15:07 - 2016-06-27 15:07 - 00115137 _____ () C:\Users\MEmroi\AppData\Local\Temp\fbe2808e-2380-4f14-a1fa-3fa9c3a364e8\CliSecureRT.dll
2013-05-26 17:53 - 2013-05-26 17:53 - 00093696 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll
2009-12-08 16:54 - 2009-12-08 16:54 - 02011648 _____ () C:\Program Files (x86)\Suunto\Moveslink for Movestick Mini\QtCore4.dll
2009-09-29 14:43 - 2009-09-29 14:43 - 07462912 _____ () C:\Program Files (x86)\Suunto\Moveslink for Movestick Mini\QtGui4.dll
2009-09-29 14:31 - 2009-09-29 14:31 - 00337408 _____ () C:\Program Files (x86)\Suunto\Moveslink for Movestick Mini\QtXml4.dll
2009-09-29 14:32 - 2009-09-29 14:32 - 00877056 _____ () C:\Program Files (x86)\Suunto\Moveslink for Movestick Mini\QtNetwork4.dll
2012-06-29 13:10 - 2012-02-10 05:42 - 01087336 _____ () C:\Program Files (x86)\Ralink\Common\RaWLAPI.dll
2012-12-09 18:33 - 2010-07-01 21:27 - 00364544 ____N () C:\Program Files (x86)\Canon Pixela VideoBrowser\pxl_m17n_tool.dll
2016-06-28 03:30 - 2016-06-28 03:30 - 00098816 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32api.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 00110080 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\pywintypes27.dll
2016-06-28 03:30 - 2016-06-28 03:30 - 00364544 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\pythoncom27.dll
2016-06-28 03:30 - 2016-06-28 03:30 - 00320512 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32com.shell.shell.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 00776704 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\_hashlib.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 01176576 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\wx._core_.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00806400 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\wx._gdi_.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00816128 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\wx._windows_.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 01067008 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\wx._controls_.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00733184 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\wx._misc_.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00682496 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\pysqlite2._sqlite.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 00088064 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\_ctypes.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00119808 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32file.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00108544 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32security.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 00007168 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\hashobjs_ext.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00017920 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\thumbnails_ext.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00088064 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\usb_ext.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 00012288 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\common.time34.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00018432 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32event.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00167936 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32gui.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 00046080 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\_socket.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 01208320 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\_ssl.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 00128512 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\_elementtree.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00127488 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\pyexpat.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00038912 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32inet.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 00036864 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\_psutil_windows.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00525208 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\windows._lib_cacheinvalidation.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00011264 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32crypt.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00077312 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\wx._html2.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 00027136 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\_multiprocessing.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 00020480 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\_yappi.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00035840 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32process.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00686080 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\unicodedata.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00078848 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\wx._animate.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00123392 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\wx._wizard.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00024064 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32pipe.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00010240 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\select.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00025600 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32pdh.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00017408 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32profile.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00022528 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32ts.pyd
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
AlternateDataStreams: C:\ProgramData\Temp:21071F2D [140]
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
==================== Hosts Inhalt: ===============================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____N C:\windows\system32\Drivers\etc\hosts
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\MEmroi\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.0.1 - 192.168.0.2
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [{711178F2-CB02-4399-8AE6-E515DF5491DC}] => (Allow) C:\Program Files (x86)\Ralink\Common\RaMediaServer.exe
FirewallRules: [{BA299467-B3FB-4D47-9F02-E22DAD8C5106}] => (Allow) C:\Program Files (x86)\Ralink\Common\RaMediaServer.exe
FirewallRules: [{2886F0B2-6822-4A0C-A47B-60B46116023D}] => (Allow) C:\windows\system32\ezSharedSvcHost.exe
FirewallRules: [{D8D0A7A4-8042-422D-9DE1-4B0306765DAF}] => (Allow) C:\Program Files (x86)\EasyBits For Kids\ezDesktop.exe
FirewallRules: [{5A679B34-8ED8-4DD9-860E-B77131F013B9}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{6F82E790-AC0E-401C-A9BA-FCC6E36D2E1A}] => (Allow) LPort=2869
FirewallRules: [{AD1F6958-00B5-4018-8B50-421E9371CF5F}] => (Allow) LPort=1900
FirewallRules: [{3C78D814-3EF4-4468-BB33-442DF3836289}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{6059852C-72E0-46B9-8D40-F307DB9B2738}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe
FirewallRules: [{A383014E-086F-4A34-8BD5-C83ABD516AB2}] => (Allow) C:\Program Files (x86)\Ralink\Common\RaWiFi.exe
FirewallRules: [{6DD9BBB1-554D-4174-839E-DDB97B1D2EBE}] => (Allow) C:\Program Files (x86)\Ralink\Common\RaWiFi.exe
FirewallRules: [{45CA9F59-F8F6-40BB-92DD-27079B7A186A}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqkygrp.exe
FirewallRules: [{77E5BE83-4657-45C8-B680-94D36C87EB54}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpfccopy.exe
FirewallRules: [{C9E64346-40C2-4C4C-9A23-6DDE5F9DF1F5}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpiscnapp.exe
FirewallRules: [{76F311C1-DBE3-4D14-9947-E70D67B45B19}] => (Allow) C:\Program Files (x86)\HP\hp software update\hpwucli.exe
FirewallRules: [{416F2F70-C941-4448-AC46-7820FAAAF5B7}] => (Allow) C:\Users\MEmroi\AppData\Local\Temp\EpInsNav\DL\3013\Network\EpsonNetSetup\EpsonNetSetup\Data\ENEasyApp.exe
FirewallRules: [{9F5449E9-13DF-43EB-9BCD-5DB9A4035580}] => (Allow) C:\Users\MEmroi\AppData\Local\Temp\EpInsNav\DL\3013\Network\EpsonNetSetup\EpsonNetSetup\Data\ENEasyApp.exe
FirewallRules: [{0109FDA5-9A78-41C3-A6A1-C323D98AE6E3}] => (Allow) C:\Users\MEmroi\AppData\Local\Temp\EpInsNav\DL\3013\Network\EpsonNetSetup\EpsonNetSetup\Data\ENEasyApp.exe
FirewallRules: [{522A3FFA-5FDA-409F-BE72-1C7FC37EB6CE}] => (Allow) C:\Users\MEmroi\AppData\Local\Temp\EpInsNav\DL\3013\Network\EpsonNetSetup\EpsonNetSetup\Data\ENEasyApp.exe
FirewallRules: [{68044D01-5D4C-4FAE-AC05-DEBB599EC6E3}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{249F4ACA-B295-4345-912E-5063A4EFBCEB}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{EEADD94E-F4AA-476D-A529-2FF1034F1F30}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{F184F795-85DB-4DDB-B73B-70B4AD92DC30}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{814D2F67-0195-4661-921F-AC9365CF5CDD}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{0E65461E-9799-47A9-AD7D-627BD40CB666}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{CCFFC58E-7C19-4FB1-BD00-0B9DE2F8695B}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{038F1115-72A9-4266-B250-0F83406E6B35}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{759BF5F2-99E5-4629-AA90-CF199D8FC1AC}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Wiederherstellungspunkte =========================
12-06-2016 17:12:27 Windows Update
27-06-2016 14:07:57 Windows Update
28-06-2016 03:00:51 Windows Update
==================== Fehlerhafte Geräte im Gerätemanager =============
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (06/29/2016 11:23:30 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 31184
Error: (06/29/2016 11:23:30 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 31184
Error: (06/29/2016 11:23:30 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (06/29/2016 11:23:15 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 15584
Error: (06/29/2016 11:23:15 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 15584
Error: (06/29/2016 11:23:15 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (06/29/2016 10:03:31 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 46785
Error: (06/29/2016 10:03:31 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 46785
Error: (06/29/2016 10:03:31 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (06/29/2016 10:03:16 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 31185
Systemfehler:
=============
Error: (06/30/2016 08:36:43 PM) (Source: Schannel) (EventID: 4119) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 20.
Error: (06/30/2016 08:26:52 PM) (Source: DCOM) (EventID: 10016) (User: Emroi)
Description: AnwendungsspezifischLokalAktivierung{D3DCB472-7261-43CE-924B-0704BD730D5F}{D3DCB472-7261-43CE-924B-0704BD730D5F}EmroiMEmroiS-1-5-21-1078291597-1949154093-2174115440-1001LocalHost (unter Verwendung von LRPC)
Error: (06/30/2016 08:26:52 PM) (Source: DCOM) (EventID: 10016) (User: Emroi)
Description: AnwendungsspezifischLokalAktivierung{145B4335-FE2A-4927-A040-7C35AD3180EF}{145B4335-FE2A-4927-A040-7C35AD3180EF}EmroiMEmroiS-1-5-21-1078291597-1949154093-2174115440-1001LocalHost (unter Verwendung von LRPC)
Error: (06/28/2016 03:31:25 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "HP Support Assistant Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2 = Das System kann die angegebene Datei nicht finden.
Error: (06/28/2016 03:29:23 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
StarOpen
Error: (06/28/2016 03:29:22 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Ralink UPnP Media Server erreicht.
Error: (06/28/2016 03:27:43 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\StarOpen.SYS nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (06/27/2016 06:29:21 PM) (Source: DCOM) (EventID: 10016) (User: Emroi)
Description: AnwendungsspezifischLokalAktivierung{D3DCB472-7261-43CE-924B-0704BD730D5F}{D3DCB472-7261-43CE-924B-0704BD730D5F}EmroiMEmroiS-1-5-21-1078291597-1949154093-2174115440-1001LocalHost (unter Verwendung von LRPC)
Error: (06/27/2016 06:29:21 PM) (Source: DCOM) (EventID: 10016) (User: Emroi)
Description: AnwendungsspezifischLokalAktivierung{145B4335-FE2A-4927-A040-7C35AD3180EF}{145B4335-FE2A-4927-A040-7C35AD3180EF}EmroiMEmroiS-1-5-21-1078291597-1949154093-2174115440-1001LocalHost (unter Verwendung von LRPC)
Error: (06/27/2016 04:27:02 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "HP Support Assistant Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2 = Das System kann die angegebene Datei nicht finden.
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Core(TM) i7-3770 CPU @ 3.40GHz
Prozentuale Nutzung des RAM: 36%
Installierter physikalischer RAM: 8148.01 MB
Verfügbarer physikalischer RAM: 5198.3 MB
Summe virtueller Speicher: 16294.21 MB
Verfügbarer virtueller Speicher: 12200.49 MB
==================== Laufwerke ================================
Drive c: (OS) (Fixed) (Total:935.96 GB) (Free:779.71 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]
Drive d: (HP_RECOVERY) (Fixed) (Total:16.74 GB) (Free:2.09 GB) NTFS
Drive l: (Bilder und Videos) (Fixed) (Total:910.09 GB) (Free:692.84 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (Size: 1863 GB) (Disk ID: C55D8423)
Partition: GPT.
==================== Ende von Addition.txt ============================
|
| Themen zu CryptXXX 3.0: Alle Files auf .crypz verschlüsselt |
| beiträge, canon, dateien, dnsapi.dll, eingefangen, entfernt, entschlüsseln, erfolgreich, essen, files, folge, folgendes, fordert, gen, hallo zusammen, logfiles, meinung, microsoft, rechner, sauber, schlüsseln, security, tool, trojaner, wirklich, zusammen, öffnen |
Baum-Darstellung