| |
| |||||||
Log-Analyse und Auswertung: PC mit Win7 64: Booten dauert lang / Programme starten auffällig langsam Teil 1Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
03.06.2015, 09:58
| #1 |
 |  PC mit Win7 64: Booten dauert lang / Programme starten auffällig langsam Teil 1 Hallo liebe Experten, seit etwa 2 Wochen bootet mein PC sehr langsam. Auch Programme (Firefox, Thunderbird, Softmaker FreeOffice etc.) brauchen gefühlt dreimal so lang, bis sie geladen sind. Selbst der Windows-Explorer braucht eine Gedenkminute. Treiber habe ich soweit wie möglich aktualisiert. Die Windows-Updates sind auch aktuell. Ich habe Avast-AV installiert, dazu habe ich Malwarebytes und Emisoft mehrmals ausgeführt. Leider ohne Erfolg  Ich bin nun mit meinem Latein am EndeIch habe mich so gut es geht an die 8 goldenen Regeln des Forums gehalten (Defogger, FRST etc.) und poste nun alle erforderlichen log-Dateien. Vorab schon mal vielen Dank für Eure Unterstützung. P.S.: Leider ist die GMER Log sehr groß. Ich muß sie in drei Teile aufteilen. Es wird also vier Posts von mir geben. defogger_disable by jpshortstuff (23.02.10.1) Log created at 17:04 on 02/06/2015 (Eltern) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 29-05-2015 Ran by Eltern (administrator) on ELTERN-PC on 02-06-2015 17:10:07 Running from C:\Users\Eltern\Desktop Loaded Profiles: Eltern (Available Profiles: Eltern) Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Emsisoft Ltd) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe (Avast Software s.r.o.) C:\Program Files (x86)\AVAST Software\Avast\AvastSvc.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Avast Software s.r.o.) C:\Program Files (x86)\AVAST Software\Avast\avastui.exe (Emsisoft Ltd) C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Avast Software s.r.o.) C:\Program Files (x86)\AVAST Software\Avast\setup\instup.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files (x86)\AVAST Software\Avast\AvastUI.exe [5515496 2015-05-12] (Avast Software s.r.o.) HKLM-x32\...\Run: [emsisoft anti-malware] => c:\program files (x86)\emsisoft anti-malware\a2guard.exe [4923832 2015-05-26] (Emsisoft Ltd) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-2127788250-3807647062-608468377-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Bubbles.scr [899584 2010-11-20] (Microsoft Corporation) HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2013-10-17] (Microsoft Corporation) ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files (x86)\AVAST Software\Avast\ashShA64.dll [2015-05-04] (Avast Software s.r.o.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank HKU\S-1-5-21-2127788250-3807647062-608468377-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/ HKU\S-1-5-21-2127788250-3807647062-608468377-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files (x86)\AVAST Software\Avast\aswWebRepIE64.dll [2015-05-04] (Avast Software s.r.o.) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.) BHO-x32: PlusIEEventHelper Class -> {551A852F-39A6-44A7-9C13-AFBEC9185A9D} -> C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll [2009-02-06] (Zeon Corporation) BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files (x86)\AVAST Software\Avast\aswWebRepIE.dll [2015-05-04] (Avast Software s.r.o.) BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.) Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2010-03-11] (Citrix Systems, Inc.) Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2010-03-11] (Citrix Systems, Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Eltern\AppData\Roaming\Mozilla\Firefox\Profiles\myv9y403.default-1432651667587 FF Homepage: https://www.google.de/ FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-13] () FF Plugin: @videolan.org/vlc,version=2.1.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-30] (VideoLAN) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-13] () FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.) FF Extension: Adblock Plus - C:\Users\Eltern\AppData\Roaming\Mozilla\Firefox\Profiles\myv9y403.default-1432651667587\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-05-26] FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files (x86)\AVAST Software\Avast\WebRep\FF FF Extension: Avast Online Security - C:\Program Files (x86)\AVAST Software\Avast\WebRep\FF [2015-04-26] Chrome: ======= CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files (x86)\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-04-26] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [5155576 2015-05-26] (Emsisoft Ltd) R2 avast! Antivirus; C:\Program Files (x86)\AVAST Software\Avast\AvastSvc.exe [343336 2015-05-04] (Avast Software s.r.o.) S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [282112 2013-09-25] (Brother Industries, Ltd.) [File not signed] S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation) S4 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [145256 2011-08-02] (Nuance Communications, Inc.) R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-05-04] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [89944 2015-05-04] (Avast Software s.r.o.) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-05-04] (Avast Software s.r.o.) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-05-04] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-05-04] (Avast Software s.r.o.) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-05-04] (Avast Software s.r.o.) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [137288 2015-05-04] (Avast Software s.r.o.) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [272248 2015-05-04] () S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [16776 2011-07-29] () [File not signed] S3 epmntdrv; C:\Windows\SysWOW64\epmntdrv.sys [14216 2011-07-29] () [File not signed] R1 epp64; C:\Windows\System32\DRIVERS\epp64.sys [135800 2015-03-24] (Emsisoft GmbH) S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9096 2011-07-29] () [File not signed] S3 EuGdiDrv; C:\Windows\SysWOW64\EuGdiDrv.sys [8456 2011-07-29] () [File not signed] R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation) S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation) R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] () U5 UnlockerDriver5; C:\Program Files (x86)\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] () S3 HWiNFO32; \??\C:\Users\Eltern\AppData\Local\Temp\HWiNFO64A.SYS [X] S3 SANDRA; \??\C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2013.SP6\WNt500x64\Sandra.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-06-02 17:10 - 2015-06-02 17:10 - 00009672 _____ () C:\Users\Eltern\Desktop\FRST.txt 2015-06-02 17:09 - 2015-06-02 17:10 - 00000000 ____D () C:\FRST 2015-06-02 17:07 - 2015-06-02 17:07 - 02108928 _____ (Farbar) C:\Users\Eltern\Desktop\FRST64.exe 2015-06-02 17:04 - 2015-06-02 17:04 - 00000474 _____ () C:\Users\Eltern\Desktop\defogger_disable.log 2015-06-02 17:04 - 2015-06-02 17:04 - 00000000 _____ () C:\Users\Eltern\defogger_reenable 2015-06-02 17:02 - 2015-06-02 17:02 - 00050477 _____ () C:\Users\Eltern\Desktop\Defogger.exe 2015-06-02 14:26 - 2015-06-02 14:26 - 00000000 ____D () C:\Users\Eltern\AppData\Local\GWX 2015-06-01 19:21 - 2015-06-01 19:21 - 00000000 ____D () C:\Program Files (x86)\Realtek 2015-06-01 19:21 - 2009-08-18 11:44 - 00236544 _____ (Realtek ) C:\Windows\system32\Drivers\Rt64win7.sys 2015-06-01 19:21 - 2009-08-18 11:44 - 00067584 _____ () C:\Windows\system32\RtNicProp64.dll 2015-06-01 19:21 - 2009-07-22 18:24 - 00097792 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst64.dll 2015-06-01 16:49 - 2015-06-01 16:49 - 00000000 ____D () C:\Users\Eltern\Documents\hw64_462-1 2015-05-27 12:08 - 2015-05-28 17:09 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird 2015-05-27 11:25 - 2015-05-27 11:25 - 00001051 _____ () C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk 2015-05-27 11:25 - 2015-05-27 11:25 - 00001051 _____ () C:\ProgramData\Desktop\Revo Uninstaller Pro.lnk 2015-05-27 11:25 - 2015-05-27 11:25 - 00000000 ____D () C:\Users\Eltern\AppData\Local\VS Revo Group 2015-05-27 11:25 - 2015-05-27 11:25 - 00000000 ____D () C:\ProgramData\VS Revo Group 2015-05-27 11:25 - 2015-05-27 11:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro 2015-05-27 11:25 - 2015-05-27 11:25 - 00000000 ____D () C:\Program Files\VS Revo Group 2015-05-27 11:25 - 2009-12-30 10:21 - 00031800 _____ (VS Revo Group) C:\Windows\system32\Drivers\revoflt.sys 2015-05-27 11:17 - 2015-05-27 11:18 - 10801480 _____ (VS Revo Group ) C:\Users\Eltern\Downloads\RevoUninProSetup-312.exe 2015-05-26 16:47 - 2015-05-26 16:47 - 00000000 ____D () C:\Users\Eltern\Desktop\Alte Firefox-Daten 2015-05-26 16:44 - 2015-05-26 16:44 - 00494857 _____ () C:\Users\Eltern\Desktop\bookmarks.html 2015-05-26 08:44 - 2015-05-26 08:44 - 00000000 ____D () C:\Program Files\avast software 2015-05-20 17:31 - 2015-01-31 05:48 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll 2015-05-20 17:31 - 2015-01-31 05:48 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll 2015-05-20 17:31 - 2015-01-31 01:56 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll 2015-05-20 17:30 - 2014-12-11 19:47 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe 2015-05-19 20:02 - 2014-09-05 03:52 - 05703168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll 2015-05-19 20:01 - 2014-09-05 04:11 - 06584320 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll 2015-05-17 19:29 - 2015-05-17 19:29 - 00000000 ____D () C:\ProgramData\Emsisoft 2015-05-17 19:11 - 2015-06-02 16:26 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware 2015-05-17 19:11 - 2015-05-17 19:11 - 00001105 _____ () C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk 2015-05-17 19:11 - 2015-05-17 19:11 - 00001105 _____ () C:\ProgramData\Desktop\Emsisoft Anti-Malware.lnk 2015-05-17 19:11 - 2015-05-17 19:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware 2015-05-17 19:11 - 2015-03-24 00:17 - 00135800 _____ (Emsisoft GmbH) C:\Windows\system32\Drivers\epp64.sys 2015-05-17 19:01 - 2015-05-17 19:10 - 161426392 _____ (Emsisoft Ltd. ) C:\Users\Eltern\Downloads\emsisoftantimalwaresetup.exe 2015-05-17 17:22 - 2015-05-17 17:22 - 21545848 _____ (Malwarebytes Corporation ) C:\Users\Eltern\Downloads\Anti-Malware.exe 2015-05-17 16:30 - 2015-05-17 16:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2015-05-17 15:56 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys 2015-05-17 15:56 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe 2015-05-17 15:56 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll 2015-05-17 15:56 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll 2015-05-17 15:56 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll 2015-05-17 15:56 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll 2015-05-17 15:56 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll 2015-05-17 15:56 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll 2015-05-17 15:56 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll 2015-05-17 15:56 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll 2015-05-17 15:56 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe 2015-05-17 15:56 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll 2015-05-17 15:56 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe 2015-05-17 15:56 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll 2015-05-17 15:56 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe 2015-05-17 15:55 - 2012-08-23 16:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys 2015-05-17 15:55 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll 2015-05-17 15:55 - 2012-08-23 12:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll 2015-05-17 15:54 - 2015-03-14 05:21 - 01632768 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll 2015-05-17 15:54 - 2015-03-14 05:21 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll 2015-05-17 15:54 - 2015-03-14 05:04 - 01372160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll 2015-05-17 15:54 - 2015-03-14 05:04 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll 2015-05-17 13:56 - 2015-05-17 10:57 - 00008969 _____ () C:\Users\Eltern\Documents\Arbeitszeitreduzierung.tmd 2015-05-14 19:49 - 2015-05-14 19:49 - 02209792 _____ () C:\Users\Eltern\Downloads\adwcleaner_4.204.exe 2015-05-13 08:28 - 2015-05-01 15:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll 2015-05-13 08:28 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll 2015-05-13 08:19 - 2015-05-05 03:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2015-05-13 08:19 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2015-05-13 08:19 - 2015-04-22 04:28 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2015-05-13 08:19 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2015-05-13 08:19 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-05-13 08:19 - 2015-04-21 19:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2015-05-13 08:19 - 2015-04-21 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2015-05-13 08:19 - 2015-04-21 18:51 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2015-05-13 08:19 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-05-13 08:19 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2015-05-13 08:19 - 2015-04-21 18:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2015-05-13 08:19 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-05-13 08:19 - 2015-04-21 18:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2015-05-13 08:19 - 2015-04-21 18:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2015-05-13 08:19 - 2015-04-21 18:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2015-05-13 08:19 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2015-05-13 08:19 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2015-05-13 08:19 - 2015-04-21 18:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2015-05-13 08:19 - 2015-04-21 18:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2015-05-13 08:19 - 2015-04-21 18:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2015-05-13 08:19 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-05-13 08:19 - 2015-04-21 18:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2015-05-13 08:19 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2015-05-13 08:19 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2015-05-13 08:19 - 2015-04-21 18:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-05-13 08:19 - 2015-04-21 18:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2015-05-13 08:19 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2015-05-13 08:19 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2015-05-13 08:19 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2015-05-13 08:19 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2015-05-13 08:19 - 2015-04-21 18:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2015-05-13 08:19 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-05-13 08:19 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2015-05-13 08:19 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2015-05-13 08:19 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2015-05-13 08:19 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2015-05-13 08:19 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2015-05-13 08:19 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2015-05-13 08:19 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2015-05-13 08:19 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2015-05-13 08:19 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2015-05-13 08:19 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-05-13 08:19 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2015-05-13 08:19 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2015-05-13 08:19 - 2015-04-21 17:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2015-05-13 08:19 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-05-13 08:19 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2015-05-13 08:19 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-05-13 08:19 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2015-05-13 08:19 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2015-05-13 08:19 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2015-05-13 08:19 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2015-05-13 08:19 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-05-13 08:19 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2015-05-13 08:19 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2015-05-13 08:19 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2015-05-13 08:19 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2015-05-13 08:19 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-05-13 08:19 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2015-05-13 08:19 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2015-05-13 08:19 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2015-05-13 08:19 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2015-05-13 08:19 - 2015-04-18 05:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll 2015-05-13 08:19 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll 2015-05-13 08:18 - 2015-04-27 21:28 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-05-13 08:18 - 2015-04-27 21:28 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2015-05-13 08:18 - 2015-04-27 21:28 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2015-05-13 08:18 - 2015-04-27 21:26 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 01254400 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll 2015-05-13 08:18 - 2015-04-27 21:22 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe 2015-05-13 08:18 - 2015-04-27 21:22 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe 2015-05-13 08:18 - 2015-04-27 21:22 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe 2015-05-13 08:18 - 2015-04-27 21:22 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe 2015-05-13 08:18 - 2015-04-27 21:22 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe 2015-05-13 08:18 - 2015-04-27 21:22 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe 2015-05-13 08:18 - 2015-04-27 21:22 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe 2015-05-13 08:18 - 2015-04-27 21:22 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2015-05-13 08:18 - 2015-04-27 21:22 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe 2015-05-13 08:18 - 2015-04-27 21:21 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe 2015-05-13 08:18 - 2015-04-27 21:18 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2015-05-13 08:18 - 2015-04-27 21:18 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2015-05-13 08:18 - 2015-04-27 21:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2015-05-13 08:18 - 2015-04-27 21:08 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll 2015-05-13 08:18 - 2015-04-27 21:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll 2015-05-13 08:18 - 2015-04-27 21:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2015-05-13 08:18 - 2015-04-27 21:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2015-05-13 08:18 - 2015-04-27 21:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2015-05-13 08:18 - 2015-04-27 21:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll 2015-05-13 08:18 - 2015-04-27 21:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2015-05-13 08:18 - 2015-04-27 21:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll 2015-05-13 08:18 - 2015-04-27 21:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2015-05-13 08:18 - 2015-04-27 21:05 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll 2015-05-13 08:18 - 2015-04-27 21:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll 2015-05-13 08:18 - 2015-04-27 21:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2015-05-13 08:18 - 2015-04-27 21:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe 2015-05-13 08:18 - 2015-04-27 21:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe 2015-05-13 08:18 - 2015-04-27 21:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe 2015-05-13 08:18 - 2015-04-27 21:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe 2015-05-13 08:18 - 2015-04-27 21:04 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe 2015-05-13 08:18 - 2015-04-27 21:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2015-05-13 08:18 - 2015-04-27 21:03 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll 2015-05-13 08:18 - 2015-04-27 21:03 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll 2015-05-13 08:18 - 2015-04-27 21:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2015-05-13 08:18 - 2015-04-27 21:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe 2015-05-13 08:18 - 2015-04-27 21:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe 2015-05-13 08:18 - 2015-04-27 21:03 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll 2015-05-13 08:18 - 2015-04-27 21:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll 2015-05-13 08:18 - 2015-04-27 21:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:06 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll 2015-05-13 08:18 - 2015-04-27 19:57 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe 2015-05-13 08:18 - 2015-04-27 19:57 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe 2015-05-13 08:18 - 2015-04-27 19:55 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll 2015-05-13 08:18 - 2015-04-13 05:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe 2015-05-13 08:17 - 2015-04-20 05:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll 2015-05-13 08:17 - 2015-04-20 05:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll 2015-05-13 08:17 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll 2015-05-13 08:17 - 2015-04-20 04:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-05-13 08:17 - 2015-04-08 05:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll 2015-05-13 08:17 - 2015-04-08 05:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll 2015-05-13 08:17 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll 2015-05-13 08:17 - 2015-03-04 06:41 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll 2015-05-13 08:17 - 2015-03-04 06:41 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll 2015-05-13 08:17 - 2015-03-04 06:41 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe 2015-05-13 08:17 - 2015-03-04 06:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll 2015-05-13 08:17 - 2015-03-04 06:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll 2015-05-13 08:17 - 2015-03-04 06:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll 2015-05-13 08:17 - 2015-03-04 06:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe 2015-05-13 08:17 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe 2015-05-13 08:17 - 2015-02-18 09:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe 2015-05-13 08:17 - 2015-01-29 05:19 - 02543104 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll 2015-05-13 08:17 - 2015-01-29 05:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll 2015-05-10 16:11 - 2015-05-10 16:11 - 00001093 _____ () C:\Users\Public\Desktop\PDF24 Creator.lnk 2015-05-10 16:11 - 2015-05-10 16:11 - 00001093 _____ () C:\ProgramData\Desktop\PDF24 Creator.lnk 2015-05-10 16:11 - 2015-05-10 16:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24 2015-05-10 16:11 - 2015-05-10 16:11 - 00000000 ____D () C:\Program Files (x86)\PDF24 2015-05-10 16:08 - 2015-05-10 16:08 - 16342352 _____ (Geek Software GmbH ) C:\Program Files (x86)\pdf24-creator-6.9.2.exe 2015-05-10 15:30 - 2015-05-10 15:31 - 27837984 _____ (pdfforge ) C:\Users\Eltern\Downloads\PDFCreator-2_1_1-setup.exe 2015-05-10 15:06 - 2015-05-10 15:06 - 00000000 ____D () C:\Users\Eltern\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker 2015-05-10 14:47 - 2015-05-10 15:06 - 00000000 ____D () C:\Program Files (x86)\Unlocker 2015-05-10 13:14 - 2015-05-10 13:14 - 00001138 _____ () C:\Users\Eltern\Desktop\PK.vbs 2015-05-10 10:50 - 2015-05-10 10:50 - 00002562 _____ () C:\Windows\diagwrn.xml 2015-05-10 10:50 - 2015-05-10 10:50 - 00001908 _____ () C:\Windows\diagerr.xml 2015-05-09 14:08 - 2015-05-10 15:27 - 00000000 ____D () C:\Windows\pss 2015-05-04 18:51 - 2015-05-04 18:51 - 00001293 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Inhaltsmanager-Assistent für PlayStation(R).lnk 2015-05-04 18:51 - 2015-05-04 18:51 - 00000000 ____D () C:\Program Files (x86)\Sony 2015-05-04 18:48 - 2015-05-04 18:49 - 10457912 _____ (Sony Computer Entertainment Inc. ) C:\Program Files (x86)\CMASetup.exe 2015-05-04 13:46 - 2015-05-04 13:46 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe 2015-05-04 13:45 - 2015-05-04 13:45 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-06-02 17:04 - 2013-10-14 21:31 - 00000000 ____D () C:\Users\Eltern 2015-06-02 16:29 - 2013-10-14 23:52 - 00000000 ____D () C:\Users\Eltern\AppData\Roaming\vlc 2015-06-02 15:14 - 2009-07-14 19:58 - 00699416 _____ () C:\Windows\system32\perfh007.dat 2015-06-02 15:14 - 2009-07-14 19:58 - 00149556 _____ () C:\Windows\system32\perfc007.dat 2015-06-02 15:14 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-06-02 14:35 - 2009-07-14 06:45 - 00023168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-06-02 14:35 - 2009-07-14 06:45 - 00023168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-06-02 14:30 - 2013-10-14 21:23 - 01782201 _____ () C:\Windows\WindowsUpdate.log 2015-06-02 14:25 - 2015-04-19 19:41 - 00004837 _____ () C:\Windows\setupact.log 2015-06-02 14:25 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-06-02 10:20 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration 2015-06-01 19:21 - 2014-06-25 19:42 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2015-05-30 19:17 - 2014-06-25 19:46 - 00007887 _____ () C:\Windows\BRRBCOM.INI 2015-05-30 18:44 - 2013-10-15 14:51 - 00000000 ____D () C:\Windows\rescache 2015-05-30 12:13 - 2015-04-26 16:08 - 00004194 _____ () C:\Windows\System32\Tasks\avast! Emergency Update 2015-05-28 18:10 - 2013-10-14 23:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2015-05-28 11:06 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF 2015-05-27 12:03 - 2013-10-17 00:31 - 01593956 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2015-05-20 18:32 - 2015-04-04 12:12 - 00000000 ___SD () C:\Windows\SysWOW64\GWX 2015-05-20 18:32 - 2015-04-04 12:12 - 00000000 ___SD () C:\Windows\system32\GWX 2015-05-17 17:54 - 2015-04-26 14:00 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-05-17 17:27 - 2015-04-26 14:00 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-05-17 16:04 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories 2015-05-17 16:01 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2015-05-16 09:18 - 2013-10-17 21:16 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2015-05-14 21:21 - 2015-04-26 13:57 - 00007504 _____ () C:\Windows\PFRO.log 2015-05-14 20:46 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Resources 2015-05-14 19:54 - 2015-04-26 13:54 - 00000000 ____D () C:\AdwCleaner 2015-05-13 14:17 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2015-05-13 10:45 - 2009-07-14 06:45 - 00287472 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-05-13 10:42 - 2013-11-15 19:52 - 00000000 ____D () C:\Program Files\Windows Journal 2015-05-13 10:42 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers 2015-05-13 08:35 - 2013-10-18 20:38 - 00000000 ____D () C:\Windows\system32\MRT 2015-05-13 08:32 - 2013-10-18 20:38 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-05-13 07:57 - 2015-02-04 19:56 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-05-13 07:57 - 2015-02-04 19:56 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2015-05-10 10:50 - 2015-04-19 19:41 - 00000000 _____ () C:\Windows\setuperr.log 2015-05-04 18:52 - 2014-08-04 15:18 - 00000000 ____D () C:\Users\Eltern\AppData\Roaming\Sony Corporation 2015-05-04 13:46 - 2015-04-26 16:08 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys 2015-05-04 13:46 - 2015-04-26 16:08 - 00272248 _____ () C:\Windows\system32\Drivers\aswVmm.sys 2015-05-04 13:46 - 2015-04-26 16:08 - 00137288 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswStm.sys 2015-05-04 13:46 - 2015-04-26 16:08 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr2.sys 2015-05-04 13:46 - 2015-04-26 16:08 - 00089944 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys 2015-05-04 13:46 - 2015-04-26 16:08 - 00065736 _____ () C:\Windows\system32\Drivers\aswRvrt.sys 2015-05-04 13:46 - 2015-04-26 16:08 - 00029168 _____ () C:\Windows\system32\Drivers\aswHwid.sys 2015-05-04 13:45 - 2015-04-26 16:08 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys ==================== Files in the root of some directories ======= 2013-11-15 19:51 - 2013-10-15 01:28 - 3294168 _____ (Piriform Ltd) C:\Program Files\ccsetup406_slim.exe 2014-08-04 15:16 - 2014-08-04 15:16 - 10410712 _____ (Sony Computer Entertainment Inc. ) C:\Program Files\CMASetup.exe 2013-11-15 19:51 - 2012-10-11 22:21 - 11766024 _____ (EASEUS ) C:\Program Files\epm911.exe 2014-02-15 19:34 - 2014-02-15 19:34 - 0921000 _____ (Oracle Corporation) C:\Program Files\jxpiinstall.exe 2014-02-17 18:56 - 2014-02-17 18:56 - 0675988 _____ () C:\Program Files\Minecraft.exe 2014-02-17 20:22 - 2014-02-17 20:22 - 0774144 _____ () C:\Program Files\NBTExplorer-2.7.0.msi 2013-11-15 19:51 - 2013-10-15 16:49 - 0537818 _____ (IDG Magazine Media GmbH ) C:\Program Files\pcwFixMyRights.exe 2014-12-26 17:14 - 2014-12-26 17:14 - 0095662 _____ () C:\Program Files (x86)\7-zip.chm 2014-12-26 17:48 - 2014-12-26 17:48 - 0080384 _____ (Igor Pavlov) C:\Program Files (x86)\7-zip.dll 2014-12-26 17:48 - 2014-12-26 17:48 - 0050176 _____ (Igor Pavlov) C:\Program Files (x86)\7-zip32.dll 2014-12-26 18:00 - 2014-12-26 18:00 - 1508352 _____ (Igor Pavlov) C:\Program Files (x86)\7z.dll 2014-12-26 17:48 - 2014-12-26 17:48 - 0424960 _____ (Igor Pavlov) C:\Program Files (x86)\7z.exe 2014-12-26 18:06 - 2014-12-26 18:06 - 0181760 _____ (Igor Pavlov) C:\Program Files (x86)\7z.sfx 2014-12-26 18:06 - 2014-12-26 18:06 - 0166400 _____ (Igor Pavlov) C:\Program Files (x86)\7zCon.sfx 2014-12-26 17:50 - 2014-12-26 17:50 - 0803328 _____ (Igor Pavlov) C:\Program Files (x86)\7zFM.exe 2014-12-26 17:50 - 2014-12-26 17:50 - 0545792 _____ (Igor Pavlov) C:\Program Files (x86)\7zG.exe 2014-08-22 08:08 - 2014-08-22 08:11 - 149527616 _____ () C:\Program Files (x86)\avira_free_antivirus_de_14.0.6.570.exe 2014-05-29 15:25 - 2014-05-29 15:25 - 8697544 _____ (Georgy Berdyshev) C:\Program Files (x86)\CDex-win32-1.70-b4-2009.exe 2014-11-07 13:28 - 2014-11-07 13:28 - 12436848 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\CitrixOnlinePluginWeb.exe 2015-05-04 18:48 - 2015-05-04 18:49 - 10457912 _____ (Sony Computer Entertainment Inc. ) C:\Program Files (x86)\CMASetup.exe 2011-04-04 17:54 - 2011-04-04 17:54 - 0000366 _____ () C:\Program Files (x86)\descript.ion 2015-04-20 17:59 - 2015-04-20 18:03 - 190719264 _____ (Microsoft Corporation) C:\Program Files (x86)\DraftSight64.exe 2015-01-04 23:03 - 2015-01-04 23:03 - 3105553 _____ () C:\Program Files (x86)\forge-1.7.10-10.13.2.1230-installer-win.exe 2015-01-03 12:26 - 2015-01-03 12:29 - 91670064 _____ (The GIMP Team ) C:\Program Files (x86)\gimp-2.8.14-setup.exe 2014-12-26 18:06 - 2014-12-26 18:06 - 0040769 _____ () C:\Program Files (x86)\History.txt 2014-06-12 22:02 - 2014-06-12 22:02 - 0001927 _____ () C:\Program Files (x86)\License.txt 2015-04-26 13:19 - 2015-04-26 13:19 - 21546080 _____ (Malwarebytes Corporation ) C:\Program Files (x86)\mbam-setup-2.1.6.1022.exe 2015-05-10 16:08 - 2015-05-10 16:08 - 16342352 _____ (Geek Software GmbH ) C:\Program Files (x86)\pdf24-creator-6.9.2.exe 2014-12-26 17:24 - 2014-12-26 17:24 - 0001683 _____ () C:\Program Files (x86)\readme.txt 2015-01-07 21:39 - 2015-01-07 21:39 - 0001551 _____ () C:\Users\Eltern\AppData\Local\recently-used.xbel ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-05-24 11:44 ==================== End of log ============================ Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-05-2015 Ran by Eltern at 2015-06-02 17:11:16 Running from C:\Users\Eltern\Desktop Boot Mode: Normal ========================================================== ==================== Accounts: ============================= Administrator (S-1-5-21-2127788250-3807647062-608468377-500 - Administrator - Disabled) Eltern (S-1-5-21-2127788250-3807647062-608468377-1000 - Administrator - Enabled) => C:\Users\Eltern Gast (S-1-5-21-2127788250-3807647062-608468377-501 - Limited - Disabled) HomeGroupUser$ (S-1-5-21-2127788250-3807647062-608468377-1002 - Limited - Enabled) ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) 7-Zip 9.36 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0936-000001000000}) (Version: 9.36.00.0 - Igor Pavlov) Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.188 - Adobe Systems Incorporated) Adobe Reader XI (11.0.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated) Amazon Music (HKU\S-1-5-21-2127788250-3807647062-608468377-1000\...\Amazon Amazon Music) (Version: 3.7.1.698 - Amazon Services LLC) Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.2.2218 - AVAST Software) Brother MFL-Pro Suite MFC-J245 (HKLM-x32\...\{B742757A-7658-4E09-A51A-085CF0F7F4D3}) (Version: 1.0.0.0 - Brother Industries, Ltd.) CDex - Open Source Digital Audio CD Extractor (HKLM-x32\...\CDex) (Version: 1.70.4.2009 - Georgy Berdyshev) Citrix Online Plug-in - Web (HKLM-x32\...\CitrixOnlinePluginPackWeb) (Version: 12.0.0.6410 - Citrix Systems, Inc.) D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden DriveImage XML (Private Edition) (HKLM-x32\...\{F7E1CA14-B39D-452A-960B-39423DDDD933}) (Version: 2.44.000 - Runtime Software) EASEUS Partition Master 9.1.1 Home Edition (HKLM-x32\...\EASEUS Partition Master Home Edition_is1) (Version: - EASEUS) ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 16.0.20150211 - Landesfinanzdirektion Thüringen) Emsisoft Anti-Malware (HKLM-x32\...\{5502032C-88C1-4303-99FE-B5CBD7684CEA}_is1) (Version: 10.0 - Emsisoft Ltd.) Free YouTube to MP3 Converter version 3.12.54.128 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.54.128 - DVDVideoSoft Ltd.) GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team) Inhaltsmanager-Assistent für PlayStation(R) (HKLM-x32\...\{961D5D7E-3DEC-4E3B-9065-EA8074923B18}) (Version: 3.31.7643.1 - Sony Computer Entertainment Inc.) Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1930 - Intel Corporation) Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation) Junk Mail filter update (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation) Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation) Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation) Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation) Mozilla Firefox 38.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.1 (x86 de)) (Version: 38.0.1 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 37.0.2 - Mozilla) Mozilla Thunderbird 31.7.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.7.0 (x86 de)) (Version: 31.7.0 - Mozilla) MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation) MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation) NBTExplorer (HKLM-x32\...\{273D5BF1-EC9C-4549-880D-D8C293296A36}) (Version: 2.7.0.0 - Justin Aquadro) Nuance PaperPort 12 (HKLM-x32\...\{869FCC6C-5669-4B0B-827E-2BBAACD88A87}) (Version: 12.1.0006 - Nuance Communications, Inc.) Nuance PDF Viewer Plus (HKLM-x32\...\{28656860-4728-433C-8AD4-D1A930437BC8}) (Version: 5.30.3290 - Nuance Communications, Inc) PaperPort Image Printer 64-bit (HKLM\...\{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}) (Version: 14.00.0000 - Nuance Communications, Inc.) PDF24 Creator 6.9.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org) Pusteblume Sachunterricht 3 (HKLM-x32\...\Pusteblume Sachunterricht 3) (Version: - Bildungshaus Schulbuchverlage Westermann Schroedel Diesterweg Schöningh Winklers GmbH) Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0008 - Realtek) Revo Uninstaller Pro 3.1.2 (HKLM\...\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1) (Version: 3.1.2 - VS Revo Group, Ltd.) Scansoft PDF Professional (x32 Version: - ) Hidden SoftMaker FreeOffice (HKLM-x32\...\{8EBB8452-274B-465D-8324-00B0832FBB02}) (Version: 1.0.3395 - SoftMaker Software GmbH) Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb) VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN) Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation) ==================== Custom CLSID (Whitelisted): ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== Restore Points ========================= 01-06-2015 16:00:03 Revo Uninstaller Pro's restore point - SiSoftware Sandra Lite 2013.SP6 01-06-2015 16:01:03 SiSoftware Sandra Lite 01-06-2015 19:17:21 vor LAN-Treiber 01-06-2015 19:21:02 Installiert Realtek Ethernet Controller Driver 02-06-2015 10:12:14 Windows Update 02-06-2015 10:16:34 Wiederherstellungsvorgang ==================== Hosts content: =============================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (Whitelisted) ============= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) Task: {0051A1AD-0606-4209-BFFE-5DC7ED6C9B20} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-07] (Microsoft Corporation) Task: {1B1ED7BC-0022-40DF-881B-1F1DD17605C9} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation) Task: {1F16F3F8-0026-445B-AC17-E40EDFB35128} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\Logon => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation) Task: {31E02CA9-C51E-4460-BA97-B7E21A651C34} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated) Task: {50535350-84E1-4323-9DDE-0CD437D0DE7A} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation) Task: {645F6365-4A2D-4183-BB76-C828836618FD} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => schtasks Task: {C16F411F-5A38-4010-8311-B2469B0D6545} - System32\Tasks\avast! Emergency Update => C:\Program Files (x86)\AVAST Software\Avast\AvastEmUpdate.exe [2015-05-04] (Avast Software s.r.o.) ==================== Loaded Modules (Whitelisted) ============== 2015-05-04 13:45 - 2015-05-04 13:45 - 00104400 _____ () C:\Program Files (x86)\AVAST Software\Avast\log.dll 2015-05-04 13:45 - 2015-05-04 13:45 - 00081728 _____ () C:\Program Files (x86)\AVAST Software\Avast\JsonRpcServer.dll 2015-06-02 10:01 - 2015-06-02 10:01 - 02951680 _____ () C:\Program Files (x86)\AVAST Software\Avast\defs\15060200\algo.dll 2015-04-26 16:08 - 2015-04-26 16:08 - 40540672 _____ () C:\Program Files (x86)\AVAST Software\Avast\libcef.dll ==================== Alternate Data Streams (Whitelisted) ========= (If an entry is included in the fixlist, only the ADS will be removed.) ==================== Safe Mode (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (Whitelisted) =============== (If an entry is included in the fixlist, the registry item will be restored to default or removed.) ==================== Internet Explorer trusted/restricted =============== (If an entry is included in the fixlist, it will be removed from the registry.) ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-2127788250-3807647062-608468377-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Eltern\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg DNS Servers: 192.168.2.1 ==================== MSCONFIG/TASK MANAGER disabled items == (Currently there is no automatic fix for this section.) MSCONFIG\Services: PDFProFiltSrvPP => 2 MSCONFIG\Services: wscsvc => 2 MSCONFIG\Services: WSearch => 2 MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Inhaltsmanager-Assistent für PlayStation(R).lnk => C:\Windows\pss\Inhaltsmanager-Assistent für PlayStation(R).lnk.CommonStartup MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" MSCONFIG\startupreg: Amazon Music => "C:\Users\Eltern\AppData\Local\Amazon Music\Amazon Music Helper.exe" MSCONFIG\startupreg: BrHelp => C:\Program Files (x86)\Brother\Brother Help\BrotherHelp.exe /AUTORUN MSCONFIG\startupreg: BrStsMon00 => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe /AUTORUN MSCONFIG\startupreg: ConnectionCenter => "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup MSCONFIG\startupreg: ControlCenter4 => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe /autorun MSCONFIG\startupreg: HotKeysCmds => C:\Windows\system32\hkcmd.exe MSCONFIG\startupreg: IndexSearch => "C:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe" MSCONFIG\startupreg: ISUSPM => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler MSCONFIG\startupreg: PaperPort PTD => "C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe" MSCONFIG\startupreg: PDF5 Registry Controller => C:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe MSCONFIG\startupreg: PDFHook => C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe MSCONFIG\startupreg: PDFPrint => C:\Program Files (x86)\PDF24\pdf24.exe MSCONFIG\startupreg: Persistence => C:\Windows\system32\igfxpers.exe ==================== FirewallRules (Whitelisted) =============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [{1B5878FA-F799-4C68-A2DA-8E7A57B40EFB}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe FirewallRules: [{AF0730C6-8801-41FD-9979-03A14518E175}] => (Allow) LPort=2869 FirewallRules: [{639EFFE0-6DC2-43C2-A676-855C8FEF6F89}] => (Allow) LPort=1900 FirewallRules: [TCP Query User{7A9608B7-A0ED-423F-BE89-7991B131A01B}C:\program files\videolan\vlc\vlc.exe] => (Block) C:\program files\videolan\vlc\vlc.exe FirewallRules: [UDP Query User{BA917422-0A70-45A0-88FF-CEA25E4D4AA8}C:\program files\videolan\vlc\vlc.exe] => (Block) C:\program files\videolan\vlc\vlc.exe FirewallRules: [TCP Query User{074F9C1C-051B-4319-BF7A-A98FD2FDF065}C:\program files (x86)\java\jre1.8.0_31\bin\java.exe] => (Block) C:\program files (x86)\java\jre1.8.0_31\bin\java.exe FirewallRules: [UDP Query User{55D30EF6-0A63-403F-900B-656D36616F2B}C:\program files (x86)\java\jre1.8.0_31\bin\java.exe] => (Block) C:\program files (x86)\java\jre1.8.0_31\bin\java.exe FirewallRules: [TCP Query User{362F5215-85FC-421B-B914-ABE6EA456261}C:\program files\firefox.exe] => (Block) C:\program files\firefox.exe FirewallRules: [UDP Query User{BE7C41C2-E1AB-4E12-9414-4D0DA7F81B6F}C:\program files\firefox.exe] => (Block) C:\program files\firefox.exe FirewallRules: [{1023DE4E-B766-48DA-AAA2-EF53ED9DE278}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{4F66FC22-FD46-46BE-87E1-A8C2AD47AF02}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe ==================== Faulty Device Manager Devices ============= Name: Microsoft PS/2-Maus Description: Microsoft PS/2-Maus Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318} Manufacturer: Microsoft Service: i8042prt Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24) Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed. Devices stay in this state if they have been prepared for removal. After you remove the device, this error disappears.Remove the device, and this error should be resolved. ==================== Event log errors: ========================= Application errors: ================== Error: (06/02/2015 10:23:14 AM) (Source: System Restore) (EventID: 8210) (User: ) Description: Unbekannter Fehler bei der Systemwiederherstellung: (vor LAN-Treiber). Zusätzliche Informationen: 0x80070003. Error: (06/01/2015 04:00:02 PM) (Source: VSS) (EventID: 8194) (User: ) Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert . Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess. Vorgang: Generatordaten werden gesammelt Kontext: Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220} Generatorname: System Writer Generatorinstanz-ID: {1ebb083b-1f10-42be-8023-f86a86c66225} Error: (06/01/2015 03:34:12 PM) (Source: ESENT) (EventID: 439) (User: ) Description: Windows (2388) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk konnte nicht geschrieben werden. Fehler -1032. Error: (06/01/2015 03:34:12 PM) (Source: ESENT) (EventID: 490) (User: ) Description: Windows (2388) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk" für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien. Error: (05/30/2015 00:14:26 PM) (Source: ESENT) (EventID: 439) (User: ) Description: Windows (1376) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk konnte nicht geschrieben werden. Fehler -1032. Error: (05/30/2015 00:14:26 PM) (Source: ESENT) (EventID: 490) (User: ) Description: Windows (1376) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk" für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien. Error: (05/30/2015 09:14:05 AM) (Source: ESENT) (EventID: 439) (User: ) Description: Windows (3048) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk konnte nicht geschrieben werden. Fehler -1032. Error: (05/30/2015 09:14:05 AM) (Source: ESENT) (EventID: 490) (User: ) Description: Windows (3048) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk" für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien. Error: (05/28/2015 06:12:41 PM) (Source: ESENT) (EventID: 439) (User: ) Description: Windows (1936) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk konnte nicht geschrieben werden. Fehler -1032. Error: (05/28/2015 06:12:41 PM) (Source: ESENT) (EventID: 490) (User: ) Description: Windows (1936) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk" für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien. System errors: ============= Error: (06/02/2015 02:27:16 PM) (Source: WMPNetworkSvc) (EventID: 14332) (User: ) Description: WMPNetworkSvc0x80004005 Error: (05/30/2015 09:55:12 AM) (Source: Service Control Manager) (EventID: 7043) (User: ) Description: Der Dienst Diagnostics Tracking Service konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden. Error: (05/30/2015 09:17:25 AM) (Source: Service Control Manager) (EventID: 7043) (User: ) Description: Der Dienst Windows Update konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden. Error: (05/29/2015 07:47:00 AM) (Source: Service Control Manager) (EventID: 7043) (User: ) Description: Der Dienst Diagnostics Tracking Service konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden. Error: (05/27/2015 05:30:02 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts. Error: (05/27/2015 05:30:02 PM) (Source: Service Control Manager) (EventID: 7024) (User: ) Description: Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem Fehler beendet: %%-1073473535. Error: (05/24/2015 05:12:29 PM) (Source: DCOM) (EventID: 10010) (User: ) Description: {995C996E-D918-4A8C-A302-45719A6F4EA7} Error: (05/22/2015 05:56:33 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "MBAMService" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (05/22/2015 05:56:33 PM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst MBAMService erreicht. Error: (05/20/2015 05:14:04 PM) (Source: Service Control Manager) (EventID: 7022) (User: ) Description: Der Dienst "Windows Update" wurde nicht richtig gestartet. Microsoft Office: ========================= Error: (06/02/2015 10:23:14 AM) (Source: System Restore) (EventID: 8210) (User: ) Description: vor LAN-Treiber0x80070003 Error: (06/01/2015 04:00:02 PM) (Source: VSS) (EventID: 8194) (User: ) Description: 0x80070005, Zugriff verweigert Vorgang: Generatordaten werden gesammelt Kontext: Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220} Generatorname: System Writer Generatorinstanz-ID: {1ebb083b-1f10-42be-8023-f86a86c66225} Error: (06/01/2015 03:34:12 PM) (Source: ESENT) (EventID: 439) (User: ) Description: Windows2388Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032 Error: (06/01/2015 03:34:12 PM) (Source: ESENT) (EventID: 490) (User: ) Description: Windows2388Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032 (0xfffffbf8)32 (0x00000020)Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. Error: (05/30/2015 00:14:26 PM) (Source: ESENT) (EventID: 439) (User: ) Description: Windows1376Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032 Error: (05/30/2015 00:14:26 PM) (Source: ESENT) (EventID: 490) (User: ) Description: Windows1376Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032 (0xfffffbf8)32 (0x00000020)Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. Error: (05/30/2015 09:14:05 AM) (Source: ESENT) (EventID: 439) (User: ) Description: Windows3048Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032 Error: (05/30/2015 09:14:05 AM) (Source: ESENT) (EventID: 490) (User: ) Description: Windows3048Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032 (0xfffffbf8)32 (0x00000020)Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. Error: (05/28/2015 06:12:41 PM) (Source: ESENT) (EventID: 439) (User: ) Description: Windows1936Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032 Error: (05/28/2015 06:12:41 PM) (Source: ESENT) (EventID: 490) (User: ) Description: Windows1936Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032 (0xfffffbf8)32 (0x00000020)Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. ==================== Memory info =========================== Processor: Pentium(R) Dual-Core CPU E5200 @ 2.50GHz Percentage of memory in use: 47% Total physical RAM: 3062.18 MB Available physical RAM: 1609.4 MB Total Pagefile: 6122.57 MB Available Pagefile: 4143.49 MB Total Virtual: 8192 MB Available Virtual: 8191.83 MB ==================== Drives ================================ Drive c: (Eigene Dateien) (Fixed) (Total:58.64 GB) (Free:17.77 GB) NTFS Drive d: () (Fixed) (Total:43.95 GB) (Free:25.07 GB) NTFS ==>[System with boot components (obtained from reading drive)] Drive e: (Eigene Bilder Filme) (Fixed) (Total:39.21 GB) (Free:21.25 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149.1 GB) (Disk ID: 102C102B) Partition 1: (Active) - (Size=43.9 GB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=39.2 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=58.6 GB) - (Type=OF Extended) ==================== End of log ============================ Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 26.04.2015 Suchlauf-Zeit: 14:02:35 Logdatei: MWBT_Scan_1.txt Administrator: Ja Version: 2.01.6.1022 Malware Datenbank: v2015.04.26.01 Rootkit Datenbank: v2015.04.21.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Eltern Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 335586 Verstrichene Zeit: 16 Min, 55 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente gefunden) Module: 0 (Keine schädliche Elemente gefunden) Registrierungsschlüssel: 0 (Keine schädliche Elemente gefunden) Registrierungswerte: 0 (Keine schädliche Elemente gefunden) Registrierungsdaten: 0 (Keine schädliche Elemente gefunden) Ordner: 0 (Keine schädliche Elemente gefunden) Dateien: 1 PUP.Optional.Softonic.A, C:\Program Files\SoftonicDownloader_fuer_minecraft.exe, In Quarantäne, [fc2da4cd751570c67f3c89c853aee41c], Physische Sektoren: 0 (Keine schädliche Elemente gefunden) (end) Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 14.05.2015 Suchlauf-Zeit: 19:59:57 Logdatei: MWBT_Scan_2.txt Administrator: Ja Version: 2.01.6.1022 Malware Datenbank: v2015.05.14.04 Rootkit Datenbank: v2015.04.21.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Eltern Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 343786 Verstrichene Zeit: 25 Min, 8 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente gefunden) Module: 0 (Keine schädliche Elemente gefunden) Registrierungsschlüssel: 0 (Keine schädliche Elemente gefunden) Registrierungswerte: 0 (Keine schädliche Elemente gefunden) Registrierungsdaten: 0 (Keine schädliche Elemente gefunden) Ordner: 0 (Keine schädliche Elemente gefunden) Dateien: 3 PUP.Optional.Babylon.A, C:\Program Files (x86)\Unlocker1.9.2.exe, In Quarantäne, [315b6231b5d5f145c1eafd3c9a67ff01], PUP.Optional.Babylon.A, C:\Users\Eltern\AppData\Local\Temp\DeltaTB.exe, In Quarantäne, [97f5662df09a78be6f3c54e5a45d59a7], PUP.Optional.Babylon.A, C:\Users\Eltern\AppData\Local\Temp\7F61D543-BAB0-7891-A3F4-F6F5DDBEF7A0\Latest\BExternal.dll, In Quarantäne, [a7e5444f8ffb2016182100255aa6916f], Physische Sektoren: 0 (Keine schädliche Elemente gefunden) (end) Emsisoft Anti-Malware - Version 10.0 Scan-Protokoll Datum Scan Methode Gescannt Erkannt Dauer Typ 01.06.2015 11:39:35 Malware 69836 0 0:04:35 Manueller Scan 17.05.2015 19:24:14 Malware 69224 0 0:05:00 Manueller Scan Emsisoft Anti-Malware - Version 10.0 Scan-Protokoll Datum Scan Methode Gescannt Erkannt Dauer Typ 01.06.2015 11:39:35 Malware 69836 0 0:04:35 Manueller Scan 17.05.2015 19:24:14 Malware 69224 0 0:05:00 Manueller Scan C:\Users\Eltern\Downloads\FreeYouTubeToMP354Converter.exe Variante von Win32/OpenCandy.C potenziell unsichere Anwendung C:\Users\Eltern\Downloads\PDFCreator-1_7_1_setup.exe Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung C:\Users\Eltern\Downloads\PDFCreator-2_1_1-setup.exe Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung D:\Documents and Settings\Eltern\Downloads\FreeYouTubeToMP354Converter.exe Variante von Win32/OpenCandy.C potenziell unsichere Anwendung D:\Documents and Settings\Eltern\Downloads\PDFCreator-1_7_1_setup.exe Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung D:\Documents and Settings\Eltern\Downloads\PDFCreator-2_1_1-setup.exe Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SaveByclick\dfnfldhlfgmlpgfacmffbnonedjmpjag.crx Win32/Adware.MultiPlug.H Anwendung D:\RECYCLER\S-1-5-21-1606980848-1390067357-839522115-1003\Dc14.exe Variante von Win32/Bundled.Toolbar.Ask.G potenziell unsichere Anwendung D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP171\A0038320.msi Variante von Win32/Systweak.L evtl. unerwünschte Anwendung D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP172\A0038322.msi Variante von Win32/Systweak.L evtl. unerwünschte Anwendung D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP175\A0039051.exe Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040097.dll Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040098.exe Variante von Win32/Bundled.Toolbar.Ask.G potenziell unsichere Anwendung D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040099.exe Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP213\A0046627.exe Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung D:\Unser Kram\Erik\FreeYouTubeToMP3Converter3.12.44.908.exe Variante von Win32/OpenCandy.C potenziell unsichere Anwendung |
| Themen zu PC mit Win7 64: Booten dauert lang / Programme starten auffällig langsam Teil 1 |
| anti-malware, antivirus, ccsetup, computer, converter, csrss.exe, explorer.exe, flash player, formation, harddisk, helper.exe, homepage, installation, launch, lsass.exe, microsoft, programme, registry, revo uninstaller, security, service.exe, services.exe, software, spoolsv.exe, svchost.exe, system32, windows live, winlogon.exe |
Baum-Darstellung