| Rika_planlos | 28.09.2014 14:47 |
hohe CPU-Auslastung - teilweise 99 %, Lüfter läuft fast ununterbrochen
Hallo,
ich benötige bitte wieder mal Hilfe. Bei einem anderen User hab ich gelesen, dass man diesen Fehler wohl beseitigen kann.
Kurze Zeit nach dem Start (Windows 8) ist die CPU-Auslastung sehr hoch, oft bei 99 %, auch bei Arbeitsspeicher sind die Werte sehr oft so hoch.
Der Lüfter gibt dann immer alles - und das sehr laut.
Windows-Updates mache ich keine mehr. Ich hatte letzte Woche das Problem mit dem Hängenbleiben bei 12 % umgangen. Nach gut einem Tag war der Laptop dann mit den 140 Updates fertig. Nur mit dem Ergebnis, dass der Drucker nicht mehr gefunden werden konnte.
Auf die CPU-Auslastung hatten die Updates keinen Einfluss. Es hat sich nichts geändert. Also hab ich wieder alles auf den letzten Wiederherstellungspunkt zurück gesetzt.
Ich würd mich wirklich freuen, wenn mir jemand helfen könnte.
Vielen Dank schon mal!
Liebe Grüße
Rika Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-09-2014
Ran by ***** (administrator) on E***** on 28-09-2014 15:26:17
Running from C:\Users\*****\Downloads
Loaded Profile: ***** (Available profiles: ***** & Administrator)
Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Greenshot) C:\Program Files\Greenshot\Greenshot.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIILE.EXE
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIILE.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteService.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteUser.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Microsoft Corporation) C:\Windows\System32\Taskmgr.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE
(Microsoft Corporation) C:\Windows\System32\calc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\*****\Downloads\FRST64 (1).exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1664000 2012-08-20] (IDT, Inc.)
HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [161984 2014-04-20] (IvoSoft)
HKLM\...\Run: [Greenshot] => C:\Program Files\Greenshot\Greenshot.exe [495616 2014-05-12] (Greenshot)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3053808 2014-07-27] (Synaptics Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-09-18] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491632 2012-09-10] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)
HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [581024 2012-09-07] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HP CoolSense] => C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [1342008 2012-09-14] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1058400 2011-10-31] (SEIKO EPSON CORPORATION)
HKLM\...\RunOnce: [NCPluginUpdater] => c:\program files (x86)\hewlett-packard\hp health check\activecheck\product_line\NCPluginUpdater.exe [21720 2014-09-26] (Hewlett-Packard)
HKU\S-1-5-21-1726714612-32550494-740089804-1002\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21650016 2014-07-24] (Skype Technologies S.A.)
HKU\S-1-5-21-1726714612-32550494-740089804-1002\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIILE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1726714612-32550494-740089804-1002\...\Run: [EPLTarget\P0000000000000001] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIILE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1726714612-32550494-740089804-1002\...\MountPoints2: {56f84078-1fb0-11e4-be76-38eaa7e2182e} - "F:\.\setup.exe"
ShellIconOverlayIdentifiers: SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers: SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers: SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers: ShareOverlay -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
ShellIconOverlayIdentifiers-x32: SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers-x32: SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers-x32: SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers-x32: ShareOverlay -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCON13/1
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCON13/1
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCON13/1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCON13/1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCON13/1
SearchScopes: HKLM - {68B85386-FE1F-4170-AD98-68D2D66983EE} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/5221-29880-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll (IvoSoft)
BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll (IvoSoft)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138 10.0.0.138
FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\9h25tcub.default
FF Homepage: hxxp://www.google.at/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1166636.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
Chrome:
=======
CHR Profile: C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-06-07]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-29]
CHR Extension: (YouTube) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-06-07]
CHR Extension: (Google Search) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-06-07]
CHR Extension: (Google Wallet) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-06-07]
CHR Extension: (Gmail) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-06-07]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-09-18] (Advanced Micro Devices, Inc.) [File not signed]
R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [86528 2012-09-27] (Hewlett-Packard Company) [File not signed]
R2 HPConnectedRemote; C:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteService.exe [35744 2012-10-12] (Hewlett-Packard)
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2451456 2012-07-14] (Realsil Microelectronics Inc.) [File not signed]
S3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [43520 2012-07-26] (Microsoft Corporation)
S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [634368 2012-07-26] (Microsoft Corporation)
S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18432 2012-07-26] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [15440 2012-07-26] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [91648 2012-08-21] (Advanced Micro Devices)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [269968 2012-07-04] (Realtek Semiconductor Corp.)
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [41272 2012-08-25] (Synaptics Incorporated)
S3 SmbDrvI; C:\Windows\System32\drivers\Smb_driver_Intel.sys [43832 2012-08-25] (Synaptics Incorporated)
R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2012-08-31] (Hewlett-Packard Development Company, L.P.)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-28 15:26 - 2014-09-28 15:26 - 00015695 _____ () C:\Users\*****\Downloads\FRST.txt
2014-09-28 15:25 - 2014-09-28 15:25 - 02108928 _____ (Farbar) C:\Users\*****\Downloads\FRST64 (1).exe
2014-09-28 15:24 - 2014-09-28 15:24 - 00050477 _____ () C:\Users\*****\Downloads\Defogger.exe
2014-09-28 15:24 - 2014-09-28 15:24 - 00000472 _____ () C:\Users\*****\Downloads\defogger_disable.log
2014-09-28 15:24 - 2014-09-28 15:24 - 00000000 _____ () C:\Users\*****\defogger_reenable
2014-09-27 18:17 - 2014-09-27 18:17 - 01034899 _____ () C:\Users\*****\Downloads\Stundenplan_2014_15_ab4SW19092014 (1).xlsx
2014-09-26 17:03 - 2014-09-26 17:04 - 39434304 _____ () C:\Users\*****\Downloads\deutschstunde1_demo.exe
2014-09-25 19:24 - 2014-09-25 19:24 - 00008728 _____ () C:\Users\*****\Downloads\PREISLIS (2).TXT
2014-09-24 12:38 - 2014-09-24 12:38 - 00136269 _____ () C:\Users\*****\Downloads\Mathematik_Klassenarbeit 1 Klasse5 BaWue.zip
2014-09-24 10:01 - 2014-09-24 10:01 - 01393699 _____ () C:\Users\*****\Downloads\Leistungsbeurteilung in der NMS.pptx
2014-09-23 19:40 - 2014-09-23 19:40 - 00009488 _____ () C:\Users\*****\Downloads\PREISLIS (1).TXT
2014-09-22 20:09 - 2014-09-27 22:50 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-21 14:22 - 2014-09-21 14:22 - 00014194 _____ () C:\Users\*****\Downloads\Cogi.ECD
2014-09-21 01:03 - 2014-09-22 18:20 - 00000000 ____D () C:\Program Files\Bonjour
2014-09-21 01:03 - 2014-09-21 01:03 - 00000000 ____D () C:\Program Files (x86)\Bonjour
2014-09-20 20:34 - 2014-09-20 20:34 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2014-09-20 20:29 - 2014-09-20 20:29 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-09-20 20:10 - 2014-09-20 20:15 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-20 17:14 - 2014-09-20 17:14 - 00302011 _____ () C:\Users\*****\Downloads\WindowsUpdateDiagnostic.diagcab
2014-09-20 17:14 - 2014-09-20 17:14 - 00302011 _____ () C:\Users\*****\Downloads\WindowsUpdateDiagnostic (1).diagcab
2014-09-20 16:51 - 2014-09-20 16:55 - 94873701 _____ () C:\Users\*****\Downloads\Windows8-RT-KB2770917-x64.msu
2014-09-20 16:51 - 2014-09-20 16:52 - 10113386 _____ () C:\Users\*****\Downloads\Windows8-RT-KB2771431-x64.msu
2014-09-20 16:50 - 2014-09-20 16:50 - 00202419 _____ () C:\Users\*****\Downloads\Windows8-RT-KB2770816-x64.msu
2014-09-20 16:49 - 2014-09-20 16:56 - 170699203 _____ () C:\Users\*****\Downloads\Windows8-RT-KB2756872-x64.msu
2014-09-19 15:31 - 2014-09-19 15:31 - 01034899 _____ () C:\Users\*****\Downloads\Stundenplan_2014_15_ab4SW19092014.xlsx
2014-09-17 12:38 - 2014-09-17 12:39 - 01275984 _____ () C:\Users\*****\Downloads\PPT Leistungsbeurteilungspraxis im Überblick Dezember 2012.pptx
2014-09-15 18:45 - 2014-09-15 18:45 - 00000950 _____ () C:\Users\*****\Downloads\2b_2013_14.csv
2014-09-15 18:43 - 2014-09-15 18:43 - 00010505 _____ () C:\Users\*****\Downloads\2a_2013_14.xlsx
2014-09-15 18:43 - 2014-09-15 18:43 - 00010030 _____ () C:\Users\*****\Downloads\1b_2013_14 (1).xlsx
2014-09-15 18:42 - 2014-09-15 18:42 - 00010841 _____ () C:\Users\*****\Downloads\1a_2013_14.xlsx
2014-09-15 18:34 - 2014-09-15 18:48 - 00016211 _____ () C:\Users\*****\Documents\Moodle_Namen_gesamt_2014_15.xlsx
2014-09-14 12:17 - 2014-09-14 12:17 - 00010030 _____ () C:\Users\*****\Downloads\1b_2013_14.xlsx
2014-09-13 13:24 - 2014-09-13 13:24 - 00022891 _____ () C:\Users\*****\Downloads\Beurteilung 4Punkt0_Kapitel_MA.xlsx
2014-09-13 13:23 - 2014-09-13 13:23 - 00022623 _____ () C:\Users\*****\Downloads\Beurteilung 4Punkt0 (1).xlsx
2014-09-13 12:24 - 2014-09-13 12:26 - 01011644 _____ () C:\Users\*****\Documents\Stundenplan_2014_15_leer.xlsx
2014-09-12 17:58 - 2014-09-13 12:24 - 01037478 _____ () C:\Users\*****\Documents\Stundenplan_2014_15_2_3SW.xlsx
2014-09-12 17:55 - 2014-09-12 17:55 - 01033403 _____ () C:\Users\*****\Downloads\Stundenplan_2014_15_2_3SW.xlsx
2014-09-11 19:02 - 2014-09-11 19:02 - 00009359 _____ () C:\Users\*****\Downloads\PREISLIS.TXT
2014-09-06 16:40 - 2014-09-06 16:41 - 44195431 _____ () C:\Users\*****\Downloads\NMS.zip
2014-09-05 13:29 - 2014-09-05 13:29 - 00022623 _____ () C:\Users\*****\Downloads\Beurteilung 4Punkt0.xlsx
2014-09-03 20:01 - 2014-09-05 22:50 - 00011297 _____ () C:\Users\*****\Documents\Event43.xlsx
2014-09-02 16:58 - 2014-09-02 19:32 - 00999543 _____ () C:\Users\*****\Documents\Stundenplan_gesamt_Endfassung.xlsx
2014-09-02 16:56 - 2014-09-02 16:56 - 01017414 _____ () C:\Users\*****\Documents\Stundenplan_gesamt_Spaltengelöscht.xlsx
2014-09-02 13:49 - 2014-09-02 16:45 - 00905730 _____ () C:\Users\*****\Documents\Stundenplan_gesamt_probieren.xlsx
2014-09-02 11:54 - 2014-09-02 13:49 - 00461427 _____ () C:\Users\*****\Documents\Stundenplan_gesamt_quer.xlsx
2014-09-01 14:12 - 2014-09-01 14:12 - 00243386 _____ () C:\Users\*****\Downloads\Stundenverteilung_Lehrer_neu.xlsx
2014-09-01 12:43 - 2014-09-01 18:34 - 00444183 _____ () C:\Users\*****\Documents\Stundenplan.xlsx
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-28 15:26 - 2014-08-25 16:59 - 00000000 ____D () C:\FRST
2014-09-28 15:24 - 2014-06-07 15:05 - 00000000 ____D () C:\Users\*****
2014-09-28 15:13 - 2014-06-07 15:56 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Skype
2014-09-28 15:00 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\sru
2014-09-28 14:53 - 2014-06-07 15:42 - 00001122 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-28 14:39 - 2014-06-08 15:27 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-28 12:41 - 2014-06-07 15:08 - 02039331 _____ () C:\Windows\WindowsUpdate.log
2014-09-28 11:14 - 2014-07-27 12:49 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2014-09-28 11:14 - 2014-07-27 12:49 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-09-27 11:24 - 2014-06-07 16:08 - 00000000 ____D () C:\Users\*****\AppData\Roaming\ClassicShell
2014-09-26 15:56 - 2014-06-07 15:47 - 00003848 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1402148802
2014-09-26 15:56 - 2014-06-07 15:46 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-09-25 07:00 - 2014-06-07 15:44 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-09-24 09:58 - 2012-07-26 09:59 - 00000000 ____D () C:\Windows\CbsTemp
2014-09-22 19:21 - 2014-06-07 15:50 - 00003594 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1726714612-32550494-740089804-1002
2014-09-22 18:53 - 2014-06-07 15:42 - 00001118 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-22 18:49 - 2012-07-26 09:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-22 18:45 - 2012-08-04 00:28 - 00000000 ____D () C:\Users\Administrator
2014-09-22 18:45 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\SysWOW64\Bthprops
2014-09-22 18:45 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\Bthprops
2014-09-22 18:44 - 2012-07-26 10:12 - 00000000 ___RD () C:\Windows\ToastData
2014-09-22 18:44 - 2012-07-26 10:12 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel
2014-09-22 18:44 - 2012-07-26 10:12 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-09-22 18:44 - 2012-07-26 10:12 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-09-22 18:44 - 2012-07-26 10:12 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools
2014-09-22 18:44 - 2012-07-26 10:12 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-09-22 18:44 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\WinStore
2014-09-22 18:44 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\SecureBootUpdates
2014-09-22 18:44 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\en-GB
2014-09-22 18:44 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-09-22 18:44 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\L2Schemas
2014-09-22 18:44 - 2012-07-26 10:12 - 00000000 ____D () C:\Program Files\Windows Photo Viewer
2014-09-22 18:44 - 2012-07-26 10:12 - 00000000 ____D () C:\Program Files\Windows Defender
2014-09-22 18:44 - 2012-07-26 10:12 - 00000000 ____D () C:\Program Files (x86)\Windows Photo Viewer
2014-09-22 18:44 - 2012-07-26 10:12 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2014-09-22 18:44 - 2012-07-26 09:52 - 00000000 ____D () C:\Program Files\Windows Journal
2014-09-22 18:44 - 2012-07-26 07:38 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-09-22 18:44 - 2012-07-26 07:38 - 00000000 ____D () C:\Windows\system32\oobe
2014-09-22 18:44 - 2012-07-26 07:38 - 00000000 ____D () C:\Windows\system32\Dism
2014-09-22 18:44 - 2012-07-26 07:37 - 00000000 ____D () C:\Windows\servicing
2014-09-22 18:39 - 2012-10-20 07:07 - 00000000 ____D () C:\Windows\SysWOW64\XPSViewer
2014-09-22 18:39 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\SysWOW64\MUI
2014-09-22 18:38 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\MUI
2014-09-22 18:34 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\rescache
2014-09-22 18:33 - 2014-08-23 11:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-09-22 18:33 - 2014-07-25 14:24 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Greenshot
2014-09-22 18:33 - 2014-06-09 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-09-22 18:33 - 2014-06-09 12:41 - 00000000 ____D () C:\Users\*****\AppData\Local\Microsoft Help
2014-09-22 18:33 - 2014-06-09 12:41 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-09-22 18:31 - 2014-08-23 10:59 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-09-22 18:31 - 2014-06-09 12:47 - 00000000 ____D () C:\Program Files (x86)\Microsoft Works
2014-09-22 18:31 - 2014-06-07 15:49 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-22 18:03 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\registration
2014-09-22 17:55 - 2012-07-26 07:38 - 00000000 ____D () C:\Windows\system32\Sysprep
2014-09-22 17:48 - 2014-08-24 13:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
2014-09-22 17:48 - 2012-10-19 22:24 - 00000000 ____D () C:\ProgramData\Hewlett-Packard
2014-09-22 17:47 - 2014-08-24 13:21 - 00000000 ____D () C:\Program Files\Common Files\EPSON
2014-09-22 17:47 - 2012-07-26 10:12 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-09-22 17:35 - 2014-06-07 17:06 - 00000000 ____D () C:\Users\*****\AppData\Local\CrashDumps
2014-09-22 08:42 - 2014-06-09 12:55 - 00278152 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-09-21 18:24 - 2012-08-04 00:23 - 01048584 _____ () C:\Windows\PFRO.log
2014-09-21 16:56 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\NDF
2014-09-21 12:47 - 2012-07-26 09:21 - 00051097 _____ () C:\Windows\setupact.log
2014-09-20 19:59 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\AUInstallAgent
2014-09-09 19:40 - 2014-06-08 15:27 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-01 18:27 - 2012-10-20 07:07 - 00830120 _____ () C:\Windows\system32\perfh007.dat
2014-09-01 18:27 - 2012-10-20 07:07 - 00188224 _____ () C:\Windows\system32\perfc007.dat
2014-09-01 18:27 - 2012-07-26 09:28 - 01949432 _____ () C:\Windows\system32\PerfStringBackup.INI
Some content of TEMP:
====================
C:\Users\*****\AppData\Local\Temp\Extract.exe
C:\Users\*****\AppData\Local\Temp\OnlineBackup.exe
C:\Users\*****\AppData\Local\Temp\Quarantine.exe
C:\Users\*****\AppData\Local\Temp\setup_292.exe
C:\Users\*****\AppData\Local\Temp\SP60642.exe
C:\Users\*****\AppData\Local\Temp\SP61877.exe
C:\Users\*****\AppData\Local\Temp\vcredist_x64.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-09-24 10:44
==================== End Of Log ============================
Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-09-28 15:42:58
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000034 Hitachi_HTS547564A9E384 rev.JEDOA50A 596,17GB
Running: Gmer-19357.exe; Driver: C:\Users\*****\AppData\Local\Temp\kfloapow.sys
---- Kernel code sections - GMER 2.1 ----
.text C:\Windows\System32\win32k.sys!W32pServiceTable fffff96000153e00 7 bytes [C0, CB, 1C, 01, 00, 7B, 9B]
.text C:\Windows\System32\win32k.sys!W32pServiceTable + 8 fffff96000153e08 7 bytes [01, 10, E4, FF, 00, 5F, E8]
---- User code sections - GMER 2.1 ----
.text C:\Windows\Explorer.EXE[2964] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fdbf021532 4 bytes [02, BF, FD, 07]
.text C:\Windows\Explorer.EXE[2964] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fdbf02153a 4 bytes [02, BF, FD, 07]
.text C:\Windows\Explorer.EXE[2964] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fdbf02165a 4 bytes [02, BF, FD, 07]
---- Threads - GMER 2.1 ----
Thread C:\Windows\system32\csrss.exe [568:592] fffff960009795e8
Thread C:\Windows\system32\svchost.exe [1008:2040] 000007fdbfe751dc
Thread C:\Windows\system32\svchost.exe [1008:3964] 000007fdbfe92508
Thread C:\Windows\system32\svchost.exe [1008:6812] 000007fdb6c03158
Thread C:\Windows\system32\svchost.exe [1008:6380] 000007fdb62e1fe4
Thread C:\Windows\system32\svchost.exe [1008:6112] 000007fdacbe54f8
Thread C:\Windows\system32\svchost.exe [1008:5296] 000007fdab3f2520
Thread C:\Windows\system32\svchost.exe [1008:36] 000007fdbd7f10f0
Thread C:\Windows\system32\svchost.exe [388:2716] 000007fdb9586ba8
Thread C:\Windows\system32\svchost.exe [388:2720] 000007fdb9586794
Thread C:\Windows\System32\svchost.exe [480:5908] 000007fdbcd3a2b0
Thread [1704:1808] 00000000773b6f00
Thread [1704:1812] 0000000076058064
Thread [1704:2000] 000000007c3494f6
Thread [1704:2004] 000000007c3494f6
Thread [1704:2008] 000000007c3494f6
Thread [1704:2012] 000000007c3494f6
Thread [1704:2016] 000000007c3494f6
Thread [1704:2020] 000000007c3494f6
Thread [1704:2024] 000000007c3494f6
Thread [1704:2028] 000000007c3494f6
Thread [1704:2032] 000000007c3494f6
Thread C:\Windows\system32\svchost.exe [1216:2076] 000007fdba4154c0
Thread C:\Windows\system32\svchost.exe [1216:2080] 000007fdba3f30ec
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
|
