Trojaner-Board - Sykey Sperre nach "Microsoft Anruf"

Ich habe den Rechner eines Kunden hier, der gestern auf den Anruf des vermeintlichen Microsoft Mitarbeiters hereingefallen ist. Beim Booten kommt nun die Syskey Sperre.

LOG von FRST64
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:09-07-2015

Ran by SYSTEM on MINWINPC on 10-07-2015 08:32:55

Running from M:\

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Recovery
 

The current controlset is ControlSet001
 ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.
 

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [VX1000] => C:\Windows\vVX1000.exe [762736 2010-05-20] (Microsoft Corporation)

HKLM-x32\...\Run: [] => [X]

HKU\Administrator\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\SysWOW64\MAHJON~1.SCR

HKU\Default\...\RunOnce: [HKCU] => C:\Windows\System32\oobe\info\HKCU.vbs [126 2009-11-12] ()

HKU\Default\...\RunOnce: [Screensaver] => C:\Windows\Web\Wallpaper\MEDION\start.vbs [129 2009-10-23] ()

HKU\Default\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\SysWOW64\MAHJON~1.SCR

HKU\Default User\...\RunOnce: [HKCU] => C:\Windows\System32\oobe\info\HKCU.vbs [126 2009-11-12] ()

HKU\Default User\...\RunOnce: [Screensaver] => C:\Windows\Web\Wallpaper\MEDION\start.vbs [129 2009-10-23] ()

HKU\Default User\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\SysWOW64\MAHJON~1.SCR

HKU\Dieter\...\Run: [gSyncit] => C:\Program Files (x86)\Fieldston Software\gSyncit\gsyncit.exe [228352 2015-06-02] (Fieldston Software)

HKU\Dieter\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize

BootExecute: autocheck autochk * sdnclean64.exe

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-05-04] (Advanced Micro Devices, Inc.)

S2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)

S2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-13] (CyberLink)

S2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-13] (CyberLink)

S3 Garmin Device Interaction Service; C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe [715784 2015-05-07] (Garmin Ltd. or its subsidiaries)

S2 HPSLPSVC; C:\Users\Dieter\AppData\Local\Temp\7zS7FB7\hpslpsvc64.dll [1039360 2013-02-06] (Hewlett-Packard Co.)

S2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89840 2015-03-28] (Hewlett-Packard Company)

S2 N360; C:\Program Files (x86)\Norton 360\Engine\21.7.0.11\N360.exe [265000 2015-03-07] (Symantec Corporation)

S2 RalinkRegistryWriter; C:\Program Files (x86)\NETGEAR\WNDA4100\Service\RaRegistry.exe [377088 2011-11-21] (Ralink Technology, Corp.)

S2 RalinkRegistryWriter64; C:\Program Files (x86)\NETGEAR\WNDA4100\Service\RaRegistry64.exe [455424 2011-11-21] (Ralink Technology, Corp.)

S2 Realtek11nSU; C:\Program Files (x86)\Realtek\11n USB Wireless LAN Utility\RtlService.exe [36864 2010-04-16] (Realtek)

S2 StarMoney 10 OnlineUpdate; C:\Program Files (x86)\StarMoney 10 S-Edition\ouservice\StarMoneyOnlineUpdate.exe [688272 2015-04-15] (Star Finanz-Software Entwicklung und Vertriebs GmbH)

S2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5495056 2015-06-18] (TeamViewer GmbH)

S2 WDDriveService; C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe [247704 2012-02-27] (Western Digital)

S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

S1 BHDrvx64; C:\Program Files (x86)\Norton 360\NortonData\21.0.1.3\Definitions\BASHDefs\20150706.001\BHDrvx64.sys [1648880 2015-06-22] (Symantec Corporation)

S1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1507000.00B\ccSetx64.sys [162392 2014-02-21] (Symantec Corporation)

S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [489776 2015-05-27] (Symantec Corporation)

S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [145200 2015-05-27] (Symantec Corporation)

S1 IDSVia64; C:\Program Files (x86)\Norton 360\NortonData\21.0.1.3\Definitions\IPSDefs\20150708.001\IDSvia64.sys [692984 2015-06-20] (Symantec Corporation)

S3 NAVENG; C:\Program Files (x86)\Norton 360\NortonData\21.0.1.3\Definitions\VirusDefs\20150708.032\ENG64.SYS [138488 2015-06-28] (Symantec Corporation)

S3 NAVEX15; C:\Program Files (x86)\Norton 360\NortonData\21.0.1.3\Definitions\VirusDefs\20150708.032\EX64.SYS [2146040 2015-06-28] (Symantec Corporation)

S3 PCAMp50a64; C:\Windows\System32\Drivers\PCAMp50a64.sys [43328 2006-11-28] (Printing Communications Assoc., Inc. (PCAUSA))

S3 PCASp50a64; C:\Windows\System32\Drivers\PCASp50a64.sys [41280 2006-11-28] (Printing Communications Assoc., Inc. (PCAUSA))

S1 SRTSP; C:\Windows\System32\Drivers\N360x64\1507000.00B\SRTSP64.SYS [876248 2014-08-26] (Symantec Corporation)

S1 SRTSPX; C:\Windows\system32\drivers\N360x64\1507000.00B\SRTSPX64.SYS [37592 2014-08-26] (Symantec Corporation)

S0 SymDS; C:\Windows\System32\drivers\N360x64\1507000.00B\SYMDS64.SYS [493656 2013-08-01] (Symantec Corporation)

S0 SymEFA; C:\Windows\System32\drivers\N360x64\1507000.00B\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation)

S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-07-18] (Symantec Corporation)

S1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [78936 2013-08-07] (Symantec Corporation)

S1 SymIRON; C:\Windows\system32\drivers\N360x64\1507000.00B\Ironx64.SYS [266968 2014-08-06] (Symantec Corporation)

S1 SymNetS; C:\Windows\System32\Drivers\N360x64\1507000.00B\SYMNETS.SYS [593112 2014-02-18] (Symantec Corporation)

S3 WPN111; system32\DRIVERS\WPN111vx.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 

==================== One Month Created files and folders ========
 

(If an entry is included in the fixlist, the file/folder will be moved.)
 

2015-07-10 08:27 - 2015-07-10 08:32 - 00000000 ____D C:\FRST

2015-07-09 15:23 - 2015-07-09 15:23 - 00001047 _____ C:\Users\Public\Desktop\TeamViewer 10.lnk

2015-07-09 15:23 - 2015-07-09 15:23 - 00000000 ____D C:\Users\Dieter\AppData\Roaming\TeamViewer

2015-07-09 15:23 - 2015-07-09 15:23 - 00000000 ____D C:\Program Files (x86)\TeamViewer

2015-07-09 15:22 - 2015-07-09 15:23 - 08050520 _____ (TeamViewer GmbH) C:\Users\Dieter\Downloads\TeamViewer_Setup_de.exe

2015-07-08 19:06 - 2015-07-09 15:06 - 17582768 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe

2015-07-07 16:24 - 2015-07-07 16:24 - 00000000 ____D C:\Users\Dieter\AppData\Local\Lavasoft

2015-07-07 16:22 - 2015-07-07 16:22 - 00422400 _____ (Lavasoft Limited) C:\Windows\System32\LavasoftTcpService64.dll

2015-07-07 16:22 - 2015-07-07 16:22 - 00342016 _____ (Lavasoft Limited) C:\Windows\SysWOW64\LavasoftTcpService.dll

2015-07-07 16:22 - 2015-07-07 16:22 - 00002792 _____ C:\Windows\SysWOW64\LavasoftTcpServiceOff.ini

2015-07-07 16:22 - 2015-07-07 16:22 - 00002792 _____ C:\Windows\System32\LavasoftTcpServiceOff.ini

2015-07-07 16:21 - 2015-07-07 16:28 - 00000000 ____D C:\Users\Dieter\AppData\Roaming\Opera Software

2015-07-07 16:21 - 2015-07-07 16:28 - 00000000 ____D C:\Users\Dieter\AppData\Local\Opera Software

2015-07-07 16:21 - 2015-07-07 16:28 - 00000000 ____D C:\Program Files (x86)\Opera

2015-07-07 16:21 - 2015-07-07 16:23 - 00000000 ____D C:\ProgramData\Lavasoft

2015-07-07 16:19 - 2015-07-07 16:19 - 00000000 ____D C:\Users\Dieter\AppData\Roaming\RPEng

2015-07-07 16:19 - 2015-07-07 16:19 - 00000000 ____D C:\Program Files (x86)\FreeCodecPack

2015-07-07 16:18 - 2015-07-07 16:18 - 34800832 _____ (DVDVideoSoft Ltd. ) C:\Users\Dieter\Downloads\FreeYouTubeDownload_3.2.59.616.exe

2015-07-07 16:02 - 2015-07-07 16:02 - 00000000 ____D C:\Users\Dieter\Documents\mediathekview_9

2015-07-06 10:54 - 2015-07-06 17:53 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2015-06-30 20:27 - 2015-06-30 20:27 - 00003584 _____ C:\Users\Dieter\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2015-06-30 20:22 - 2015-06-30 20:25 - 00921624 _____ C:\img2-001.raw

2015-06-30 20:20 - 2015-06-30 20:25 - 00000000 ____D C:\Users\Dieter\Tracing

2015-06-30 09:12 - 2015-06-30 09:13 - 10525626 _____ (Dr. J. Rathlev ) C:\Users\Dieter\Downloads\pb-setup-x64-5.7.0101.exe

2015-06-28 17:40 - 2015-05-09 19:26 - 00493504 _____ (Microsoft Corporation) C:\Windows\System32\mcupdate_GenuineIntel.dll

2015-06-28 17:40 - 2015-04-27 20:23 - 01480192 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll

2015-06-28 17:40 - 2015-04-27 20:23 - 00229376 _____ (Microsoft Corporation) C:\Windows\System32\wintrust.dll

2015-06-28 17:40 - 2015-04-27 20:23 - 00188416 _____ (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll

2015-06-28 17:40 - 2015-04-27 20:23 - 00140288 _____ (Microsoft Corporation) C:\Windows\System32\cryptnet.dll

2015-06-28 17:40 - 2015-04-27 20:05 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll

2015-06-28 17:40 - 2015-04-27 20:04 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll

2015-06-28 17:40 - 2015-04-27 20:04 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll

2015-06-28 17:40 - 2015-04-27 20:04 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll

2015-06-13 10:29 - 2015-06-13 10:29 - 00000943 _____ C:\Users\Public\Desktop\dm-Fotowelt.lnk

2015-06-13 10:26 - 2015-06-13 10:26 - 00000000 ____D C:\Program Files\Common Files\AV

2015-06-10 12:03 - 2015-06-01 20:16 - 00389840 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll

2015-06-10 12:03 - 2015-06-01 19:07 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2015-06-10 12:03 - 2015-05-27 15:35 - 24917504 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2015-06-10 12:03 - 2015-05-27 15:08 - 19607040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2015-06-10 12:03 - 2015-05-25 18:08 - 03206144 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys

2015-06-10 12:03 - 2015-05-23 04:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2015-06-10 12:03 - 2015-05-23 04:15 - 00503808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2015-06-10 12:03 - 2015-05-23 04:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2015-06-10 12:03 - 2015-05-23 04:15 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2015-06-10 12:03 - 2015-05-23 04:14 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec

2015-06-10 12:03 - 2015-05-23 04:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2015-06-10 12:03 - 2015-05-23 04:10 - 02278912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2015-06-10 12:03 - 2015-05-23 04:09 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2015-06-10 12:03 - 2015-05-23 04:08 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2015-06-10 12:03 - 2015-05-23 04:06 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2015-06-10 12:03 - 2015-05-23 04:05 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2015-06-10 12:03 - 2015-05-23 04:05 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2015-06-10 12:03 - 2015-05-23 04:04 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2015-06-10 12:03 - 2015-05-23 03:57 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2015-06-10 12:03 - 2015-05-23 03:52 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2015-06-10 12:03 - 2015-05-23 03:49 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2015-06-10 12:03 - 2015-05-23 03:48 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2015-06-10 12:03 - 2015-05-23 03:47 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2015-06-10 12:03 - 2015-05-23 03:47 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2015-06-10 12:03 - 2015-05-23 03:38 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2015-06-10 12:03 - 2015-05-23 03:37 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2015-06-10 12:03 - 2015-05-23 03:37 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2015-06-10 12:03 - 2015-05-23 03:28 - 12829696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2015-06-10 12:03 - 2015-05-23 03:20 - 01950720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2015-06-10 12:03 - 2015-05-23 03:16 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2015-06-10 12:03 - 2015-05-23 03:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2015-06-10 12:03 - 2015-05-22 20:16 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2015-06-10 12:03 - 2015-05-22 20:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll

2015-06-10 12:03 - 2015-05-22 20:01 - 00066560 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll

2015-06-10 12:03 - 2015-05-22 20:00 - 02885632 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2015-06-10 12:03 - 2015-05-22 20:00 - 00584192 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll

2015-06-10 12:03 - 2015-05-22 20:00 - 00417792 _____ (Microsoft Corporation) C:\Windows\System32\html.iec

2015-06-10 12:03 - 2015-05-22 20:00 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll

2015-06-10 12:03 - 2015-05-22 19:59 - 00088064 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll

2015-06-10 12:03 - 2015-05-22 19:53 - 00054784 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll

2015-06-10 12:03 - 2015-05-22 19:52 - 06026240 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll

2015-06-10 12:03 - 2015-05-22 19:52 - 00034304 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll

2015-06-10 12:03 - 2015-05-22 19:48 - 00633856 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll

2015-06-10 12:03 - 2015-05-22 19:47 - 00816640 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll

2015-06-10 12:03 - 2015-05-22 19:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll

2015-06-10 12:03 - 2015-05-22 19:47 - 00144384 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe

2015-06-10 12:03 - 2015-05-22 19:47 - 00114688 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe

2015-06-10 12:03 - 2015-05-22 19:40 - 00968704 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe

2015-06-10 12:03 - 2015-05-22 19:36 - 00490496 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll

2015-06-10 12:03 - 2015-05-22 19:29 - 00077824 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll

2015-06-10 12:03 - 2015-05-22 19:25 - 00199680 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll

2015-06-10 12:03 - 2015-05-22 19:24 - 00092160 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll

2015-06-10 12:03 - 2015-05-22 19:21 - 00316928 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll

2015-06-10 12:03 - 2015-05-22 19:07 - 00720384 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe

2015-06-10 12:03 - 2015-05-22 19:06 - 00801280 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll

2015-06-10 12:03 - 2015-05-22 19:05 - 02125824 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl

2015-06-10 12:03 - 2015-05-22 19:05 - 01359360 _____ (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll

2015-06-10 12:03 - 2015-05-22 18:57 - 14404096 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2015-06-10 12:03 - 2015-05-22 18:50 - 02426880 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll

2015-06-10 12:03 - 2015-05-22 18:38 - 01545728 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2015-06-10 12:03 - 2015-05-22 18:26 - 00800768 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll

2015-06-10 12:03 - 2015-04-29 19:22 - 14635008 _____ (Microsoft Corporation) C:\Windows\System32\wmp.dll

2015-06-10 12:03 - 2015-04-29 19:21 - 00009728 _____ (Microsoft Corporation) C:\Windows\System32\spwmp.dll

2015-06-10 12:03 - 2015-04-29 19:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\System32\msdxm.ocx

2015-06-10 12:03 - 2015-04-29 19:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\System32\dxmasf.dll

2015-06-10 12:03 - 2015-04-29 19:19 - 12625920 _____ (Microsoft Corporation) C:\Windows\System32\wmploc.DLL

2015-06-10 12:03 - 2015-04-29 19:07 - 11411456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll

2015-06-10 12:03 - 2015-04-29 19:07 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll

2015-06-10 12:03 - 2015-04-29 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx

2015-06-10 12:03 - 2015-04-29 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll

2015-06-10 12:03 - 2015-04-29 19:05 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL

2015-06-10 12:03 - 2015-04-24 19:17 - 00633856 _____ (Microsoft Corporation) C:\Windows\System32\comctl32.dll

2015-06-10 12:03 - 2015-04-24 18:56 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
 

==================== One Month Modified files and folders ========
 

(If an entry is included in the fixlist, the file/folder will be moved.)
 

2015-07-10 17:19 - 2014-07-18 22:21 - 00000000 ____D C:\ProgramData\Norton

2015-07-10 17:19 - 2014-04-01 15:07 - 00000000 ____D C:\users\Administrator

2015-07-10 17:19 - 2012-11-03 17:16 - 00000000 ____D C:\users\Dieter

2015-07-10 17:19 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration

2015-07-10 07:20 - 2009-07-14 05:45 - 05163504 _____ C:\Windows\System32\FNTCACHE.DAT

2015-07-09 16:40 - 2014-10-07 08:28 - 00000000 ____D C:\Users\Dieter\Documents\Outlook-Dateien

2015-07-09 16:40 - 2014-04-06 14:14 - 00000000 ____D C:\Users\Dieter\Outlook-Dateien

2015-07-09 15:29 - 2013-12-13 17:29 - 00000292 _____ C:\Windows\Tasks\FoxTab.job

2015-07-09 15:26 - 2012-11-03 17:17 - 00146032 _____ C:\Users\Dieter\AppData\Local\GDIPFONTCACHEV1.DAT

2015-07-09 15:07 - 2008-01-01 08:31 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2015-07-09 15:07 - 2008-01-01 08:31 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-07-09 15:06 - 2011-12-01 22:26 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-07-09 15:06 - 2008-01-01 08:31 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-07-09 14:46 - 2014-08-05 18:01 - 00000000 ____D C:\Users\Dieter\AppData\Roaming\gSyncit

2015-07-09 14:46 - 2014-07-18 21:44 - 00222308 _____ C:\Windows\setupact.log

2015-07-09 13:52 - 2009-07-14 05:45 - 00024576 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-07-09 13:52 - 2009-07-14 05:45 - 00024576 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-07-09 13:51 - 2011-05-16 15:04 - 00699716 _____ C:\Windows\System32\perfh007.dat

2015-07-09 13:51 - 2011-05-16 15:04 - 00149856 _____ C:\Windows\System32\perfc007.dat

2015-07-09 13:51 - 2009-07-14 06:13 - 01621844 _____ C:\Windows\System32\PerfStringBackup.INI

2015-07-09 13:48 - 2012-11-03 17:12 - 01058542 _____ C:\Windows\WindowsUpdate.log

2015-07-09 13:44 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2015-07-08 18:44 - 2013-11-21 18:30 - 00003938 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{D4BF0979-B394-46AE-A366-D01EDD0574CE}

2015-07-08 18:42 - 2014-08-15 10:21 - 00000000 ____D C:\Users\Dieter\AppData\Local\Adobe

2015-07-08 10:33 - 2013-12-13 08:22 - 01058968 _____ C:\Windows\PFRO.log

2015-07-07 16:46 - 2015-05-11 10:57 - 00000000 ____D C:\Program Files (x86)\StarMoney 10 S-Edition

2015-07-07 16:28 - 2014-11-22 21:38 - 00000000 __SHD C:\Users\Dieter\AppData\Local\EmieBrowserModeList

2015-07-07 16:28 - 2014-04-15 12:54 - 00000000 __SHD C:\Users\Dieter\AppData\Local\EmieUserList

2015-07-07 16:28 - 2014-04-15 12:54 - 00000000 __SHD C:\Users\Dieter\AppData\Local\EmieSiteList

2015-07-07 16:19 - 2014-01-18 19:01 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft

2015-07-07 16:19 - 2014-01-18 16:24 - 00000000 __SHD C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}

2015-07-07 16:19 - 2014-01-18 16:24 - 00000000 ____D C:\ProgramData\TuneUp Software

2015-07-07 16:19 - 2013-03-02 16:18 - 00000000 ____D C:\Users\Dieter\AppData\Roaming\DVDVideoSoft

2015-07-07 16:03 - 2015-01-07 09:41 - 00000000 ____D C:\Users\Dieter\.mediathek3

2015-07-06 18:29 - 2014-04-04 13:04 - 00000000 ____D C:\Windows\CryptoGuard

2015-07-06 17:53 - 2012-11-03 20:22 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2015-07-06 16:50 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\System32\NDF

2015-06-30 21:15 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD

2015-06-30 09:13 - 2013-10-04 21:09 - 00000897 _____ C:\Users\Public\Desktop\Personal Backup 5.lnk

2015-06-30 09:13 - 2013-10-04 21:09 - 00000000 ____D C:\Program Files\Personal Backup 5

2015-06-28 18:31 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache

2015-06-28 17:41 - 2014-12-25 20:03 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task

2015-06-17 19:22 - 2013-09-08 21:29 - 00000000 ____D C:\Users\Dieter\AppData\Roaming\vlc

2015-06-15 20:19 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2015-06-13 10:30 - 2014-05-07 20:02 - 00000000 ____D C:\ProgramData\tmp

2015-06-10 19:28 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions

2015-06-10 19:09 - 2012-11-03 17:24 - 00000000 ____D C:\ProgramData\Microsoft Help

2015-06-10 19:06 - 2013-07-11 13:20 - 00000000 ____D C:\Windows\System32\MRT

2015-06-10 19:03 - 2011-07-18 21:31 - 140135120 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe

2015-06-10 19:02 - 2009-07-14 03:34 - 00000478 _____ C:\Windows\win.ini

2015-06-10 18:31 - 2014-04-04 09:46 - 00000000 ____D C:\Users\Dieter\Documents\PersBackup
 

==================== Known DLLs (Whitelisted) ================
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 

==================== Restore Points =========================
 

Restore point made on: 2015-06-10 19:01:49

Restore point made on: 2015-06-19 09:37:04

Restore point made on: 2015-06-28 17:40:58

Restore point made on: 2015-06-28 19:31:36

Restore point made on: 2015-07-06 08:55:23

Restore point made on: 2015-07-06 18:31:43

Restore point made on: 2015-07-09 15:41:21
 

==================== BCD ================================
 

Windows-Start-Manager

---------------------

Bezeichner              {bootmgr}

device                  partition=Y:

description             Windows Boot Manager

locale                  de-DE

inherit                 {globalsettings}

default                 {default}

resumeobject            {70b5baff-25c9-11e2-902c-d5906764f43f}

displayorder            {default}

toolsdisplayorder       {memdiag}

timeout                 30
 

Windows-Startladeprogramm

-------------------------

Bezeichner              {default}

device                  partition=C:

path                    \Windows\system32\winload.exe

description             Windows 7

locale                  de-DE

inherit                 {bootloadersettings}

recoverysequence        {70b5bb01-25c9-11e2-902c-d5906764f43f}

recoveryenabled         Yes

osdevice                partition=C:

systemroot              \Windows

resumeobject            {70b5baff-25c9-11e2-902c-d5906764f43f}

nx                      OptIn

bootlog                 No
 

Windows-Startladeprogramm

-------------------------

Bezeichner              {70b5bb01-25c9-11e2-902c-d5906764f43f}

device                  ramdisk=[C:]\Recovery\70b5bb01-25c9-11e2-902c-d5906764f43f\Winre.wim,{70b5bb02-25c9-11e2-902c-d5906764f43f}

path                    \windows\system32\winload.exe

description             Windows Recovery Environment

inherit                 {bootloadersettings}

osdevice                ramdisk=[C:]\Recovery\70b5bb01-25c9-11e2-902c-d5906764f43f\Winre.wim,{70b5bb02-25c9-11e2-902c-d5906764f43f}

systemroot              \windows

nx                      OptIn

winpe                   Yes
 

Wiederaufnahme aus dem Ruhezustand

----------------------------------

Bezeichner              {70b5baff-25c9-11e2-902c-d5906764f43f}

device                  partition=C:

path                    \Windows\system32\winresume.exe

description             Windows Resume Application

locale                  de-DE

inherit                 {resumeloadersettings}

filedevice              partition=C:

filepath                \hiberfil.sys

debugoptionenabled      No
 

Windows-Speichertestprogramm

----------------------------

Bezeichner              {memdiag}

device                  partition=Y:

path                    \boot\memtest.exe

description             Windows Memory Diagnostic

locale                  de-DE

inherit                 {globalsettings}

badmemoryaccess         Yes
 

EMS-Einstellungen

-----------------

Bezeichner              {emssettings}

bootems                 Yes
 

Debuggereinstellungen

---------------------

Bezeichner              {dbgsettings}

debugtype               Serial

debugport               1

baudrate                115200
 

RAM-Defekte

-----------

Bezeichner              {badmemory}
 

Globale Einstellungen

---------------------

Bezeichner              {globalsettings}

inherit                 {dbgsettings}

                        {emssettings}

                        {badmemory}
 

Startladeprogramm-Einstellungen

-------------------------------

Bezeichner              {bootloadersettings}

inherit                 {globalsettings}

                        {hypervisorsettings}
 

Hypervisoreinstellungen

-------------------

Bezeichner              {hypervisorsettings}

hypervisordebugtype     Serial

hypervisordebugport     1

hypervisorbaudrate      115200
 

Einstellungen zur Ladeprogrammfortsetzung

-----------------------------------------

Bezeichner              {resumeloadersettings}

inherit                 {globalsettings}
 

Ger„teoptionen

--------------

Bezeichner              {70b5bb02-25c9-11e2-902c-d5906764f43f}

description             Ramdisk Options

ramdisksdidevice        partition=C:

ramdisksdipath          \Recovery\70b5bb01-25c9-11e2-902c-d5906764f43f\boot.sdi
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 11%

Total physical RAM: 7641.07 MB

Available physical RAM: 6785.27 MB

Total Virtual: 7639.27 MB

Available Virtual: 6786.35 MB
 

==================== Drives ================================
 

Drive c: (Boot Neu SSD) (Fixed) (Total:231.78 GB) (Free:113.42 GB) NTFS

Drive d: () (Fixed) (Total:0.1 GB) (Free:0.03 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Drive f: (Boot) (Fixed) (Total:880.41 GB) (Free:179.89 GB) NTFS

Drive g: (Recover) (Fixed) (Total:50 GB) (Free:25.52 GB) NTFS

Drive m: () (Removable) (Total:7.47 GB) (Free:2.65 GB) NTFS

Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Drive y: () (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 232.9 GB) (Disk ID: 2D7529B6)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=231.8 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=1 GB) - (Type=12)
 

========================================================

Disk: 1 (Size: 931.5 GB) (Disk ID: 17AA74B7)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=880.4 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=50 GB) - (Type=07 NTFS)

Partition 4: (Not Active) - (Size=1 GB) - (Type=12)
 

========================================================

Disk: 5 (MBR Code: Windows 7 or 8) (Size: 7.5 GB) (Disk ID: 00377FA4)

Partition 1: (Active) - (Size=7.5 GB) - (Type=07 NTFS)
 
 

LastRegBack: 2015-07-03 13:28
 

==================== End of log ============================
Ich würde mich über eure Hilfe sehr freuen, danke schonmal.

Patrick

Password found 123