|
Log-Analyse und Auswertung: Windows 10 Home: Meldung "Bios update" (wie Konsole) Maus / Browserfenster bewegen sich von alleineWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
23.11.2016, 16:52 | #1 |
| Windows 10 Home: Meldung "Bios update" (wie Konsole) Maus / Browserfenster bewegen sich von alleine Hallo, gerne würde ich eure Unterstütung in Anspruch nehmen, um den PC meines Vaters zu kontrollieren und evtl zu bereinigen. Das ungewöhnliche Verhalten hat sich wie folgt dargestellst: Bei erneutem öffnen von Firefox wurde festgestellt, das ein CMD Fenster aufgemacht wurde. Dieses forderte ein "BIOS-Update" und ließ eine Routine durchlaufen. Diese wurde (dummerweise) bestätigt. Nun ist unklar, was passiert ist und ob der rechner mit Schad- / Virensoftware befallen ist. Ist in den Logs etwas zu erkennen und lässt sich da noch etwas machen? Viele Grüße und vielen Dank im Voraus Fabian Flodman FRST.txt Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 20-11-2016 01 durchgeführt von wolfg (Administrator) auf WOLFGANGS-PC (23-11-2016 16:31:55) Gestartet von C:\Users\wolfg\Desktop Geladene Profile: wolfg (Verfügbare Profile: wolfg) Platform: Windows 10 Home Version 1607 (X64) Sprache: Deutsch (Deutschland) Internet Explorer Version 11 (Standard-Browser: FF) Start-Modus: Normal Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Prozesse (Nicht auf der Ausnahmeliste) ================= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.) (ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvscpapisvr.exe (Intel Corporation) C:\Windows\System32\igfxCUIService.exe (Windows (R) Win 7 DDK provider) C:\Windows\System32\AdminService.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\HidMonitorSvc.exe (Lenovo Group Limited) C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe () C:\Program Files\Dolby\Dolby DAX2\DAX2_API\DolbyDAX2API.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Lenovo) C:\Program Files (x86)\Lenovo\CCSDK\CCSDK.exe (Lenovo) C:\Program Files (x86)\Lenovo\GDCAgentSetupRed\GDCAgent.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe (ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\hidfind.exe (Lenovo) C:\Program Files (x86)\Lenovo\CCSDK\WinGather.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_w32.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_x64.exe () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.9.261.0_x64__kzf8qxf38zg5c\SkypeHost.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Microsoft Corporation) C:\Windows\System32\smartscreen.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe () C:\Program Files\Lenovo\LenovoUtility\utility.exe () C:\Program Files\Dolby\Dolby DAX2\DAX2_APP\DolbyDAX2TrayIcon.exe (CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Desktop.exe () C:\Program Files\Realtek\Audio\HDA\FMAPP.exe (Lenovo) C:\Users\wolfg\AppData\Local\Apps\2.0\8ZZ1JY9T.XWW\4KM9MO27.TWO\lsb...tion_2d7b41b05b24775e_0001.0006_589ac911618caaca\LSB.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Lenovo Group Limited) C:\Program Files (x86)\Lenovo\ImController\PluginHost\Lenovo.Modern.ImController.PluginHost.exe (Lenovo Group Limited) C:\Program Files\Lenovo\ImController\PluginHost\Lenovo.Modern.ImController.PluginHost.exe (Lenovo Group Limited) C:\Program Files\Lenovo\ImController\PluginHost\Lenovo.Modern.ImController.PluginHost.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe ==================== Registry (Nicht auf der Ausnahmeliste) ==================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.) HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [703272 2016-08-08] (Alps Electric Co., Ltd.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [16412920 2016-08-03] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1416440 2016-08-03] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg_LENOVO_DOLBYDRAGON] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1416440 2016-08-03] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg_LENOVO_MICPKEY] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1416440 2016-08-03] (Realtek Semiconductor) HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch HKLM\...\Run: [LenovoUtility] => C:\Program Files\Lenovo\LenovoUtility\utility.exe [791848 2015-11-17] () HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [322472 2015-07-22] (Intel Corporation) HKLM\...\Run: [DAX2_APP] => C:\Program Files\Dolby\Dolby DAX2\DAX2_APP\DolbyDAX2TrayIcon.exe [628736 2015-06-16] () HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2397120 2016-06-14] (NVIDIA Corporation) HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111576 2013-08-05] (CyberLink) HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [490760 2013-08-19] (CyberLink Corp.) HKU\S-1-5-21-1992661465-1345991192-209890017-1001\...\Run: [Power2GoExpress8] => C:\Program Files (x86)\CyberLink\Power2Go8\Power2GoExpress8.exe [1713416 2013-08-19] (CyberLink Corp.) Startup: C:\Users\wolfg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2016-08-23] ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE (Microsoft Corporation) ==================== Internet (Nicht auf der Ausnahmeliste) ==================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 Tcpip\..\Interfaces\{9588926d-3869-400d-abec-2d8b2b3262dd}: [DhcpNameServer] 192.168.2.1 Tcpip\..\Interfaces\{99dda4df-771a-4f35-a7eb-cc731d332ec9}: [DhcpNameServer] 192.168.2.1 Internet Explorer: ================== HKU\S-1-5-21-1992661465-1345991192-209890017-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo15.msn.com/?pc=LCTE HKU\S-1-5-21-1992661465-1345991192-209890017-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo15.msn.com/?pc=LCTE HKU\S-1-5-21-1992661465-1345991192-209890017-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://mystart.lenovo.com SearchScopes: HKU\S-1-5-21-1992661465-1345991192-209890017-1001 -> DefaultScope {79FD4F24-CEDF-496C-AB91-4B6DE3F67980} URL = SearchScopes: HKU\S-1-5-21-1992661465-1345991192-209890017-1001 -> {79FD4F24-CEDF-496C-AB91-4B6DE3F67980} URL = BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\root\Office16\OCHelper.dll [2016-10-30] (Microsoft Corporation) BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\root\Office16\GROOVEEX.DLL [2016-10-30] (Microsoft Corporation) BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll [2016-10-30] (Microsoft Corporation) BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\GROOVEEX.DLL [2016-10-30] (Microsoft Corporation) Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2016-10-30] (Microsoft Corporation) Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2016-10-30] (Microsoft Corporation) Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2016-10-30] (Microsoft Corporation) Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2016-10-30] (Microsoft Corporation) Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2016-10-30] (Microsoft Corporation) Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2016-10-30] (Microsoft Corporation) Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2016-10-30] (Microsoft Corporation) Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2016-10-30] (Microsoft Corporation) FireFox: ======== FF DefaultProfile: n0t393ck.default FF ProfilePath: C:\Users\wolfg\AppData\Roaming\Mozilla\Firefox\Profiles\n0t393ck.default [2016-11-23] FF Homepage: Mozilla\Firefox\Profiles\n0t393ck.default -> google.de FF Extension: (Adblock Plus) - C:\Users\wolfg\AppData\Roaming\Mozilla\Firefox\Profiles\n0t393ck.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-10-30] FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_23_0_0_207.dll [2016-11-17] () FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL [2016-10-30] (Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.2.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWoW64\Macromed\Flash\NPSWF32_23_0_0_207.dll [2016-11-17] () FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2016-08-25] (Google) FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-10-30] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL [2016-10-30] (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2016-08-11] (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2016-08-11] (NVIDIA Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-26] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-26] (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-10-01] (Adobe Systems Inc.) ==================== Dienste (Nicht auf der Ausnahmeliste) ==================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) R2 ApHidMonitorService; C:\Program Files\Apoint2K\HidMonitorSvc.exe [88920 2016-08-08] (Alps Electric Co., Ltd.) R2 AtherosSvc; C:\WINDOWS\system32\AdminService.exe [355760 2016-08-08] (Windows (R) Win 7 DDK provider) R2 CCSDK; C:\Program Files (x86)\Lenovo\CCSDK\CCSDK.exe [650680 2015-07-29] (Lenovo) R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [3294912 2016-10-30] (Microsoft Corporation) S3 cplspcon; C:\WINDOWS\system32\IntelCpHDCPSvc.exe [595560 2015-09-04] (Intel Corporation) R2 DAX2API; C:\Program Files\Dolby\Dolby DAX2\DAX2_API\DolbyDAX2API.exe [176640 2015-09-15] () [Datei ist nicht signiert] R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2779136 2016-10-07] (ESET) R2 GDCAgent; C:\Program Files (x86)\Lenovo\GDCAgentSetupRed\GDCAgent.exe [1155512 2015-07-29] (Lenovo) R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1163712 2016-06-14] (NVIDIA Corporation) R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [18856 2015-07-22] (Intel Corporation) R2 igfxCUIService2.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [350312 2015-09-04] (Intel Corporation) R2 ImControllerService; C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe [61256 2016-10-05] (Lenovo Group Limited) R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1879488 2016-06-14] (NVIDIA Corporation) R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [7500048 2016-09-20] (TeamViewer GmbH) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation) ===================== Treiber (Nicht auf der Ausnahmeliste) ====================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) R1 CLVirtualDrive; C:\WINDOWS\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink) R1 eamonm; C:\WINDOWS\System32\DRIVERS\eamonm.sys [263296 2016-08-03] (ESET) R0 edevmon; C:\WINDOWS\System32\DRIVERS\edevmon.sys [199328 2016-06-23] (ESET) S0 eelam; C:\WINDOWS\System32\DRIVERS\eelam.sys [15488 2016-06-23] (ESET) R1 ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [197288 2016-06-23] (ESET) R2 epfwwfpr; C:\WINDOWS\system32\DRIVERS\epfwwfpr.sys [181416 2016-06-23] (ESET) S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] () S3 NETwNe64; C:\WINDOWS\System32\drivers\NETwew01.sys [3354384 2015-07-10] (Intel Corporation) R3 nvlddmkm; C:\WINDOWS\System32\DriverStore\FileRepository\nvlti.inf_amd64_561c3173c020f30d\nvlddmkm.sys [14199352 2016-08-16] (NVIDIA Corporation) S3 Qcamain; C:\WINDOWS\System32\drivers\Qcamainx64.sys [2276352 2015-07-10] (Qualcomm Atheros, Inc.) [Datei ist nicht signiert] R3 Qcamain10x64; C:\WINDOWS\System32\drivers\Qcamain10x64.sys [2336768 2016-07-16] (Qualcomm Atheros, Inc.) R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [886528 2015-07-30] (Realtek ) S3 RTSUER; C:\WINDOWS\system32\Drivers\RtsUer.sys [419584 2016-08-08] (Realsil Semiconductor Corporation) R3 rtsuvc; C:\WINDOWS\system32\DRIVERS\rtsuvc.sys [3059416 2015-06-11] (Realtek Semiconductor Corp.) S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation) S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation) S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation) S3 wsvd; C:\WINDOWS\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink) ==================== NetSvcs (Nicht auf der Ausnahmeliste) =================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) ==================== Ein Monat: Erstellte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2016-11-23 16:31 - 2016-11-23 16:32 - 00016884 _____ C:\Users\wolfg\Desktop\FRST.txt 2016-11-23 16:31 - 2016-11-23 16:31 - 00000000 ____D C:\FRST 2016-11-23 16:30 - 2016-11-23 16:31 - 02412544 _____ (Farbar) C:\Users\wolfg\Desktop\FRST64.exe 2016-11-20 15:17 - 2016-11-20 15:17 - 00000000 ____D C:\Users\wolfg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo 2016-11-20 15:17 - 2016-11-20 15:17 - 00000000 ____D C:\Users\wolfg\AppData\Local\Deployment 2016-11-20 15:17 - 2016-11-20 15:17 - 00000000 ____D C:\Users\wolfg\AppData\Local\Apps\2.0 2016-11-20 15:16 - 2016-11-20 15:17 - 00611400 _____ () C:\Users\wolfg\Downloads\LSBsetup(2).exe 2016-11-19 19:16 - 2016-11-19 19:16 - 00000000 ____D C:\BIOS 2016-11-19 19:03 - 2016-11-19 19:03 - 00002142 _____ C:\Users\Public\Desktop\OneKey Recovery.lnk 2016-11-19 19:03 - 2016-11-19 19:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo 2016-11-19 19:03 - 2012-06-13 17:10 - 00102376 _____ ("CyberLink) C:\WINDOWS\system32\Drivers\wsvd.sys 2016-11-18 18:57 - 2016-11-23 16:29 - 00000000 ____D C:\Users\wolfg\AppData\LocalLow\Mozilla 2016-11-17 10:52 - 2016-11-17 10:52 - 00000000 ____D C:\Program Files\Common Files\DESIGNER 2016-11-17 10:40 - 2016-11-23 16:31 - 00016419 _____ C:\WINDOWS\system32\InstallUtil.InstallLog 2016-11-14 16:07 - 2016-11-14 16:07 - 00000150 _____ C:\WINDOWS\system32\ricdb.ini 2016-11-13 18:43 - 2016-11-13 18:43 - 00021435 _____ C:\Users\wolfg\Downloads\PB_Überweisung_KtoNr0843076856_13-11-2016_1838.pdf 2016-11-09 10:45 - 2016-11-02 13:01 - 00484584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll 2016-11-09 10:45 - 2016-11-02 13:01 - 00315744 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll 2016-11-09 10:45 - 2016-11-02 12:22 - 01570672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll 2016-11-09 10:45 - 2016-11-02 12:22 - 00601712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll 2016-11-09 10:45 - 2016-11-02 12:20 - 00590960 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll 2016-11-09 10:45 - 2016-11-02 12:15 - 01051112 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi 2016-11-09 10:45 - 2016-11-02 12:15 - 00894096 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe 2016-11-09 10:45 - 2016-11-02 12:14 - 07816544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe 2016-11-09 10:45 - 2016-11-02 12:13 - 01883784 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll 2016-11-09 10:45 - 2016-11-02 12:13 - 01354320 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi 2016-11-09 10:45 - 2016-11-02 12:13 - 01173496 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe 2016-11-09 10:45 - 2016-11-02 12:13 - 00773720 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll 2016-11-09 10:45 - 2016-11-02 12:13 - 00423776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifitask.exe 2016-11-09 10:45 - 2016-11-02 12:12 - 02255712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys 2016-11-09 10:45 - 2016-11-02 12:12 - 00376672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys 2016-11-09 10:45 - 2016-11-02 12:12 - 00341344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll 2016-11-09 10:45 - 2016-11-02 12:10 - 02323728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll 2016-11-09 10:45 - 2016-11-02 12:09 - 02257104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2016-11-09 10:45 - 2016-11-02 12:08 - 00602464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupEngine.dll 2016-11-09 10:45 - 2016-11-02 12:08 - 00576408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll 2016-11-09 10:45 - 2016-11-02 12:08 - 00186424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\weretw.dll 2016-11-09 10:45 - 2016-11-02 12:08 - 00111968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupApi.dll 2016-11-09 10:45 - 2016-11-02 12:05 - 20969928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll 2016-11-09 10:45 - 2016-11-02 12:05 - 06657176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll 2016-11-09 10:45 - 2016-11-02 12:05 - 03892352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll 2016-11-09 10:45 - 2016-11-02 12:05 - 00959112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll 2016-11-09 10:45 - 2016-11-02 12:05 - 00951904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll 2016-11-09 10:45 - 2016-11-02 12:05 - 00405856 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll 2016-11-09 10:45 - 2016-11-02 12:04 - 04312248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe 2016-11-09 10:45 - 2016-11-02 12:03 - 02750936 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2016-11-09 10:45 - 2016-11-02 12:03 - 00714592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys 2016-11-09 10:45 - 2016-11-02 12:02 - 00682816 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll 2016-11-09 10:45 - 2016-11-02 12:02 - 00238056 _____ (Microsoft Corporation) C:\WINDOWS\system32\weretw.dll 2016-11-09 10:45 - 2016-11-02 12:01 - 01425000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d9.dll 2016-11-09 10:45 - 2016-11-02 12:01 - 01415744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll 2016-11-09 10:45 - 2016-11-02 12:01 - 01263856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll 2016-11-09 10:45 - 2016-11-02 12:01 - 00545936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe 2016-11-09 10:45 - 2016-11-02 12:01 - 00276832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\input.dll 2016-11-09 10:45 - 2016-11-02 12:01 - 00092512 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll 2016-11-09 10:45 - 2016-11-02 12:00 - 22223968 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll 2016-11-09 10:45 - 2016-11-02 12:00 - 08156080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll 2016-11-09 10:45 - 2016-11-02 12:00 - 04130432 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll 2016-11-09 10:45 - 2016-11-02 12:00 - 01274712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll 2016-11-09 10:45 - 2016-11-02 12:00 - 01061968 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll 2016-11-09 10:45 - 2016-11-02 12:00 - 00534096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll 2016-11-09 10:45 - 2016-11-02 11:59 - 04673304 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe 2016-11-09 10:45 - 2016-11-02 11:56 - 01609920 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d9.dll 2016-11-09 10:45 - 2016-11-02 11:56 - 01572768 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll 2016-11-09 10:45 - 2016-11-02 11:56 - 01418312 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll 2016-11-09 10:45 - 2016-11-02 11:56 - 00628552 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe 2016-11-09 10:45 - 2016-11-02 11:50 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LaunchWinApp.exe 2016-11-09 10:45 - 2016-11-02 11:49 - 00147968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32k.sys 2016-11-09 10:45 - 2016-11-02 11:49 - 00037376 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll 2016-11-09 10:45 - 2016-11-02 11:48 - 00095232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TSpkg.dll 2016-11-09 10:45 - 2016-11-02 11:48 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll 2016-11-09 10:45 - 2016-11-02 11:47 - 00047104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Shell.Search.UriHandler.dll 2016-11-09 10:45 - 2016-11-02 11:46 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininetlui.dll 2016-11-09 10:45 - 2016-11-02 11:45 - 00182784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsensorgroup.dll 2016-11-09 10:45 - 2016-11-02 11:44 - 00180224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe 2016-11-09 10:45 - 2016-11-02 11:44 - 00089088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AuthExt.dll 2016-11-09 10:45 - 2016-11-02 11:43 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll 2016-11-09 10:45 - 2016-11-02 11:43 - 00270336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll 2016-11-09 10:45 - 2016-11-02 11:43 - 00198144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FSClient.dll 2016-11-09 10:45 - 2016-11-02 11:43 - 00126464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll 2016-11-09 10:45 - 2016-11-02 11:42 - 00632832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sud.dll 2016-11-09 10:45 - 2016-11-02 11:42 - 00549376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActionCenterCPL.dll 2016-11-09 10:45 - 2016-11-02 11:42 - 00506880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DevicePairing.dll 2016-11-09 10:45 - 2016-11-02 11:42 - 00306176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll 2016-11-09 10:45 - 2016-11-02 11:42 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgentUserBroker.exe 2016-11-09 10:45 - 2016-11-02 11:41 - 00635904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll 2016-11-09 10:45 - 2016-11-02 11:40 - 00896512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontext.dll 2016-11-09 10:45 - 2016-11-02 11:40 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\indexeddbserver.dll 2016-11-09 10:45 - 2016-11-02 11:39 - 00465920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppBroker.dll 2016-11-09 10:45 - 2016-11-02 11:39 - 00348672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\zipfldr.dll 2016-11-09 10:45 - 2016-11-02 11:39 - 00236544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAnimation.dll 2016-11-09 10:45 - 2016-11-02 11:38 - 22563840 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll 2016-11-09 10:45 - 2016-11-02 11:38 - 00760832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\appwiz.cpl 2016-11-09 10:45 - 2016-11-02 11:37 - 19415040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll 2016-11-09 10:45 - 2016-11-02 11:36 - 19415552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2016-11-09 10:45 - 2016-11-02 11:36 - 07626752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll 2016-11-09 10:45 - 2016-11-02 11:36 - 00063488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ErrorDetailsUpdate.dll 2016-11-09 10:45 - 2016-11-02 11:35 - 00336896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msinfo32.exe 2016-11-09 10:45 - 2016-11-02 11:34 - 00043008 _____ (Microsoft Corporation) C:\WINDOWS\system32\LaunchWinApp.exe 2016-11-09 10:45 - 2016-11-02 11:33 - 12349952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll 2016-11-09 10:45 - 2016-11-02 11:33 - 03307520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll 2016-11-09 10:45 - 2016-11-02 11:32 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\efsext.dll 2016-11-09 10:45 - 2016-11-02 11:31 - 03196416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll 2016-11-09 10:45 - 2016-11-02 11:31 - 01228288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usercpl.dll 2016-11-09 10:45 - 2016-11-02 11:31 - 00226304 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcTok.exe 2016-11-09 10:45 - 2016-11-02 11:31 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\system32\BcastDVRHelper.dll 2016-11-09 10:45 - 2016-11-02 11:31 - 00170496 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppCapture.dll 2016-11-09 10:45 - 2016-11-02 11:31 - 00159232 _____ (Microsoft Corporation) C:\WINDOWS\system32\ACPBackgroundManagerPolicy.dll 2016-11-09 10:45 - 2016-11-02 11:31 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSpkg.dll 2016-11-09 10:45 - 2016-11-02 11:31 - 00097792 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll 2016-11-09 10:45 - 2016-11-02 11:31 - 00090624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll 2016-11-09 10:45 - 2016-11-02 11:30 - 12175360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2016-11-09 10:45 - 2016-11-02 11:30 - 09131008 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll 2016-11-09 10:45 - 2016-11-02 11:30 - 00635904 _____ (Microsoft Corporation) C:\WINDOWS\system32\FlightSettings.dll 2016-11-09 10:45 - 2016-11-02 11:30 - 00567296 _____ (Microsoft Corporation) C:\WINDOWS\system32\DevicePairing.dll 2016-11-09 10:45 - 2016-11-02 11:30 - 00363520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BioFeedback.dll 2016-11-09 10:45 - 2016-11-02 11:30 - 00321536 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll 2016-11-09 10:45 - 2016-11-02 11:30 - 00134144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ErrorDetails.dll 2016-11-09 10:45 - 2016-11-02 11:30 - 00109056 _____ (Microsoft Corporation) C:\WINDOWS\system32\dab.dll 2016-11-09 10:45 - 2016-11-02 11:30 - 00058880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Shell.Search.UriHandler.dll 2016-11-09 10:45 - 2016-11-02 11:29 - 07469056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll 2016-11-09 10:45 - 2016-11-02 11:29 - 03666432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2016-11-09 10:45 - 2016-11-02 11:29 - 01247232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll 2016-11-09 10:45 - 2016-11-02 11:29 - 00884224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll 2016-11-09 10:45 - 2016-11-02 11:29 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BlockedShutdown.dll 2016-11-09 10:45 - 2016-11-02 11:29 - 00336896 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkBindingEngineMigPlugin.dll 2016-11-09 10:45 - 2016-11-02 11:29 - 00314880 _____ (Microsoft Corporation) C:\WINDOWS\system32\FSClient.dll 2016-11-09 10:45 - 2016-11-02 11:29 - 00296960 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsensorgroup.dll 2016-11-09 10:45 - 2016-11-02 11:29 - 00276992 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll 2016-11-09 10:45 - 2016-11-02 11:29 - 00211968 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe 2016-11-09 10:45 - 2016-11-02 11:29 - 00139264 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll 2016-11-09 10:45 - 2016-11-02 11:29 - 00122368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NPSM.dll 2016-11-09 10:45 - 2016-11-02 11:28 - 06044160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll 2016-11-09 10:45 - 2016-11-02 11:28 - 04423680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll 2016-11-09 10:45 - 2016-11-02 11:28 - 00807424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.OnlineId.dll 2016-11-09 10:45 - 2016-11-02 11:28 - 00748544 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll 2016-11-09 10:45 - 2016-11-02 11:28 - 00690176 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll 2016-11-09 10:45 - 2016-11-02 11:28 - 00566784 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActionCenterCPL.dll 2016-11-09 10:45 - 2016-11-02 11:28 - 00432128 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpAXHolder.dll 2016-11-09 10:45 - 2016-11-02 11:28 - 00411136 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCenter.dll 2016-11-09 10:45 - 2016-11-02 11:28 - 00324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll 2016-11-09 10:45 - 2016-11-02 11:28 - 00279552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.HumanInterfaceDevice.dll 2016-11-09 10:45 - 2016-11-02 11:28 - 00274432 _____ (Microsoft Corporation) C:\WINDOWS\system32\ListSvc.dll 2016-11-09 10:45 - 2016-11-02 11:28 - 00252928 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll 2016-11-09 10:45 - 2016-11-02 11:28 - 00240640 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkDesktopSettings.dll 2016-11-09 10:45 - 2016-11-02 11:28 - 00115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\IdCtrls.dll 2016-11-09 10:45 - 2016-11-02 11:28 - 00109568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\chartv.dll 2016-11-09 10:45 - 2016-11-02 11:28 - 00088576 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll 2016-11-09 10:45 - 2016-11-02 11:28 - 00079360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\asycfilt.dll 2016-11-09 10:45 - 2016-11-02 11:27 - 23677952 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2016-11-09 10:45 - 2016-11-02 11:27 - 02458112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\themecpl.dll 2016-11-09 10:45 - 2016-11-02 11:27 - 01388544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Cred.dll 2016-11-09 10:45 - 2016-11-02 11:27 - 00631296 _____ (Microsoft Corporation) C:\WINDOWS\system32\WlanMediaManager.dll 2016-11-09 10:45 - 2016-11-02 11:27 - 00605184 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvr.exe 2016-11-09 10:45 - 2016-11-02 11:27 - 00580608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hgcpl.dll 2016-11-09 10:45 - 2016-11-02 11:27 - 00545792 _____ (Microsoft Corporation) C:\WINDOWS\system32\timedate.cpl 2016-11-09 10:45 - 2016-11-02 11:27 - 00495104 _____ (Microsoft Corporation) C:\WINDOWS\system32\DataSenseHandlers.dll 2016-11-09 10:45 - 2016-11-02 11:27 - 00422400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.dll 2016-11-09 10:45 - 2016-11-02 11:27 - 00261632 _____ (Microsoft Corporation) C:\WINDOWS\system32\indexeddbserver.dll 2016-11-09 10:45 - 2016-11-02 11:26 - 02747392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll 2016-11-09 10:45 - 2016-11-02 11:26 - 02484736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gameux.dll 2016-11-09 10:45 - 2016-11-02 11:26 - 01880576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll 2016-11-09 10:45 - 2016-11-02 11:26 - 01595392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2016-11-09 10:45 - 2016-11-02 11:26 - 01509376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll 2016-11-09 10:45 - 2016-11-02 11:26 - 00912896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comdlg32.dll 2016-11-09 10:45 - 2016-11-02 11:26 - 00798208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll 2016-11-09 10:45 - 2016-11-02 11:26 - 00712192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll 2016-11-09 10:45 - 2016-11-02 11:26 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\ddraw.dll 2016-11-09 10:45 - 2016-11-02 11:26 - 00388608 _____ (Microsoft Corporation) C:\WINDOWS\system32\zipfldr.dll 2016-11-09 10:45 - 2016-11-02 11:26 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\stobject.dll 2016-11-09 10:45 - 2016-11-02 11:26 - 00278016 _____ (Microsoft Corporation) C:\WINDOWS\system32\netplwiz.dll 2016-11-09 10:45 - 2016-11-02 11:26 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll 2016-11-09 10:45 - 2016-11-02 11:25 - 02998272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys 2016-11-09 10:45 - 2016-11-02 11:25 - 02256384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2016-11-09 10:45 - 2016-11-02 11:25 - 01556480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll 2016-11-09 10:45 - 2016-11-02 11:25 - 00956416 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll 2016-11-09 10:45 - 2016-11-02 11:25 - 00772608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntshrui.dll 2016-11-09 10:45 - 2016-11-02 11:25 - 00655872 _____ (Microsoft Corporation) C:\WINDOWS\system32\sud.dll 2016-11-09 10:45 - 2016-11-02 11:25 - 00541696 _____ (Microsoft Corporation) C:\WINDOWS\system32\ipnathlp.dll 2016-11-09 10:45 - 2016-11-02 11:25 - 00496128 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.UserAccountsHandlers.dll 2016-11-09 10:45 - 2016-11-02 11:24 - 03778560 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll 2016-11-09 10:45 - 2016-11-02 11:24 - 00940032 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontext.dll 2016-11-09 10:45 - 2016-11-02 11:23 - 03106304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstsc.exe 2016-11-09 10:45 - 2016-11-02 11:23 - 02356736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVidCtl.dll 2016-11-09 10:45 - 2016-11-02 11:23 - 02104320 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll 2016-11-09 10:45 - 2016-11-02 11:23 - 00199680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GlobCollationHost.dll 2016-11-09 10:45 - 2016-11-02 11:23 - 00101888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bowser.sys 2016-11-09 10:45 - 2016-11-02 11:23 - 00072704 _____ (Microsoft Corporation) C:\WINDOWS\system32\ErrorDetailsUpdate.dll 2016-11-09 10:45 - 2016-11-02 11:22 - 13441024 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll 2016-11-09 10:45 - 2016-11-02 11:22 - 13081600 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2016-11-09 10:45 - 2016-11-02 11:22 - 04749312 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll 2016-11-09 10:45 - 2016-11-02 11:22 - 00369664 _____ (Microsoft Corporation) C:\WINDOWS\system32\msinfo32.exe 2016-11-09 10:45 - 2016-11-02 11:22 - 00337920 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll 2016-11-09 10:45 - 2016-11-02 11:21 - 05111296 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll 2016-11-09 10:45 - 2016-11-02 11:21 - 00942080 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll 2016-11-09 10:45 - 2016-11-02 11:20 - 02273792 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll 2016-11-09 10:45 - 2016-11-02 11:20 - 00167936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ErrorDetails.dll 2016-11-09 10:45 - 2016-11-02 11:19 - 08127488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll 2016-11-09 10:45 - 2016-11-02 11:19 - 08075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll 2016-11-09 10:45 - 2016-11-02 11:19 - 01586176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll 2016-11-09 10:45 - 2016-11-02 11:19 - 00981504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.OnlineId.dll 2016-11-09 10:45 - 2016-11-02 11:19 - 00805888 _____ (Microsoft Corporation) C:\WINDOWS\system32\FrameServer.dll 2016-11-09 10:45 - 2016-11-02 11:19 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\NPSM.dll 2016-11-09 10:45 - 2016-11-02 11:19 - 00130560 _____ (Microsoft Corporation) C:\WINDOWS\system32\chartv.dll 2016-11-09 10:45 - 2016-11-02 11:19 - 00089088 _____ (Microsoft Corporation) C:\WINDOWS\system32\asycfilt.dll 2016-11-09 10:45 - 2016-11-02 11:18 - 01690112 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll 2016-11-09 10:45 - 2016-11-02 11:18 - 00991232 _____ (Microsoft Corporation) C:\WINDOWS\system32\comdlg32.dll 2016-11-09 10:45 - 2016-11-02 11:18 - 00836608 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcRefreshTask.dll 2016-11-09 10:45 - 2016-11-02 11:18 - 00243712 _____ (Microsoft Corporation) C:\WINDOWS\system32\shdocvw.dll 2016-11-09 10:45 - 2016-11-02 11:17 - 04746752 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2016-11-09 10:45 - 2016-11-02 11:17 - 01282048 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll 2016-11-09 10:45 - 2016-11-02 11:17 - 00982528 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll 2016-11-09 10:45 - 2016-11-02 11:17 - 00909824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll 2016-11-09 10:45 - 2016-11-02 11:17 - 00828416 _____ (Microsoft Corporation) C:\WINDOWS\system32\appwiz.cpl 2016-11-09 10:45 - 2016-11-02 11:17 - 00389632 _____ (Microsoft Corporation) C:\WINDOWS\system32\stobject.dll 2016-11-09 10:45 - 2016-11-02 11:16 - 03400192 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncCenter.dll 2016-11-09 10:45 - 2016-11-02 11:16 - 03133440 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll 2016-11-09 10:45 - 2016-11-02 11:16 - 02688512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll 2016-11-09 10:45 - 2016-11-02 11:16 - 02669056 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2016-11-09 10:45 - 2016-11-02 11:16 - 02512384 _____ (Microsoft Corporation) C:\WINDOWS\system32\themecpl.dll 2016-11-09 10:45 - 2016-11-02 11:16 - 01779712 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2016-11-09 10:45 - 2016-11-02 11:16 - 01637888 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll 2016-11-09 10:45 - 2016-11-02 11:16 - 01490944 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll 2016-11-09 10:45 - 2016-11-02 11:16 - 01359360 _____ (Microsoft Corporation) C:\WINDOWS\system32\usercpl.dll 2016-11-09 10:45 - 2016-11-02 11:16 - 00881664 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll 2016-11-09 10:45 - 2016-11-02 11:16 - 00770560 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll 2016-11-09 10:45 - 2016-11-02 11:16 - 00629248 _____ (Microsoft Corporation) C:\WINDOWS\system32\hgcpl.dll 2016-11-09 10:45 - 2016-11-02 11:16 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppBroker.dll 2016-11-09 10:45 - 2016-11-02 11:16 - 00308736 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActionCenter.dll 2016-11-09 10:45 - 2016-11-02 11:15 - 04708864 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll 2016-11-09 10:45 - 2016-11-02 11:15 - 03616768 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys 2016-11-09 10:45 - 2016-11-02 11:15 - 02611200 _____ (Microsoft Corporation) C:\WINDOWS\system32\gameux.dll 2016-11-09 10:45 - 2016-11-02 11:15 - 01513472 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys 2016-11-09 10:45 - 2016-11-02 11:15 - 01348608 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll 2016-11-09 10:45 - 2016-11-02 11:15 - 00842240 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntshrui.dll 2016-11-09 10:45 - 2016-11-02 11:15 - 00483328 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.dll 2016-11-09 10:45 - 2016-11-02 11:14 - 01726976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll 2016-11-09 10:45 - 2016-11-02 11:13 - 03496960 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVidCtl.dll 2016-11-09 10:45 - 2016-11-02 11:13 - 03299840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstsc.exe 2016-11-09 10:45 - 2016-11-02 11:13 - 00322048 _____ (Microsoft Corporation) C:\WINDOWS\system32\GlobCollationHost.dll 2016-11-09 10:45 - 2016-11-02 09:20 - 00446896 _____ C:\WINDOWS\system32\ApnDatabase.xml 2016-11-09 10:45 - 2016-08-02 05:30 - 00822784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll 2016-11-09 10:44 - 2016-11-02 12:20 - 00378720 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll 2016-11-09 10:44 - 2016-11-02 12:04 - 02678056 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll 2016-11-09 10:44 - 2016-11-02 12:04 - 00596832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comctl32.dll 2016-11-09 10:44 - 2016-11-02 12:02 - 00848736 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupEngine.dll 2016-11-09 10:44 - 2016-11-02 12:02 - 00148832 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupApi.dll 2016-11-09 10:44 - 2016-11-02 11:56 - 00322912 _____ (Microsoft Corporation) C:\WINDOWS\system32\input.dll 2016-11-09 10:44 - 2016-11-02 11:55 - 00048992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\iorate.sys 2016-11-09 10:44 - 2016-11-02 11:48 - 00032768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\efsext.dll 2016-11-09 10:44 - 2016-11-02 11:47 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BlockedShutdown.dll 2016-11-09 10:44 - 2016-11-02 11:47 - 00156672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BcastDVRHelper.dll 2016-11-09 10:44 - 2016-11-02 11:46 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppCapture.dll 2016-11-09 10:44 - 2016-11-02 11:45 - 00492032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcastdvr.exe 2016-11-09 10:44 - 2016-11-02 11:45 - 00253952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BioFeedback.dll 2016-11-09 10:44 - 2016-11-02 11:44 - 00231936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll 2016-11-09 10:44 - 2016-11-02 11:43 - 00731136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d8.dll 2016-11-09 10:44 - 2016-11-02 11:42 - 00866816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Cred.dll 2016-11-09 10:44 - 2016-11-02 11:42 - 00202752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.HumanInterfaceDevice.dll 2016-11-09 10:44 - 2016-11-02 11:40 - 00548352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ddraw.dll 2016-11-09 10:44 - 2016-11-02 11:34 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\system32\microsoft-windows-system-events.dll 2016-11-09 10:44 - 2016-11-02 11:33 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys 2016-11-09 10:44 - 2016-11-02 11:32 - 00045056 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll 2016-11-09 10:44 - 2016-11-02 11:31 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininetlui.dll 2016-11-09 10:44 - 2016-11-02 11:28 - 00321024 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkUXBroker.dll 2016-11-09 10:44 - 2016-11-02 11:28 - 00260608 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgentUserBroker.exe 2016-11-09 10:44 - 2016-11-02 11:26 - 00273920 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAnimation.dll 2016-11-09 10:44 - 2016-11-02 11:16 - 04148736 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll 2016-11-09 10:44 - 2016-11-02 11:16 - 00265728 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupSvc.dll 2016-11-09 10:44 - 2016-11-02 10:11 - 00788624 _____ C:\WINDOWS\SysWOW64\locale.nls 2016-11-09 10:44 - 2016-11-02 10:11 - 00788624 _____ C:\WINDOWS\system32\locale.nls 2016-11-05 19:57 - 2016-11-05 19:57 - 00266912 _____ C:\Users\wolfg\Documents\Fotobuch Yann und Sönke Burgenland 2015.pbf 2016-11-05 19:57 - 2016-11-05 19:57 - 00000000 ____D C:\Users\wolfg\Documents\Fotobuch Yann und Sönke Burgenland 2015-Dateien 2016-11-05 19:34 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx9_33.dll 2016-11-05 19:33 - 2016-11-05 19:33 - 00000000 ____D C:\Users\wolfg\AppData\Local\WhiteWall 2016-11-05 19:32 - 2016-11-05 19:32 - 00001078 _____ C:\Users\Public\Desktop\WhiteWall.lnk 2016-11-05 19:32 - 2016-11-05 19:32 - 00000000 ____D C:\ProgramData\WhiteWall 2016-11-05 19:32 - 2016-11-05 19:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WhiteWall 2016-11-05 19:32 - 2016-11-05 19:32 - 00000000 ____D C:\Program Files (x86)\WhiteWall 2016-10-31 15:21 - 2016-11-05 19:32 - 100201664 _____ ( ) C:\Users\wolfg\Downloads\WhiteWall_Installer.exe 2016-10-28 19:52 - 2016-10-15 05:48 - 00498952 _____ (Microsoft Corporation) C:\WINDOWS\system32\DolbyDecMFT.dll 2016-10-28 19:52 - 2016-10-15 05:26 - 01990648 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll 2016-10-28 19:52 - 2016-10-15 05:26 - 01472536 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll 2016-10-28 19:52 - 2016-10-15 05:15 - 01557808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll 2016-10-28 19:52 - 2016-10-15 04:53 - 00147456 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll 2016-10-28 19:52 - 2016-10-15 04:52 - 06285312 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll 2016-10-28 19:52 - 2016-10-15 04:50 - 00509440 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_Bluetooth.dll 2016-10-28 19:52 - 2016-08-27 06:12 - 00244816 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll 2016-10-28 19:51 - 2016-10-15 05:51 - 02186896 _____ (Microsoft Corporation) C:\WINDOWS\system32\hevcdecoder.dll 2016-10-28 19:51 - 2016-10-15 05:51 - 01637728 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll 2016-10-28 19:51 - 2016-10-15 05:51 - 01235296 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll 2016-10-28 19:51 - 2016-10-15 05:51 - 00595296 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll 2016-10-28 19:51 - 2016-10-15 05:51 - 00584032 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll 2016-10-28 19:51 - 2016-10-15 05:51 - 00322912 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll 2016-10-28 19:51 - 2016-10-15 05:51 - 00283488 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe 2016-10-28 19:51 - 2016-10-15 05:51 - 00232800 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll 2016-10-28 19:51 - 2016-10-15 05:51 - 00137568 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll 2016-10-28 19:51 - 2016-10-15 05:51 - 00078688 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe 2016-10-28 19:51 - 2016-10-15 05:43 - 01356352 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipUp.exe 2016-10-28 19:51 - 2016-10-15 05:41 - 05622088 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe 2016-10-28 19:51 - 2016-10-15 05:38 - 00500064 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll 2016-10-28 19:51 - 2016-10-15 05:38 - 00409952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS 2016-10-28 19:51 - 2016-10-15 05:37 - 00063328 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dam.sys 2016-10-28 19:51 - 2016-10-15 05:34 - 01969912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hevcdecoder.dll 2016-10-28 19:51 - 2016-10-15 05:33 - 00455040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DolbyDecMFT.dll 2016-10-28 19:51 - 2016-10-15 05:31 - 02827864 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll 2016-10-28 19:51 - 2016-10-15 05:31 - 02190688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys 2016-10-28 19:51 - 2016-10-15 05:31 - 00658272 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys 2016-10-28 19:51 - 2016-10-15 05:31 - 00402272 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys 2016-10-28 19:51 - 2016-10-15 05:30 - 01851696 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll 2016-10-28 19:51 - 2016-10-15 05:30 - 00557408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys 2016-10-28 19:51 - 2016-10-15 05:30 - 00509280 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys 2016-10-28 19:51 - 2016-10-15 05:30 - 00341936 _____ (Microsoft Corporation) C:\WINDOWS\system32\wintrust.dll 2016-10-28 19:51 - 2016-10-15 05:29 - 02913104 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll 2016-10-28 19:51 - 2016-10-15 05:29 - 01267504 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinTypes.dll 2016-10-28 19:51 - 2016-10-15 05:29 - 00908640 _____ (Microsoft Corporation) C:\WINDOWS\system32\drvstore.dll 2016-10-28 19:51 - 2016-10-15 05:29 - 00335712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys 2016-10-28 19:51 - 2016-10-15 05:29 - 00079200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\crashdmp.sys 2016-10-28 19:51 - 2016-10-15 05:26 - 01694712 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmde.dll 2016-10-28 19:51 - 2016-10-15 05:26 - 01600632 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll 2016-10-28 19:51 - 2016-10-15 05:26 - 00811416 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFCaptureEngine.dll 2016-10-28 19:51 - 2016-10-15 05:26 - 00691080 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll 2016-10-28 19:51 - 2016-10-15 05:26 - 00160096 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHostBroker.dll 2016-10-28 19:51 - 2016-10-15 05:25 - 00882680 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeManagerObj.dll 2016-10-28 19:51 - 2016-10-15 05:25 - 00742704 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll 2016-10-28 19:51 - 2016-10-15 05:22 - 01461200 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll 2016-10-28 19:51 - 2016-10-15 05:21 - 02537824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys 2016-10-28 19:51 - 2016-10-15 05:21 - 01100128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\http.sys 2016-10-28 19:51 - 2016-10-15 05:21 - 00584032 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys 2016-10-28 19:51 - 2016-10-15 05:21 - 00292872 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpeffects.dll 2016-10-28 19:51 - 2016-10-15 05:20 - 02276736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll 2016-10-28 19:51 - 2016-10-15 05:19 - 00272720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wintrust.dll 2016-10-28 19:51 - 2016-10-15 05:18 - 02166232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll 2016-10-28 19:51 - 2016-10-15 05:18 - 01556712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll 2016-10-28 19:51 - 2016-10-15 05:18 - 00846560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinTypes.dll 2016-10-28 19:51 - 2016-10-15 05:18 - 00749920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\drvstore.dll 2016-10-28 19:51 - 2016-10-15 05:15 - 01853776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll 2016-10-28 19:51 - 2016-10-15 05:15 - 01123368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfplat.dll 2016-10-28 19:51 - 2016-10-15 05:15 - 00687936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll 2016-10-28 19:51 - 2016-10-15 05:11 - 01435896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll 2016-10-28 19:51 - 2016-10-15 05:10 - 00254656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmpeffects.dll 2016-10-28 19:51 - 2016-10-15 05:06 - 05685760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll 2016-10-28 19:51 - 2016-10-15 05:05 - 07216640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll 2016-10-28 19:51 - 2016-10-15 05:01 - 01631232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll 2016-10-28 19:51 - 2016-10-15 05:00 - 01631232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Resources.dll 2016-10-28 19:51 - 2016-10-15 05:00 - 00323584 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll 2016-10-28 19:51 - 2016-10-15 05:00 - 00048640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll 2016-10-28 19:51 - 2016-10-15 05:00 - 00018432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\stdole2.tlb 2016-10-28 19:51 - 2016-10-15 04:59 - 00272384 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfksproxy.dll 2016-10-28 19:51 - 2016-10-15 04:59 - 00187904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfksproxy.dll 2016-10-28 19:51 - 2016-10-15 04:59 - 00130560 _____ (Microsoft Corporation) C:\WINDOWS\splwow64.exe 2016-10-28 19:51 - 2016-10-15 04:59 - 00018432 _____ (Microsoft Corporation) C:\WINDOWS\system32\stdole2.tlb 2016-10-28 19:51 - 2016-10-15 04:58 - 00258560 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\xboxgip.sys 2016-10-28 19:51 - 2016-10-15 04:57 - 00217600 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpdxm.dll 2016-10-28 19:51 - 2016-10-15 04:57 - 00186880 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe 2016-10-28 19:51 - 2016-10-15 04:57 - 00175104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmpdxm.dll 2016-10-28 19:51 - 2016-10-15 04:57 - 00039424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dtdump.exe 2016-10-28 19:51 - 2016-10-15 04:56 - 00339968 _____ (Microsoft Corporation) C:\WINDOWS\system32\esentutl.exe 2016-10-28 19:51 - 2016-10-15 04:56 - 00327680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll 2016-10-28 19:51 - 2016-10-15 04:56 - 00306688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esentutl.exe 2016-10-28 19:51 - 2016-10-15 04:56 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdd.dll 2016-10-28 19:51 - 2016-10-15 04:56 - 00219648 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSrvPolicyManager.dll 2016-10-28 19:51 - 2016-10-15 04:56 - 00193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.WiFi.dll 2016-10-28 19:51 - 2016-10-15 04:56 - 00120832 _____ (Microsoft Corporation) C:\WINDOWS\system32\BluetoothApis.dll 2016-10-28 19:51 - 2016-10-15 04:56 - 00098816 _____ (Microsoft Corporation) C:\WINDOWS\system32\BthRadioMedia.dll 2016-10-28 19:51 - 2016-10-15 04:56 - 00095232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BluetoothApis.dll 2016-10-28 19:51 - 2016-10-15 04:56 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\system32\HttpsDataSource.dll 2016-10-28 19:51 - 2016-10-15 04:56 - 00065024 _____ (Microsoft Corporation) C:\WINDOWS\system32\OnDemandConnRouteHelper.dll 2016-10-28 19:51 - 2016-10-15 04:55 - 00329216 _____ (Microsoft Corporation) C:\WINDOWS\system32\wc_storage.dll 2016-10-28 19:51 - 2016-10-15 04:55 - 00265728 _____ (Microsoft Corporation) C:\WINDOWS\system32\dhcpcore6.dll 2016-10-28 19:51 - 2016-10-15 04:55 - 00236544 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_Flights.dll 2016-10-28 19:51 - 2016-10-15 04:55 - 00156672 _____ (Microsoft Corporation) C:\WINDOWS\system32\hidclass.sys 2016-10-28 19:51 - 2016-10-15 04:55 - 00156672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidclass.sys 2016-10-28 19:51 - 2016-10-15 04:55 - 00142336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.WiFi.dll 2016-10-28 19:51 - 2016-10-15 04:55 - 00126464 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpshell.dll 2016-10-28 19:51 - 2016-10-15 04:54 - 00717312 _____ (Microsoft Corporation) C:\WINDOWS\system32\taskbarcpl.dll 2016-10-28 19:51 - 2016-10-15 04:54 - 00463872 _____ (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll 2016-10-28 19:51 - 2016-10-15 04:54 - 00410112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SndVolSSO.dll 2016-10-28 19:51 - 2016-10-15 04:54 - 00241152 _____ (Microsoft Corporation) C:\WINDOWS\system32\dafBth.dll 2016-10-28 19:51 - 2016-10-15 04:54 - 00217088 _____ (Microsoft Corporation) C:\WINDOWS\system32\DevicePairingFolder.dll 2016-10-28 19:51 - 2016-10-15 04:54 - 00152064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\autoplay.dll 2016-10-28 19:51 - 2016-10-15 04:54 - 00102912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmpshell.dll 2016-10-28 19:51 - 2016-10-15 04:54 - 00043520 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmTasks.dll 2016-10-28 19:51 - 2016-10-15 04:53 - 00313856 _____ (Microsoft Corporation) C:\WINDOWS\system32\moshostcore.dll 2016-10-28 19:51 - 2016-10-15 04:52 - 00523776 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll 2016-10-28 19:51 - 2016-10-15 04:52 - 00410624 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdpsvc.dll 2016-10-28 19:51 - 2016-10-15 04:52 - 00339456 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdpusersvc.dll 2016-10-28 19:51 - 2016-10-15 04:52 - 00288256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\systemcpl.dll 2016-10-28 19:51 - 2016-10-15 04:52 - 00163328 _____ (Microsoft Corporation) C:\WINDOWS\system32\autoplay.dll 2016-10-28 19:51 - 2016-10-15 04:51 - 13868544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll 2016-10-28 19:51 - 2016-10-15 04:51 - 00429568 _____ (Microsoft Corporation) C:\WINDOWS\system32\SndVolSSO.dll 2016-10-28 19:51 - 2016-10-15 04:51 - 00226304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpcore6.dll 2016-10-28 19:51 - 2016-10-15 04:50 - 17188352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll 2016-10-28 19:51 - 2016-10-15 04:50 - 02716672 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmSvc.dll 2016-10-28 19:51 - 2016-10-15 04:50 - 02333184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmSvc.dll 2016-10-28 19:51 - 2016-10-15 04:50 - 00967168 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthport.sys 2016-10-28 19:51 - 2016-10-15 04:50 - 00438784 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDec.dll 2016-10-28 19:51 - 2016-10-15 04:50 - 00310272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll 2016-10-28 19:51 - 2016-10-15 04:50 - 00090112 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatepolicy.dll 2016-10-28 19:51 - 2016-10-15 04:50 - 00074752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\updatepolicy.dll 2016-10-28 19:51 - 2016-10-15 04:49 - 01913344 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_fs.dll 2016-10-28 19:51 - 2016-10-15 04:49 - 00838144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JpMapControl.dll 2016-10-28 19:51 - 2016-10-15 04:49 - 00187904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscsvc.dll 2016-10-28 19:51 - 2016-10-15 04:49 - 00111616 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAppInstaller.exe 2016-10-28 19:51 - 2016-10-15 04:49 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSManHTTPConfig.exe 2016-10-28 19:51 - 2016-10-15 04:49 - 00032256 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSManHTTPConfig.exe 2016-10-28 19:51 - 2016-10-15 04:48 - 01554944 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_health.dll 2016-10-28 19:51 - 2016-10-15 04:48 - 01323008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_fs.dll 2016-10-28 19:51 - 2016-10-15 04:48 - 01054208 _____ (Microsoft Corporation) C:\WINDOWS\system32\qmgr.dll 2016-10-28 19:51 - 2016-10-15 04:47 - 07792640 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll 2016-10-28 19:51 - 2016-10-15 04:47 - 04612608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll 2016-10-28 19:51 - 2016-10-15 04:47 - 01113600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_health.dll 2016-10-28 19:51 - 2016-10-15 04:47 - 00720896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.BackgroundMediaPlayback.dll 2016-10-28 19:51 - 2016-10-15 04:47 - 00558080 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpnprv.dll 2016-10-28 19:51 - 2016-10-15 04:46 - 03287552 _____ (Microsoft Corporation) C:\WINDOWS\system32\mispace.dll 2016-10-28 19:51 - 2016-10-15 04:46 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Playback.BackgroundMediaPlayer.dll 2016-10-28 19:51 - 2016-10-15 04:46 - 00471552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.BackgroundMediaPlayback.dll 2016-10-28 19:51 - 2016-10-15 04:45 - 01790464 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationFramework.dll 2016-10-28 19:51 - 2016-10-15 04:45 - 00702464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Playback.MediaPlayer.dll 2016-10-28 19:51 - 2016-10-15 04:45 - 00406016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll 2016-10-28 19:51 - 2016-10-15 04:44 - 00747008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RemoteNaturalLanguage.dll 2016-10-28 19:51 - 2016-10-15 04:44 - 00636928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winhttp.dll 2016-10-28 19:51 - 2016-10-15 04:44 - 00470016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Playback.BackgroundMediaPlayer.dll 2016-10-28 19:51 - 2016-10-15 04:44 - 00090112 _____ (Microsoft Corporation) C:\WINDOWS\system32\powercfg.exe 2016-10-28 19:51 - 2016-10-15 04:43 - 02748928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mispace.dll 2016-10-28 19:51 - 2016-10-15 04:43 - 01365504 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpncore.dll 2016-10-28 19:51 - 2016-10-15 04:43 - 00574976 _____ (Microsoft Corporation) C:\WINDOWS\system32\energy.dll 2016-10-28 19:51 - 2016-10-15 04:43 - 00078336 _____ (Microsoft Corporation) C:\WINDOWS\system32\iscsiwmi.dll 2016-10-28 19:51 - 2016-10-15 04:42 - 06108672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll 2016-10-28 19:51 - 2016-10-15 04:42 - 00539136 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll 2016-10-28 19:51 - 2016-10-15 04:42 - 00467968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Geolocation.dll 2016-10-28 19:51 - 2016-10-15 04:42 - 00459776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Playback.MediaPlayer.dll 2016-10-28 19:51 - 2016-10-15 04:42 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\powercfg.exe 2016-10-28 19:51 - 2016-10-15 04:41 - 07654912 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll 2016-10-28 19:51 - 2016-10-15 04:41 - 05376000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll 2016-10-28 19:51 - 2016-10-15 04:41 - 00945664 _____ (Microsoft Corporation) C:\WINDOWS\system32\iphlpsvc.dll 2016-10-28 19:51 - 2016-10-15 04:41 - 00161792 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeHelper.dll 2016-10-28 19:51 - 2016-10-15 04:41 - 00067584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iscsiwmi.dll 2016-10-28 19:51 - 2016-10-15 04:39 - 04474368 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll 2016-10-28 19:51 - 2016-10-15 04:39 - 01060864 _____ (Microsoft Corporation) C:\WINDOWS\system32\JpMapControl.dll 2016-10-28 19:51 - 2016-10-15 04:39 - 01005568 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3D12.dll 2016-10-28 19:51 - 2016-10-15 04:39 - 00869888 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll 2016-10-28 19:51 - 2016-10-15 04:39 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\winhttp.dll 2016-10-28 19:51 - 2016-10-15 04:39 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3D12.dll 2016-10-28 19:51 - 2016-10-15 04:39 - 00631296 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationController.dll 2016-10-28 19:51 - 2016-10-15 04:39 - 00357376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Geolocation.dll 2016-10-28 19:51 - 2016-10-15 04:38 - 01993216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll 2016-10-28 19:51 - 2016-10-15 04:38 - 00913920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.dll 2016-10-28 19:51 - 2016-10-15 04:38 - 00675840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.dll 2016-10-28 19:51 - 2016-10-15 04:37 - 03733504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll 2016-10-28 19:51 - 2016-10-15 04:37 - 01980416 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll 2016-10-28 19:51 - 2016-10-15 04:37 - 01643008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Speech.dll 2016-10-28 19:51 - 2016-10-15 04:37 - 01029632 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll 2016-10-28 19:51 - 2016-10-15 04:37 - 00715264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapControlCore.dll 2016-10-28 19:51 - 2016-10-15 04:37 - 00709120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CPFilters.dll 2016-10-28 19:51 - 2016-10-15 04:37 - 00093184 _____ (Microsoft Corporation) C:\WINDOWS\system32\cmifw.dll 2016-10-28 19:51 - 2016-10-15 04:36 - 02290176 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll 2016-10-28 19:51 - 2016-10-15 04:36 - 01170944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Speech.dll 2016-10-28 19:51 - 2016-10-15 04:36 - 00983040 _____ (Microsoft Corporation) C:\WINDOWS\system32\RemoteNaturalLanguage.dll 2016-10-28 19:51 - 2016-10-15 04:36 - 00792064 _____ (Microsoft Corporation) C:\WINDOWS\system32\spoolsv.exe 2016-10-28 19:51 - 2016-10-15 04:36 - 00673792 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe 2016-10-28 19:51 - 2016-10-15 04:36 - 00542208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.Connectivity.dll 2016-10-28 19:51 - 2016-10-15 04:36 - 00347136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Display.dll 2016-10-28 19:51 - 2016-10-15 04:36 - 00338944 _____ (Microsoft Corporation) C:\WINDOWS\system32\fhcpl.dll 2016-10-28 19:51 - 2016-10-15 04:36 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cmifw.dll 2016-10-28 19:51 - 2016-10-15 04:35 - 03054080 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll 2016-10-28 19:51 - 2016-10-15 04:35 - 02708992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esent.dll 2016-10-28 19:51 - 2016-10-15 04:35 - 02315264 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll 2016-10-28 19:51 - 2016-10-15 04:35 - 02005504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll 2016-10-28 19:51 - 2016-10-15 04:35 - 00905216 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlCore.dll 2016-10-28 19:51 - 2016-10-15 04:35 - 00760832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NMAA.dll 2016-10-28 19:51 - 2016-10-15 04:35 - 00701952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.Connectivity.dll 2016-10-28 19:51 - 2016-10-15 04:35 - 00391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll 2016-10-28 19:51 - 2016-10-15 04:34 - 02476544 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll 2016-10-28 19:51 - 2016-10-15 04:34 - 01840640 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll 2016-10-28 19:51 - 2016-10-15 04:34 - 00936448 _____ (Microsoft Corporation) C:\WINDOWS\system32\NMAA.dll 2016-10-28 19:51 - 2016-10-15 04:32 - 00886784 _____ (Microsoft Corporation) C:\WINDOWS\system32\CPFilters.dll 2016-10-28 19:51 - 2016-10-15 04:31 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys 2016-10-28 19:51 - 2016-09-10 14:21 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\capimg.sys 2016-10-28 19:51 - 2016-08-06 05:17 - 00619368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys 2016-10-28 09:36 - 2016-10-28 09:36 - 01198288 _____ (Adobe Systems Incorporated) C:\Users\wolfg\Downloads\flashplayer23au_d_install(1).exe ==================== Ein Monat: Geänderte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2016-11-23 16:30 - 2016-08-02 17:47 - 00000000 ____D C:\Users\wolfg\AppData\Local\Packages 2016-11-23 16:30 - 2016-07-16 12:47 - 00000000 ___HD C:\Program Files\WindowsApps 2016-11-23 16:30 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\AppReadiness 2016-11-23 16:26 - 2016-09-22 22:50 - 00000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat 2016-11-22 17:11 - 2016-07-16 23:51 - 00789298 _____ C:\WINDOWS\system32\perfh007.dat 2016-11-22 17:11 - 2016-07-16 23:51 - 00170148 _____ C:\WINDOWS\system32\perfc007.dat 2016-11-22 17:11 - 2015-07-16 16:54 - 02004628 _____ C:\WINDOWS\system32\PerfStringBackup.INI 2016-11-22 16:26 - 2016-09-22 22:49 - 00000000 ____D C:\WINDOWS\system32\SleepStudy 2016-11-22 14:52 - 2016-08-02 17:47 - 00000000 __SHD C:\Users\wolfg\IntelGraphicsProfiles 2016-11-22 10:55 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\LiveKernelReports 2016-11-20 15:17 - 2016-09-22 22:58 - 00000000 ____D C:\WINDOWS\System32\Tasks\Lenovo 2016-11-19 19:24 - 2016-09-22 22:58 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT 2016-11-19 19:24 - 2016-09-22 22:51 - 00000000 ____D C:\ProgramData\NVIDIA 2016-11-19 19:19 - 2016-08-03 10:07 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2016-11-19 19:17 - 2016-07-16 07:04 - 00524288 _____ C:\WINDOWS\system32\config\BBI 2016-11-19 19:03 - 2015-11-17 05:31 - 00000000 ____D C:\Users\Public\Documents\Lenovo 2016-11-19 19:03 - 2015-11-17 04:49 - 00000000 ____D C:\Program Files\Lenovo 2016-11-19 19:03 - 2015-11-17 04:49 - 00000000 ____D C:\Program Files (x86)\Lenovo 2016-11-18 18:57 - 2016-08-03 10:07 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2016-11-17 20:43 - 2016-09-22 22:52 - 00000000 ____D C:\Users\wolfg 2016-11-17 15:55 - 2016-08-19 19:46 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2016-11-17 15:55 - 2016-08-03 10:03 - 00000000 ____D C:\Program Files (x86)\TeamViewer 2016-11-17 15:53 - 2016-08-03 12:05 - 00000000 ____D C:\Users\wolfg\AppData\Local\Adobe 2016-11-17 15:53 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed 2016-11-17 15:53 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\Macromed 2016-11-17 10:52 - 2016-07-16 12:47 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft 2016-11-17 10:52 - 2016-07-16 12:47 - 00000000 ____D C:\Program Files\Common Files\microsoft shared 2016-11-17 10:51 - 2016-08-03 12:15 - 00000000 ____D C:\Program Files\Microsoft Office 2016-11-14 20:35 - 2016-07-16 12:45 - 00000000 ____D C:\WINDOWS\INF 2016-11-14 16:07 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\spool 2016-11-10 17:56 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\rescache 2016-11-09 18:35 - 2016-04-27 06:56 - 00000000 __RHD C:\Users\Public\AccountPictures 2016-11-09 17:34 - 2016-09-22 22:49 - 00331592 _____ C:\WINDOWS\system32\FNTCACHE.DAT 2016-11-09 17:33 - 2016-07-16 12:47 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel 2016-11-09 17:33 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns 2016-11-09 17:33 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\oobe 2016-11-09 17:33 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\migwiz 2016-11-09 17:33 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\ShellExperiences 2016-11-09 17:33 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\bcastdvr 2016-11-09 10:51 - 2016-07-16 12:36 - 00000000 ____D C:\WINDOWS\CbsTemp 2016-11-09 10:49 - 2016-08-03 18:09 - 00000000 ____D C:\WINDOWS\system32\MRT 2016-11-09 10:48 - 2016-08-03 18:09 - 141011376 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2016-11-07 19:04 - 2016-08-03 13:08 - 00000000 ____D C:\Users\wolfg\Documents\Mediation 2016-11-07 16:03 - 2016-08-03 12:08 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk 2016-11-07 16:02 - 2016-09-22 22:58 - 00004562 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task 2016-10-31 01:01 - 2016-09-22 22:58 - 00003870 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater 2016-10-29 00:56 - 2016-07-16 12:49 - 00828408 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2016-10-29 00:56 - 2016-07-16 12:49 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2016-10-28 22:31 - 2016-07-16 12:47 - 00015425 _____ C:\WINDOWS\system32\OEMDefaultAssociations.xml 2016-10-28 22:31 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\appraiser ==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ======= 2016-09-22 22:51 - 2016-09-22 22:51 - 0000000 ____H () C:\ProgramData\DP45977C.lfl 2016-09-22 22:51 - 2016-09-22 22:51 - 0000102 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.64.bc ==================== Bamital & volsnap ====================== (Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.) C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert C:\WINDOWS\explorer.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert C:\WINDOWS\system32\services.exe => Datei ist digital signiert C:\WINDOWS\system32\User32.dll => Datei ist digital signiert C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert LastRegBack: 2016-11-17 20:33 ==================== Ende von FRST.txt ============================ Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 20-11-2016 01 durchgeführt von wolfg (23-11-2016 16:32:33) Gestartet von C:\Users\wolfg\Desktop Windows 10 Home Version 1607 (X64) (2016-09-22 21:59:39) Start-Modus: Normal ========================================================== ==================== Konten: ============================= Administrator (S-1-5-21-1992661465-1345991192-209890017-500 - Administrator - Disabled) DefaultAccount (S-1-5-21-1992661465-1345991192-209890017-503 - Limited - Disabled) Gast (S-1-5-21-1992661465-1345991192-209890017-501 - Limited - Disabled) wolfg (S-1-5-21-1992661465-1345991192-209890017-1001 - Administrator - Enabled) => C:\Users\wolfg ==================== Sicherheits-Center ======================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.) AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AV: ESET NOD32 Antivirus 9.0.402.1 (Enabled - Up to date) {EC1D6F37-E411-475A-DF50-12FF7FE4AC70} AS: ESET NOD32 Antivirus 9.0.402.1 (Enabled - Up to date) {577C8ED3-C22B-48D4-E5E0-298D0463E6CD} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installierte Programme ====================== (Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.) Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.020.20042 - Adobe Systems Incorporated) Adobe Flash Player 23 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 23.0.0.207 - Adobe Systems Incorporated) Aiseesoft Blu-ray Player 6.2.80 (HKLM-x32\...\{3E1A13C3-E458-4995-BEA6-4B9BE279D502}_is1) (Version: 6.2.80 - Aiseesoft Studio) ALPS Touch Pad Driver (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 8.201.1611.255 - Alps Electric) Ansel (Version: 372.54 - NVIDIA Corporation) Hidden CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.0.3215 - CyberLink Corp.) Dolby Audio X2 Windows API SDK (HKLM\...\{6A478BF2-F67F-4ABC-A7F1-B6B5BA862371}) (Version: 0.5.2.32 - Dolby Laboratories, Inc.) Dolby Audio X2 Windows APP (HKLM\...\{7DA57EF8-9D20-4126-AF15-D0CC97D0C017}) (Version: 0.4.0.22 - Dolby Laboratories, Inc.) DoNotSpy10 (HKLM-x32\...\{32D066BD-F94C-4948-8FA8-84653EE9617E}_is1) (Version: 1.1.0.0 - pXc-coding.com) ESET NOD32 Antivirus (HKLM\...\{6A816859-EC01-43F5-9EE2-B3B168CC52CB}) (Version: 9.0.386.1 - ESET, spol. s r.o.) Google Earth (HKLM-x32\...\{2C44ABB9-8621-4EF5-AF34-0886DCDA7C21}) (Version: 7.1.7.2600 - Google) Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.0.0.1158 - Intel Corporation) Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.15.4279 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 14.5.2.1088 - Intel Corporation) Intel® Chipsatz-Gerätesoftware (x32 Version: 10.1.1.9 - Intel(R) Corporation) Hidden Lenovo EasyCamera (HKLM-x32\...\{E399A5B3-ED53-4DEA-AF04-8011E1EB1EAC}) (Version: 6.3.9600.11105 - Realtek Semiconductor Corp.) Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 8.1.0.4706 - CyberLink Corp.) Lenovo OneKey Recovery (Version: 8.1.0.4706 - CyberLink Corp.) Hidden Lenovo QuickOptimizer (HKLM\...\{8D2C871B-1B9F-45AC-9C43-2BB18089CDFA}) (Version: 1.0.019.00 - Lenovo) Lenovo Service Bridge (HKU\S-1-5-21-1992661465-1345991192-209890017-1001\...\dda9ca0b023f4c56) (Version: 1.6.4.0 - Lenovo) Lenovo System Interface Foundation (HKLM\...\{C2E5CA37-C862-4A69-AC6D-24F450A20C16}) (Version: 1.0.067.00 - Lenovo) LenovoUtility (HKLM-x32\...\InstallShield_{6ADA7E88-8D16-4D0D-BC90-2B93AC5E56DA}) (Version: 3.0.0.3 - Lenovo) LenovoUtility (x32 Version: 3.0.0.3 - Lenovo) Hidden Metric Collection SDK (x32 Version: 1.1.0012.00 - Lenovo Group Limited) Hidden Metric Collection SDK 35 (x32 Version: 1.2.0010.00 - Lenovo Group Limited) Hidden Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation) Microsoft Office Professional Plus 2016 - de-de (HKLM\...\ProPlusRetail - de-de) (Version: 16.0.7466.2038 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation) Mozilla Firefox 50.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 50.0 (x86 de)) (Version: 50.0 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 50.0.0.6152 - Mozilla) Mozilla Thunderbird 45.4.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 45.4.0 (x86 de)) (Version: 45.4.0 - Mozilla) NVIDIA 3D Vision Treiber 372.54 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 372.54 - NVIDIA Corporation) NVIDIA GeForce Experience 2.11.4.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.11.4.0 - NVIDIA Corporation) NVIDIA Grafiktreiber 372.54 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 372.54 - NVIDIA Corporation) NVIDIA PhysX-Systemsoftware 9.16.0318 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.16.0318 - NVIDIA Corporation) Office 16 Click-to-Run Extensibility Component (Version: 16.0.7466.2038 - Microsoft Corporation) Hidden Office 16 Click-to-Run Licensing Component (Version: 16.0.7466.2038 - Microsoft Corporation) Hidden Office 16 Click-to-Run Localization Component (Version: 16.0.7466.2038 - Microsoft Corporation) Hidden Qualcomm Atheros QCA9377 Bluetooth Suite (64) (HKLM\...\{628988B4-3FA5-4EA6-BAA3-DA640F6718BD}) (Version: 10.0.0.126 - Qualcomm Atheros) Qualcomm Atheros QCA9377 Wireless LAN Installer (HKLM-x32\...\{20CA507E-24AA-4741-87CF-CC1B250790B7}) (Version: 11.0.0.085 - Qualcomm Atheros) Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.1.505.2015 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7624 - Realtek Semiconductor Corp.) TeamViewer 11 (HKLM-x32\...\TeamViewer) (Version: 11.0.66695 - TeamViewer) VLC media player (HKLM\...\VLC media player) (Version: 2.2.4 - VideoLAN) Vulkan Run Time Libraries 1.0.11.1 (HKLM\...\VulkanRT1.0.11.1) (Version: 1.0.11.1 - LunarG, Inc.) WhiteWall 5.3 (HKLM-x32\...\WhiteWall_is1) (Version: - ) WinRAR 5.31 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.31.0 - win.rar GmbH) ==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) ==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) ============= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) Task: {2F0883F7-809C-4959-B7F6-771F900232ED} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe [2016-11-02] (Microsoft Corporation) Task: {4BA09B73-DCA0-44BF-AEFB-5B19065ED0DD} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-08-26] (Google Inc.) Task: {590A18C8-C420-4E1F-9B14-A80452D7AE55} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2015-07-08] (Lenovo) Task: {60CF9133-C274-4E79-8886-91D68562F212} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe [2016-11-02] (Microsoft Corporation) Task: {998E0A01-F315-4244-B9F8-81BF08A621FF} - System32\Tasks\Microsoft\Windows\PLA\LSC Memory => Rundll32.exe C:\Windows\system32\pla.dll,PlaHost "LSC Memory" "$(Arg0)" Task: {A08F9F32-7E73-40E0-A4D8-FFB0D9DFCC31} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-10-30] (Microsoft Corporation) Task: {A1E4EE00-2EAC-4B45-825E-F7AF7210452A} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-10-21] (Adobe Systems Incorporated) Task: {A7899F68-8FDD-41D5-8024-36C4EAC6C36B} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-10-30] (Microsoft Corporation) Task: {AFB53D58-A0D6-4421-8CD5-1C2A9D8CBD47} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-11-17] (Adobe Systems Incorporated) Task: {C726E6E7-3B3A-4235-B2FD-99A05F9AF374} - System32\Tasks\Lenovo\ImController\Plugins\LenovoSystemUpdatePlugin_WeeklyTask => reg.exe add hklm\SOFTWARE\Lenovo\SystemUpdatePlugin\scheduler /v start /t reg_dword /d 1 /f /reg:32 Task: {CA9DF2CB-AA20-4A9C-BD69-B6CC83570C89} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-08-26] (Google Inc.) Task: {DEA76D5B-46EB-4327-A4EF-8784DAC028E2} - System32\Tasks\Lenovo\ImController\Lenovo iM Controller Scheduled Maintenance => Sc.exe START ImControllerService Task: {F5A6699D-6735-4008-823D-2B0D204E3A52} - System32\Tasks\Lenovo\Lenovo Service Bridge\S-1-5-21-1992661465-1345991192-209890017-1001 => Rundll32.exe dfshim.dll,ShOpenVerbShortcut C:\Users\wolfg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo\Lenovo Service Bridge.appref-ms (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.) Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Verknüpfungen ============================= (Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.) ==================== Geladene Module (Nicht auf der Ausnahmeliste) ============== 2015-09-15 00:58 - 2015-09-15 00:58 - 00176640 _____ () C:\Program Files\Dolby\Dolby DAX2\DAX2_API\DolbyDAX2API.exe 2016-07-16 12:42 - 2016-07-16 12:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll 2016-09-30 12:08 - 2016-09-15 18:25 - 02681200 _____ () C:\WINDOWS\System32\CoreUIComponents.dll 2016-09-22 22:51 - 2016-08-11 13:27 - 00134712 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll 2016-09-30 12:08 - 2016-09-15 18:25 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll 2016-09-30 12:08 - 2016-09-15 18:25 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll 2016-09-22 23:02 - 2016-09-22 23:02 - 00959168 _____ () C:\Users\wolfg\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_2\amd64\ClientTelemetry.dll 2016-09-22 23:45 - 2016-09-22 23:45 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll 2016-11-09 10:45 - 2016-11-02 11:30 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll 2016-11-09 10:45 - 2016-11-02 11:21 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll 2016-11-09 10:45 - 2016-11-02 11:15 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll 2016-11-09 10:45 - 2016-11-02 11:14 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll 2016-11-09 10:45 - 2016-11-02 11:16 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll 2016-11-09 10:45 - 2016-11-02 11:17 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll 2016-11-17 21:49 - 2016-11-17 21:51 - 00072192 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.9.261.0_x64__kzf8qxf38zg5c\SkypeHost.exe 2016-11-17 21:49 - 2016-11-17 21:51 - 00178688 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.9.261.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll 2016-11-17 21:49 - 2016-11-17 21:51 - 41609728 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.9.261.0_x64__kzf8qxf38zg5c\SkyWrap.dll 2015-11-17 04:49 - 2015-11-17 04:49 - 00791848 _____ () C:\Program Files\Lenovo\LenovoUtility\utility.exe 2015-11-17 04:49 - 2015-11-17 04:49 - 00097048 _____ () C:\Program Files\Lenovo\LenovoUtility\kbdhook.dll 2015-06-16 02:53 - 2015-06-16 02:53 - 00628736 _____ () C:\Program Files\Dolby\Dolby DAX2\DAX2_APP\DolbyDAX2TrayIcon.exe 2016-08-03 17:34 - 2016-08-03 17:34 - 00142904 _____ () C:\Program Files\Realtek\Audio\HDA\FMAPP.exe 2015-11-17 04:49 - 2015-02-12 16:02 - 00224696 _____ () C:\Program Files (x86)\Lenovo\CCSDK\SDKClient.dll 2016-08-24 09:40 - 2016-06-14 21:03 - 00018880 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll 2016-08-25 15:09 - 2013-08-05 08:49 - 00627672 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll 2013-08-05 14:48 - 2013-08-05 14:48 - 00016856 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll ==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) ========= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.) ==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) =================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver" ==================== Verknüpfungen (Nicht auf der Ausnahmeliste) =============== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.) ==================== Internet Explorer Vertrauenswürdig/Eingeschränkt =============== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.) ==================== Hosts Inhalt: =============================== (Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.) 2015-07-10 12:04 - 2016-08-24 09:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts ==================== Andere Bereiche ============================ (Aktuell gibt es keinen automatisierten Fix für diesen Bereich.) HKU\S-1-5-21-1992661465-1345991192-209890017-1001\Control Panel\Desktop\\Wallpaper -> DNS Servers: 192.168.2.1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) Windows Firewall ist aktiviert. ==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge == HKLM\...\StartupApproved\Run: => "Logitech Download Assistant" HKU\S-1-5-21-1992661465-1345991192-209890017-1001\...\StartupApproved\StartupFolder: => "An OneNote senden.lnk" HKU\S-1-5-21-1992661465-1345991192-209890017-1001\...\StartupApproved\Run: => "OneDrive" HKU\S-1-5-21-1992661465-1345991192-209890017-1001\...\StartupApproved\Run: => "Skype" ==================== Firewall Regeln (Nicht auf der Ausnahmeliste) =============== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139 FirewallRules: [{BE29B3AE-9B88-4DD0-BBED-DA0380C23C0A}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe FirewallRules: [{9F69AC6A-7D13-46D7-955F-9556608F58EA}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe FirewallRules: [{D992A897-4AB8-40E0-9235-86545A885FC4}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe FirewallRules: [{26863C99-8F61-47A1-A358-AFDE931A3BBF}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe FirewallRules: [{4A09C533-D41B-47FA-9B81-07A2079FBA9D}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe FirewallRules: [{C1D6DAD7-EBFE-4E76-A49B-99E686AC52EA}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe FirewallRules: [{62CDE4C0-9371-4A99-93C1-1F9A49986476}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{5802A8FF-8700-47FA-9BA6-1D8719165D34}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{EE7E5E8F-0E09-4EFE-BF5E-669989179BC3}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\outlook.exe FirewallRules: [{77BD0DFC-0C84-4FF1-91FA-CD4BAE827490}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\Lync.exe FirewallRules: [{EF029239-A1EF-43B4-B7FD-BF6B4EC2F295}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\Lync.exe FirewallRules: [{2DC9FBC5-DB62-4A93-BA41-8BB05E396480}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\UcMapi.exe FirewallRules: [{EB66EC8F-9920-44F1-8637-1B20274AA796}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\UcMapi.exe FirewallRules: [{2EBB221C-2E88-46F7-8ED1-A09AB42FFEB2}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe FirewallRules: [{38F524CD-9718-4A32-8A45-3DF1F551D9EC}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe FirewallRules: [{B67C5435-513C-4377-9337-D52C5CDB3B03}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe FirewallRules: [{5701A260-0B0D-48A7-84E0-B8026E76C520}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe ==================== Wiederherstellungspunkte ========================= ACHTUNG: Systemwiederherstellung ist deaktiviert ==================== Fehlerhafte Geräte im Gerätemanager ============= Name: Intel(R) HD Graphics 520 Description: Intel(R) HD Graphics 520 Class Guid: {4d36e968-e325-11ce-bfc1-08002be10318} Manufacturer: Intel Corporation Service: igfx Problem: : Windows has stopped this device because it has reported problems. (Code 43) Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation. ==================== Fehlereinträge in der Ereignisanzeige: ========================= Applikationsfehler: ================== Error: (11/22/2016 05:10:34 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: dwm.exe, Version: 10.0.14393.0, Zeitstempel: 0x578999ab Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0000000000000000 ID des fehlerhaften Prozesses: 0x388 Startzeit der fehlerhaften Anwendung: 0x01d244daf445c4bc Pfad der fehlerhaften Anwendung: C:\WINDOWS\System32\dwm.exe Pfad des fehlerhaften Moduls: unknown Berichtskennung: 16fde23b-3994-42e4-a718-247f635d7aaf Vollständiger Name des fehlerhaften Pakets: Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Error: (11/22/2016 05:10:33 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: dwm.exe, Version: 10.0.14393.0, Zeitstempel: 0x578999ab Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0000000000000000 ID des fehlerhaften Prozesses: 0x1d28 Startzeit der fehlerhaften Anwendung: 0x01d244daf3f4933b Pfad der fehlerhaften Anwendung: C:\WINDOWS\System32\dwm.exe Pfad des fehlerhaften Moduls: unknown Berichtskennung: ffdabdc6-3d1d-4d2a-8bc7-8c91cf8212ed Vollständiger Name des fehlerhaften Pakets: Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Error: (11/22/2016 05:10:33 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: dwm.exe, Version: 10.0.14393.0, Zeitstempel: 0x578999ab Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0000000000000000 ID des fehlerhaften Prozesses: 0x1978 Startzeit der fehlerhaften Anwendung: 0x01d244daf3a969e1 Pfad der fehlerhaften Anwendung: C:\WINDOWS\System32\dwm.exe Pfad des fehlerhaften Moduls: unknown Berichtskennung: 4937b87d-0d3c-4fed-8da4-6b599b0a7352 Vollständiger Name des fehlerhaften Pakets: Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Error: (11/22/2016 05:10:32 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: dwm.exe, Version: 10.0.14393.0, Zeitstempel: 0x578999ab Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0000000000000000 ID des fehlerhaften Prozesses: 0x13fc Startzeit der fehlerhaften Anwendung: 0x01d244daf33ee6ae Pfad der fehlerhaften Anwendung: C:\WINDOWS\System32\dwm.exe Pfad des fehlerhaften Moduls: unknown Berichtskennung: 3cc2a351-57eb-4755-9629-4fec22089a06 Vollständiger Name des fehlerhaften Pakets: Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Error: (11/22/2016 05:10:31 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: dwm.exe, Version: 10.0.14393.0, Zeitstempel: 0x578999ab Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0000000000000000 ID des fehlerhaften Prozesses: 0x1424 Startzeit der fehlerhaften Anwendung: 0x01d244daf2f15fed Pfad der fehlerhaften Anwendung: C:\WINDOWS\System32\dwm.exe Pfad des fehlerhaften Moduls: unknown Berichtskennung: 840bb9ff-3513-46cd-be3a-50ebec2b1a54 Vollständiger Name des fehlerhaften Pakets: Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Error: (11/22/2016 05:10:31 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: dwm.exe, Version: 10.0.14393.0, Zeitstempel: 0x578999ab Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0000000000000000 ID des fehlerhaften Prozesses: 0x1140 Startzeit der fehlerhaften Anwendung: 0x01d244daf2a13187 Pfad der fehlerhaften Anwendung: C:\WINDOWS\System32\dwm.exe Pfad des fehlerhaften Moduls: unknown Berichtskennung: ebfbbc2a-0ab7-49fd-9b99-ca4048bc85b2 Vollständiger Name des fehlerhaften Pakets: Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Error: (11/22/2016 05:10:30 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: dwm.exe, Version: 10.0.14393.0, Zeitstempel: 0x578999ab Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0000000000000000 ID des fehlerhaften Prozesses: 0x2068 Startzeit der fehlerhaften Anwendung: 0x01d244daf2509a75 Pfad der fehlerhaften Anwendung: C:\WINDOWS\System32\dwm.exe Pfad des fehlerhaften Moduls: unknown Berichtskennung: 8494a771-ffb0-4ac2-8292-5903b7214422 Vollständiger Name des fehlerhaften Pakets: Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Error: (11/22/2016 05:10:29 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: dwm.exe, Version: 10.0.14393.0, Zeitstempel: 0x578999ab Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0000000000000000 ID des fehlerhaften Prozesses: 0x2120 Startzeit der fehlerhaften Anwendung: 0x01d244a7e1fff963 Pfad der fehlerhaften Anwendung: C:\WINDOWS\System32\dwm.exe Pfad des fehlerhaften Moduls: unknown Berichtskennung: d0c2d5b0-7cef-44f5-84a9-53f95ba5b6ea Vollständiger Name des fehlerhaften Pakets: Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Error: (11/22/2016 05:09:28 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.14393.0, Zeitstempel: 0x57899082 Name des fehlerhaften Moduls: ntdll.dll, Version: 10.0.14393.447, Zeitstempel: 0x5819be95 Ausnahmecode: 0xc0000409 Fehleroffset: 0x00082420 ID des fehlerhaften Prozesses: 0x7cc Startzeit der fehlerhaften Anwendung: 0x01d244d581cda092 Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE Pfad des fehlerhaften Moduls: C:\WINDOWS\SYSTEM32\ntdll.dll Berichtskennung: 979b4859-a042-4311-bcb8-2434210f8b03 Vollständiger Name des fehlerhaften Pakets: Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Error: (11/22/2016 04:27:18 PM) (Source: Microsoft Office 16) (EventID: 2011) (User: ) Description: Office Subscription licensing exception: Error Code: 0x305; CorrelationId: {ABF5F41B-95D7-45E3-AF0A-A949EE909F7F} Systemfehler: ============= Error: (11/23/2016 04:31:10 PM) (Source: bowser) (EventID: 8003) (User: ) Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX", der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{99DDA4DF-771A-4F35-A7EB-CC731D332EC9}-Transport zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen. Error: (11/23/2016 04:26:23 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT) Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID {8D8F4F83-3594-4F07-8369-FC3C3CAE4919} und der APPID {F72671A9-012C-4725-9D2F-2A4D32D65169} im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden. Error: (11/22/2016 05:07:57 PM) (Source: bowser) (EventID: 8003) (User: ) Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX", der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{99DDA4DF-771A-4F35-A7EB-CC731D332EC9}-Transport zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen. Error: (11/22/2016 04:07:51 PM) (Source: bowser) (EventID: 8003) (User: ) Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX", der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{99DDA4DF-771A-4F35-A7EB-CC731D332EC9}-Transport zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen. Error: (11/22/2016 02:52:44 PM) (Source: bowser) (EventID: 8003) (User: ) Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX", der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{99DDA4DF-771A-4F35-A7EB-CC731D332EC9}-Transport zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen. Error: (11/22/2016 02:52:20 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT) Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID {8D8F4F83-3594-4F07-8369-FC3C3CAE4919} und der APPID {F72671A9-012C-4725-9D2F-2A4D32D65169} im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden. Error: (11/22/2016 10:55:10 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT) Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID {8D8F4F83-3594-4F07-8369-FC3C3CAE4919} und der APPID {F72671A9-012C-4725-9D2F-2A4D32D65169} im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden. Error: (11/21/2016 10:29:56 PM) (Source: bowser) (EventID: 8003) (User: ) Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX", der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{99DDA4DF-771A-4F35-A7EB-CC731D332EC9}-Transport zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen. Error: (11/21/2016 07:44:37 PM) (Source: bowser) (EventID: 8003) (User: ) Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX", der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{99DDA4DF-771A-4F35-A7EB-CC731D332EC9}-Transport zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen. Error: (11/21/2016 04:50:20 PM) (Source: bowser) (EventID: 8003) (User: ) Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX", der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{99DDA4DF-771A-4F35-A7EB-CC731D332EC9}-Transport zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen. ==================== Speicherinformationen =========================== Prozessor: Intel(R) Core(TM) i7-6500U CPU @ 2.50GHz Prozentuale Nutzung des RAM: 37% Installierter physikalischer RAM: 8032.26 MB Verfügbarer physikalischer RAM: 5051.82 MB Summe virtueller Speicher: 9312.26 MB Verfügbarer virtueller Speicher: 6298.92 MB ==================== Laufwerke ================================ Drive c: (Windows) (Fixed) (Total:98.18 GB) (Free:52.81 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)] ==================== MBR & Partitionstabelle ================== ======================================================== Disk: 0 (Size: 119.2 GB) (Disk ID: 9288A75A) Partition: GPT. ==================== Ende von Addition.txt ============================ |
23.11.2016, 21:35 | #2 |
Ruhe in Frieden † 2019 | Windows 10 Home: Meldung "Bios update" (wie Konsole) Maus / Browserfenster bewegen sich von alleineMein Name ist Sandra und ich werde Dir bei Deinem Problem behilflich sein.
Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der schnellere und bei einem Befall durch Malware immer der sicherste Weg. Adware lässt sich in den allermeisten Fällen problemlos entfernen. Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Dir jemand vom Team sagt, dass Du clean bist. Ja, da ist tatsächlich was, was verdächtig aussieht. Schritt 1 Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop
Schritt 2 Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers
__________________ |
23.11.2016, 22:09 | #3 |
| Windows 10 Home: Meldung "Bios update" (wie Konsole) Maus / Browserfenster bewegen sich von alleine Guten Abend Sandra,
__________________vielen Dank, das Du dir die Sache annimmst. TDSSKILLER Code:
ATTFilter 21:53:04.0031 0x13f8 TDSS rootkit removing tool 3.1.0.12 Nov 7 2016 07:10:01 21:53:04.0031 0x13f8 UEFI system 21:53:19.0865 0x13f8 ============================================================ 21:53:19.0865 0x13f8 Current date / time: 2016/11/23 21:53:19.0865 21:53:19.0868 0x13f8 SystemInfo: 21:53:19.0868 0x13f8 21:53:19.0868 0x13f8 OS Version: 10.0.14393 ServicePack: 0.0 21:53:19.0868 0x13f8 Product type: Workstation 21:53:19.0868 0x13f8 ComputerName: WOLFGANGS-PC 21:53:19.0869 0x13f8 UserName: wolfg 21:53:19.0869 0x13f8 Windows directory: C:\WINDOWS 21:53:19.0869 0x13f8 System windows directory: C:\WINDOWS 21:53:19.0869 0x13f8 Running under WOW64 21:53:19.0869 0x13f8 Processor architecture: Intel x64 21:53:19.0869 0x13f8 Number of processors: 4 21:53:19.0869 0x13f8 Page size: 0x1000 21:53:19.0869 0x13f8 Boot type: Normal boot 21:53:19.0869 0x13f8 CodeIntegrityOptions = 0x00000001 21:53:19.0869 0x13f8 ============================================================ 21:53:20.0115 0x13f8 KLMD registered as C:\WINDOWS\system32\drivers\30543711.sys 21:53:20.0115 0x13f8 KLMD ARK init status: drvProperties = 0xFFF00, osBuild = 14393.447, osProperties = 0x19 21:53:20.0335 0x13f8 System UUID: {CCE03DEE-ECE8-1E7C-30B3-273FB5EE491E} 21:53:20.0728 0x13f8 Drive \Device\Harddisk0\DR0 - Size: 0x1DCF856000 ( 119.24 Gb ), SectorSize: 0x200, Cylinders: 0x3CCE, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 21:53:20.0732 0x13f8 ============================================================ 21:53:20.0732 0x13f8 \Device\Harddisk0\DR0: 21:53:20.0732 0x13f8 GPT partitions: 21:53:20.0733 0x13f8 \Device\Harddisk0\DR0\Partition1: GPT, TypeGUID: {C12A7328-F81F-11D2-BA4B-00A0C93EC93B}, UniqueGUID: {DAE1CBE2-D6F8-471E-9E5B-10504F271619}, Name: EFI system partition, StartLBA 0x800, BlocksNum 0x82000 21:53:20.0733 0x13f8 \Device\Harddisk0\DR0\Partition2: GPT, TypeGUID: {E3C9E316-0B5C-4DB8-817D-F92DF00215AE}, UniqueGUID: {653F084D-6213-4E6C-A0F4-84312B9DBB94}, Name: Microsoft reserved partition, StartLBA 0x82800, BlocksNum 0x8000 21:53:20.0733 0x13f8 \Device\Harddisk0\DR0\Partition3: GPT, TypeGUID: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}, UniqueGUID: {0FB83E3F-1FBB-4B9F-9EC2-E76E56954657}, Name: Basic data partition, StartLBA 0x8A800, BlocksNum 0xC45D800 21:53:20.0733 0x13f8 \Device\Harddisk0\DR0\Partition4: GPT, TypeGUID: {DE94BBA4-06D1-4D40-A16A-BFD50179D6AC}, UniqueGUID: {C10C5FD3-BE24-46D1-83AB-B6512C026354}, Name: Basic data partition, StartLBA 0xC4E8000, BlocksNum 0x1F4000 21:53:20.0733 0x13f8 \Device\Harddisk0\DR0\Partition5: GPT, TypeGUID: {DE94BBA4-06D1-4D40-A16A-BFD50179D6AC}, UniqueGUID: {46F62646-500C-4509-8C7E-55D076E3FD05}, Name: Basic data partition, StartLBA 0xC6DC000, BlocksNum 0x25AC000 21:53:20.0733 0x13f8 \Device\Harddisk0\DR0\Partition6: GPT, TypeGUID: {BFBFAFE7-A34F-448A-9A5B-6213EB736C22}, UniqueGUID: {0DF546DE-33A0-42FC-96FD-AE07658B136D}, Name: Basic data partition, StartLBA 0xEC88000, BlocksNum 0x1F4000 21:53:20.0733 0x13f8 MBR partitions: 21:53:20.0733 0x13f8 ============================================================ 21:53:20.0735 0x13f8 C: <-> \Device\Harddisk0\DR0\Partition3 21:53:20.0735 0x13f8 ============================================================ 21:53:20.0735 0x13f8 Initialize success 21:53:20.0735 0x13f8 ============================================================ 21:53:44.0152 0x108c ============================================================ 21:53:44.0152 0x108c Scan started 21:53:44.0152 0x108c Mode: Manual; SigCheck; TDLFS; 21:53:44.0152 0x108c ============================================================ 21:53:44.0152 0x108c KSN ping started 21:53:44.0373 0x108c KSN ping finished: true 21:53:44.0890 0x108c ================ Scan system memory ======================== 21:53:44.0890 0x108c System memory - ok 21:53:44.0891 0x108c ================ Scan services ============================= 21:53:44.0958 0x108c 1394ohci - ok 21:53:44.0961 0x108c 3ware - ok 21:53:44.0965 0x108c ACPI - ok 21:53:44.0969 0x108c AcpiDev - ok 21:53:44.0973 0x108c acpiex - ok 21:53:44.0976 0x108c acpipagr - ok 21:53:44.0980 0x108c AcpiPmi - ok 21:53:44.0983 0x108c acpitime - ok 21:53:44.0987 0x108c [ E13DE7CD2B62254DD4FF658B7798A37D, 9FCCC90DEF6BE83F8C41D4552D235A7BB5534954D2E7CB7B1C336A31FCCAB3AD ] ACPIVPC C:\WINDOWS\System32\drivers\AcpiVpc.sys 21:53:45.0031 0x108c ACPIVPC - ok 21:53:45.0043 0x108c [ C92B0A0957ACAD3CEEF502A2CA10ACB8, 78BF46318B69D9479ECDC83446DD8D454AA2A9A9D94B33C5FC68933DB18AFA3B ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe 21:53:45.0051 0x108c AdobeARMservice - ok 21:53:45.0090 0x108c [ 9BAF21BA600EC4E5FD9A66AD3E4FF5A6, 5E02E5E80557F6EC870EB7CC2DE95169D4225B87A2FE7E796736205F51C15816 ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe 21:53:45.0101 0x108c AdobeFlashPlayerUpdateSvc - ok 21:53:45.0110 0x108c ADP80XX - ok 21:53:45.0118 0x108c AFD - ok 21:53:45.0131 0x108c ahcache - ok 21:53:45.0135 0x108c AJRouter - ok 21:53:45.0138 0x108c ALG - ok 21:53:45.0145 0x108c AmdK8 - ok 21:53:45.0149 0x108c AmdPPM - ok 21:53:45.0152 0x108c amdsata - ok 21:53:45.0156 0x108c amdsbs - ok 21:53:45.0163 0x108c amdxata - ok 21:53:45.0185 0x108c [ A1454210C3B0B8A326F63097300E1593, C295CADCA6F4FA6C447B4B4AD050E606017023CF378ED16A64F6D2E0878B662C ] ApfiltrService C:\WINDOWS\system32\DRIVERS\Apfiltr.sys 21:53:45.0209 0x108c ApfiltrService - ok 21:53:45.0219 0x108c [ 35F56C4ED521AD0D4DD62A87E73FFA5D, DB1C73299B6F21000F41C3C3942899EB110FCB92774690F4372369CF97D7BF4B ] ApHidMonitorService C:\Program Files\Apoint2K\HidMonitorSvc.exe 21:53:45.0227 0x108c ApHidMonitorService - ok 21:53:45.0232 0x108c AppID - ok 21:53:45.0239 0x108c AppIDSvc - ok 21:53:45.0242 0x108c Appinfo - ok 21:53:45.0245 0x108c applockerfltr - ok 21:53:45.0249 0x108c AppReadiness - ok 21:53:45.0260 0x108c AppXSvc - ok 21:53:45.0266 0x108c arcsas - ok 21:53:45.0274 0x108c AsyncMac - ok 21:53:45.0278 0x108c atapi - ok 21:53:45.0292 0x108c [ C345E697B68BE9A45BB6CBD03F1E66F2, F50E0CC874A67A9EED3C792599ADA92C888348E7256663F7C784FBBF51D19EAC ] AtherosSvc C:\WINDOWS\system32\AdminService.exe 21:53:45.0314 0x108c AtherosSvc - ok 21:53:45.0318 0x108c AudioEndpointBuilder - ok 21:53:45.0328 0x108c Audiosrv - ok 21:53:45.0334 0x108c AxInstSV - ok 21:53:45.0340 0x108c b06bdrv - ok 21:53:45.0349 0x108c BasicDisplay - ok 21:53:45.0352 0x108c BasicRender - ok 21:53:45.0357 0x108c bcmfn - ok 21:53:45.0365 0x108c bcmfn2 - ok 21:53:45.0368 0x108c BDESVC - ok 21:53:45.0371 0x108c Beep - ok 21:53:45.0374 0x108c BFE - ok 21:53:45.0384 0x108c BITS - ok 21:53:45.0390 0x108c bowser - ok 21:53:45.0398 0x108c BrokerInfrastructure - ok 21:53:45.0402 0x108c Browser - ok 21:53:45.0421 0x108c [ 7170961E98A4F47175972D7F096AA7C5, 8D060277A7C1371DBA1CAFBFB23632664FFFFD3FA2B512F811A25C1871E5CE7D ] BtFilter C:\WINDOWS\system32\DRIVERS\btfilter.sys 21:53:45.0444 0x108c BtFilter - ok 21:53:45.0452 0x108c BthAvrcpTg - ok 21:53:45.0462 0x108c BthHFEnum - ok 21:53:45.0471 0x108c bthhfhid - ok 21:53:45.0475 0x108c BthHFSrv - ok 21:53:45.0479 0x108c BTHMODEM - ok 21:53:45.0482 0x108c BTHPORT - ok 21:53:45.0491 0x108c bthserv - ok 21:53:45.0498 0x108c BTHUSB - ok 21:53:45.0508 0x108c buttonconverter - ok 21:53:45.0511 0x108c CapImg - ok 21:53:45.0527 0x108c [ 8189001F994864B4C4CAE344494749E3, 19CF815639588CAA5A85FCE76E3780A004350654B7917E9F0DB7B5245E4CF9B7 ] CCSDK C:\Program Files (x86)\Lenovo\CCSDK\CCSDK.exe 21:53:45.0553 0x108c CCSDK - ok 21:53:45.0557 0x108c cdfs - ok 21:53:45.0560 0x108c CDPSvc - ok 21:53:45.0564 0x108c CDPUserSvc - ok 21:53:45.0575 0x108c cdrom - ok 21:53:45.0581 0x108c CertPropSvc - ok 21:53:45.0587 0x108c cht4iscsi - ok 21:53:45.0597 0x108c cht4vbd - ok 21:53:45.0601 0x108c circlass - ok 21:53:45.0605 0x108c CLFS - ok 21:53:45.0685 0x108c [ BDED70145D7F931CAD02BD531BEB38B7, 6B6355482F7FD44ECD958BBFDC9795C8F79A60EB5294349DCB0DBBECE607A5B6 ] ClickToRunSvc C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe 21:53:45.0758 0x108c ClickToRunSvc - ok 21:53:45.0773 0x108c ClipSVC - ok 21:53:45.0779 0x108c clreg - ok 21:53:45.0798 0x108c [ 3E76A1547F2448BCEE3D2F4AE3931AB5, 31B41723FAA4210A86B1AE02D6C052BD8B738C4B89FB0177C1AE997D24BA5B8C ] CLVirtualDrive C:\WINDOWS\system32\DRIVERS\CLVirtualDrive.sys 21:53:45.0806 0x108c CLVirtualDrive - ok 21:53:45.0816 0x108c CmBatt - ok 21:53:45.0822 0x108c CNG - ok 21:53:45.0831 0x108c cnghwassist - ok 21:53:45.0855 0x108c CompositeBus - ok 21:53:45.0862 0x108c COMSysApp - ok 21:53:45.0868 0x108c condrv - ok 21:53:45.0873 0x108c CoreMessagingRegistrar - ok 21:53:45.0917 0x108c [ C6A2B8A2FBEBF4127A8791EEEBDEF034, 105463D877E46E9D077EA0B46A1568CCC93FA210C267C62F3321B8DD09EBC2EE ] cphs C:\WINDOWS\SysWow64\IntelCpHeciSvc.exe 21:53:45.0939 0x108c cphs - ok 21:53:45.0957 0x108c [ 48F40B30772B503CEC6C09F974E18F92, BBB5D752025819B77BB26C305D2C38897C97A6D709AF53A570ACE1C7E47F97DD ] cplspcon C:\WINDOWS\system32\IntelCpHDCPSvc.exe 21:53:45.0980 0x108c cplspcon - ok 21:53:45.0986 0x108c CryptSvc - ok 21:53:45.0989 0x108c dam - ok 21:53:45.0996 0x108c [ 7D59855C30C01839CC6F8C28313B8E28, 9E37AF9CB6DF4A0A785519FA09BD6396C9D8A737A5B8D19E69F65175376D4170 ] DAX2API C:\Program Files\Dolby\Dolby DAX2\DAX2_API\DolbyDAX2API.exe 21:53:46.0013 0x108c DAX2API - detected UnsignedFile.Multi.Generic ( 1 ) 21:53:46.0167 0x108c Detect skipped due to KSN trusted 21:53:46.0168 0x108c DAX2API - ok 21:53:46.0176 0x108c DcomLaunch - ok 21:53:46.0181 0x108c DcpSvc - ok 21:53:46.0188 0x108c defragsvc - ok 21:53:46.0195 0x108c DeviceAssociationService - ok 21:53:46.0201 0x108c DeviceInstall - ok 21:53:46.0210 0x108c DevQueryBroker - ok 21:53:46.0213 0x108c Dfsc - ok 21:53:46.0217 0x108c Dhcp - ok 21:53:46.0221 0x108c diagnosticshub.standardcollector.service - ok 21:53:46.0230 0x108c DiagTrack - ok 21:53:46.0234 0x108c disk - ok 21:53:46.0237 0x108c DmEnrollmentSvc - ok 21:53:46.0246 0x108c dmvsc - ok 21:53:46.0253 0x108c dmwappushservice - ok 21:53:46.0262 0x108c Dnscache - ok 21:53:46.0269 0x108c dot3svc - ok 21:53:46.0272 0x108c DPS - ok 21:53:46.0276 0x108c drmkaud - ok 21:53:46.0287 0x108c DsmSvc - ok 21:53:46.0294 0x108c DsSvc - ok 21:53:46.0303 0x108c DXGKrnl - ok 21:53:46.0312 0x108c [ 107F101A02BB0FBA1140E406895FF570, 7B22AB5D3380F6AADB6F94CAAF2DC737C96FC6F38E62C7D53F9C863451E52F1D ] eamonm C:\WINDOWS\system32\DRIVERS\eamonm.sys 21:53:46.0330 0x108c eamonm - ok 21:53:46.0334 0x108c EapHost - ok 21:53:46.0337 0x108c ebdrv - ok 21:53:46.0345 0x108c [ 4AF1BB78DF0325BA59963FB8FC7A8C73, 20D2FA7A1BFC30329745106AF2E9456C52D2F18CFFE1AD44B75B912F1E3E2DA1 ] edevmon C:\WINDOWS\system32\DRIVERS\edevmon.sys 21:53:46.0358 0x108c edevmon - ok 21:53:46.0362 0x108c [ A6E666A2C13782E7D012202351DE0FFB, 1FC886F68681FC34738A562C2AD0B294DC614AEE5467ECC8AEADA8AE698B1450 ] eelam C:\WINDOWS\system32\DRIVERS\eelam.sys 21:53:46.0379 0x108c eelam - ok 21:53:46.0384 0x108c EFS - ok 21:53:46.0395 0x108c [ 3944E86529A072405EADA8A8D9B27CE8, 7274675754470F922791651665E7C0F3F840CE03B3889002D91C0F5936978594 ] ehdrv C:\WINDOWS\system32\DRIVERS\ehdrv.sys 21:53:46.0410 0x108c ehdrv - ok 21:53:46.0416 0x108c EhStorClass - ok 21:53:46.0426 0x108c EhStorTcgDrv - ok 21:53:46.0482 0x108c [ 3C52420285C0E12061EE1FF76930E3A6, 12C8F7EC91D23A589A3AB1C1F7F7F4E8B6754B392E92D645632DEBB6F881EF5A ] ekrn C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe 21:53:46.0543 0x108c ekrn - ok 21:53:46.0554 0x108c embeddedmode - ok 21:53:46.0557 0x108c EntAppSvc - ok 21:53:46.0564 0x108c [ 9C5A9121C4381755E9924889B1B819E5, 167400770981825BF5C35EB1DF24F14DF3178A04F7EE817353584622D75621E5 ] epfwwfpr C:\WINDOWS\system32\DRIVERS\epfwwfpr.sys 21:53:46.0581 0x108c epfwwfpr - ok 21:53:46.0585 0x108c ErrDev - ok 21:53:46.0592 0x108c EventSystem - ok 21:53:46.0595 0x108c exfat - ok 21:53:46.0599 0x108c fastfat - ok 21:53:46.0606 0x108c Fax - ok 21:53:46.0613 0x108c fdc - ok 21:53:46.0618 0x108c fdPHost - ok 21:53:46.0627 0x108c FDResPub - ok 21:53:46.0630 0x108c fhsvc - ok 21:53:46.0634 0x108c FileCrypt - ok 21:53:46.0637 0x108c FileInfo - ok 21:53:46.0646 0x108c Filetrace - ok 21:53:46.0653 0x108c flpydisk - ok 21:53:46.0661 0x108c FltMgr - ok 21:53:46.0665 0x108c FontCache - ok 21:53:46.0669 0x108c FontCache3.0.0.0 - ok 21:53:46.0672 0x108c FrameServer - ok 21:53:46.0679 0x108c FsDepends - ok 21:53:46.0683 0x108c Fs_Rec - ok 21:53:46.0686 0x108c fvevol - ok 21:53:46.0723 0x108c [ D56EE61F9B62AD677395BF003A49B4A7, A4B657AF38253F4BAE2A8BE7E9453E662BC378773A93631C0445C96267296B53 ] GDCAgent C:\Program Files (x86)\Lenovo\GDCAgentSetupRed\GDCAgent.exe 21:53:46.0752 0x108c GDCAgent - ok 21:53:46.0757 0x108c gencounter - ok 21:53:46.0761 0x108c genericusbfn - ok 21:53:46.0795 0x108c [ F78BC07DCED5EDDD6D477E923620F8EA, ABE28155100A38A5E1B58FFC8099EF416145278B440A67B8DAFD7715FE412624 ] GfExperienceService C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe 21:53:46.0827 0x108c GfExperienceService - ok 21:53:46.0832 0x108c GPIOClx0101 - ok 21:53:46.0835 0x108c gpsvc - ok 21:53:46.0843 0x108c GpuEnergyDrv - ok 21:53:46.0849 0x108c [ A8FD9222E4D72596BB37DA8BE95C0BA4, 52FC3AA9F704300041E486E57FE863218E4CDF4C8EEE05CA6B99A296EFEE5737 ] gupdate C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 21:53:46.0862 0x108c gupdate - ok 21:53:46.0870 0x108c [ A8FD9222E4D72596BB37DA8BE95C0BA4, 52FC3AA9F704300041E486E57FE863218E4CDF4C8EEE05CA6B99A296EFEE5737 ] gupdatem C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 21:53:46.0883 0x108c gupdatem - ok 21:53:46.0887 0x108c HDAudBus - ok 21:53:46.0890 0x108c HidBatt - ok 21:53:46.0900 0x108c HidBth - ok 21:53:46.0906 0x108c hidi2c - ok 21:53:46.0915 0x108c hidinterrupt - ok 21:53:46.0918 0x108c HidIr - ok 21:53:46.0922 0x108c hidserv - ok 21:53:46.0926 0x108c HidUsb - ok 21:53:46.0935 0x108c HomeGroupListener - ok 21:53:46.0942 0x108c HomeGroupProvider - ok 21:53:46.0951 0x108c HpSAMD - ok 21:53:46.0954 0x108c HTTP - ok 21:53:46.0958 0x108c HvHost - ok 21:53:46.0963 0x108c hvservice - ok 21:53:46.0973 0x108c hwpolicy - ok 21:53:46.0979 0x108c hyperkbd - ok 21:53:46.0988 0x108c i8042prt - ok 21:53:46.0992 0x108c iagpio - ok 21:53:46.0995 0x108c iai2c - ok 21:53:46.0999 0x108c iaLPSS2i_GPIO2 - ok 21:53:47.0009 0x108c iaLPSS2i_I2C - ok 21:53:47.0015 0x108c iaLPSSi_GPIO - ok 21:53:47.0024 0x108c iaLPSSi_I2C - ok 21:53:47.0061 0x108c [ 827933B762F90EB4E7690D4484190D77, 7400FA7CB1FDCC3142D9F56156C41427FB394CA32BC8887D17B1FB2DFC962C34 ] iaStorA C:\WINDOWS\system32\drivers\iaStorA.sys 21:53:47.0099 0x108c iaStorA - ok 21:53:47.0107 0x108c iaStorAV - ok 21:53:47.0113 0x108c [ F28CAA094A64E02E8EA9F42C81D4482E, B5908752FFEB9509C52436B520C2D56CDB4E180D84462ECD7FEA9F074D780093 ] IAStorDataMgrSvc C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe 21:53:47.0121 0x108c IAStorDataMgrSvc - ok 21:53:47.0124 0x108c iaStorV - ok 21:53:47.0134 0x108c ibbus - ok 21:53:47.0141 0x108c icssvc - ok 21:53:47.0263 0x108c [ AEFF8BE94EBA58138962BE3F448F55D4, F7E431A780555A547989A62D3088DB71633EE92C5BF3767588EE6E2DB285254A ] igfx C:\WINDOWS\system32\DRIVERS\igdkmd64.sys 21:53:47.0394 0x108c igfx - ok 21:53:47.0421 0x108c [ ED2CD8EF96422754E89A6C52F6AB8570, 86AA260FF1D5A8C9BEF3A9EFD450FDE56F3BD3A900808E19790D01C3186B3099 ] igfxCUIService2.0.0.0 C:\WINDOWS\system32\igfxCUIService.exe 21:53:47.0438 0x108c igfxCUIService2.0.0.0 - ok 21:53:47.0442 0x108c IKEEXT - ok 21:53:47.0451 0x108c [ D10CAFE291F7440D29A6F25343F8B5F3, ECEA095FE6A28BE1198AA258CB22CFBFC40FB5B053D76CDF130717249B12608B ] ImControllerService C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe 21:53:47.0458 0x108c ImControllerService - ok 21:53:47.0462 0x108c IndirectKmd - ok 21:53:47.0554 0x108c [ 353F1955822732E5D2C4613AEA1D528D, D1A33ED9D0D829317E51D8135BF48F66B7D7E1752D225D10A4EFC2366AE3A416 ] IntcAzAudAddService C:\WINDOWS\system32\drivers\RTKVHD64.sys 21:53:47.0654 0x108c IntcAzAudAddService - ok 21:53:47.0689 0x108c [ 00FD074D6CE5DBAAD76D7D7C7F99A99B, 0B9DD56D94D1B53F998BBDAC95011BFC23C7AB53988239782F12C41307CFA7DD ] IntcDAud C:\WINDOWS\system32\DRIVERS\IntcDAud.sys 21:53:47.0722 0x108c IntcDAud - ok 21:53:47.0728 0x108c intelide - ok 21:53:47.0732 0x108c intelpep - ok 21:53:47.0736 0x108c intelppm - ok 21:53:47.0741 0x108c iorate - ok 21:53:47.0745 0x108c IpFilterDriver - ok 21:53:47.0754 0x108c iphlpsvc - ok 21:53:47.0760 0x108c IPMIDRV - ok 21:53:47.0769 0x108c IPNAT - ok 21:53:47.0773 0x108c irda - ok 21:53:47.0777 0x108c IRENUM - ok 21:53:47.0787 0x108c irmon - ok 21:53:47.0792 0x108c isapnp - ok 21:53:47.0802 0x108c iScsiPrt - ok 21:53:47.0806 0x108c kbdclass - ok 21:53:47.0809 0x108c kbdhid - ok 21:53:47.0813 0x108c kdnic - ok 21:53:47.0820 0x108c KeyIso - ok 21:53:47.0823 0x108c KSecDD - ok 21:53:47.0826 0x108c KSecPkg - ok 21:53:47.0835 0x108c ksthunk - ok 21:53:47.0841 0x108c KtmRm - ok 21:53:47.0847 0x108c LanmanServer - ok 21:53:47.0856 0x108c LanmanWorkstation - ok 21:53:47.0860 0x108c lfsvc - ok 21:53:47.0863 0x108c LicenseManager - ok 21:53:47.0871 0x108c lltdio - ok 21:53:47.0877 0x108c lltdsvc - ok 21:53:47.0883 0x108c lmhosts - ok 21:53:47.0894 0x108c LSI_SAS - ok 21:53:47.0897 0x108c LSI_SAS2i - ok 21:53:47.0901 0x108c LSI_SAS3i - ok 21:53:47.0911 0x108c LSI_SSS - ok 21:53:47.0917 0x108c LSM - ok 21:53:47.0925 0x108c luafv - ok 21:53:47.0929 0x108c MapsBroker - ok 21:53:47.0933 0x108c megasas - ok 21:53:47.0936 0x108c megasas2i - ok 21:53:47.0943 0x108c megasr - ok 21:53:47.0951 0x108c [ 48F64A35BA9F2E4AC0587DDA555FF951, 77FE2BE86ADCE103F4220A641139C42B1407CF8EFFEB66F841ABF9CFC3621558 ] MEIx64 C:\WINDOWS\System32\drivers\TeeDriverW8x64.sys 21:53:47.0968 0x108c MEIx64 - ok 21:53:47.0974 0x108c MessagingService - ok 21:53:47.0984 0x108c mlx4_bus - ok 21:53:47.0987 0x108c MMCSS - ok 21:53:47.0991 0x108c Modem - ok 21:53:47.0999 0x108c monitor - ok 21:53:48.0005 0x108c mouclass - ok 21:53:48.0011 0x108c mouhid - ok 21:53:48.0019 0x108c mountmgr - ok 21:53:48.0025 0x108c [ 86320BA9D6A972C79D467931518B165A, 4D7ABD7E5637B9AF98D7F3D4C4DAE595C27C8FEEBAAFF9E6443271C41598FCE1 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 21:53:48.0041 0x108c MozillaMaintenance - ok 21:53:48.0046 0x108c mpsdrv - ok 21:53:48.0050 0x108c MpsSvc - ok 21:53:48.0054 0x108c MRxDAV - ok 21:53:48.0057 0x108c mrxsmb - ok 21:53:48.0060 0x108c mrxsmb10 - ok 21:53:48.0063 0x108c mrxsmb20 - ok 21:53:48.0072 0x108c MsBridge - ok 21:53:48.0079 0x108c MSDTC - ok 21:53:48.0091 0x108c Msfs - ok 21:53:48.0095 0x108c msgpiowin32 - ok 21:53:48.0098 0x108c mshidkmdf - ok 21:53:48.0106 0x108c mshidumdf - ok 21:53:48.0113 0x108c msisadrv - ok 21:53:48.0119 0x108c MSiSCSI - ok 21:53:48.0127 0x108c msiserver - ok 21:53:48.0131 0x108c MSKSSRV - ok 21:53:48.0134 0x108c MsLldp - ok 21:53:48.0137 0x108c MSPCLOCK - ok 21:53:48.0145 0x108c MSPQM - ok 21:53:48.0148 0x108c MsRPC - ok 21:53:48.0152 0x108c mssmbios - ok 21:53:48.0156 0x108c MSTEE - ok 21:53:48.0166 0x108c MTConfig - ok 21:53:48.0171 0x108c Mup - ok 21:53:48.0181 0x108c mvumis - ok 21:53:48.0186 0x108c NativeWifiP - ok 21:53:48.0189 0x108c NcaSvc - ok 21:53:48.0197 0x108c NcbService - ok 21:53:48.0204 0x108c NcdAutoSetup - ok 21:53:48.0215 0x108c ndfltr - ok 21:53:48.0219 0x108c NDIS - ok 21:53:48.0222 0x108c NdisCap - ok 21:53:48.0226 0x108c NdisImPlatform - ok 21:53:48.0235 0x108c NdisTapi - ok 21:53:48.0243 0x108c Ndisuio - ok 21:53:48.0251 0x108c NdisVirtualBus - ok 21:53:48.0256 0x108c NdisWan - ok 21:53:48.0259 0x108c ndiswanlegacy - ok 21:53:48.0262 0x108c ndproxy - ok 21:53:48.0269 0x108c Ndu - ok 21:53:48.0273 0x108c NetAdapterCx - ok 21:53:48.0276 0x108c NetBIOS - ok 21:53:48.0280 0x108c NetBT - ok 21:53:48.0289 0x108c Netlogon - ok 21:53:48.0296 0x108c Netman - ok 21:53:48.0305 0x108c netprofm - ok 21:53:48.0310 0x108c NetSetupSvc - ok 21:53:48.0317 0x108c NetTcpPortSharing - ok 21:53:48.0390 0x108c [ 0F76FA3A3F8D169B1CA6F54DC7561CD5, F6C49E5D4F627FD539670DFCBC20C69F627A90CBA473873640D4DD378EE34ED5 ] NETwNe64 C:\WINDOWS\System32\drivers\NETwew01.sys 21:53:48.0461 0x108c NETwNe64 - ok 21:53:48.0480 0x108c NgcCtnrSvc - ok 21:53:48.0489 0x108c NgcSvc - ok 21:53:48.0493 0x108c NlaSvc - ok 21:53:48.0496 0x108c Npfs - ok 21:53:48.0503 0x108c npsvctrig - ok 21:53:48.0507 0x108c nsi - ok 21:53:48.0510 0x108c nsiproxy - ok 21:53:48.0515 0x108c NTFS - ok 21:53:48.0523 0x108c Null - ok 21:53:48.0785 0x108c [ A51617881CEF500F8139494CBFBD543E, 2B5912D7D0490CC654DE0B8745D6F1574389E929C71DB0F5B8F504BAC691E790 ] nvlddmkm C:\WINDOWS\System32\DriverStore\FileRepository\nvlti.inf_amd64_561c3173c020f30d\nvlddmkm.sys 21:53:49.0084 0x108c nvlddmkm - ok 21:53:49.0143 0x108c [ 020F45E362D3B57CCC5735582BB1A6EC, E2D953CEF208528382153D06FED8394BEB52657C547E4D2D2954E537C9A382DC ] NvNetworkService C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe 21:53:49.0186 0x108c NvNetworkService - ok 21:53:49.0195 0x108c nvraid - ok 21:53:49.0198 0x108c nvstor - ok 21:53:49.0236 0x108c [ 1D97F4D3B6D1F64E6419317EF0DA5768, B06D07D5757BF0760EAC2F2DF6FA3E841FF20C25E21D28E76DFB16187A385A46 ] nvsvc C:\WINDOWS\system32\nvvsvc.exe 21:53:49.0278 0x108c nvsvc - ok 21:53:49.0284 0x108c OneSyncSvc - ok 21:53:49.0295 0x108c [ D1AF4C86F851F9A345A400FD3B9D673A, BCC7B3AF92A2AB09CC52FB10107E209C02AC078E5F0197AEC40D7AE56F3A7CA0 ] ose64 C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 21:53:49.0311 0x108c ose64 - ok 21:53:49.0314 0x108c p2pimsvc - ok 21:53:49.0317 0x108c p2psvc - ok 21:53:49.0325 0x108c Parport - ok 21:53:49.0332 0x108c partmgr - ok 21:53:49.0338 0x108c PcaSvc - ok 21:53:49.0347 0x108c pci - ok 21:53:49.0351 0x108c pciide - ok 21:53:49.0355 0x108c pcmcia - ok 21:53:49.0358 0x108c pcw - ok 21:53:49.0368 0x108c pdc - ok 21:53:49.0376 0x108c PEAUTH - ok 21:53:49.0384 0x108c percsas2i - ok 21:53:49.0388 0x108c percsas3i - ok 21:53:49.0425 0x108c PerfHost - ok 21:53:49.0437 0x108c PhoneSvc - ok 21:53:49.0444 0x108c PimIndexMaintenanceSvc - ok 21:53:49.0455 0x108c pla - ok 21:53:49.0458 0x108c PlugPlay - ok 21:53:49.0462 0x108c PNRPAutoReg - ok 21:53:49.0465 0x108c PNRPsvc - ok 21:53:49.0472 0x108c PolicyAgent - ok 21:53:49.0476 0x108c Power - ok 21:53:49.0480 0x108c PptpMiniport - ok 21:53:49.0560 0x108c [ 7196D3C2E2E3129814C8DAB91F9A7D1E, 6763E4BF8E846B597E78778E520F5BADC95608BAA4EA0AC84971384B5D976DD7 ] PrintNotify C:\WINDOWS\system32\spool\drivers\x64\3\PrintConfig.dll 21:53:49.0671 0x108c PrintNotify - ok 21:53:49.0681 0x108c Processor - ok 21:53:49.0690 0x108c ProfSvc - ok 21:53:49.0697 0x108c Psched - ok 21:53:49.0755 0x108c [ D76F885983B04E8BE2D1BDEF118A097E, 34D293F7E9D2E4BF43B2BB575D77E6A8D45D54C22F8F0214EA26712BE6CE9A49 ] Qcamain C:\WINDOWS\System32\drivers\Qcamainx64.sys 21:53:49.0831 0x108c Qcamain - detected UnsignedFile.Multi.Generic ( 1 ) 21:53:49.0995 0x108c Detect skipped due to KSN trusted 21:53:49.0996 0x108c Qcamain - ok 21:53:50.0005 0x108c Qcamain10x64 - ok 21:53:50.0010 0x108c QWAVE - ok 21:53:50.0021 0x108c QWAVEdrv - ok 21:53:50.0027 0x108c RasAcd - ok 21:53:50.0036 0x108c RasAgileVpn - ok 21:53:50.0039 0x108c RasAuto - ok 21:53:50.0042 0x108c Rasl2tp - ok 21:53:50.0046 0x108c RasMan - ok 21:53:50.0053 0x108c RasPppoe - ok 21:53:50.0056 0x108c RasSstp - ok 21:53:50.0060 0x108c rdbss - ok 21:53:50.0068 0x108c rdpbus - ok 21:53:50.0074 0x108c RDPDR - ok 21:53:50.0091 0x108c RdpVideoMiniport - ok 21:53:50.0094 0x108c rdyboost - ok 21:53:50.0098 0x108c ReFSv1 - ok 21:53:50.0105 0x108c RemoteAccess - ok 21:53:50.0112 0x108c RemoteRegistry - ok 21:53:50.0118 0x108c RetailDemo - ok 21:53:50.0128 0x108c RmSvc - ok 21:53:50.0132 0x108c RpcEptMapper - ok 21:53:50.0136 0x108c RpcLocator - ok 21:53:50.0145 0x108c RpcSs - ok 21:53:50.0153 0x108c rspndr - ok 21:53:50.0181 0x108c [ 3D54ACD83F774C73D213A976A3F53C1A, D819CA427795CE11601DCCDD7DF33A6EB2C59E6E697AB6E7919D9A75490FA8A1 ] rt640x64 C:\WINDOWS\System32\drivers\rt640x64.sys 21:53:50.0207 0x108c rt640x64 - ok 21:53:50.0219 0x108c [ 229B924BFA63BC39CC3D9A72B6465562, F4A980DDF79A4B4DCF1BA0A40C2C9145862AC24AD1F5C40805019940231A2ADF ] RTSUER C:\WINDOWS\system32\Drivers\RtsUer.sys 21:53:50.0241 0x108c RTSUER - ok 21:53:50.0306 0x108c [ 3AE5B0877348E9399C7C2B1B1CFA6167, 3B19BDE0E2322537DC47F7E698F8081BF1B9E52617DF85C4078DCD3B9D34A826 ] rtsuvc C:\WINDOWS\system32\DRIVERS\rtsuvc.sys 21:53:50.0373 0x108c rtsuvc - ok 21:53:50.0382 0x108c s3cap - ok 21:53:50.0386 0x108c SamSs - ok 21:53:50.0397 0x108c sbp2port - ok 21:53:50.0403 0x108c SCardSvr - ok 21:53:50.0411 0x108c ScDeviceEnum - ok 21:53:50.0415 0x108c scfilter - ok 21:53:50.0419 0x108c Schedule - ok 21:53:50.0422 0x108c scmbus - ok 21:53:50.0432 0x108c scmdisk0101 - ok 21:53:50.0438 0x108c SCPolicySvc - ok 21:53:50.0447 0x108c sdbus - ok 21:53:50.0451 0x108c SDRSVC - ok 21:53:50.0455 0x108c sdstor - ok 21:53:50.0458 0x108c seclogon - ok 21:53:50.0467 0x108c SENS - ok 21:53:50.0473 0x108c SensorDataService - ok 21:53:50.0483 0x108c SensorService - ok 21:53:50.0487 0x108c SensrSvc - ok 21:53:50.0490 0x108c SerCx - ok 21:53:50.0493 0x108c SerCx2 - ok 21:53:50.0501 0x108c Serenum - ok 21:53:50.0504 0x108c Serial - ok 21:53:50.0507 0x108c sermouse - ok 21:53:50.0521 0x108c SessionEnv - ok 21:53:50.0528 0x108c sfloppy - ok 21:53:50.0538 0x108c SharedAccess - ok 21:53:50.0542 0x108c ShellHWDetection - ok 21:53:50.0546 0x108c shpamsvc - ok 21:53:50.0549 0x108c SiSRaid2 - ok 21:53:50.0559 0x108c SiSRaid4 - ok 21:53:50.0566 0x108c smphost - ok 21:53:50.0575 0x108c SmsRouter - ok 21:53:50.0581 0x108c SNMPTRAP - ok 21:53:50.0585 0x108c spaceport - ok 21:53:50.0595 0x108c SpbCx - ok 21:53:50.0601 0x108c Spooler - ok 21:53:50.0610 0x108c sppsvc - ok 21:53:50.0614 0x108c srv - ok 21:53:50.0617 0x108c srv2 - ok 21:53:50.0620 0x108c srvnet - ok 21:53:50.0629 0x108c SSDPSRV - ok 21:53:50.0635 0x108c SstpSvc - ok 21:53:50.0641 0x108c StateRepository - ok 21:53:50.0657 0x108c [ 86E93885D05EF3DE8561D4A4A7E3B1E4, 0B7A0459853588C23E2ADFCBF34F5F16FBB856563418D622C828BAA718BF15B8 ] Stereo Service C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvscpapisvr.exe 21:53:50.0674 0x108c Stereo Service - ok 21:53:50.0684 0x108c stexstor - ok 21:53:50.0692 0x108c stisvc - ok 21:53:50.0697 0x108c storahci - ok 21:53:50.0702 0x108c storflt - ok 21:53:50.0705 0x108c stornvme - ok 21:53:50.0709 0x108c storqosflt - ok 21:53:50.0717 0x108c StorSvc - ok 21:53:50.0723 0x108c storufs - ok 21:53:50.0729 0x108c storvsc - ok 21:53:50.0738 0x108c svsvc - ok 21:53:50.0741 0x108c swenum - ok 21:53:50.0745 0x108c swprv - ok 21:53:50.0752 0x108c Synth3dVsc - ok 21:53:50.0759 0x108c SysMain - ok 21:53:50.0767 0x108c SystemEventsBroker - ok 21:53:50.0775 0x108c TabletInputService - ok 21:53:50.0779 0x108c TapiSrv - ok 21:53:50.0784 0x108c Tcpip - ok 21:53:50.0793 0x108c Tcpip6 - ok 21:53:50.0800 0x108c tcpipreg - ok 21:53:50.0814 0x108c tdx - ok 21:53:50.0960 0x108c [ F2F02E436BA56A96A06E4427C5787B6E, 1562FF264011A15AC69808CB74F387917C4E8ED3B91546B12933BE10B6E20B3A ] TeamViewer C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe 21:53:51.0120 0x108c TeamViewer - ok 21:53:51.0136 0x108c terminpt - ok 21:53:51.0145 0x108c TermService - ok 21:53:51.0149 0x108c Themes - ok 21:53:51.0157 0x108c TieringEngineService - ok 21:53:51.0160 0x108c tiledatamodelsvc - ok 21:53:51.0164 0x108c TimeBrokerSvc - ok 21:53:51.0167 0x108c TPM - ok 21:53:51.0177 0x108c TrkWks - ok 21:53:51.0182 0x108c TrustedInstaller - ok 21:53:51.0193 0x108c tsusbflt - ok 21:53:51.0198 0x108c TsUsbGD - ok 21:53:51.0201 0x108c tunnel - ok 21:53:51.0205 0x108c tzautoupdate - ok 21:53:51.0215 0x108c UASPStor - ok 21:53:51.0220 0x108c UcmCx0101 - ok 21:53:51.0229 0x108c UcmTcpciCx0101 - ok 21:53:51.0233 0x108c UcmUcsi - ok 21:53:51.0236 0x108c Ucx01000 - ok 21:53:51.0239 0x108c UdeCx - ok 21:53:51.0248 0x108c udfs - ok 21:53:51.0255 0x108c UEFI - ok 21:53:51.0260 0x108c Ufx01000 - ok 21:53:51.0267 0x108c UfxChipidea - ok 21:53:51.0271 0x108c ufxsynopsys - ok 21:53:51.0277 0x108c UI0Detect - ok 21:53:51.0287 0x108c umbus - ok 21:53:51.0293 0x108c UmPass - ok 21:53:51.0302 0x108c UmRdpService - ok 21:53:51.0306 0x108c UnistoreSvc - ok 21:53:51.0311 0x108c upnphost - ok 21:53:51.0318 0x108c UrsChipidea - ok 21:53:51.0322 0x108c UrsCx01000 - ok 21:53:51.0325 0x108c UrsSynopsys - ok 21:53:51.0328 0x108c usbccgp - ok 21:53:51.0336 0x108c usbcir - ok 21:53:51.0343 0x108c usbehci - ok 21:53:51.0348 0x108c usbhub - ok 21:53:51.0357 0x108c USBHUB3 - ok 21:53:51.0361 0x108c usbohci - ok 21:53:51.0364 0x108c usbprint - ok 21:53:51.0373 0x108c [ 2EC7B2C8123236B1233A77281D378DF7, D97DB59C9CAE2B8B33C707E8CEA7A65BF88712842CC715D270F7432A99D21BB6 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys 21:53:51.0393 0x108c usbscan - ok 21:53:51.0397 0x108c usbser - ok 21:53:51.0400 0x108c USBSTOR - ok 21:53:51.0407 0x108c usbuhci - ok 21:53:51.0414 0x108c USBXHCI - ok 21:53:51.0420 0x108c UserDataSvc - ok 21:53:51.0431 0x108c UserManager - ok 21:53:51.0434 0x108c UsoSvc - ok 21:53:51.0437 0x108c VaultSvc - ok 21:53:51.0443 0x108c vdrvroot - ok 21:53:51.0449 0x108c vds - ok 21:53:51.0452 0x108c VerifierExt - ok 21:53:51.0455 0x108c vhdmp - ok 21:53:51.0463 0x108c vhf - ok 21:53:51.0470 0x108c vmbus - ok 21:53:51.0476 0x108c VMBusHID - ok 21:53:51.0484 0x108c vmgid - ok 21:53:51.0488 0x108c vmicguestinterface - ok 21:53:51.0491 0x108c vmicheartbeat - ok 21:53:51.0499 0x108c vmickvpexchange - ok 21:53:51.0506 0x108c vmicrdv - ok 21:53:51.0511 0x108c vmicshutdown - ok 21:53:51.0519 0x108c vmictimesync - ok 21:53:51.0522 0x108c vmicvmsession - ok 21:53:51.0525 0x108c vmicvss - ok 21:53:51.0529 0x108c volmgr - ok 21:53:51.0539 0x108c volmgrx - ok 21:53:51.0546 0x108c volsnap - ok 21:53:51.0555 0x108c volume - ok 21:53:51.0558 0x108c vpci - ok 21:53:51.0562 0x108c vsmraid - ok 21:53:51.0566 0x108c VSS - ok 21:53:51.0576 0x108c VSTXRAID - ok 21:53:51.0582 0x108c vwifibus - ok 21:53:51.0590 0x108c vwififlt - ok 21:53:51.0594 0x108c vwifimp - ok 21:53:51.0597 0x108c W32Time - ok 21:53:51.0601 0x108c WacomPen - ok 21:53:51.0612 0x108c WalletService - ok 21:53:51.0618 0x108c wanarp - ok 21:53:51.0627 0x108c wanarpv6 - ok 21:53:51.0630 0x108c wbengine - ok 21:53:51.0634 0x108c WbioSrvc - ok 21:53:51.0637 0x108c wcifs - ok 21:53:51.0645 0x108c Wcmsvc - ok 21:53:51.0648 0x108c wcncsvc - ok 21:53:51.0652 0x108c wcnfs - ok 21:53:51.0656 0x108c WdBoot - ok 21:53:51.0665 0x108c Wdf01000 - ok 21:53:51.0671 0x108c WdFilter - ok 21:53:51.0680 0x108c WdiServiceHost - ok 21:53:51.0685 0x108c WdiSystemHost - ok 21:53:51.0688 0x108c wdiwifi - ok 21:53:51.0692 0x108c WdNisDrv - ok 21:53:51.0699 0x108c WdNisSvc - ok 21:53:51.0707 0x108c WebClient - ok 21:53:51.0716 0x108c Wecsvc - ok 21:53:51.0720 0x108c WEPHOSTSVC - ok 21:53:51.0724 0x108c wercplsupport - ok 21:53:51.0727 0x108c WerSvc - ok 21:53:51.0737 0x108c WFPLWFS - ok 21:53:51.0743 0x108c WiaRpc - ok 21:53:51.0752 0x108c WIMMount - ok 21:53:51.0754 0x108c WinDefend - ok 21:53:51.0761 0x108c WindowsTrustedRT - ok 21:53:51.0765 0x108c WindowsTrustedRTProxy - ok 21:53:51.0775 0x108c WinHttpAutoProxySvc - ok 21:53:51.0783 0x108c WinMad - ok 21:53:51.0796 0x108c Winmgmt - ok 21:53:51.0799 0x108c WinRM - ok 21:53:51.0810 0x108c WINUSB - ok 21:53:51.0814 0x108c WinVerbs - ok 21:53:51.0818 0x108c wisvc - ok 21:53:51.0826 0x108c WlanSvc - ok 21:53:51.0833 0x108c wlidsvc - ok 21:53:51.0842 0x108c WmiAcpi - ok 21:53:51.0849 0x108c wmiApSrv - ok 21:53:51.0852 0x108c WMPNetworkSvc - ok 21:53:51.0860 0x108c Wof - ok 21:53:51.0870 0x108c workfolderssvc - ok 21:53:51.0878 0x108c WPDBusEnum - ok 21:53:51.0883 0x108c WpdUpFltr - ok 21:53:51.0887 0x108c WpnService - ok 21:53:51.0890 0x108c WpnUserService - ok 21:53:51.0904 0x108c ws2ifsl - ok 21:53:51.0913 0x108c wscsvc - ok 21:53:51.0918 0x108c WSDPrintDevice - ok 21:53:51.0922 0x108c WSDScan - ok 21:53:51.0925 0x108c WSearch - ok 21:53:51.0936 0x108c [ 72B4E9DF6456C43C42A1419B09486045, 536BA7377B5BEA7EA46864453933111DB88DB8FB689C68915ACD7261A996E61D ] wsvd C:\WINDOWS\system32\DRIVERS\wsvd.sys 21:53:51.0949 0x108c wsvd - ok 21:53:51.0955 0x108c wuauserv - ok 21:53:51.0961 0x108c WudfPf - ok 21:53:51.0970 0x108c WUDFRd - ok 21:53:51.0975 0x108c wudfsvc - ok 21:53:51.0978 0x108c WUDFWpdFs - ok 21:53:51.0982 0x108c WUDFWpdMtp - ok 21:53:51.0993 0x108c WwanSvc - ok 21:53:51.0998 0x108c XblAuthManager - ok 21:53:52.0008 0x108c XblGameSave - ok 21:53:52.0012 0x108c xboxgip - ok 21:53:52.0016 0x108c XboxNetApiSvc - ok 21:53:52.0024 0x108c xinputhid - ok 21:53:52.0028 0x108c ================ Scan global =============================== 21:53:52.0048 0x108c [ Global ] - ok 21:53:52.0049 0x108c ================ Scan MBR ================================== 21:53:52.0051 0x108c [ 5FB38429D5D77768867C76DCBDB35194 ] \Device\Harddisk0\DR0 21:53:52.0090 0x108c \Device\Harddisk0\DR0 - ok 21:53:52.0090 0x108c ================ Scan VBR ================================== 21:53:52.0092 0x108c [ FC983D66B62CDD8DFD04169DEB58F679 ] \Device\Harddisk0\DR0\Partition1 21:53:52.0093 0x108c \Device\Harddisk0\DR0\Partition1 - ok 21:53:52.0095 0x108c [ EAA9ACF1B7B38FEE49CB7EE48A5CA163 ] \Device\Harddisk0\DR0\Partition2 21:53:52.0095 0x108c \Device\Harddisk0\DR0\Partition2 - ok 21:53:52.0098 0x108c [ F6B8394D9ED1E336B4ACAE4B1E0B7313 ] \Device\Harddisk0\DR0\Partition3 21:53:52.0099 0x108c \Device\Harddisk0\DR0\Partition3 - ok 21:53:52.0101 0x108c [ 71E5790B244955F37AE1931FDB511226 ] \Device\Harddisk0\DR0\Partition4 21:53:52.0102 0x108c \Device\Harddisk0\DR0\Partition4 - ok 21:53:52.0104 0x108c [ 871946DA8EB38C0710D19ED6BF29E54D ] \Device\Harddisk0\DR0\Partition5 21:53:52.0106 0x108c \Device\Harddisk0\DR0\Partition5 - ok 21:53:52.0111 0x108c [ 1ECC2FCF8438A8A438D3E45812AA6C6E ] \Device\Harddisk0\DR0\Partition6 21:53:52.0112 0x108c \Device\Harddisk0\DR0\Partition6 - ok 21:53:52.0114 0x108c ================ Scan generic autorun ====================== 21:53:52.0134 0x108c [ 85AC79F070737D721056881F898A1C37, 4AD8B1A016BB9C66ED76827480EA12EB5853C8536B60B4F79BBA19993DBD1912 ] C:\Program Files\Apoint2K\Apoint.exe 21:53:52.0164 0x108c Apoint - ok 21:53:52.0437 0x108c [ B34F985FBD8FF7C6D99581145EA794A2, 52B4D0E79CEC07FB73584FD952329CDA4AA525D2DE92DFCE123131EDA1699CB6 ] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe 21:53:52.0794 0x108c RTHDVCPL - ok 21:53:52.0842 0x108c [ 5E2875923B7D0BE1CF35D456A708EBE1, 1769B9FD25C53406EF5A8152A89723F4BD8235052E626850A2D90CA0FDD33C03 ] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe 21:53:52.0878 0x108c RtHDVBg_Dolby - ok 21:53:52.0910 0x108c [ 5E2875923B7D0BE1CF35D456A708EBE1, 1769B9FD25C53406EF5A8152A89723F4BD8235052E626850A2D90CA0FDD33C03 ] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe 21:53:52.0941 0x108c RtHDVBg_LENOVO_DOLBYDRAGON - ok 21:53:52.0974 0x108c [ 5E2875923B7D0BE1CF35D456A708EBE1, 1769B9FD25C53406EF5A8152A89723F4BD8235052E626850A2D90CA0FDD33C03 ] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe 21:53:53.0007 0x108c RtHDVBg_LENOVO_MICPKEY - ok 21:53:53.0011 0x108c Logitech Download Assistant - ok 21:53:53.0031 0x108c [ 773864F1C5C2F7D9711EDD842B555CAD, 593ABC4042B78BAD835E503557FDA853431CD3173DD786E9271E4E1B2603E19D ] C:\Program Files\Lenovo\LenovoUtility\utility.exe 21:53:53.0061 0x108c LenovoUtility - ok 21:53:53.0066 0x108c [ CAFF91D18E85FEDB51F5EFBB73335227, 20939026D4AD9CB3E8284DB353102273A49B10A53A794566AE9B8B28110D3736 ] C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe 21:53:53.0072 0x108c IAStorIcon - detected UnsignedFile.Multi.Generic ( 1 ) 21:53:53.0229 0x108c Detect skipped due to KSN trusted 21:53:53.0229 0x108c IAStorIcon - ok 21:53:53.0251 0x108c [ 5DB2D863BEECABABE5AFBD36AD055919, EDA57E210834275DD78650C55267F1EB55BB03964D0BCB8C87CCB5CCE290AE51 ] C:\Program Files\Dolby\Dolby DAX2\DAX2_APP\DolbyDAX2TrayIcon.exe 21:53:53.0281 0x108c DAX2_APP - detected UnsignedFile.Multi.Generic ( 1 ) 21:53:53.0424 0x108c Detect skipped due to KSN trusted 21:53:53.0424 0x108c DAX2_APP - ok 21:53:53.0482 0x108c [ 94A8196066774252DF015EEDF02CCA44, AD2DFDA427E3CCB5C8404F0AFAFE71C64B862D2E26A67E1BFC2B40738FD0B873 ] C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe 21:53:53.0546 0x108c NvBackend - ok 21:53:53.0563 0x108c [ 4E9AF25BA5E8219310E384AEA5B0EED8, 743062F755E7A88BA394E96CA26A988CCFDF73B441B779B3149D54A769CBC411 ] C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe 21:53:53.0571 0x108c CLMLServer_For_P2G8 - ok 21:53:53.0586 0x108c [ 87DFBEA4D27170B0A54378DFBF0BE8E4, CA98EA1CADAF6712F1E828386902EF590253286AC860D077FD5C5971022C2146 ] C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe 21:53:53.0610 0x108c CLVirtualDrive - ok 21:53:53.0650 0x108c OneDriveSetup - ok 21:53:53.0654 0x108c OneDriveSetup - ok 21:53:53.0673 0x108c [ 8F2EA5EE0695CCE2285D92C44108375C, 2C96A8E7E41E87C27B6A3325526F99A03333357EF2682C17A4892BE4A58D157E ] C:\Users\wolfg\AppData\Local\Microsoft\OneDrive\OneDrive.exe 21:53:53.0698 0x108c OneDrive - ok 21:53:53.0743 0x108c [ CAC8165B201CD4A30B3944BA3FCDD9C0, DA6289D950C641FD78AB57EC0A391BFBC0577DD87E48F707EAE4C50AB3DF3311 ] C:\Program Files (x86)\CyberLink\Power2Go8\Power2GoExpress8.exe 21:53:53.0794 0x108c Power2GoExpress8 - ok 21:53:53.0797 0x108c Waiting for KSN requests completion. In queue: 55 21:53:54.0820 0x108c AV detected via SS2: Windows Defender, C:\Program Files\Windows Defender\MSASCui.exe ( 4.10.14393.187 ), 0x60100 ( disabled : updated ) 21:53:54.0820 0x108c AV detected via SS2: ESET NOD32 Antivirus 9.0.402.1, C:\Program Files\ESET\ESET NOD32 Antivirus\ecmd.exe ( 9.0.395.0 ), 0x41000 ( enabled : updated ) 21:53:54.0834 0x108c Win FW state via NFP2: enabled ( trusted ) 21:53:54.0995 0x108c ============================================================ 21:53:54.0995 0x108c Scan finished 21:53:54.0995 0x108c ============================================================ 21:53:55.0006 0x08a4 Detected object count: 0 21:53:55.0006 0x08a4 Actual detected object count: 0 Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.9.3.1001 www.malwarebytes.org Database version: main: v2016.11.23.15 rootkit: v2016.11.20.01 Windows 10 x64 NTFS Internet Explorer 11.447.14393.0 wolfg :: WOLFGANGS-PC [administrator] 23.11.2016 21:57:38 mbar-log-2016-11-23 (21-57-38).txt Scan type: Quick scan Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken Scan options disabled: Objects scanned: 316716 Time elapsed: 9 minute(s), 57 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) Physical Sectors Detected: 0 (No malicious items detected) (end) VG Fabi |
02.12.2016, 23:33 | #4 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Windows 10 Home: Meldung "Bios update" (wie Konsole) Maus / Browserfenster bewegen sich von alleine Hi Sandra ist leider indisponiert und ich springe deswegen ein. Da doch einige Zeit vergangen ist bitte ich dich neue FRST Log zu erstellen. Danke. Scan mit Farbar's Recovery Scan Tool (FRST) Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
Lesestoff: Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit. Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ Logfiles bitte immer in CODE-Tags posten |
Themen zu Windows 10 Home: Meldung "Bios update" (wie Konsole) Maus / Browserfenster bewegen sich von alleine |
adobe, antivirus, computer, cpu, defender, failed, firefox, flash player, helper, home, homepage, iexplore.exe, maus, mozilla, prozesse, realtek, registry, rundll, scan, services.exe, software, svchost.exe, system, updates, windows, windowsapps |