Hallo zusammen!

Ich habe einen Windows 2008 Server als Fileserver bei mir zuhause stehen. Mir ist vor einiger Zeit schon aufgefallen, dass einige PDF Dateien nichtmehr funktionierten, da habe ich mir noch nichts dabei gedacht. Dachte dass sei ein Kopierfehler gewesen da ich zu der Zeit öfter die Festplatte wechseln musste.

Jetzt habe ich allerdings festgestellt, dass so einige andere Dateien (nicht alle) auch defekt sind. PDF, JPEG, XLSX und DOCX sind nichtmehr zu öffnen. JPGs sind einfach schwarz, bei erhaltenem Dateinamen, kein "Locked" file oder ähnliches, also originaldatei besteht keine. Shadowdateien leider auch nicht. PDF, Word und Excel dateien wird angezeigt, dass die Dateien beschädigt sind und werden nicht geöffnet.

Ich habe dann diverse Themen hier gelesen und die decrypter Tools dazu ausprobiert, leider ohne Erfolg!

Malwarebytes ist durchgelaufen und hat auf dem Server nix gefunden. Nur ein JPG wurde mit "extension.missmatch" erkannt. Da die Festplatten aber über SMB im Netzwerk hängen kann auch einer der Clientrechner infiziert sein.
FRST ist durchgelaufen, die Logs kann ich schicken!
Würde gerne eine der Dateien mal per email schicken, ob da überhaupt noch was zu machen ist?

danke bereits vorab!

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-03-2015 01
Ran by Administrator at 2015-03-06 20:48:57
Running from D:\Storage\Handy Fotos
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)


==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

AMD Catalyst Install Manager (HKLM\...\{37FCE154-7F59-74F0-3A35-BF503CEB230B}) (Version: 8.0.877.0 - Advanced Micro Devices, Inc.)
DirectUpdate (HKLM\...\DirectUpdate_is1) (Version: 4.6.6 - WildUP - William Levra-Juillet)
GoodSync (HKLM\...\{B26B00DA-2E5D-4CF2-83C5-911198C0F009}) (Version: 9.7.7.7 - Siber Systems)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Exchange Server 2010 (HKLM\...\Microsoft Exchange v14) (Version: 14.3.123.4 - Microsoft Corporation)
Microsoft Filter Pack 2.0 (HKLM\...\{95140000-2000-0407-1000-0000000FF1CE}) (Version: 14.0.6029.1000 - Microsoft Corporation)
Microsoft Server Speech Platform Runtime (x64) (HKLM\...\{3B433087-E62E-4BF5-97F9-4AF6E1C2409C}) (Version: 10.1.7200.5 - Microsoft Corporation)
Microsoft Unified Communications Managed API, Core Runtime 64-bit (HKLM\...\{7EB901DD-CB50-4046-A434-3E9A112E8F86}) (Version: 3.5.6907.210 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Mobile Broadband HL Service (HKLM-x32\...\Mobile Broadband HL Service) (Version: 22.001.21.00.03 - Huawei Technologies Co.,Ltd)
Plex Media Server (HKLM-x32\...\{7425d872-d65d-42c9-8c6d-7a8a529a4b50}) (Version: 0.9.1107 - Plex, Inc.)
Plex Media Server (x32 Version: 0.9.1107 - Plex, Inc.) Hidden
UltraVnc (HKLM\...\Ultravnc2_is1) (Version: 1.1.9.6 - uvnc bvba)
WinRAR 4.11 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.11.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3376472197-1297083076-3331110164-500_Classes\CLSID\{004B49B7-11B9-5058-FF22-08DD093ADC4B}\InprocServer32 -> {1F512083-9468-D082-D5B0-20EE85889A47} No File
CustomCLSID: HKU\S-1-5-21-3376472197-1297083076-3331110164-500_Classes\CLSID\{DD0822FF-3A09-4BDC-B749-4B00B9115850}\InprocServer32 -> {5ED054A7-9468-D082-F1C4-A1AF85889A47} No File

==================== Restore Points  =========================

ATTENTION: System Restore is disabled.
Check "winmgmt" service or repair WMI.


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0418C55E-87CD-443E-A97F-F2A56B7FD4BE} - System32\Tasks\Database One Copy Alert => C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe [2009-07-14] (Microsoft Corporation)
Task: {63EE8552-A444-4BA2-8E1E-C8350D6D412A} - System32\Tasks\Microsoft\Windows\Server Manager\ServerManager => C:\Windows\system32\ServerManagerLauncher.exe [2009-07-14] (Microsoft Corporation)
Task: {69110D7B-41DC-4E9D-BDD3-C826C7DB613B} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Server\ServerRoleUsageCollector => C:\Windows\system32\ceipdata.exe [2010-11-21] (Microsoft Corporation)
Task: {AFECE848-8DA2-461B-B5E6-CBEF57A4DF7D} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Server\ServerRoleCollector => C:\Windows\system32\ceiprole.exe [2010-11-21] (Microsoft Corporation)
Task: {D49A10DA-0F70-4779-BD96-B2D976A4F2E3} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Server\ServerCeipAssistant => C:\Windows\system32\ceipdata.exe [2010-11-21] (Microsoft Corporation)

==================== Loaded Modules (whitelisted) ==============

2014-01-28 20:58 - 2014-01-28 20:58 - 08167056 _____ () C:\Program Files\GoodSync\Gs-Server.exe
2014-04-10 18:05 - 2013-07-23 04:47 - 00239696 _____ () C:\ProgramData\MobileBrServ\mbbservice.exe
2014-01-18 10:51 - 2013-12-03 16:08 - 00229376 _____ () C:\nssm.exe
2014-06-26 06:03 - 2014-06-26 06:03 - 00003584 _____ () C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Temporary ASP.NET Files\microsoft-server-activesync\a9362037\12cdb99e\App_global.asax.r1lqoerr.dll
2014-12-28 19:34 - 2012-02-17 20:55 - 00193536 _____ () C:\Program Files\WinRAR\rarext.dll
2014-07-16 09:28 - 2014-07-16 09:28 - 00003584 _____ () C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Temporary ASP.NET Files\owa\c60e4757\114626a\App_global.asax.ds35kupg.dll
2014-07-16 09:28 - 2014-07-16 09:28 - 00061440 _____ () C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Temporary ASP.NET Files\owa\c60e4757\114626a\App_Web_b3h7eliq.dll
2014-10-28 16:48 - 2014-10-28 16:48 - 00303104 _____ () C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Temporary ASP.NET Files\owa\c60e4757\114626a\App_Web_rt9k074e.dll
2014-10-28 16:48 - 2014-10-28 16:48 - 00147456 _____ () C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Temporary ASP.NET Files\owa\c60e4757\114626a\App_Web_ocuwuvp7.dll
2014-10-31 12:29 - 2014-10-31 12:29 - 00053248 _____ () C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Temporary ASP.NET Files\owa\c60e4757\114626a\App_Web_g4uivppx.dll
2014-01-18 10:51 - 2011-12-29 13:32 - 00048640 _____ () C:\Program Files (x86)\Pyload\dist\pyLoadCore.exe
2014-01-18 10:51 - 2010-09-06 09:59 - 00216535 _____ () C:\Program Files (x86)\Pyload\pyLoadCore.exe
2014-12-21 22:31 - 2014-12-21 22:31 - 00072840 _____ () C:\Program Files (x86)\Plex\Plex Media Server\zlib.dll
2014-12-21 22:31 - 2014-12-21 22:31 - 00196232 _____ () C:\Program Files (x86)\Plex\Plex Media Server\libidn.dll
2014-12-21 22:31 - 2014-12-21 22:31 - 00838792 _____ () C:\Program Files (x86)\Plex\Plex Media Server\libxml2.dll
2014-12-21 22:31 - 2014-12-21 22:31 - 00049800 _____ () C:\Program Files (x86)\Plex\Plex Media Server\soci_sqlite3-vc80-3_0.dll
2014-12-21 22:31 - 2014-12-21 22:31 - 00086664 _____ () C:\Program Files (x86)\Plex\Plex Media Server\soci_core-vc80-3_0.dll
2014-12-21 22:31 - 2014-12-21 22:31 - 02092680 _____ () C:\Program Files (x86)\Plex\Plex Media Server\opencv_core249.dll
2014-12-21 22:31 - 2014-12-21 22:31 - 01883272 _____ () C:\Program Files (x86)\Plex\Plex Media Server\opencv_imgproc249.dll
2014-12-21 22:31 - 2014-12-21 22:31 - 00502920 _____ () C:\Program Files (x86)\Plex\Plex Media Server\tag.dll
2014-01-18 10:51 - 2010-11-27 17:31 - 00040960 _____ () C:\Program Files (x86)\Pyload\dist\_socket.pyd
2014-01-18 10:51 - 2011-06-12 19:31 - 00301056 _____ () C:\Program Files (x86)\Pyload\dist\pycurl.pyd
2014-01-18 10:51 - 2010-11-27 17:31 - 00285184 _____ () C:\Program Files (x86)\Pyload\dist\_hashlib.pyd
2014-01-18 10:51 - 2010-11-27 17:31 - 00011776 _____ () C:\Program Files (x86)\Pyload\dist\select.pyd
2014-01-18 10:51 - 2010-11-27 17:31 - 00057344 _____ () C:\Program Files (x86)\Pyload\dist\_sqlite3.pyd
2014-01-18 10:51 - 2010-11-27 17:31 - 00635392 _____ () C:\Program Files (x86)\Pyload\dist\sqlite3.dll
2014-01-18 10:51 - 2010-11-27 17:31 - 00688128 _____ () C:\Program Files (x86)\Pyload\dist\unicodedata.pyd
2014-01-18 10:51 - 2010-11-27 17:31 - 00988672 _____ () C:\Program Files (x86)\Pyload\dist\_bsddb.pyd
2014-01-18 10:51 - 2011-02-13 16:02 - 00008192 _____ () C:\Program Files (x86)\Pyload\dist\Crypto.Util.strxor.pyd
2014-01-18 10:51 - 2011-02-13 16:02 - 00031232 _____ () C:\Program Files (x86)\Pyload\dist\Crypto.Cipher.AES.pyd
2014-01-18 10:51 - 2010-11-27 17:31 - 00073216 _____ () C:\Program Files (x86)\Pyload\dist\_ctypes.pyd
2014-01-18 10:51 - 2010-11-01 16:54 - 00053248 _____ () C:\Program Files (x86)\Pyload\dist\OpenSSL.crypto.pyd
2014-01-18 10:51 - 2010-11-01 16:54 - 00010240 _____ () C:\Program Files (x86)\Pyload\dist\OpenSSL.rand.pyd
2014-01-18 10:51 - 2010-11-01 16:54 - 00039936 _____ () C:\Program Files (x86)\Pyload\dist\OpenSSL.SSL.pyd
2014-01-18 10:51 - 2011-04-19 08:56 - 00408064 _____ () C:\Program Files (x86)\Pyload\dist\_imaging.pyd
2014-12-21 22:31 - 2014-12-21 22:31 - 00044680 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\_socket.pyd
2014-12-21 22:31 - 2014-12-21 22:31 - 00027784 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\_ssl.pyd
2014-12-21 22:31 - 2014-12-21 22:31 - 00018568 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\_hashlib.pyd
2014-12-21 22:31 - 2014-12-21 22:31 - 00034952 _____ () C:\Program Files (x86)\Plex\Plex Media Server\Exts\simplejson\_speedups.pyd
2014-12-21 22:31 - 2014-12-21 22:31 - 00836232 _____ () C:\Program Files (x86)\Plex\Plex Media Server\Exts\lxml\etree.pyd
2014-12-21 22:31 - 2014-12-21 22:31 - 00062600 _____ () C:\Program Files (x86)\Plex\Plex Media Server\libexslt.dll
2014-12-21 22:31 - 2014-12-21 22:31 - 00166024 _____ () C:\Program Files (x86)\Plex\Plex Media Server\libxslt.dll
2014-12-21 22:31 - 2014-12-21 22:31 - 00192136 _____ () C:\Program Files (x86)\Plex\Plex Media Server\Exts\lxml\objectify.pyd
2014-12-21 22:31 - 2014-12-21 22:31 - 00016520 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\select.pyd
2014-12-21 22:31 - 2014-12-21 22:31 - 00054920 _____ () C:\Program Files (x86)\Plex\Plex Media Server\Exts\OpenSSL\crypto.pyd
2014-12-21 22:31 - 2014-12-21 22:31 - 00017032 _____ () C:\Program Files (x86)\Plex\Plex Media Server\Exts\OpenSSL\rand.pyd
2014-12-21 22:31 - 2014-12-21 22:31 - 00043656 _____ () C:\Program Files (x86)\Plex\Plex Media Server\Exts\OpenSSL\SSL.pyd
2014-12-21 22:31 - 2014-12-21 22:31 - 00081544 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\_ctypes.pyd
2014-12-21 22:31 - 2014-12-21 22:31 - 00111240 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\pyexpat.pyd
2014-12-21 22:31 - 2014-12-21 22:31 - 00689800 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\unicodedata.pyd

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3376472197-1297083076-3331110164-500\Control Panel\Desktop\\Wallpaper -> 
DNS Servers: 192.168.5.1 - 192.168.5.50

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-1069927590-2038760598-1045681319-500 - Administrator - Enabled)
Gast (S-1-5-21-1069927590-2038760598-1045681319-501 - Limited - Disabled)
krbtgt (0 - Limited - Disabled) => %systemroot%\system32\config\systemprofile
SM_1a528e06d41849259 (0 - Limited - Disabled) => %systemroot%\system32\config\systemprofile
SM_6c4e3e311b1648d79 (0 - Limited - Disabled) => %systemroot%\system32\config\systemprofile
SM_8ff68f7309d442458 (0 - Limited - Disabled) => %systemroot%\system32\config\systemprofile
SM_bcbf76a392294a9eb (0 - Limited - Disabled) => %systemroot%\system32\config\systemprofile
nasuser (0 - Limited - Enabled) => %systemroot%\system32\config\systemprofile
read (0 - Limited - Enabled) => %systemroot%\system32\config\systemprofile
Trust (0 - Limited - Enabled) => %systemroot%\system32\config\systemprofile
FHEM (0 - Limited - Enabled) => %systemroot%\system32\config\systemprofile
MICROSERVER$ (0 - Administrator - Enabled) => %systemroot%\system32\config\systemprofile

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (01/10/2015 01:27:35 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/10/2015 01:21:28 PM) (Source: MSExchange ADAccess) (EventID: 2104) (User: )
Description: Prozess MSEXCHANGEADTOPOLOGYSERVICE.EXE (PID=1852). Fehler bei der Topologieerkennung aufgrund des Fehlers 'LDAP_SERVER_DOWN'. Dieses Ereignis kann auftreten, wenn mindestens ein Domänencontroller in lokalen oder allen Domänen aufgrund von Netzwerkproblemen nicht mehr erreichbar ist. Testen Sie die Netzwerkverbindungen mit lokalen Domänencontrollern mithilfe des Befehlszeilentools 'Ping' oder 'PathPing'. Führen Sie das Dcdiag-Befehlszeilenprogramm aus, um den Domänencontrollerzustand zu testen.

Error: (01/10/2015 01:21:28 PM) (Source: MSExchange ADAccess) (EventID: 2102) (User: )
Description: Prozess MSEXCHANGEADTOPOLOGYSERVICE.EXE (PID=1852). Keine Antwort von allen verwendeten Domänencontrollerservern:

Microserver.homenet.local

Error: (01/04/2015 08:41:48 PM) (Source: MSExchangeAL) (EventID: 8365) (User: )
Description: Die Sicherheitsbeschreibung konnte nicht aus dem Exchange Server-Objekt mit GUID = 2DDF0DFFC3C5AC4B93C1D701A96C6068 gelesen werden. Die Proxyadressberechnungs-RPC-Schnittstelle ist daher auf dem lokalen Computer mit Exchange Server nicht verfügbar.

Error: (01/03/2015 00:19:48 AM) (Source: MSExchange ADAccess) (EventID: 2102) (User: )
Description: Prozess MSEXCHANGEADTOPOLOGYSERVICE.EXE (PID=1852). Keine Antwort von allen verwendeten Domänencontrollerservern:

Microserver.homenet.local

Error: (01/02/2015 06:14:06 PM) (Source: ESE) (EventID: 2007) (User: )
Description: Information Store (1928) Schattenkopieinstanz 1 wurde abgebrochen.


Weitere Informationen erhalten Sie unter "hxxp://www.microsoft.com/contentredirect.asp".

Error: (01/02/2015 06:14:06 PM) (Source: MSExchangeIS) (EventID: 9782) (User: )
Description: Exchange VSS Writer (Instanz 0688dac5-6701-4f7a-9209-56846bf086d5:1) hat die Sicherung der Datenbank 'Mailbox Database 2058236133' mit Fehlern abgeschlossen. Die Sicherung wurde nicht erfolgreich abgeschlossen, und es wurden keine Protokolldateien für diese Datenbank abgeschnitten.

Error: (01/02/2015 06:14:06 PM) (Source: MSExchangeIS) (EventID: 9782) (User: )
Description: Exchange VSS Writer (Instanz 0688dac5-6701-4f7a-9209-56846bf086d5:1) hat die Sicherung der Datenbank 'Public Folder Database 0928137553' mit Fehlern abgeschlossen. Die Sicherung wurde nicht erfolgreich abgeschlossen, und es wurden keine Protokolldateien für diese Datenbank abgeschnitten.

Error: (01/02/2015 10:11:14 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/24/2014 08:38:37 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (03/06/2015 07:04:01 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 1205.

Error: (03/06/2015 07:04:01 PM) (Source: Schannel) (EventID: 4106) (User: NT-AUTORITÄT)
Description: Eine TLS 1.0-Verbindungsanforderung wurde von einer Remoteclientanwendung übermittelt, jedoch werden keine der Verschlüsselungssammlungen, die von der Clientanwendung unterstützt werden, vom Server unterstützt. Fehler bei der SSL-Verbindungsanforderung.

Error: (03/06/2015 04:13:16 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 10.

Error: (03/06/2015 02:55:24 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 1205.

Error: (03/06/2015 02:55:24 PM) (Source: Schannel) (EventID: 4106) (User: NT-AUTORITÄT)
Description: Eine TLS 1.0-Verbindungsanforderung wurde von einer Remoteclientanwendung übermittelt, jedoch werden keine der Verschlüsselungssammlungen, die von der Clientanwendung unterstützt werden, vom Server unterstützt. Fehler bei der SSL-Verbindungsanforderung.

Error: (03/06/2015 02:15:22 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 1205.

Error: (03/06/2015 02:15:22 PM) (Source: Schannel) (EventID: 4106) (User: NT-AUTORITÄT)
Description: Eine TLS 1.0-Verbindungsanforderung wurde von einer Remoteclientanwendung übermittelt, jedoch werden keine der Verschlüsselungssammlungen, die von der Clientanwendung unterstützt werden, vom Server unterstützt. Fehler bei der SSL-Verbindungsanforderung.

Error: (03/05/2015 11:23:28 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 1203.

Error: (03/05/2015 06:00:57 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 1203.

Error: (03/05/2015 06:00:52 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 1203.


Microsoft Office Sessions:
=========================
Error: (01/10/2015 01:27:35 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/10/2015 01:21:28 PM) (Source: MSExchange ADAccess) (EventID: 2104) (User: )
Description: MSEXCHANGEADTOPOLOGYSERVICE.EXE1852

Error: (01/10/2015 01:21:28 PM) (Source: MSExchange ADAccess) (EventID: 2102) (User: )
Description: MSEXCHANGEADTOPOLOGYSERVICE.EXE1852Microserver.homenet.local

Error: (01/04/2015 08:41:48 PM) (Source: MSExchangeAL) (EventID: 8365) (User: )
Description: 2DDF0DFFC3C5AC4B93C1D701A96C6068

Error: (01/03/2015 00:19:48 AM) (Source: MSExchange ADAccess) (EventID: 2102) (User: )
Description: MSEXCHANGEADTOPOLOGYSERVICE.EXE1852Microserver.homenet.local

Error: (01/02/2015 06:14:06 PM) (Source: ESE) (EventID: 2007) (User: )
Description: Information Store19281

Error: (01/02/2015 06:14:06 PM) (Source: MSExchangeIS) (EventID: 9782) (User: )
Description: 0688dac5-6701-4f7a-9209-56846bf086d5:1Mailbox Database 2058236133

Error: (01/02/2015 06:14:06 PM) (Source: MSExchangeIS) (EventID: 9782) (User: )
Description: 0688dac5-6701-4f7a-9209-56846bf086d5:1Public Folder Database 0928137553

Error: (01/02/2015 10:11:14 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/24/2014 08:38:37 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info =========================== 

Processor: AMD Turion(tm) II Neo N54L Dual-Core Processor
Percentage of memory in use: 77%
Total physical RAM: 8063.18 MB
Available physical RAM: 1832.3 MB
Total Pagefile: 16124.55 MB
Available Pagefile: 7481.39 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:232.79 GB) (Free:151.68 GB) NTFS
Drive d: (HDD1) (Fixed) (Total:2328.77 GB) (Free:938.22 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 4E6BD6B6)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=232.8 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 2328.8 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

==================== End Of Log ============================
         

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-03-2015 01
Ran by Administrator (administrator) on MICROSERVER on 06-03-2015 20:48:00
Running from D:\Storage\Handy Fotos
Loaded Profiles: Administrator (Available profiles: Administrator & Classic .NET AppPool)
Platform: Windows Server 2008 R2 Datacenter Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe
(Microsoft Corporation) C:\Windows\System32\dfsrs.exe
(WildUP) C:\Program Files\DirectUpdate v4\DUEngine.exe
(Microsoft Corporation) C:\Windows\System32\dns.exe
() C:\Program Files\GoodSync\Gs-Server.exe
(Microsoft Corporation) C:\Windows\System32\inetsrv\inetinfo.exe
(Microsoft Corporation) C:\Windows\System32\ismserv.exe
() C:\ProgramData\MobileBrServ\mbbService.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Exchange Server\V14\Bin\MSExchangeADTopologyService.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Exchange Server\V14\Bin\exfba.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Exchange Server\V14\Bin\store.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Exchange Server\V14\Bin\MSExchangeMailboxAssistants.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Exchange Server\V14\Bin\MSExchangeMailSubmission.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Exchange Server\V14\Bin\Microsoft.Exchange.ProtectedServiceHost.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Exchange Server\V14\Bin\msexchangerepl.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Exchange Server\V14\Bin\Microsoft.Exchange.RpcClientAccess.Service.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Exchange Server\V14\Bin\mad.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Exchange Server\V14\Bin\Microsoft.Exchange.ServiceHost.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Exchange Server\V14\Bin\MSExchangeThrottling.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Exchange Server\V14\Bin\MSExchangeTransport.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Exchange Server\V14\Bin\MSExchangeTransportLogSearch.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Exchange Server\V14\Bin\umservice.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Exchange Server\V14\Bin\EdgeTransport.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Exchange Server\V14\Bin\msftesql.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
() C:\nssm.exe
(UltraVNC) C:\Program Files\UltraVNC\winvnc.exe
(Microsoft Corporation) C:\Windows\System32\dfssvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Exchange Server\V14\Bin\Microsoft.Exchange.AddressBook.Service.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Exchange Server\V14\Bin\Microsoft.Exchange.AntispamUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Exchange Server\V14\Bin\Microsoft.Exchange.EdgeSyncSvc.exe
(UltraVNC) C:\Program Files\UltraVNC\winvnc.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Exchange Server\V14\Bin\MsExchangeFDS.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Exchange Server\V14\Bin\Microsoft.Exchange.Search.ExSearch.exe
(Microsoft Corporation) C:\Windows\System32\vmms.exe
(Microsoft Corporation) C:\Windows\System32\nfsclnt.exe
(Microsoft Corporation) C:\Windows\System32\nfssvc.exe
(Microsoft Corporation) C:\Windows\System32\nfssvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\agents\Hygiene\Microsoft.Exchange.ContentFilter.Wrapper.exe
(Microsoft Corporation) C:\Windows\System32\vmwp.exe
(Microsoft Corporation) C:\Windows\System32\inetsrv\w3wp.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Exchange Server\V14\Bin\MSExchangeMailboxReplication.exe
(Microsoft Corporation) C:\Windows\System32\vds.exe
(Microsoft Corporation) C:\Windows\System32\vmwp.exe
(AMD) C:\Windows\System32\atieclxx.exe
(WildUP) C:\Program Files\DirectUpdate v4\DUControl.exe
(Plex, Inc.) C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe
(Plex, Inc.) C:\Program Files (x86)\Plex\Plex Media Server\PlexDlnaServer.exe
(Microsoft Corporation) C:\Windows\System32\inetsrv\w3wp.exe
(Microsoft Corporation) C:\Windows\System32\inetsrv\w3wp.exe
() C:\Program Files (x86)\Pyload\dist\pyLoadCore.exe
() C:\Program Files (x86)\Pyload\pyLoadCore.exe
() C:\Program Files (x86)\Pyload\dist\pyLoadCore.exe
() C:\Program Files (x86)\Pyload\dist\pyLoadCore.exe
() C:\Program Files (x86)\Pyload\dist\pyLoadCore.exe
() C:\Program Files (x86)\Pyload\dist\pyLoadCore.exe
() C:\Program Files (x86)\Pyload\dist\pyLoadCore.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Exchange Server\V14\Bin\UMWorkerProcess.exe
(Python Software Foundation) C:\Program Files (x86)\Plex\Plex Media Server\PlexScriptHost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [DUControl] => [X]
HKLM\...\Policies\Explorer: [ShowSuperHidden] 1
HKU\S-1-5-21-3376472197-1297083076-3331110164-500\...\Run: [DUControl] => C:\Program Files\DirectUpdate v4\DUControl.exe [52464 2011-03-02] (WildUP)
HKU\S-1-5-21-3376472197-1297083076-3331110164-500\...\Run: [Plex Media Server] => C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe [5142664 2014-12-21] (Plex, Inc.)
HKU\S-1-5-21-3376472197-1297083076-3331110164-500\...\MountPoints2: {77a8027a-c0c0-11e3-8a5a-38eaa7a49ece} - F:\AutoRun.exe
Lsa: [Notification Packages] scecli rassfm
SecurityProviders: credssp.dll, pwdssp.dll
ShellIconOverlayIdentifiers: [NFSShares] -> {04EA2470-913A-11D2-8CB8-0000F8083420} => C:\Windows\System32\nfssprop.dll (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-3376472197-1297083076-3331110164-500\Software\Microsoft\Internet Explorer\Main,Start Page = res://iesetup.dll/HardAdmin.htm
Tcpip\..\Interfaces\{CA9AF9C8-8252-427B-94EE-DC8500B88046}: [NameServer] 192.168.5.1,192.168.5.50
Tcpip\..\Interfaces\{EABB477B-F711-4FB0-8285-E0852C12DF1E}: [NameServer] 127.0.0.1

FireFox:
========

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ADWS; C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe [487424 2013-01-25] (Microsoft Corporation)
R2 Dfs; C:\Windows\system32\dfssvc.exe [377344 2010-11-21] (Microsoft Corporation)
R2 DFSR; C:\Windows\system32\DFSRs.exe [4518400 2010-11-21] (Microsoft Corporation)
R2 DirectUpdate; C:\Program Files\DirectUpdate v4\DUEngine.exe [324336 2011-03-02] (WildUP)
R2 DNS; C:\Windows\system32\dns.exe [696832 2011-12-26] (Microsoft Corporation)
S3 FCRegSvc; C:\Windows\system32\FCRegSvc.dll [25600 2009-07-14] (Microsoft Corporation)
R2 GsServer; C:\Program Files\GoodSync\Gs-Server.exe [8167056 2014-01-28] ()
R2 IISADMIN; C:\Windows\system32\inetsrv\inetinfo.exe [15872 2010-11-21] (Microsoft Corporation)
R2 IsmServ; C:\Windows\System32\ismserv.exe [59392 2010-11-21] (Microsoft Corporation)
R2 kdc; C:\Windows\System32\lsass.exe [31232 2014-04-12] (Microsoft Corporation)
R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [239696 2013-07-23] ()
R2 MSExchangeAB; C:\Program Files\Microsoft\Exchange Server\V14\bin\Microsoft.Exchange.AddressBook.Service.exe [155240 2013-02-05] (Microsoft Corporation)
R2 MSExchangeADTopology; C:\Program Files\Microsoft\Exchange Server\V14\Bin\MSExchangeADTopologyService.exe [113720 2013-02-05] (Microsoft Corporation)
R2 MSExchangeAntispamUpdate; C:\Program Files\Microsoft\Exchange Server\V14\Bin\Microsoft.Exchange.AntispamUpdateSvc.exe [44640 2013-02-05] (Microsoft Corporation)
R2 MSExchangeEdgeSync; C:\Program Files\Microsoft\Exchange Server\V14\Bin\Microsoft.Exchange.EdgeSyncSvc.exe [114248 2013-02-05] (Microsoft Corporation)
R2 MSExchangeFBA; C:\Program Files\Microsoft\Exchange Server\V14\Bin\ExFBA.exe [110560 2013-02-05] (Microsoft Corporation)
R2 MSExchangeFDS; C:\Program Files\Microsoft\Exchange Server\V14\Bin\MSExchangeFDS.exe [110080 2013-02-05] (Microsoft Corporation)
S3 MSExchangeImap4; C:\Program Files\Microsoft\Exchange Server\V14\ClientAccess\PopImap\Microsoft.Exchange.Imap4Service.exe [28768 2013-02-05] (Microsoft Corporation)
R2 MSExchangeIS; C:\Program Files\Microsoft\Exchange Server\V14\bin\store.exe [6923744 2013-02-05] (Microsoft Corporation)
R2 MSExchangeMailboxAssistants; C:\Program Files\Microsoft\Exchange Server\V14\Bin\MSExchangeMailboxAssistants.exe [781880 2013-02-05] (Microsoft Corporation)
R2 MSExchangeMailboxReplication; C:\Program Files\Microsoft\Exchange Server\V14\Bin\MSExchangeMailboxReplication.exe [27216 2013-02-05] (Microsoft Corporation)
R2 MSExchangeMailSubmission; C:\Program Files\Microsoft\Exchange Server\V14\Bin\MSExchangeMailSubmission.exe [118320 2013-02-05] (Microsoft Corporation)
S3 MSExchangeMonitoring; C:\Program Files\Microsoft\Exchange Server\V14\Bin\Microsoft.Exchange.Monitoring.exe [73296 2013-02-05] (Microsoft Corporation)
S3 MSExchangePop3; C:\Program Files\Microsoft\Exchange Server\V14\ClientAccess\PopImap\Microsoft.Exchange.Pop3Service.exe [28760 2013-02-05] (Microsoft Corporation)
R2 MSExchangeProtectedServiceHost; C:\Program Files\Microsoft\Exchange Server\V14\bin\Microsoft.Exchange.ProtectedServiceHost.exe [32368 2013-02-05] (Microsoft Corporation)
R2 MSExchangeRepl; C:\Program Files\Microsoft\Exchange Server\V14\bin\msexchangerepl.exe [69144 2013-02-05] (Microsoft Corporation)
R2 MSExchangeRPC; C:\Program Files\Microsoft\Exchange Server\V14\bin\Microsoft.Exchange.RpcClientAccess.Service.exe [89744 2013-02-05] (Microsoft Corporation)
R2 MSExchangeSA; C:\Program Files\Microsoft\Exchange Server\V14\bin\mad.exe [1371608 2013-02-05] (Microsoft Corporation)
R2 MSExchangeSearch; C:\Program Files\Microsoft\Exchange Server\V14\Bin\Microsoft.Exchange.Search.ExSearch.exe [417384 2013-02-05] (Microsoft Corporation)
R2 MSExchangeServiceHost; C:\Program Files\Microsoft\Exchange Server\V14\bin\Microsoft.Exchange.ServiceHost.exe [35400 2013-02-05] (Microsoft Corporation)
R2 MSExchangeThrottling; C:\Program Files\Microsoft\Exchange Server\V14\Bin\MSExchangeThrottling.exe [48688 2013-02-05] (Microsoft Corporation)
R2 MSExchangeTransport; C:\Program Files\Microsoft\Exchange Server\V14\Bin\MSExchangeTransport.exe [81448 2013-02-05] (Microsoft Corporation)
R2 MSExchangeTransportLogSearch; C:\Program Files\Microsoft\Exchange Server\V14\Bin\MSExchangeTransportLogSearch.exe [212560 2013-02-05] (Microsoft Corporation)
R2 MSExchangeUM; C:\Program Files\Microsoft\Exchange Server\V14\Bin\umservice.exe [146928 2013-02-05] (Microsoft Corporation)
R3 msftesql-Exchange; C:\Program Files\Microsoft\Exchange Server\V14\Bin\msftesql.exe [183728 2013-02-05] (Microsoft Corporation)
R2 NfsClnt; C:\Windows\system32\nfsclnt.exe [65536 2010-11-21] (Microsoft Corporation)
R2 NfsService; C:\Windows\system32\nfssvc.exe [41472 2010-11-21] (Microsoft Corporation)
R2 NTDS; C:\Windows\System32\lsass.exe [31232 2014-04-12] (Microsoft Corporation)
S4 NtFrs; C:\Windows\system32\ntfrs.exe [1020416 2010-11-21] (Microsoft Corporation)
R2 nvspwmi; C:\Windows\system32\nvspwmi.dll [407040 2010-11-21] (Microsoft Corporation)
R2 Pyload; C:\nssm.exe [229376 2013-12-03] () [File not signed]
S3 RPCHTTPLBS; C:\Windows\System32\RpcProxy\LBService.dll [24576 2010-11-21] (Microsoft Corporation)
S3 RSoPProv; C:\Windows\system32\RSoPProv.exe [91648 2009-07-14] (Microsoft Corporation)
S3 sacsvr; C:\Windows\system32\sacsvr.dll [14848 2009-07-14] (Microsoft Corporation)
R2 uvnc_service; C:\Program Files\UltraVNC\WinVNC.exe [1940248 2013-12-05] (UltraVNC)
R2 vhdsvc; C:\Windows\system32\vhdsvc.dll [193024 2010-11-21] (Microsoft Corporation)
R2 vmms; C:\Windows\system32\vmms.exe [4625408 2010-11-21] (Microsoft Corporation)
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-21] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S3 wsbexchange; C:\Program Files\Microsoft\Exchange Server\V14\bin\wsbexchange.exe [131064 2013-02-05] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 DfsDriver; C:\Windows\System32\drivers\dfs.sys [51776 2009-07-14] (Microsoft Corporation)
R0 DfsrRo; C:\Windows\System32\drivers\dfsrro.sys [66944 2010-11-21] (Microsoft Corporation)
R1 hvboot; C:\Windows\System32\drivers\hvboot.sys [118128 2012-08-22] (Microsoft Corporation)
S3 ioatdma; C:\Windows\System32\Drivers\qd260x64.sys [35328 2009-06-10] (Intel Corporation)
R3 msnfsflt; C:\Windows\System32\drivers\msnfsflt.sys [31232 2010-11-21] (Microsoft Corporation)
R3 NfsRdr; C:\Windows\System32\drivers\nfsrdr.sys [246272 2010-11-21] (Microsoft Corporation)
R3 NfsServer; C:\Windows\System32\drivers\nfssvr.sys [736256 2013-01-02] (Microsoft Corporation)
R3 passthruparser; C:\Windows\System32\drivers\passthruparser.sys [20992 2010-11-21] (Microsoft Corporation)
R3 Portmap; C:\Windows\System32\drivers\portmap.sys [57344 2010-11-21] (Microsoft Corporation)
R3 RpcXdr; C:\Windows\System32\drivers\rpcxdr.sys [104960 2010-11-21] (Microsoft Corporation)
S0 sacdrv; C:\Windows\System32\DRIVERS\sacdrv.sys [96320 2009-07-14] (Microsoft Corporation)
R3 vhdparser; C:\Windows\System32\drivers\vhdparser.sys [17408 2010-11-21] (Microsoft Corporation)
R3 VMSMP; C:\Windows\System32\DRIVERS\vmswitch.sys [407552 2011-05-14] (Microsoft Corporation)
S3 VMSP; C:\Windows\System32\DRIVERS\vmswitch.sys [407552 2011-05-14] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

NETSVC: sacsvr -> C:\Windows\system32\sacsvr.dll (Microsoft Corporation)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-06 20:47 - 2015-03-06 20:48 - 00000000 ____D () C:\FRST
2015-03-06 19:08 - 2015-03-06 20:16 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-06 19:08 - 2015-03-06 19:08 - 00001118 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-03-06 19:08 - 2015-03-06 19:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-03-06 19:07 - 2015-03-06 19:08 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-03-06 19:07 - 2015-03-06 19:07 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-03-06 19:07 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-03-06 19:07 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-03-06 19:07 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-06 19:23 - 2014-01-18 10:36 - 01157711 _____ () C:\Windows\WindowsUpdate.log
2015-03-04 19:12 - 2014-01-26 11:48 - 00000000 ____D () C:\Pyload
2015-02-24 03:17 - 2014-01-18 17:43 - 00295552 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

==================== Files in the root of some directories =======

2014-01-19 14:21 - 2014-01-19 14:21 - 0420692 _____ () C:\Users\Administrator\AppData\Local\dd_vcredistMSI5F0C.txt
2014-01-19 14:21 - 2014-01-19 14:21 - 0011424 _____ () C:\Users\Administrator\AppData\Local\dd_vcredistUI5F0C.txt
2014-01-19 09:37 - 2014-06-13 09:39 - 0007606 _____ () C:\Users\Administrator\AppData\Local\resmon.resmoncfg

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-25 23:47

==================== End Of Log ============================
         

--- --- ---

--- --- ---

--- --- ---

Hi,

Firmenrechner?

Also die Dateien haben alle noch die original dateiendung? Bitte eine zippen und anhaengen.

Hi!

Nein, ist ein privater Microserver.
Die Lizenzen sind zugegebenermaßen für private Zwecke ungewöhnlich, sind aber legal erworben.

ich habe mal ein defektes foto angehangen.

Alle Dateien haben noch den originalen Namen, originale Größe und Dateiendung.

Verschlüsselt scheint da nix. Aber ja, die sind kaputt.

OK! Danke dir!

Also am ehesten doch ein Problem der Festplatte... Warum auch immer, ist ne WD green, bisher keine Probleme gehabt.
Dateien vermutlich unwiederbringbar hinüber, oder?

Naja, Schattenkopien, falls noch nicht versucht. Aber ansonsten denke ich du kannst die Daten vergessen.