Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Pc fährt nach Neustart nicht mehr hoch,zeit nur kryptische Zeichenkette (https://www.trojaner-board.de/164205-pc-faehrt-neustart-mehr-hoch-zeit-nur-kryptische-zeichenkette.html)

Sunny-Melone 19.02.2015 19:48
Pc fährt nach Neustart nicht mehr hoch,zeit nur kryptische Zeichenkette
 
Hallo und guten Abend,
Nach einem Neustart fährt der PC nicht mehr hoch .
Ich sehe das Bild vom Bios *f8 geht nicht* danach kommt sofort eine lange zeichenkette und nichts geht mehr.
Hab ich mir da was eingefangen??? Ich weiß jetzt nicht wirklich wie ich verfahren soll , ich hoffe ich kann hier Hilfe bekommen.
Ichversuche mal ein Bild mit hoch zu laden.
Gruß Sunny

[IMG]http://abload.de/img/fehlerygpij.jpg[/IMG]

Aneri 19.02.2015 19:55
:hallo:

Mein Name ist Heiko, ich werde dir bei deinem Problem helfen.
Die Bereinigung deines Systems ist individuell auf dich zugeschnitten und mitunter mit viel Arbeit für uns beide verbunden.

Bitte Lesen:
Regeln für die Bereinigung

Eine Bereinigung beinhaltet nebst dem Entfernen von Malware auch das Schließn von Sicherheitslücken und sollte gründlich durchgeführt werden.
Sie erfolgt deshalb in mehreren Schritten und bedeutet einigen Aufwand für dich. Beachte: Das Verschwinden der offensichtlichen Symptome bedeutet nicht, dass das System schon sauber ist.

Lese Dir die Anleitung zuerst vollständig durch. Sollte etwas unklar sein, frage bevor Du mit der abarbeitung der Schritte beginnst.
  • :pfui: Beim ersten Anzeichen illegal genutzter Software (Cracks, Patches und Co) wird der Support unterbrochen . Bis die illegale Software deinstalliert ist.
  • Falls es sich bei dem Rechner um einen Firmenrechner handelt teile es mir bitte mit.

  • Bitte arbeite alle Schritte der Reihe nach ab. Gib mir bitte zu jedem Schritt die angeforderte Rückmeldung (Logfile oder Antwort)
    und zwar gesammelt, wenn du alles erledigt hast, in einer Antwort.
  • Bitte führe nur Scanns durch zu denen Du aufgefordert wirst.
  • Bitte kein Crossposting (posten in mehreren Foren).
  • Installiere oder Deinstalliere während der Bereinigung keine Software, ausser Du wurdest dazu von mir oder einem anderen Teammitglied aufgefordert.
  • Poste die Logfiles direkt in deinen Thread (möglichst in Code-Tags - #-Symbol im Editor anklicken). Nicht anhängen oder zippen, außer ich fordere Dich dazu auf, oder das Logfile wäre zu gross. Erschwert mir nämlich das Auswerten.
  • Mache deinen Namen nur dann unkenntlich, wenn es unbedingt sein muss (erleichtert uns die Arbeit).
  • Sollte ich nicht nach 3 Tagen geantwortet haben, dann (und nur dann) schicke mir bitte eine PM.
  • Ich werde dir ganz deutlich mitteilen, dass du "sauber" bist. Bis dahin arbeite bitte gut mit.

Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der schnellere und immer der sicherste Weg.


Schritt 1:

wir fangen gleich an deinen Rechner zu bereinigen, kannst du mir das komplette Display als Photo posten?

Schritt 2:

kommst du ins Bios um die Bootreihenfolge so einzustellen dass du von einer CD starten kannst?
Hast du eine Windows CD zur Hand um von dieser zu starten?

Was siehst du genau beim Start, hast du eine möglichkeit aus der Recovery zu starten?

Sunny-Melone 20.02.2015 09:35
hallo Aneri,
vielen vielen dank für deine schnelle antwort,leider ist gestern abend auch unser 2 rechner abgestürzt und ich habe mich nicht mehr getraut ihn anzustellen :heulen:

nun läuft dieser wieder,hat sich wohl nur aufgehangen.


1. eigentlich ist nicht mehr auf dem Bildschirm zu sehen aber ich versuche es noch einmal alles drauf zu bekommen

2. ja, ich glaube das ich die bootreihenfolge ändern kann und eine win7 habe ich auch zur Hand.

Zitat:
Was siehst du genau beim Start, hast du eine möglichkeit aus der Recovery zu starten?
ich sehe das startbild vom bios danach kommt diese zeichenkette.das mit der recovery hab ich noch nie gemacht,ich möchte es auch ungern noch schlimmer machen

cosinus 20.02.2015 10:28
Hi

*michmalkurzeinmisch* :)

1.) der 2. Rechner hat den gleich Fehler wie der 1. Rechner? :wtf:

2.) Den Screenshot den du gepostet hast, diese Zeichenkette soll vom BIOS sein oder kommt das erst wenn der Rechner versucht das Betriebssystem zu booten?

3.) den 1. Rechner mit dem o.g. Fehlerbild würde ich erstmal für mindesten zehn Minuten von der Stromversorgung trennen, also Powerkabel ziehen, dann nochmal versuch hochzufahren

Sunny-Melone 20.02.2015 11:10
guten morgen Cosinus,


1.nein,das ist der rechner von meinem mann der hängt sich wohl ab und an immer mal auf*so wie ebend auch*

Zitat:
Den Screenshot den du gepostet hast, diese Zeichenkette soll vom BIOS sein oder kommt das erst wenn der Rechner versucht das Betriebssystem zu booten?
das kommt nach dem bios bild,also wenn der rechner anfangen sollte zu booten


Zitat:
den 1. Rechner mit dem o.g. Fehlerbild würde ich erstmal für mindesten zehn Minuten von der Stromversorgung trennen, also Powerkabel ziehen, dann nochmal versuch hochzufahren
habe den stecker gezogen und werde nun die 10 min warten

leider hat sich nichts geändert

hier noch mal ein besseres bild

[IMG]http://abload.de/img/fehlercns3o.jpg[/IMG]

cosinus 20.02.2015 11:38
Das sieht leider übel aus...als Privatmensch hast du bestimmt auch nicht diverse passende Ersatzteile rumliegen...

Was genau ist das eigentlich für ein Rechner? Modell und Eckdaten wie Mainboard, CPU, RAM und Platte wären ganz interessant...und naja Kaufdatum, vllt hat der ja noch Garantie?

Sunny-Melone 20.02.2015 12:10
Zitat:
als Privatmensch hast du bestimmt auch nicht diverse passende Ersatzteile rumliegen...
nein der rechner ist relative neu,auf alles noch garantie hier mal deine gewünschten Daten:

Mainboard: ASrock FM2A88M Extrem4 +AMD A88x So.FM2+Dual Channel DDR3
Grafik: Radeon HD 7730 PCIe 3.0 x16
CPU: AMD A10 Serie 7850k 4x3.70GHz.
RAM: 16GB G.Skill TridentX DDR3-2400 Dimm CL10 Dual Kit
Platte ich glaube eine Sygate kann das aber nicht beschwören

Was ist das für ein fehler???

cosinus 20.02.2015 12:13
Na, dann renn mal mit dem Ding zum Händler und hau es ihm umme Ohren :D

BTW: Du hast nicht rein zufällig vor dem Zeichensalat versucht ein Firmwareupdate des Mainboards zu machen???

Sunny-Melone 20.02.2015 12:24
Zitat:
Na, dann renn mal mit dem Ding zum Händler und hau es ihm umme Ohren
würdest du mir freundlicher weise auch sagen was ich den erzählen soll?was ist an diesem ding den nun kaputt??????


Zitat:
BTW: Du hast nicht rein zufällig vor dem Zeichensalat versucht ein Firmwareupdate des Mainboards zu machen???
nein,natürlich nicht. ich habe normal am rechner gearbeitet.danach hab ich ihn neu gestartet und ich hab das auf dem Bildschirm zu sehen bekommen

cosinus 20.02.2015 13:08
Zitat:
Zitat von Sunny-Melone (Beitrag 1429935)
würdest du mir freundlicher weise auch sagen was ich den erzählen soll?was ist an diesem ding den nun kaputt??????
Das soll ich über ein Forum sehen? Hälste du mich für nen :glaskugel: :lach:
Was genau kaputt ist, das muss dein Händler rausfinden.

Sunny-Melone 20.02.2015 13:53
:confused::confused::confused:
wie kommst du den auf den Gedanken das was kaputt ist,kann es nicht auch der bootloader oder irgend ein schädliches Programm sein???
ich verstehe dich nicht

cosinus 20.02.2015 13:58
Zitat:
Zitat von Sunny-Melone (Beitrag 1429973)
wie kommst du den auf den Gedanken das was kaputt ist
Das Bild ist doch selbstsprechend!

Zitat:
Zitat von Sunny-Melone (Beitrag 1429973)
,kann es nicht auch der bootloader oder irgend ein schädliches Programm sein???
Du hast geschrieben es sieht schon direkt nach dem Einschalten beim BIOS so aus. Da ist nix mit Bootloader von der Festplatte.

Sunny-Melone 20.02.2015 15:17
Zitat:
Das Bild ist doch selbstsprechend!
Für mich leider nicht, aber wenn du das so siehst, bitt,leider Muss ich dich enttäuschen, der Rechner läuft seit wenigen Minuten wieder.
Geholfen hast du mir nicht wirklich ,ganz im Gegenteil mir eher noch angst gemacht.
Scheinbar war es doch ein Virus oder der gleichen.
ich habe eine alte ct Rettung`s cd benutzt die ein virtuelles Betriebssystem installiert hat.
somit hatte ich zugriff auf meine Festplatte. Ich habe alle Programme, es waren 2, die ich zum formatumwandeln brauchte und auch heruntergeladen habe wieder gelöscht und das System mit Windows 7 neu gestartet. Siehe da................ alles wieder ok.
Da du ja steif und fest behauptest das es sich um einen Hardware Fehler handelt du aber nicht erklären kannst oder willst wie du darauf kommst belasse ich es hierbei.
Scheinbar bist du der einzige der diese Schriftkette lesen kann, für mich jedenfalls ist es in keiner weise ersichtlich was das für ein Fehler sein sollte.
Ich danke dir für diese kleine Diskussion und hoffe das du beim nächsten Problem bitte etwas weitsichtiger bist bzw. offener für andere Lösungsvorschläge.
Dies ist und bleibt die Anlaufstelle Nr. Eins bei derartigen Problemen, leider war das hier etwas enttäuschend.
Lg Sunny

cosinus 20.02.2015 15:43
Dann hast du das Problem aber auch falsch beschrieben! Denn du sagtest "direkt nachm BIOS" kommt das so. Und dann hier die beleidigte und enttäuschte Leberwurst spielen, herrlich :applaus:

Sunny-Melone 20.02.2015 17:04
Zitat:
Dann hast du das Problem aber auch falsch beschrieben! Denn du sagtest "direkt nachm BIOS" kommt das so
Und genau so ist es ja auch,wie oft den noch!!!!
Ich weiß nicht was du dir da zusammen reimst, das problem bestand NACH DEM BIOS BILD
:nono::nono:

cosinus 20.02.2015 20:22
Zum Thema zusammenreimen:

Zitat:
Ich sehe das Bild vom Bios *f8 geht nicht* danach kommt sofort eine lange zeichenkette und nichts geht mehr.
Du siehst das BILD vom BIOS, F8 geht nicht, offensichtich kommst du auch nicht ins BIOS, und es geht nix mehr. Aus der Ferne klinkgt diese Fehlerbeschreibung für mich nach einem Hardwarefehler. Wenn du Probleme so nicht präzise genug beschreibst, ist nicht gerade förderlich die Helfer anzumotzen, oder kannst du auf deinem Gebiet 100%ig richtige Aussagen treffen wenn man dir fehlerhafte Informationen rüberschiebt? Nein? Na also.

Zitat:
Ich habe alle Programme, es waren 2, die ich zum formatumwandeln brauchte und auch heruntergeladen habe
Damit kann ich nichts anfangen, hast du was was in dem Anfangspost vergessen zu erwähnen?

Aneri 20.02.2015 20:32
ich hab da mal ne kurze Frage... Cosinus machst du das jetzt hier ??? Ich hab das Thema eigendlich noch in Arbeit


Versuchen wir mal folgendes:

den Punkt Windows CD solltest du einmal versuchen...

Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)
Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)
  • Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST Download FRST 32-Bit | FRST 64-Bit
  • Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.
  • Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:
Über den Boot Manager:
  • Starte den Rechner neu.
  • Während dem Hochfahren drücke mehrmals die F8 Taste
  • Wähle nun Computer reparieren.
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Mit Windows CD/DVD (auch bei Windows 8 möglich):
  • Lege die Windows CD in dein Laufwerk.
  • Starte den Rechner neu und starte von der CD.
  • Wähle die Spracheinstellungen und klicke "Weiter".
  • Klicke auf Computerreparaturoptionen !
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Wähle in den Reparaturoptionen: Eingabeaufforderung
  • Gib nun bitte notepad ein und drücke Enter.
  • Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
    Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.
  • Schließe Notepad wieder
  • Gib nun bitte folgenden Befehl ein.
    e:\frst.exe bzw. e:\frst64.exe
    Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.
  • Akzeptiere den Disclaimer mit Ja und klicke Untersuchen
Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).


cosinus 20.02.2015 20:39
Ich wollte mich eigentlich nur kurz einklinken weil es nach der Fehlerbeschreibung eher nach einem Hardwaredefekt aussah ;)

Sunny-Melone hat's ja aber selber wieder hingekriegt...wie auch immer was für Formate umgewandelt worden...du kannst ja gerne jetzt weitermachen mit FRST und Co :D

schrauber 20.02.2015 20:49
trotzdem kein Grund sich in einen laufenden Thread einzumischen. In diesen beiden Foren postet EINER in das Thema, ist das Thema bereits in Arbeit, bleibt man aus dem Thema raus.

@Aneri
weiter machen.

Sunny-Melone 24.02.2015 11:53
vieln dank ihr beiden,
aber der rechner geht im moment ich mag da jetzt nicht dran rumspielen.
lg sunny

Aneri 24.02.2015 12:58
Schade dass du deinen Rechner nicht bereinigen willst. Er kann danach nur stabiler laufen

cosinus 24.02.2015 13:26
Vllt hätte man in den FRST-Logs auch mal Hinweise auf die Ursache des Zeichensalats gefunden...

Sunny-Melone 24.02.2015 16:58
:heulen::heulen::heulen::heulen::heulen:
Neustart gleiches Problem,also doch reinigen,eines weiß ich mit Sicherheit,nach der Reinigung wird der Computer vernagelt für die Familie :schrei:

hier das logfile:


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-02-2015 01
Ran by SYSTEM on MININT-2D7NC68 on 24-02-2015 16:46:01
Running from P:\
Platform: Windows 7 Professional (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Bdagent] => C:\Program Files\Bitdefender\Bitdefender 2013\bdagent.exe [1575192 2013-09-27] (Bitdefender)
HKLM\...\Run: [NUSB3MON] => C:\Program Files (x86)\ATI Technologies\AMDUSB3DeviceDetector\nusb3mon.exe [97280 2012-04-11] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [OODefragTray] => C:\Windows\system32\oodtray.exe [3805704 2007-05-11] (O&O Software GmbH)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Skiller Pro] => C:\Program Files (x86)\Skiller Pro\Monitor.exe [475136 2014-02-26] ()
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [373760 2014-03-18] (shbox.de)
HKLM\...26dfa299cadb\InprocServer32: [Authentication UI Logon UI] authuitu.dll <==== ATTENTION!
HKLM\...\Policies\Explorer: [NoViewContextMenu] 0
HKU\Sherlock Holmes\...\Run: [SandboxieControl] => "d:\Program Files\Sandboxie\SbieCtrl.exe"
HKU\Sherlock Holmes\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
HKU\Sherlock Holmes\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
BootExecute: autocheck autochk * OODBS

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-09-15] (Advanced Micro Devices, Inc.)
S4 BdDesktopParental; C:\Program Files\Bitdefender\Bitdefender 2013\bdparentalservice.exe [69392 2013-08-07] (Bitdefender)
S2 O&O Defrag; C:\Windows\system32\oodag.exe [1418248 2007-05-11] (O&O Software GmbH)
S2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [239176 2013-02-19] (Realtek Semiconductor)
S2 SafeBox; C:\Program Files\Bitdefender\Bitdefender SafeBox\safeboxservice.exe [95184 2012-06-25] (Bitdefender)
S2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender 2013\updatesrv.exe [67320 2013-08-07] (Bitdefender)
S2 VSSERV; C:\Program Files\Bitdefender\Bitdefender 2013\vsserv.exe [1645256 2013-09-30] (Bitdefender)
S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S4 AHDDC2; C:\Program Files (x86)\Ashampoo\Ashampoo HDD Control 2\AHDDC2_Service.exe [X]
S2 MBAMScheduler; "d:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe" [X]
S2 MBAMService; "d:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe" [X]
S2 SbieSvc; "d:\Program Files\Sandboxie\SbieSvc.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S0 amdide64; C:\Windows\System32\DRIVERS\amdide64.sys [11904 2014-10-31] (Advanced Micro Devices Inc.)
S0 amdkmafd; C:\Windows\System32\DRIVERS\amdkmafd.sys [21160 2014-11-04] (Advanced Micro Devices, Inc.)
S2 AODDriver4.3; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
S3 AsrDrv101; C:\Windows\SysWOW64\Drivers\AsrDrv101.sys [22280 2014-08-16] (ASRock Incorporation)
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2014-09-14] ()
S0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [727592 2013-07-19] (BitDefender)
S3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [261056 2012-11-02] (BitDefender)
S3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [601360 2013-07-19] (BitDefender)
S1 BdfNdisf; c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [93600 2013-02-22] (BitDefender LLC)
S1 bdfwfpf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [103504 2011-11-14] (BitDefender LLC)
S3 BDSandBox; C:\Windows\system32\drivers\bdsandbox.sys [82824 2013-07-23] (BitDefender SRL)
S1 BDVEDISK; C:\Windows\System32\DRIVERS\bdvedisk.sys [76944 2012-04-17] (BitDefender)
S3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-09-01] (Disc Soft Ltd)
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [17480 2013-03-07] ()
S3 epmntdrv; C:\Windows\SysWOW64\epmntdrv.sys [14920 2013-03-07] ()
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9800 2013-03-07] ()
S3 EuGdiDrv; C:\Windows\SysWOW64\EuGdiDrv.sys [9160 2013-03-07] ()
S3 FLxHCIh; C:\Windows\System32\DRIVERS\FLxHCIh.sys [77480 2014-08-16] (Fresco Logic)
S0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [150256 2013-08-23] (BitDefender LLC)
S3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [129224 2013-07-18] (Qualcomm Atheros Co., Ltd.)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2014-09-14] ()
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-24] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
S0 pwdrvio; C:\Windows\System32\pwdrvio.sys [19152 2013-09-30] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [12504 2013-09-30] ()
S5 RTSPER; C:\Windows\System32\Drivers\RTSPER.sys [465624 2014-01-03] (Realsil Semiconductor Corporation)
S0 trufos; C:\Windows\System32\DRIVERS\trufos.sys [389240 2013-08-07] (BitDefender S.R.L.)
S1 ISODrive; \??\D:\UltraISO\drivers\ISODrv64.sys [X]
S3 SbieDrv; \??\d:\Program Files\Sandboxie\SbieDrv.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-24 16:45 - 2015-02-24 16:46 - 00000000 ____D () C:\FRST
2015-02-24 15:26 - 2015-02-24 15:44 - 00000000 ____D () C:\Users\Sherlock Holmes\.VirtualBox
2015-02-24 15:25 - 2015-02-24 15:25 - 00001084 _____ () C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk
2015-02-24 15:25 - 2013-04-12 11:41 - 00237840 _____ (Oracle Corporation) C:\Windows\System32\Drivers\VBoxDrv.sys
2015-02-24 15:25 - 2013-04-12 11:40 - 00120080 _____ (Oracle Corporation) C:\Windows\System32\Drivers\VBoxUSBMon.sys
2015-02-24 15:24 - 2015-02-24 15:24 - 00000000 ____D () C:\Program Files\Oracle
2015-02-24 15:22 - 2015-02-24 15:37 - 00000000 ____D () C:\VirtualBox
2015-02-24 15:21 - 2015-02-24 15:21 - 00000000 ____D () C:\Austausch
2015-02-20 19:03 - 2015-02-20 19:03 - 00000861 _____ () C:\Users\Public\Desktop\EaseUS Data Recovery Wizard 8.6.lnk
2015-02-20 14:54 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\System32\perftrack.dll
2015-02-20 14:54 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\System32\wdi.dll
2015-02-20 14:54 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\System32\powertracker.dll
2015-02-20 14:54 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll
2015-02-20 14:28 - 2015-02-20 14:28 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Temp
2015-02-20 14:14 - 2015-02-20 15:26 - 00002659 _____ () C:\Windows\System32\oodbs.lor
2015-02-19 18:13 - 2015-02-19 18:13 - 00000000 ____D () C:\Users\Sherlock Holmes\Calibre Library
2015-02-18 20:52 - 2015-02-18 20:52 - 00000000 _____ () C:\Windows\oodcnt.INI
2015-02-18 16:35 - 2015-02-18 18:41 - 00000000 ____D () C:\Windows\System32\oodag
2015-02-18 16:23 - 2015-02-18 16:23 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\O&O
2015-02-18 16:22 - 2015-02-18 16:22 - 00002068 _____ () C:\Users\Public\Desktop\O&O Defrag.lnk
2015-02-18 16:22 - 2015-02-18 16:22 - 00000000 ____D () C:\Program Files\OO Software
2015-02-18 15:05 - 2015-01-23 05:42 - 00814080 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll
2015-02-18 15:05 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2015-02-18 15:05 - 2015-01-23 04:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-02-18 15:05 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-18 14:57 - 2015-02-18 14:58 - 00002481 ____H () C:\Windows\EPMBatch.ept
2015-02-18 11:29 - 2015-02-18 11:29 - 00000991 _____ () C:\Users\Public\Desktop\EaseUS Partition Master 10.1.lnk
2015-02-18 11:28 - 2014-04-04 00:42 - 03382440 _____ () C:\Windows\System32\BootMan.exe
2015-02-18 11:28 - 2014-04-04 00:25 - 02499752 _____ () C:\Windows\SysWOW64\BootMan.exe
2015-02-18 11:28 - 2013-03-07 09:49 - 00100936 _____ () C:\Windows\System32\setupempdrvx64.exe
2015-02-18 11:28 - 2013-03-07 09:49 - 00087112 _____ () C:\Windows\SysWOW64\setupempdrv03.exe
2015-02-18 11:28 - 2013-03-07 09:49 - 00019840 _____ () C:\Windows\SysWOW64\EuEpmGdi.dll
2015-02-18 11:28 - 2013-03-07 09:49 - 00017480 _____ () C:\Windows\System32\epmntdrv.sys
2015-02-18 11:28 - 2013-03-07 09:49 - 00016256 _____ () C:\Windows\System32\EuEpmGdi.dll
2015-02-18 11:28 - 2013-03-07 09:49 - 00014920 _____ () C:\Windows\SysWOW64\epmntdrv.sys
2015-02-18 11:28 - 2013-03-07 09:49 - 00009800 _____ () C:\Windows\System32\EuGdiDrv.sys
2015-02-18 11:28 - 2013-03-07 09:49 - 00009160 _____ () C:\Windows\SysWOW64\EuGdiDrv.sys
2015-02-17 21:29 - 2015-02-22 15:09 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\MEMENTO
2015-02-17 16:18 - 2015-02-17 16:18 - 00000725 _____ () C:\Users\Sherlock Holmes\Desktop\Memento Mori.lnk
2015-02-17 16:08 - 2015-02-17 16:08 - 00335288 _____ (Protect Software GmbH) C:\Windows\System32\Drivers\acedrv11.sys
2015-02-17 16:08 - 2015-02-17 16:08 - 00004096 _____ () C:\Users\Public\Documents\00000A51.LCS
2015-02-17 16:05 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll
2015-02-17 16:05 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\System32\xactengine3_2.dll
2015-02-17 16:05 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\Windows\System32\XAPOFX1_1.dll
2015-02-17 16:05 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2015-02-17 16:05 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\Windows\System32\XAudio2_2.dll
2015-02-17 16:05 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2015-02-17 16:05 - 2008-07-12 08:18 - 04992520 _____ (Microsoft Corporation) C:\Windows\System32\D3DX9_39.dll
2015-02-17 16:05 - 2008-07-12 08:18 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2015-02-17 16:05 - 2008-07-12 08:18 - 01942552 _____ (Microsoft Corporation) C:\Windows\System32\D3DCompiler_39.dll
2015-02-17 16:05 - 2008-07-12 08:18 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2015-02-17 16:05 - 2008-07-12 08:18 - 00540688 _____ (Microsoft Corporation) C:\Windows\System32\d3dx10_39.dll
2015-02-17 16:05 - 2008-07-12 08:18 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2015-02-17 16:03 - 2015-02-17 16:04 - 00017627 _____ () C:\Windows\DirectX.log
2015-02-17 15:36 - 2015-02-17 15:36 - 00002921 _____ () C:\Windows\PWCMDLST.BAK
2015-02-17 15:06 - 2015-01-14 06:47 - 00389808 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2015-02-17 15:06 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-17 15:06 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2015-02-17 15:06 - 2015-01-12 04:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2015-02-17 15:06 - 2015-01-12 04:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll
2015-02-17 15:06 - 2015-01-12 03:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2015-02-17 15:06 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2015-02-17 15:06 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2015-02-17 15:06 - 2015-01-12 03:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll
2015-02-17 15:06 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll
2015-02-17 15:06 - 2015-01-12 03:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2015-02-17 15:06 - 2015-01-12 03:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2015-02-17 15:06 - 2015-01-12 03:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2015-02-17 15:06 - 2015-01-12 03:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2015-02-17 15:06 - 2015-01-12 03:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe
2015-02-17 15:06 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-17 15:06 - 2015-01-12 03:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2015-02-17 15:06 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-02-17 15:06 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2015-02-17 15:06 - 2015-01-12 03:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll
2015-02-17 15:06 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-17 15:06 - 2015-01-12 03:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2015-02-17 15:06 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2015-02-17 15:06 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-02-17 15:06 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-02-17 15:06 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-02-17 15:06 - 2015-01-12 03:04 - 00316928 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2015-02-17 15:06 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-17 15:06 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-02-17 15:06 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-02-17 15:06 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-02-17 15:06 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-02-17 15:06 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2015-02-17 15:06 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2015-02-17 15:06 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2015-02-17 15:06 - 2015-01-12 02:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2015-02-17 15:06 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-17 15:06 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2015-02-17 15:06 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-02-17 15:06 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-02-17 15:06 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-02-17 15:06 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-02-17 15:06 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2015-02-17 15:06 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-17 15:06 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-17 15:06 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-02-17 15:06 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-17 15:06 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2015-02-17 15:06 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2015-02-17 15:06 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-17 15:06 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-17 15:06 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-17 15:05 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\System32\appraiser.dll
2015-02-17 15:05 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\System32\invagent.dll
2015-02-17 15:05 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\System32\generaltel.dll
2015-02-17 15:05 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\System32\devinv.dll
2015-02-17 15:05 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2015-02-17 15:05 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\System32\aepic.dll
2015-02-17 15:05 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2015-02-17 15:05 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\System32\aitstatic.exe
2015-02-17 15:05 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2015-02-17 15:05 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-02-17 15:04 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
2015-02-17 15:04 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2015-02-17 15:04 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\System32\lsasrv.dll
2015-02-17 15:04 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\System32\sspicli.dll
2015-02-17 15:04 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\System32\lsass.exe
2015-02-17 15:04 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\System32\sspisrv.dll
2015-02-17 15:04 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\System32\secur32.dll
2015-02-17 15:04 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\System32\auditpol.exe
2015-02-17 15:04 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\System32\msaudite.dll
2015-02-17 15:04 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\System32\msobjs.dll
2015-02-17 15:04 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\System32\adtschema.dll
2015-02-17 15:04 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-02-17 15:04 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-02-17 15:04 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-02-17 15:04 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-02-17 15:04 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-02-17 15:04 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-02-17 15:04 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys
2015-02-17 15:04 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2015-02-17 15:04 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\System32\srcore.dll
2015-02-17 15:04 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\System32\srclient.dll
2015-02-17 15:04 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\System32\rstrui.exe
2015-02-17 15:04 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-02-17 15:04 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-02-17 15:04 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00728064 _____ (Microsoft Corporation) C:\Windows\System32\kerberos.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00341504 _____ (Microsoft Corporation) C:\Windows\System32\schannel.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00314880 _____ (Microsoft Corporation) C:\Windows\System32\msv1_0.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00309760 _____ (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00210944 _____ (Microsoft Corporation) C:\Windows\System32\wdigest.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00086528 _____ (Microsoft Corporation) C:\Windows\System32\TSpkg.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\System32\credssp.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-02-17 15:03 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2015-02-17 15:03 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-17 15:03 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\System32\scesrv.dll
2015-02-17 15:03 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-17 15:03 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\System32\oleaut32.dll
2015-02-17 15:03 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-17 14:58 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2015-02-16 17:01 - 2015-01-14 11:28 - 03066880 _____ () C:\Windows\System32\pwNative.exe
2015-02-16 17:01 - 2013-09-30 16:26 - 00019152 ____N () C:\Windows\System32\pwdrvio.sys
2015-02-16 17:01 - 2013-09-30 16:26 - 00012504 ____N () C:\Windows\System32\pwdspio.sys
2015-02-16 17:00 - 2015-02-16 17:00 - 00000846 _____ () C:\Users\Public\Desktop\MiniTool Partition Wizard Free.lnk
2015-02-16 15:29 - 2015-02-16 15:29 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\FreeFLVConverter
2015-02-16 15:29 - 2011-09-22 11:05 - 00364544 _____ () C:\Windows\SysWOW64\PropertyGrid.ocx
2015-02-16 15:29 - 2011-09-22 11:05 - 00208500 _____ () C:\Windows\SysWOW64\ReyXpBasics.tlb
2015-02-16 15:29 - 2011-09-22 11:05 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCMCFR.DLL
2015-02-16 15:29 - 2011-09-22 11:05 - 00119568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VB6FR.DLL
2015-02-16 15:29 - 2011-09-22 11:05 - 00101888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VB6STKIT.DLL
2015-02-16 15:29 - 2011-09-22 11:05 - 00084512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PICCLP32.OCX
2015-02-16 15:29 - 2011-09-22 11:05 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CMDLGFR.DLL
2015-02-16 15:29 - 2011-09-22 11:05 - 00024576 _____ () C:\Windows\SysWOW64\ControlSubX.ocx
2015-02-16 15:29 - 2011-09-22 11:05 - 00009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PCCLPFR.DLL
2015-02-16 15:28 - 2015-02-17 01:42 - 00000000 ____D () C:\Program Files (x86)\Free FLV Converter
2015-02-15 18:15 - 2015-02-15 18:15 - 00000000 ____D () C:\ProgramData\rokapublish
2015-02-15 18:03 - 2015-02-15 18:03 - 00000000 ____D () C:\ProgramData\Solidshield
2015-02-15 15:01 - 2015-02-15 15:01 - 00034816 ___SH () C:\Users\Sherlock Holmes\Documents\Thumbs.db
2015-02-15 15:00 - 2014-12-24 18:46 - 00000326 _____ () C:\Users\Sherlock Holmes\Documents\Verknüpfung mit Recycled.lnk
2015-02-15 15:00 - 2013-10-27 09:06 - 04156350 _____ () C:\Users\Sherlock Holmes\Documents\Scannen0001.bmp
2015-02-15 15:00 - 2013-10-27 09:04 - 04157110 _____ () C:\Users\Sherlock Holmes\Documents\Scannen0001.bmp.orig
2015-02-15 14:59 - 2015-02-15 14:59 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\Bewerbung_Aktuell_2014
2015-02-15 14:59 - 2014-08-08 14:55 - 1114717902 _____ (n/a) C:\Users\Sherlock Holmes\Documents\Grim Tales - Die Vergeltung Sammleredition.exe
2015-02-14 18:56 - 2015-02-14 18:56 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\FinewayStudios
2015-02-13 20:23 - 2015-02-13 20:23 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\ERS G-Studio
2015-02-10 20:27 - 2015-02-10 20:27 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\VendelGAMES
2015-02-10 20:12 - 2015-02-10 20:12 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\EleFun Games
2015-02-10 19:13 - 2015-02-10 19:13 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\Frogwares
2015-02-10 18:42 - 2015-02-10 18:42 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\IsolatedStorage
2015-02-10 18:42 - 2015-02-10 18:42 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\DigitalVolcano
2015-02-10 18:42 - 2015-02-10 18:42 - 00000000 ____D () C:\ProgramData\IsolatedStorage
2015-02-10 12:49 - 2015-02-10 12:49 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\HP Photosmart Projects
2015-02-10 12:48 - 2015-02-10 12:48 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
2015-02-10 12:48 - 2015-02-10 12:48 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
2015-02-07 16:12 - 2015-01-09 15:11 - 00046075 _____ () C:\Users\Sherlock Holmes\Documents\Wunschserien.docx.lnk
2015-02-07 16:12 - 2014-09-14 11:37 - 00000083 _____ () C:\Users\Sherlock Holmes\Documents\dc addy.txt
2015-02-07 09:39 - 2015-02-20 15:27 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Local\FreePDF_XP
2015-02-07 09:34 - 2015-02-07 09:34 - 00000000 ____D () C:\ProgramData\FreePDF
2015-02-07 09:34 - 2015-02-07 09:34 - 00000000 ____D () C:\Program Files (x86)\FreePDF_XP
2015-02-07 09:34 - 2012-06-21 07:25 - 00113152 _____ () C:\Windows\System32\redmon64.dll
2015-02-07 09:34 - 2012-06-21 07:25 - 00044032 _____ () C:\Windows\System32\unredmon64.exe
2015-02-07 09:34 - 2012-06-21 07:25 - 00028435 _____ () C:\Windows\System32\redmon.chm
2015-02-07 09:31 - 2015-02-07 09:31 - 00000000 ____D () C:\Program Files\gs
2015-02-07 09:25 - 2015-02-07 09:25 - 00000135 _____ () C:\Windows\SysWOW64\debug.log
2015-02-07 09:23 - 2015-02-07 09:23 - 23737820 _____ () C:\Users\Sherlock Holmes\Documents\Optimal Lernen.xps
2015-02-06 20:54 - 2015-02-06 20:54 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-02-06 12:11 - 2015-02-06 12:11 - 00000000 ____H () C:\Users\Sherlock Holmes\Documents\Default.rdp
2015-02-05 19:32 - 2015-02-05 19:32 - 00003050 _____ () C:\Windows\System32\Tasks\{C368D411-8AEF-457F-BDFC-4346540C31BB}
2015-02-05 19:31 - 2015-02-05 19:31 - 00003250 _____ () C:\Windows\System32\Tasks\{69079650-C5EF-4F24-B366-0BCE7920D9A3}
2015-02-05 18:47 - 2015-02-05 18:47 - 00002019 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2015-02-03 22:18 - 2015-02-03 22:18 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Local\Adobe_Systems_Incorporate
2015-02-03 22:17 - 2015-02-03 22:24 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\My Digital Editions
2015-02-03 22:17 - 2015-02-03 22:17 - 00003090 _____ () C:\Windows\System32\Tasks\{55D0A493-F2BE-41C4-947D-119C9D648949}
2015-02-03 22:17 - 2015-02-03 22:17 - 00002178 _____ () C:\Users\Public\Desktop\Adobe Digital Editions 3.0.lnk
2015-01-30 11:02 - 2015-01-30 11:02 - 00001357 _____ () C:\Users\Sherlock Holmes\Desktop\HP Solution Center.lnk
2015-01-28 10:35 - 2015-01-28 10:35 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-27 00:23 - 2015-01-27 00:23 - 00014464 _____ (Western Digital Technologies) C:\Windows\System32\Drivers\wdcsam64.sys
2015-01-26 15:05 - 2015-01-30 12:03 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\Eigene Scans
2015-01-26 15:00 - 2015-02-02 16:45 - 00000000 ____D () C:\Scans

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-24 15:58 - 2014-05-11 20:43 - 01369653 _____ () C:\Windows\WindowsUpdate.log
2015-02-24 15:26 - 2014-05-11 19:57 - 00000000 ____D () C:\users\Sherlock Holmes
2015-02-24 14:54 - 2014-08-08 16:26 - 00000501 _____ () C:\Windows\System32\checkdnsid.xml
2015-02-24 13:01 - 2014-05-14 09:13 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\MBAMSwissArmy.sys
2015-02-24 02:01 - 2011-04-12 08:43 - 00699416 _____ () C:\Windows\System32\perfh007.dat
2015-02-24 02:01 - 2011-04-12 08:43 - 00149556 _____ () C:\Windows\System32\perfc007.dat
2015-02-24 02:01 - 2009-07-14 06:13 - 01620612 _____ () C:\Windows\System32\PerfStringBackup.INI
2015-02-23 19:43 - 2014-05-12 21:23 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\vlc
2015-02-23 17:47 - 2014-05-14 06:32 - 00003998 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{CAEDF7C5-6BE4-40C6-A7D7-838E0CB1CD24}
2015-02-23 15:27 - 2014-11-06 11:17 - 00000372 _____ () C:\Windows\Tasks\powersuite_monitor.job
2015-02-23 15:27 - 2014-08-14 17:23 - 00000360 _____ () C:\Windows\Tasks\dsmonitor.job
2015-02-23 06:53 - 2015-01-11 01:00 - 00008835 _____ () C:\Windows\setupact.log
2015-02-21 11:33 - 2009-07-14 05:45 - 00031984 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-21 11:33 - 2009-07-14 05:45 - 00031984 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-20 15:27 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-20 15:25 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2015-02-20 14:14 - 2015-01-14 13:16 - 00002130 _____ () C:\Windows\PFRO.log
2015-02-19 14:47 - 2015-01-01 15:28 - 00011776 _____ () C:\Users\Sherlock Holmes\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-02-19 06:51 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-02-18 22:17 - 2015-01-05 15:45 - 00002830 _____ () C:\Windows\Sandboxie.ini
2015-02-18 15:02 - 2014-05-13 13:34 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-18 15:02 - 2014-05-13 13:34 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-18 11:57 - 2014-08-13 23:00 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\DC++
2015-02-18 11:57 - 2014-08-13 23:00 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Local\DC++
2015-02-17 21:28 - 2014-11-06 11:34 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\My ISO Files
2015-02-17 16:08 - 2014-11-06 13:49 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\ProtectDISC
2015-02-17 15:41 - 2009-07-14 05:45 - 05033688 _____ () C:\Windows\System32\FNTCACHE.DAT
2015-02-17 15:37 - 2014-12-12 03:23 - 00000000 ____D () C:\Windows\System32\appraiser
2015-02-17 15:37 - 2014-05-12 00:18 - 00000000 ___SD () C:\Windows\System32\CompatTel
2015-02-17 15:37 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-02-17 15:19 - 2014-05-11 20:13 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-17 15:18 - 2014-05-15 20:08 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-17 15:18 - 2009-07-14 03:34 - 00000513 _____ () C:\Windows\win.ini
2015-02-17 15:14 - 2014-05-11 22:23 - 00000000 ____D () C:\Windows\System32\MRT
2015-02-17 15:10 - 2014-05-11 22:23 - 116773704 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2015-02-17 14:53 - 2014-08-12 17:22 - 00000000 ____D () C:\Windows\System32\Tasks\Aufgaben der Ereignisanzeige
2015-02-16 15:52 - 2014-05-11 20:27 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-02-10 16:39 - 2014-05-13 16:12 - 00000000 ____D () C:\ProgramData\Oracle
2015-02-10 15:55 - 2014-05-13 16:11 - 00000000 ____D () C:\Program Files (x86)\Java
2015-02-10 15:53 - 2014-05-13 16:11 - 00272296 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2015-02-10 15:53 - 2014-05-13 16:11 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2015-02-10 15:53 - 2014-05-13 16:11 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2015-02-10 15:53 - 2014-05-13 16:11 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-02-10 12:49 - 2014-05-11 20:31 - 00000000 ____D () C:\ProgramData\Adobe
2015-02-10 12:48 - 2014-05-11 20:31 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-02-10 12:46 - 2014-07-14 16:39 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Local\Adobe
2015-02-08 14:14 - 2014-09-01 14:44 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\DAEMON Tools Lite
2015-02-07 16:50 - 2014-05-15 15:03 - 00000486 __RSH () C:\Users\Sherlock Holmes\ntuser.pol
2015-02-07 16:17 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\System32\NDF
2015-02-07 11:14 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Public\Libraries
2015-02-07 09:25 - 2014-05-11 20:32 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\Adobe
2015-02-06 20:52 - 2014-05-12 19:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-02-06 10:22 - 2015-01-11 19:57 - 00000731 _____ () C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk
2015-01-28 20:30 - 2015-01-02 13:06 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\dvdcss
2015-01-26 15:09 - 2014-05-11 19:57 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Local\VirtualStore

Some content of TEMP:
====================
C:\Users\Sherlock Holmes\AppData\Local\Temp\A~NSISu_.exe
C:\Users\Sherlock Holmes\AppData\Local\Temp\jre-8u31-windows-au.exe
C:\Users\Sherlock Holmes\AppData\Local\Temp\proxy_vole2862650717388283353.dll
C:\Users\Sherlock Holmes\AppData\Local\Temp\_isCDDA.exe


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points  =========================

Restore point made on: 2015-02-19 06:50:23
Restore point made on: 2015-02-20 14:54:27
Restore point made on: 2015-02-24 15:24:40

==================== Memory info ===========================

Percentage of memory in use: 7%
Total physical RAM: 16304.71 MB
Available physical RAM: 15116.7 MB
Total Pagefile: 16302.86 MB
Available Pagefile: 15105.21 MB
Total Virtual: 8192 MB
Available Virtual: 8191.89 MB

==================== Drives ================================

Drive c: (Windows7) (Fixed) (Total:97.65 GB) (Free:3.07 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Frei) (Fixed) (Total:465.76 GB) (Free:459.15 GB) NTFS
Drive f: (Downloads) (Fixed) (Total:300.37 GB) (Free:140.16 GB) NTFS
Drive g: (Programme ) (Fixed) (Total:498.54 GB) (Free:481.65 GB) NTFS
Drive h: (Grafik_Fotos) (Fixed) (Total:1266.82 GB) (Free:624.86 GB) NTFS
Drive i: (Reparaturdatenträger Windows 7 6) (CDROM) (Total:0.16 GB) (Free:0 GB) UDF
Drive j: (Games) (Fixed) (Total:698.74 GB) (Free:385.89 GB) NTFS
Drive k: (Daten) (Fixed) (Total:698.52 GB) (Free:442.45 GB) NTFS
Drive p: (USB) (Removable) (Total:7.46 GB) (Free:7.45 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (Software) (Fixed) (Total:398.26 GB) (Free:255.45 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows XP) (Size: 698.6 GB) (Disk ID: A56DFF5E)
Partition 1: (Not Active) - (Size=398.3 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=300.4 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 465.8 GB) (Disk ID: E83A4318)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 472DB8E2)
Partition 1: (Active) - (Size=97.7 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=498.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=1266.8 GB) - (Type=07 NTFS)

========================================================
Disk: 3 (Size: 1397.3 GB) (Disk ID: 000CE977)
Partition 1: (Not Active) - (Size=698.7 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=698.5 GB) - (Type=OF Extended)

========================================================
Disk: 8 (Size: 7.5 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.


LastRegBack: 2015-02-23 00:09

==================== End Of Log ============================
--- --- ---

Aneri 24.02.2015 19:55
Hi,

Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
HKLM\...26dfa299cadb\InprocServer32: [Authentication UI Logon UI] authuitu.dll <==== ATTENTION!
SaveMbr: drive=0
SaveMbr: drive=1
SaveMbr: drive=2
SaveMbr: drive=3
SaveMbr: drive=8
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.


boote das System neu und teile mir mit, ob der Krypt-Bildschirm noch erscheint...
Poste bitte die MBRDUMP.txt aus deinem FRST Verzeichnis.

Sollte das System normal booten erstelle ein neues FRST Logfile (setze den Hacken bei List BCD) und poste es hier.
Wenn das System nicht bootet erstelle ein neues FRST Logfile (setze den Hacken bei List BCD) in der Recovery und poste es hier

Sunny-Melone 24.02.2015 22:33
ich muß aber vorher in den reperaturteil von Windows oder?

Aneri 24.02.2015 22:34
ja :) wir arbeiten aus der Recovery

Sunny-Melone 24.02.2015 22:49
leider hat es nicht geholfen,die zeichen sind nach dem Neustart immer noch da

Fixlog:
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 18-02-2015 01
Ran by SYSTEM at 2015-02-24 22:44:54 Run:1
Running from P:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
HKLM\...26dfa299cadb\InprocServer32: [Authentication UI Logon UI] authuitu.dll <==== ATTENTION!
SaveMbr: drive=0
SaveMbr: drive=1
SaveMbr: drive=2
SaveMbr: drive=3
SaveMbr: drive=8

*****************

HKLM\Software\Classes\CLSID\{7986d495-ce42-4926-8afc-26dfa299cadb}\InprocServer32\\Default => Value was restored successfully.
MBRDUMP.txt is made successfully.
MBRDUMP.txt is made successfully.
MBRDUMP.txt is made successfully.
MBRDUMP.txt is made successfully.
MBRDUMP.txt is made successfully.

==== End of Fixlog 22:44:54 ====
MBRDUMP:
Code:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                ! ]ÎÏ    àï                                                Uª

Aneri 24.02.2015 22:54
der mbrdump ist leer?

Erstelle bitte aus der recovery nochmals ein logfile. Setzt bei frst den Haken bei List Bcd

Sunny-Melone 24.02.2015 23:09
MBRDUMP:

Code:
! ]ÎÏ    àï                                                Uª
das steht da drinn

Aneri 24.02.2015 23:14
Ok das hilft uns heute nicht mehr weiter. Ich muss jetzt eh offline gehen.. lass uns morgen weitermachen.. das die kryptzeichen noch da sind ist normal... wir sind auf dem richtigen weg

Sunny-Melone 24.02.2015 23:16
ok ich poste ebend schnell noch das log file


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-02-2015 01
Ran by SYSTEM on MININT-TCSFEOJ on 24-02-2015 23:16:45
Running from P:\
Platform: Windows 7 Professional (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Bdagent] => C:\Program Files\Bitdefender\Bitdefender 2013\bdagent.exe [1575192 2013-09-27] (Bitdefender)
HKLM\...\Run: [NUSB3MON] => C:\Program Files (x86)\ATI Technologies\AMDUSB3DeviceDetector\nusb3mon.exe [97280 2012-04-11] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [OODefragTray] => C:\Windows\system32\oodtray.exe [3805704 2007-05-11] (O&O Software GmbH)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Skiller Pro] => C:\Program Files (x86)\Skiller Pro\Monitor.exe [475136 2014-02-26] ()
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [373760 2014-03-18] (shbox.de)
HKLM\...\Policies\Explorer: [NoViewContextMenu] 0
HKU\Sherlock Holmes\...\Run: [SandboxieControl] => "d:\Program Files\Sandboxie\SbieCtrl.exe"
HKU\Sherlock Holmes\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
HKU\Sherlock Holmes\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
BootExecute: autocheck autochk * OODBS

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-09-15] (Advanced Micro Devices, Inc.)
S4 BdDesktopParental; C:\Program Files\Bitdefender\Bitdefender 2013\bdparentalservice.exe [69392 2013-08-07] (Bitdefender)
S2 O&O Defrag; C:\Windows\system32\oodag.exe [1418248 2007-05-11] (O&O Software GmbH)
S2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [239176 2013-02-19] (Realtek Semiconductor)
S2 SafeBox; C:\Program Files\Bitdefender\Bitdefender SafeBox\safeboxservice.exe [95184 2012-06-25] (Bitdefender)
S2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender 2013\updatesrv.exe [67320 2013-08-07] (Bitdefender)
S2 VSSERV; C:\Program Files\Bitdefender\Bitdefender 2013\vsserv.exe [1645256 2013-09-30] (Bitdefender)
S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S4 AHDDC2; C:\Program Files (x86)\Ashampoo\Ashampoo HDD Control 2\AHDDC2_Service.exe [X]
S2 MBAMScheduler; "d:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe" [X]
S2 MBAMService; "d:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe" [X]
S2 SbieSvc; "d:\Program Files\Sandboxie\SbieSvc.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S0 amdide64; C:\Windows\System32\DRIVERS\amdide64.sys [11904 2014-10-31] (Advanced Micro Devices Inc.)
S0 amdkmafd; C:\Windows\System32\DRIVERS\amdkmafd.sys [21160 2014-11-04] (Advanced Micro Devices, Inc.)
S2 AODDriver4.3; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
S3 AsrDrv101; C:\Windows\SysWOW64\Drivers\AsrDrv101.sys [22280 2014-08-16] (ASRock Incorporation)
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2014-09-14] ()
S0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [727592 2013-07-19] (BitDefender)
S3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [261056 2012-11-02] (BitDefender)
S3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [601360 2013-07-19] (BitDefender)
S1 BdfNdisf; c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [93600 2013-02-22] (BitDefender LLC)
S1 bdfwfpf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [103504 2011-11-14] (BitDefender LLC)
S3 BDSandBox; C:\Windows\system32\drivers\bdsandbox.sys [82824 2013-07-23] (BitDefender SRL)
S1 BDVEDISK; C:\Windows\System32\DRIVERS\bdvedisk.sys [76944 2012-04-17] (BitDefender)
S3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-09-01] (Disc Soft Ltd)
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [17480 2013-03-07] ()
S3 epmntdrv; C:\Windows\SysWOW64\epmntdrv.sys [14920 2013-03-07] ()
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9800 2013-03-07] ()
S3 EuGdiDrv; C:\Windows\SysWOW64\EuGdiDrv.sys [9160 2013-03-07] ()
S3 FLxHCIh; C:\Windows\System32\DRIVERS\FLxHCIh.sys [77480 2014-08-16] (Fresco Logic)
S0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [150256 2013-08-23] (BitDefender LLC)
S3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [129224 2013-07-18] (Qualcomm Atheros Co., Ltd.)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2014-09-14] ()
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-24] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
S0 pwdrvio; C:\Windows\System32\pwdrvio.sys [19152 2013-09-30] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [12504 2013-09-30] ()
S5 RTSPER; C:\Windows\System32\Drivers\RTSPER.sys [465624 2014-01-03] (Realsil Semiconductor Corporation)
S0 trufos; C:\Windows\System32\DRIVERS\trufos.sys [389240 2013-08-07] (BitDefender S.R.L.)
S1 ISODrive; \??\D:\UltraISO\drivers\ISODrv64.sys [X]
S3 SbieDrv; \??\d:\Program Files\Sandboxie\SbieDrv.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-24 16:45 - 2015-02-24 23:16 - 00000000 ____D () C:\FRST
2015-02-24 15:26 - 2015-02-24 15:44 - 00000000 ____D () C:\Users\Sherlock Holmes\.VirtualBox
2015-02-24 15:25 - 2015-02-24 15:25 - 00001084 _____ () C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk
2015-02-24 15:25 - 2013-04-12 11:41 - 00237840 _____ (Oracle Corporation) C:\Windows\System32\Drivers\VBoxDrv.sys
2015-02-24 15:25 - 2013-04-12 11:40 - 00120080 _____ (Oracle Corporation) C:\Windows\System32\Drivers\VBoxUSBMon.sys
2015-02-24 15:24 - 2015-02-24 15:24 - 00000000 ____D () C:\Program Files\Oracle
2015-02-24 15:22 - 2015-02-24 15:37 - 00000000 ____D () C:\VirtualBox
2015-02-24 15:21 - 2015-02-24 15:21 - 00000000 ____D () C:\Austausch
2015-02-20 19:03 - 2015-02-20 19:03 - 00000861 _____ () C:\Users\Public\Desktop\EaseUS Data Recovery Wizard 8.6.lnk
2015-02-20 14:54 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\System32\perftrack.dll
2015-02-20 14:54 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\System32\wdi.dll
2015-02-20 14:54 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\System32\powertracker.dll
2015-02-20 14:54 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll
2015-02-20 14:28 - 2015-02-20 14:28 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Temp
2015-02-20 14:14 - 2015-02-20 15:26 - 00002659 _____ () C:\Windows\System32\oodbs.lor
2015-02-19 18:13 - 2015-02-19 18:13 - 00000000 ____D () C:\Users\Sherlock Holmes\Calibre Library
2015-02-18 20:52 - 2015-02-18 20:52 - 00000000 _____ () C:\Windows\oodcnt.INI
2015-02-18 16:35 - 2015-02-18 18:41 - 00000000 ____D () C:\Windows\System32\oodag
2015-02-18 16:23 - 2015-02-18 16:23 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\O&O
2015-02-18 16:22 - 2015-02-18 16:22 - 00002068 _____ () C:\Users\Public\Desktop\O&O Defrag.lnk
2015-02-18 16:22 - 2015-02-18 16:22 - 00000000 ____D () C:\Program Files\OO Software
2015-02-18 15:05 - 2015-01-23 05:42 - 00814080 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll
2015-02-18 15:05 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2015-02-18 15:05 - 2015-01-23 04:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-02-18 15:05 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-18 14:57 - 2015-02-18 14:58 - 00002481 ____H () C:\Windows\EPMBatch.ept
2015-02-18 11:29 - 2015-02-18 11:29 - 00000991 _____ () C:\Users\Public\Desktop\EaseUS Partition Master 10.1.lnk
2015-02-18 11:28 - 2014-04-04 00:42 - 03382440 _____ () C:\Windows\System32\BootMan.exe
2015-02-18 11:28 - 2014-04-04 00:25 - 02499752 _____ () C:\Windows\SysWOW64\BootMan.exe
2015-02-18 11:28 - 2013-03-07 09:49 - 00100936 _____ () C:\Windows\System32\setupempdrvx64.exe
2015-02-18 11:28 - 2013-03-07 09:49 - 00087112 _____ () C:\Windows\SysWOW64\setupempdrv03.exe
2015-02-18 11:28 - 2013-03-07 09:49 - 00019840 _____ () C:\Windows\SysWOW64\EuEpmGdi.dll
2015-02-18 11:28 - 2013-03-07 09:49 - 00017480 _____ () C:\Windows\System32\epmntdrv.sys
2015-02-18 11:28 - 2013-03-07 09:49 - 00016256 _____ () C:\Windows\System32\EuEpmGdi.dll
2015-02-18 11:28 - 2013-03-07 09:49 - 00014920 _____ () C:\Windows\SysWOW64\epmntdrv.sys
2015-02-18 11:28 - 2013-03-07 09:49 - 00009800 _____ () C:\Windows\System32\EuGdiDrv.sys
2015-02-18 11:28 - 2013-03-07 09:49 - 00009160 _____ () C:\Windows\SysWOW64\EuGdiDrv.sys
2015-02-17 21:29 - 2015-02-22 15:09 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\MEMENTO
2015-02-17 16:18 - 2015-02-17 16:18 - 00000725 _____ () C:\Users\Sherlock Holmes\Desktop\Memento Mori.lnk
2015-02-17 16:08 - 2015-02-17 16:08 - 00335288 _____ (Protect Software GmbH) C:\Windows\System32\Drivers\acedrv11.sys
2015-02-17 16:08 - 2015-02-17 16:08 - 00004096 _____ () C:\Users\Public\Documents\00000A51.LCS
2015-02-17 16:05 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll
2015-02-17 16:05 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\System32\xactengine3_2.dll
2015-02-17 16:05 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\Windows\System32\XAPOFX1_1.dll
2015-02-17 16:05 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2015-02-17 16:05 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\Windows\System32\XAudio2_2.dll
2015-02-17 16:05 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2015-02-17 16:05 - 2008-07-12 08:18 - 04992520 _____ (Microsoft Corporation) C:\Windows\System32\D3DX9_39.dll
2015-02-17 16:05 - 2008-07-12 08:18 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2015-02-17 16:05 - 2008-07-12 08:18 - 01942552 _____ (Microsoft Corporation) C:\Windows\System32\D3DCompiler_39.dll
2015-02-17 16:05 - 2008-07-12 08:18 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2015-02-17 16:05 - 2008-07-12 08:18 - 00540688 _____ (Microsoft Corporation) C:\Windows\System32\d3dx10_39.dll
2015-02-17 16:05 - 2008-07-12 08:18 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2015-02-17 16:03 - 2015-02-17 16:04 - 00017627 _____ () C:\Windows\DirectX.log
2015-02-17 15:36 - 2015-02-17 15:36 - 00002921 _____ () C:\Windows\PWCMDLST.BAK
2015-02-17 15:06 - 2015-01-14 06:47 - 00389808 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2015-02-17 15:06 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-17 15:06 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2015-02-17 15:06 - 2015-01-12 04:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2015-02-17 15:06 - 2015-01-12 04:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll
2015-02-17 15:06 - 2015-01-12 03:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2015-02-17 15:06 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2015-02-17 15:06 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2015-02-17 15:06 - 2015-01-12 03:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll
2015-02-17 15:06 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll
2015-02-17 15:06 - 2015-01-12 03:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2015-02-17 15:06 - 2015-01-12 03:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2015-02-17 15:06 - 2015-01-12 03:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2015-02-17 15:06 - 2015-01-12 03:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2015-02-17 15:06 - 2015-01-12 03:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe
2015-02-17 15:06 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-17 15:06 - 2015-01-12 03:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2015-02-17 15:06 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-02-17 15:06 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2015-02-17 15:06 - 2015-01-12 03:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll
2015-02-17 15:06 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-17 15:06 - 2015-01-12 03:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2015-02-17 15:06 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2015-02-17 15:06 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-02-17 15:06 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-02-17 15:06 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-02-17 15:06 - 2015-01-12 03:04 - 00316928 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2015-02-17 15:06 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-17 15:06 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-02-17 15:06 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-02-17 15:06 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-02-17 15:06 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-02-17 15:06 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2015-02-17 15:06 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2015-02-17 15:06 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2015-02-17 15:06 - 2015-01-12 02:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2015-02-17 15:06 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-17 15:06 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2015-02-17 15:06 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-02-17 15:06 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-02-17 15:06 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-02-17 15:06 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-02-17 15:06 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2015-02-17 15:06 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-17 15:06 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-17 15:06 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-02-17 15:06 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-17 15:06 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2015-02-17 15:06 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2015-02-17 15:06 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-17 15:06 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-17 15:06 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-17 15:05 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\System32\appraiser.dll
2015-02-17 15:05 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\System32\invagent.dll
2015-02-17 15:05 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\System32\generaltel.dll
2015-02-17 15:05 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\System32\devinv.dll
2015-02-17 15:05 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2015-02-17 15:05 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\System32\aepic.dll
2015-02-17 15:05 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2015-02-17 15:05 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\System32\aitstatic.exe
2015-02-17 15:05 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2015-02-17 15:05 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-02-17 15:04 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
2015-02-17 15:04 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2015-02-17 15:04 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\System32\lsasrv.dll
2015-02-17 15:04 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\System32\sspicli.dll
2015-02-17 15:04 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\System32\lsass.exe
2015-02-17 15:04 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\System32\sspisrv.dll
2015-02-17 15:04 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\System32\secur32.dll
2015-02-17 15:04 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\System32\auditpol.exe
2015-02-17 15:04 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\System32\msaudite.dll
2015-02-17 15:04 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\System32\msobjs.dll
2015-02-17 15:04 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\System32\adtschema.dll
2015-02-17 15:04 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-02-17 15:04 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-02-17 15:04 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-02-17 15:04 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-02-17 15:04 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-02-17 15:04 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-02-17 15:04 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys
2015-02-17 15:04 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2015-02-17 15:04 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\System32\srcore.dll
2015-02-17 15:04 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\System32\srclient.dll
2015-02-17 15:04 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\System32\rstrui.exe
2015-02-17 15:04 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-02-17 15:04 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-02-17 15:04 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00728064 _____ (Microsoft Corporation) C:\Windows\System32\kerberos.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00341504 _____ (Microsoft Corporation) C:\Windows\System32\schannel.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00314880 _____ (Microsoft Corporation) C:\Windows\System32\msv1_0.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00309760 _____ (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00210944 _____ (Microsoft Corporation) C:\Windows\System32\wdigest.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00086528 _____ (Microsoft Corporation) C:\Windows\System32\TSpkg.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\System32\credssp.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-02-17 15:03 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2015-02-17 15:03 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-17 15:03 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\System32\scesrv.dll
2015-02-17 15:03 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-17 15:03 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\System32\oleaut32.dll
2015-02-17 15:03 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-17 14:58 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2015-02-16 17:01 - 2015-01-14 11:28 - 03066880 _____ () C:\Windows\System32\pwNative.exe
2015-02-16 17:01 - 2013-09-30 16:26 - 00019152 ____N () C:\Windows\System32\pwdrvio.sys
2015-02-16 17:01 - 2013-09-30 16:26 - 00012504 ____N () C:\Windows\System32\pwdspio.sys
2015-02-16 17:00 - 2015-02-16 17:00 - 00000846 _____ () C:\Users\Public\Desktop\MiniTool Partition Wizard Free.lnk
2015-02-16 15:29 - 2015-02-16 15:29 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\FreeFLVConverter
2015-02-16 15:29 - 2011-09-22 11:05 - 00364544 _____ () C:\Windows\SysWOW64\PropertyGrid.ocx
2015-02-16 15:29 - 2011-09-22 11:05 - 00208500 _____ () C:\Windows\SysWOW64\ReyXpBasics.tlb
2015-02-16 15:29 - 2011-09-22 11:05 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCMCFR.DLL
2015-02-16 15:29 - 2011-09-22 11:05 - 00119568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VB6FR.DLL
2015-02-16 15:29 - 2011-09-22 11:05 - 00101888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VB6STKIT.DLL
2015-02-16 15:29 - 2011-09-22 11:05 - 00084512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PICCLP32.OCX
2015-02-16 15:29 - 2011-09-22 11:05 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CMDLGFR.DLL
2015-02-16 15:29 - 2011-09-22 11:05 - 00024576 _____ () C:\Windows\SysWOW64\ControlSubX.ocx
2015-02-16 15:29 - 2011-09-22 11:05 - 00009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PCCLPFR.DLL
2015-02-16 15:28 - 2015-02-17 01:42 - 00000000 ____D () C:\Program Files (x86)\Free FLV Converter
2015-02-15 18:15 - 2015-02-15 18:15 - 00000000 ____D () C:\ProgramData\rokapublish
2015-02-15 18:03 - 2015-02-15 18:03 - 00000000 ____D () C:\ProgramData\Solidshield
2015-02-15 15:01 - 2015-02-15 15:01 - 00034816 ___SH () C:\Users\Sherlock Holmes\Documents\Thumbs.db
2015-02-15 15:00 - 2014-12-24 18:46 - 00000326 _____ () C:\Users\Sherlock Holmes\Documents\Verknüpfung mit Recycled.lnk
2015-02-15 15:00 - 2013-10-27 09:06 - 04156350 _____ () C:\Users\Sherlock Holmes\Documents\Scannen0001.bmp
2015-02-15 15:00 - 2013-10-27 09:04 - 04157110 _____ () C:\Users\Sherlock Holmes\Documents\Scannen0001.bmp.orig
2015-02-15 14:59 - 2015-02-15 14:59 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\Bewerbung_Aktuell_2014
2015-02-15 14:59 - 2014-08-08 14:55 - 1114717902 _____ (n/a) C:\Users\Sherlock Holmes\Documents\Grim Tales - Die Vergeltung Sammleredition.exe
2015-02-14 18:56 - 2015-02-14 18:56 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\FinewayStudios
2015-02-13 20:23 - 2015-02-13 20:23 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\ERS G-Studio
2015-02-10 20:27 - 2015-02-10 20:27 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\VendelGAMES
2015-02-10 20:12 - 2015-02-10 20:12 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\EleFun Games
2015-02-10 19:13 - 2015-02-10 19:13 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\Frogwares
2015-02-10 18:42 - 2015-02-10 18:42 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\IsolatedStorage
2015-02-10 18:42 - 2015-02-10 18:42 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\DigitalVolcano
2015-02-10 18:42 - 2015-02-10 18:42 - 00000000 ____D () C:\ProgramData\IsolatedStorage
2015-02-10 12:49 - 2015-02-10 12:49 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\HP Photosmart Projects
2015-02-10 12:48 - 2015-02-10 12:48 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
2015-02-10 12:48 - 2015-02-10 12:48 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
2015-02-07 16:12 - 2015-01-09 15:11 - 00046075 _____ () C:\Users\Sherlock Holmes\Documents\Wunschserien.docx.lnk
2015-02-07 16:12 - 2014-09-14 11:37 - 00000083 _____ () C:\Users\Sherlock Holmes\Documents\dc addy.txt
2015-02-07 09:39 - 2015-02-20 15:27 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Local\FreePDF_XP
2015-02-07 09:34 - 2015-02-07 09:34 - 00000000 ____D () C:\ProgramData\FreePDF
2015-02-07 09:34 - 2015-02-07 09:34 - 00000000 ____D () C:\Program Files (x86)\FreePDF_XP
2015-02-07 09:34 - 2012-06-21 07:25 - 00113152 _____ () C:\Windows\System32\redmon64.dll
2015-02-07 09:34 - 2012-06-21 07:25 - 00044032 _____ () C:\Windows\System32\unredmon64.exe
2015-02-07 09:34 - 2012-06-21 07:25 - 00028435 _____ () C:\Windows\System32\redmon.chm
2015-02-07 09:31 - 2015-02-07 09:31 - 00000000 ____D () C:\Program Files\gs
2015-02-07 09:25 - 2015-02-07 09:25 - 00000135 _____ () C:\Windows\SysWOW64\debug.log
2015-02-07 09:23 - 2015-02-07 09:23 - 23737820 _____ () C:\Users\Sherlock Holmes\Documents\Optimal Lernen.xps
2015-02-06 20:54 - 2015-02-06 20:54 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-02-06 12:11 - 2015-02-06 12:11 - 00000000 ____H () C:\Users\Sherlock Holmes\Documents\Default.rdp
2015-02-05 19:32 - 2015-02-05 19:32 - 00003050 _____ () C:\Windows\System32\Tasks\{C368D411-8AEF-457F-BDFC-4346540C31BB}
2015-02-05 19:31 - 2015-02-05 19:31 - 00003250 _____ () C:\Windows\System32\Tasks\{69079650-C5EF-4F24-B366-0BCE7920D9A3}
2015-02-05 18:47 - 2015-02-05 18:47 - 00002019 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2015-02-03 22:18 - 2015-02-03 22:18 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Local\Adobe_Systems_Incorporate
2015-02-03 22:17 - 2015-02-03 22:24 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\My Digital Editions
2015-02-03 22:17 - 2015-02-03 22:17 - 00003090 _____ () C:\Windows\System32\Tasks\{55D0A493-F2BE-41C4-947D-119C9D648949}
2015-02-03 22:17 - 2015-02-03 22:17 - 00002178 _____ () C:\Users\Public\Desktop\Adobe Digital Editions 3.0.lnk
2015-01-30 11:02 - 2015-01-30 11:02 - 00001357 _____ () C:\Users\Sherlock Holmes\Desktop\HP Solution Center.lnk
2015-01-28 10:35 - 2015-01-28 10:35 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-27 00:23 - 2015-01-27 00:23 - 00014464 _____ (Western Digital Technologies) C:\Windows\System32\Drivers\wdcsam64.sys
2015-01-26 15:05 - 2015-01-30 12:03 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\Eigene Scans
2015-01-26 15:00 - 2015-02-02 16:45 - 00000000 ____D () C:\Scans

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-24 15:58 - 2014-05-11 20:43 - 01369653 _____ () C:\Windows\WindowsUpdate.log
2015-02-24 15:26 - 2014-05-11 19:57 - 00000000 ____D () C:\users\Sherlock Holmes
2015-02-24 14:54 - 2014-08-08 16:26 - 00000501 _____ () C:\Windows\System32\checkdnsid.xml
2015-02-24 13:01 - 2014-05-14 09:13 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\MBAMSwissArmy.sys
2015-02-24 02:01 - 2011-04-12 08:43 - 00699416 _____ () C:\Windows\System32\perfh007.dat
2015-02-24 02:01 - 2011-04-12 08:43 - 00149556 _____ () C:\Windows\System32\perfc007.dat
2015-02-24 02:01 - 2009-07-14 06:13 - 01620612 _____ () C:\Windows\System32\PerfStringBackup.INI
2015-02-23 19:43 - 2014-05-12 21:23 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\vlc
2015-02-23 17:47 - 2014-05-14 06:32 - 00003998 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{CAEDF7C5-6BE4-40C6-A7D7-838E0CB1CD24}
2015-02-23 15:27 - 2014-11-06 11:17 - 00000372 _____ () C:\Windows\Tasks\powersuite_monitor.job
2015-02-23 15:27 - 2014-08-14 17:23 - 00000360 _____ () C:\Windows\Tasks\dsmonitor.job
2015-02-23 06:53 - 2015-01-11 01:00 - 00008835 _____ () C:\Windows\setupact.log
2015-02-21 11:33 - 2009-07-14 05:45 - 00031984 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-21 11:33 - 2009-07-14 05:45 - 00031984 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-20 15:27 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-20 15:25 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2015-02-20 14:14 - 2015-01-14 13:16 - 00002130 _____ () C:\Windows\PFRO.log
2015-02-19 14:47 - 2015-01-01 15:28 - 00011776 _____ () C:\Users\Sherlock Holmes\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-02-19 06:51 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-02-18 22:17 - 2015-01-05 15:45 - 00002830 _____ () C:\Windows\Sandboxie.ini
2015-02-18 15:02 - 2014-05-13 13:34 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-18 15:02 - 2014-05-13 13:34 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-18 11:57 - 2014-08-13 23:00 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\DC++
2015-02-18 11:57 - 2014-08-13 23:00 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Local\DC++
2015-02-17 21:28 - 2014-11-06 11:34 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\My ISO Files
2015-02-17 16:08 - 2014-11-06 13:49 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\ProtectDISC
2015-02-17 15:41 - 2009-07-14 05:45 - 05033688 _____ () C:\Windows\System32\FNTCACHE.DAT
2015-02-17 15:37 - 2014-12-12 03:23 - 00000000 ____D () C:\Windows\System32\appraiser
2015-02-17 15:37 - 2014-05-12 00:18 - 00000000 ___SD () C:\Windows\System32\CompatTel
2015-02-17 15:37 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-02-17 15:19 - 2014-05-11 20:13 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-17 15:18 - 2014-05-15 20:08 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-17 15:18 - 2009-07-14 03:34 - 00000513 _____ () C:\Windows\win.ini
2015-02-17 15:14 - 2014-05-11 22:23 - 00000000 ____D () C:\Windows\System32\MRT
2015-02-17 15:10 - 2014-05-11 22:23 - 116773704 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2015-02-17 14:53 - 2014-08-12 17:22 - 00000000 ____D () C:\Windows\System32\Tasks\Aufgaben der Ereignisanzeige
2015-02-16 15:52 - 2014-05-11 20:27 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-02-10 16:39 - 2014-05-13 16:12 - 00000000 ____D () C:\ProgramData\Oracle
2015-02-10 15:55 - 2014-05-13 16:11 - 00000000 ____D () C:\Program Files (x86)\Java
2015-02-10 15:53 - 2014-05-13 16:11 - 00272296 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2015-02-10 15:53 - 2014-05-13 16:11 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2015-02-10 15:53 - 2014-05-13 16:11 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2015-02-10 15:53 - 2014-05-13 16:11 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-02-10 12:49 - 2014-05-11 20:31 - 00000000 ____D () C:\ProgramData\Adobe
2015-02-10 12:48 - 2014-05-11 20:31 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-02-10 12:46 - 2014-07-14 16:39 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Local\Adobe
2015-02-08 14:14 - 2014-09-01 14:44 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\DAEMON Tools Lite
2015-02-07 16:50 - 2014-05-15 15:03 - 00000486 __RSH () C:\Users\Sherlock Holmes\ntuser.pol
2015-02-07 16:17 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\System32\NDF
2015-02-07 11:14 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Public\Libraries
2015-02-07 09:25 - 2014-05-11 20:32 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\Adobe
2015-02-06 20:52 - 2014-05-12 19:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-02-06 10:22 - 2015-01-11 19:57 - 00000731 _____ () C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk
2015-01-28 20:30 - 2015-01-02 13:06 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\dvdcss
2015-01-26 15:09 - 2014-05-11 19:57 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Local\VirtualStore

Some content of TEMP:
====================
C:\Users\Sherlock Holmes\AppData\Local\Temp\A~NSISu_.exe
C:\Users\Sherlock Holmes\AppData\Local\Temp\jre-8u31-windows-au.exe
C:\Users\Sherlock Holmes\AppData\Local\Temp\proxy_vole2862650717388283353.dll
C:\Users\Sherlock Holmes\AppData\Local\Temp\_isCDDA.exe


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points  =========================

Restore point made on: 2015-02-19 06:50:23
Restore point made on: 2015-02-20 14:54:27
Restore point made on: 2015-02-24 15:24:40

==================== BCD ================================

Windows-Start-Manager
---------------------
Bezeichner              {bootmgr}
device                  partition=C:
description            Windows Boot Manager
locale                  de-DE
inherit                {globalsettings}
default                {default}
resumeobject            {4e0b9b2e-d94c-11e3-bd76-f61d6a1afe88}
displayorder            {default}
toolsdisplayorder      {bdbdbd00-6057-11e0-a7f3-ce9adfd72001}
                        {memdiag}
timeout                30

Windows-Startladeprogramm
-------------------------
Bezeichner              {default}
device                  partition=C:
path                    \Windows\system32\winload.exe
description            Windows 7
locale                  de-DE
inherit                {bootloadersettings}
recoverysequence        {4e0b9b30-d94c-11e3-bd76-f61d6a1afe88}
recoveryenabled        Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {4e0b9b2e-d94c-11e3-bd76-f61d6a1afe88}
nx                      OptIn

Windows-Startladeprogramm
-------------------------
Bezeichner              {4e0b9b30-d94c-11e3-bd76-f61d6a1afe88}
device                  ramdisk=[C:]\Recovery\4e0b9b30-d94c-11e3-bd76-f61d6a1afe88\Winre.wim,{4e0b9b31-d94c-11e3-bd76-f61d6a1afe88}
path                    \windows\system32\winload.exe
description            Windows Recovery Environment
inherit                {bootloadersettings}
osdevice                ramdisk=[C:]\Recovery\4e0b9b30-d94c-11e3-bd76-f61d6a1afe88\Winre.wim,{4e0b9b31-d94c-11e3-bd76-f61d6a1afe88}
systemroot              \windows
nx                      OptIn
winpe                  Yes

Wiederaufnahme aus dem Ruhezustand
----------------------------------
Bezeichner              {4e0b9b2e-d94c-11e3-bd76-f61d6a1afe88}
device                  partition=C:
path                    \Windows\system32\winresume.exe
description            Windows Resume Application
locale                  de-DE
inherit                {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
debugoptionenabled      No

Windows-Speichertestprogramm
----------------------------
Bezeichner              {memdiag}
device                  partition=C:
path                    \boot\memtest.exe
description            Windows-Speicherdiagnose
locale                  de-DE
inherit                {globalsettings}
badmemoryaccess        Yes

Echtmodus-Startabschnitt
------------------------
Bezeichner              {bdbdbd00-6057-11e0-a7f3-ce9adfd72001}
device                  partition=C:
path                    \bdr-ld01.mbr
description            Bitdefender Rescue Mode - Windows 7 Professional SP 1 (x64)

EMS-Einstellungen
-----------------
Bezeichner              {emssettings}
bootems                Yes

Debuggereinstellungen
---------------------
Bezeichner              {dbgsettings}
debugtype              Serial
debugport              1
baudrate                115200

RAM-Defekte
-----------
Bezeichner              {badmemory}

Globale Einstellungen
---------------------
Bezeichner              {globalsettings}
inherit                {dbgsettings}
                        {emssettings}
                        {badmemory}

Startladeprogramm-Einstellungen
-------------------------------
Bezeichner              {bootloadersettings}
inherit                {globalsettings}
                        {hypervisorsettings}

Hypervisoreinstellungen
-------------------
Bezeichner              {hypervisorsettings}
hypervisordebugtype    Serial
hypervisordebugport    1
hypervisorbaudrate      115200

Einstellungen zur Ladeprogrammfortsetzung
-----------------------------------------
Bezeichner              {resumeloadersettings}
inherit                {globalsettings}

Ger„teoptionen
--------------
Bezeichner              {4e0b9b31-d94c-11e3-bd76-f61d6a1afe88}
description            Ramdisk Options
ramdisksdidevice        partition=C:
ramdisksdipath          \Recovery\4e0b9b30-d94c-11e3-bd76-f61d6a1afe88\boot.sdi


==================== Memory info ===========================

Percentage of memory in use: 7%
Total physical RAM: 16304.71 MB
Available physical RAM: 15117.32 MB
Total Pagefile: 16302.86 MB
Available Pagefile: 15105.47 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB

==================== Drives ================================

Drive c: (Windows7) (Fixed) (Total:97.65 GB) (Free:3.07 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Frei) (Fixed) (Total:465.76 GB) (Free:459.15 GB) NTFS
Drive f: (Downloads) (Fixed) (Total:300.37 GB) (Free:140.16 GB) NTFS
Drive g: (Programme ) (Fixed) (Total:498.54 GB) (Free:481.65 GB) NTFS
Drive h: (Grafik_Fotos) (Fixed) (Total:1266.82 GB) (Free:624.86 GB) NTFS
Drive i: (Reparaturdatenträger Windows 7 6) (CDROM) (Total:0.16 GB) (Free:0 GB) UDF
Drive j: (Games) (Fixed) (Total:698.74 GB) (Free:385.89 GB) NTFS
Drive k: (Daten) (Fixed) (Total:698.52 GB) (Free:442.45 GB) NTFS
Drive p: (USB) (Removable) (Total:7.46 GB) (Free:7.45 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (Software) (Fixed) (Total:398.26 GB) (Free:255.45 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows XP) (Size: 698.6 GB) (Disk ID: A56DFF5E)
Partition 1: (Not Active) - (Size=398.3 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=300.4 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 465.8 GB) (Disk ID: E83A4318)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 472DB8E2)
Partition 1: (Active) - (Size=97.7 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=498.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=1266.8 GB) - (Type=07 NTFS)

========================================================
Disk: 3 (Size: 1397.3 GB) (Disk ID: 000CE977)
Partition 1: (Not Active) - (Size=698.7 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=698.5 GB) - (Type=OF Extended)

========================================================
Disk: 8 (Size: 7.5 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.


LastRegBack: 2015-02-23 00:09

==================== End Of Log ============================
--- --- ---

schrauber 25.02.2015 07:53
Hi,

bitte auch die MBRdump.txt Dateien anhängen, die auf dem Stick erstellt wurden.

Sunny-Melone 25.02.2015 13:03
Mbrdump:

Code:
! ]îï    àï                                                uª
vielleicht hilf es ja, dieses Programm habe ich beim ersten mal gelöscht

2015-02-16 15:29 - 2015-02-16 15:29 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\FreeFLVConverter

was soll ich als nächstes tun?

Aneri 25.02.2015 19:39
Hi, die Datei nicht posten sonder als Anhang hier einfügen...

wenn du antwortest gibts unter dem weißen Fenster noch zusätzliche Einstellungen ... Anhang hinzufügen

Sunny-Melone 25.02.2015 20:13
Liste der Anhänge anzeigen (Anzahl: 1)
wie geht es jetzt weiter?

Aneri 25.02.2015 20:17
wir prüfen die Datei und melden uns dann

Sunny-Melone 25.02.2015 20:18
öhmmm, hab ich gemacht oder war das nicht richtig so?

ok

Aneri 25.02.2015 20:26
alles ok, du hast nur einen alten Beitrag editiert ...

Aneri 25.02.2015 20:59
hi

Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
cmd: bootrec.exe /fixmbr
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.


versuche nach dem fix das System neu zu starten (Normalmodus) . Teile mir mit, ob es geklappt hat

Sunny-Melone 25.02.2015 23:11
Leider keine Änderung immer noch diese zeichenkette
hier der log:

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 18-02-2015 01
Ran by SYSTEM at 2015-02-25 21:47:55 Run:2
Running from P:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
cmd: bootrec.exe /fixmbr
*****************


=========  bootrec.exe /fixmbr =========

??D e r  V o r g a n g  w u r d e  a b g e s c h l o s s e n .
 
========= End of CMD: =========


==== End of Fixlog 21:47:55 ====
machen wir heute noch weiter???

Aneri 26.02.2015 09:24
Hi.

Bitte erstelle ein neues FRST Logfile aus der Recovery Umgebung. Setzte den BCD Haken bitte wieder.

Sunny-Melone 26.02.2015 19:47
Guten morgen aneri,
schön das du mich nicht vergessen hast
hier der gewünschte log


FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-02-2015 01
Ran by SYSTEM on MININT-7OHUD3B on 26-02-2015 10:18:40
Running from P:\
Platform: Windows 7 Professional (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Bdagent] => C:\Program Files\Bitdefender\Bitdefender 2013\bdagent.exe [1575192 2013-09-27] (Bitdefender)
HKLM\...\Run: [NUSB3MON] => C:\Program Files (x86)\ATI Technologies\AMDUSB3DeviceDetector\nusb3mon.exe [97280 2012-04-11] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [OODefragTray] => C:\Windows\system32\oodtray.exe [3805704 2007-05-11] (O&O Software GmbH)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Skiller Pro] => C:\Program Files (x86)\Skiller Pro\Monitor.exe [475136 2014-02-26] ()
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [373760 2014-03-18] (shbox.de)
HKLM\...\Policies\Explorer: [NoViewContextMenu] 0
HKU\Sherlock Holmes\...\Run: [SandboxieControl] => "d:\Program Files\Sandboxie\SbieCtrl.exe"
HKU\Sherlock Holmes\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
HKU\Sherlock Holmes\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
BootExecute: autocheck autochk * OODBS

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-09-15] (Advanced Micro Devices, Inc.)
S4 BdDesktopParental; C:\Program Files\Bitdefender\Bitdefender 2013\bdparentalservice.exe [69392 2013-08-07] (Bitdefender)
S2 O&O Defrag; C:\Windows\system32\oodag.exe [1418248 2007-05-11] (O&O Software GmbH)
S2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [239176 2013-02-19] (Realtek Semiconductor)
S2 SafeBox; C:\Program Files\Bitdefender\Bitdefender SafeBox\safeboxservice.exe [95184 2012-06-25] (Bitdefender)
S2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender 2013\updatesrv.exe [67320 2013-08-07] (Bitdefender)
S2 VSSERV; C:\Program Files\Bitdefender\Bitdefender 2013\vsserv.exe [1645256 2013-09-30] (Bitdefender)
S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S4 AHDDC2; C:\Program Files (x86)\Ashampoo\Ashampoo HDD Control 2\AHDDC2_Service.exe [X]
S2 MBAMScheduler; "d:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe" [X]
S2 MBAMService; "d:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe" [X]
S2 SbieSvc; "d:\Program Files\Sandboxie\SbieSvc.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S0 amdide64; C:\Windows\System32\DRIVERS\amdide64.sys [11904 2014-10-31] (Advanced Micro Devices Inc.)
S0 amdkmafd; C:\Windows\System32\DRIVERS\amdkmafd.sys [21160 2014-11-04] (Advanced Micro Devices, Inc.)
S2 AODDriver4.3; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
S3 AsrDrv101; C:\Windows\SysWOW64\Drivers\AsrDrv101.sys [22280 2014-08-16] (ASRock Incorporation)
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2014-09-14] ()
S0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [727592 2013-07-19] (BitDefender)
S3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [261056 2012-11-02] (BitDefender)
S3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [601360 2013-07-19] (BitDefender)
S1 BdfNdisf; c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [93600 2013-02-22] (BitDefender LLC)
S1 bdfwfpf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [103504 2011-11-14] (BitDefender LLC)
S3 BDSandBox; C:\Windows\system32\drivers\bdsandbox.sys [82824 2013-07-23] (BitDefender SRL)
S1 BDVEDISK; C:\Windows\System32\DRIVERS\bdvedisk.sys [76944 2012-04-17] (BitDefender)
S3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-09-01] (Disc Soft Ltd)
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [17480 2013-03-07] ()
S3 epmntdrv; C:\Windows\SysWOW64\epmntdrv.sys [14920 2013-03-07] ()
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9800 2013-03-07] ()
S3 EuGdiDrv; C:\Windows\SysWOW64\EuGdiDrv.sys [9160 2013-03-07] ()
S3 FLxHCIh; C:\Windows\System32\DRIVERS\FLxHCIh.sys [77480 2014-08-16] (Fresco Logic)
S0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [150256 2013-08-23] (BitDefender LLC)
S3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [129224 2013-07-18] (Qualcomm Atheros Co., Ltd.)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2014-09-14] ()
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-24] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
S0 pwdrvio; C:\Windows\System32\pwdrvio.sys [19152 2013-09-30] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [12504 2013-09-30] ()
S5 RTSPER; C:\Windows\System32\Drivers\RTSPER.sys [465624 2014-01-03] (Realsil Semiconductor Corporation)
S0 trufos; C:\Windows\System32\DRIVERS\trufos.sys [389240 2013-08-07] (BitDefender S.R.L.)
S1 ISODrive; \??\D:\UltraISO\drivers\ISODrv64.sys [X]
S3 SbieDrv; \??\d:\Program Files\Sandboxie\SbieDrv.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-24 16:45 - 2015-02-26 10:18 - 00000000 ____D () C:\FRST
2015-02-24 15:26 - 2015-02-24 15:44 - 00000000 ____D () C:\Users\Sherlock Holmes\.VirtualBox
2015-02-24 15:25 - 2015-02-24 15:25 - 00001084 _____ () C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk
2015-02-24 15:25 - 2013-04-12 11:41 - 00237840 _____ (Oracle Corporation) C:\Windows\System32\Drivers\VBoxDrv.sys
2015-02-24 15:25 - 2013-04-12 11:40 - 00120080 _____ (Oracle Corporation) C:\Windows\System32\Drivers\VBoxUSBMon.sys
2015-02-24 15:24 - 2015-02-24 15:24 - 00000000 ____D () C:\Program Files\Oracle
2015-02-24 15:22 - 2015-02-24 15:37 - 00000000 ____D () C:\VirtualBox
2015-02-24 15:21 - 2015-02-24 15:21 - 00000000 ____D () C:\Austausch
2015-02-20 19:03 - 2015-02-20 19:03 - 00000861 _____ () C:\Users\Public\Desktop\EaseUS Data Recovery Wizard 8.6.lnk
2015-02-20 14:54 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\System32\perftrack.dll
2015-02-20 14:54 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\System32\wdi.dll
2015-02-20 14:54 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\System32\powertracker.dll
2015-02-20 14:54 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll
2015-02-20 14:28 - 2015-02-20 14:28 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Temp
2015-02-20 14:14 - 2015-02-20 15:26 - 00002659 _____ () C:\Windows\System32\oodbs.lor
2015-02-19 18:13 - 2015-02-19 18:13 - 00000000 ____D () C:\Users\Sherlock Holmes\Calibre Library
2015-02-18 20:52 - 2015-02-18 20:52 - 00000000 _____ () C:\Windows\oodcnt.INI
2015-02-18 16:35 - 2015-02-18 18:41 - 00000000 ____D () C:\Windows\System32\oodag
2015-02-18 16:23 - 2015-02-18 16:23 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\O&O
2015-02-18 16:22 - 2015-02-18 16:22 - 00002068 _____ () C:\Users\Public\Desktop\O&O Defrag.lnk
2015-02-18 16:22 - 2015-02-18 16:22 - 00000000 ____D () C:\Program Files\OO Software
2015-02-18 15:05 - 2015-01-23 05:42 - 00814080 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll
2015-02-18 15:05 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2015-02-18 15:05 - 2015-01-23 04:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-02-18 15:05 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-18 14:57 - 2015-02-18 14:58 - 00002481 ____H () C:\Windows\EPMBatch.ept
2015-02-18 11:29 - 2015-02-18 11:29 - 00000991 _____ () C:\Users\Public\Desktop\EaseUS Partition Master 10.1.lnk
2015-02-18 11:28 - 2014-04-04 00:42 - 03382440 _____ () C:\Windows\System32\BootMan.exe
2015-02-18 11:28 - 2014-04-04 00:25 - 02499752 _____ () C:\Windows\SysWOW64\BootMan.exe
2015-02-18 11:28 - 2013-03-07 09:49 - 00100936 _____ () C:\Windows\System32\setupempdrvx64.exe
2015-02-18 11:28 - 2013-03-07 09:49 - 00087112 _____ () C:\Windows\SysWOW64\setupempdrv03.exe
2015-02-18 11:28 - 2013-03-07 09:49 - 00019840 _____ () C:\Windows\SysWOW64\EuEpmGdi.dll
2015-02-18 11:28 - 2013-03-07 09:49 - 00017480 _____ () C:\Windows\System32\epmntdrv.sys
2015-02-18 11:28 - 2013-03-07 09:49 - 00016256 _____ () C:\Windows\System32\EuEpmGdi.dll
2015-02-18 11:28 - 2013-03-07 09:49 - 00014920 _____ () C:\Windows\SysWOW64\epmntdrv.sys
2015-02-18 11:28 - 2013-03-07 09:49 - 00009800 _____ () C:\Windows\System32\EuGdiDrv.sys
2015-02-18 11:28 - 2013-03-07 09:49 - 00009160 _____ () C:\Windows\SysWOW64\EuGdiDrv.sys
2015-02-17 21:29 - 2015-02-22 15:09 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\MEMENTO
2015-02-17 16:18 - 2015-02-17 16:18 - 00000725 _____ () C:\Users\Sherlock Holmes\Desktop\Memento Mori.lnk
2015-02-17 16:08 - 2015-02-17 16:08 - 00335288 _____ (Protect Software GmbH) C:\Windows\System32\Drivers\acedrv11.sys
2015-02-17 16:08 - 2015-02-17 16:08 - 00004096 _____ () C:\Users\Public\Documents\00000A51.LCS
2015-02-17 16:05 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll
2015-02-17 16:05 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\System32\xactengine3_2.dll
2015-02-17 16:05 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\Windows\System32\XAPOFX1_1.dll
2015-02-17 16:05 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2015-02-17 16:05 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\Windows\System32\XAudio2_2.dll
2015-02-17 16:05 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2015-02-17 16:05 - 2008-07-12 08:18 - 04992520 _____ (Microsoft Corporation) C:\Windows\System32\D3DX9_39.dll
2015-02-17 16:05 - 2008-07-12 08:18 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2015-02-17 16:05 - 2008-07-12 08:18 - 01942552 _____ (Microsoft Corporation) C:\Windows\System32\D3DCompiler_39.dll
2015-02-17 16:05 - 2008-07-12 08:18 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2015-02-17 16:05 - 2008-07-12 08:18 - 00540688 _____ (Microsoft Corporation) C:\Windows\System32\d3dx10_39.dll
2015-02-17 16:05 - 2008-07-12 08:18 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2015-02-17 16:03 - 2015-02-17 16:04 - 00017627 _____ () C:\Windows\DirectX.log
2015-02-17 15:36 - 2015-02-17 15:36 - 00002921 _____ () C:\Windows\PWCMDLST.BAK
2015-02-17 15:06 - 2015-01-14 06:47 - 00389808 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2015-02-17 15:06 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-17 15:06 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2015-02-17 15:06 - 2015-01-12 04:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2015-02-17 15:06 - 2015-01-12 04:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll
2015-02-17 15:06 - 2015-01-12 03:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2015-02-17 15:06 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2015-02-17 15:06 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2015-02-17 15:06 - 2015-01-12 03:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll
2015-02-17 15:06 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll
2015-02-17 15:06 - 2015-01-12 03:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2015-02-17 15:06 - 2015-01-12 03:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2015-02-17 15:06 - 2015-01-12 03:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2015-02-17 15:06 - 2015-01-12 03:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2015-02-17 15:06 - 2015-01-12 03:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe
2015-02-17 15:06 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-17 15:06 - 2015-01-12 03:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2015-02-17 15:06 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-02-17 15:06 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2015-02-17 15:06 - 2015-01-12 03:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll
2015-02-17 15:06 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-17 15:06 - 2015-01-12 03:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2015-02-17 15:06 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2015-02-17 15:06 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-02-17 15:06 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-02-17 15:06 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-02-17 15:06 - 2015-01-12 03:04 - 00316928 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2015-02-17 15:06 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-17 15:06 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-02-17 15:06 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-02-17 15:06 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-02-17 15:06 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-02-17 15:06 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2015-02-17 15:06 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2015-02-17 15:06 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2015-02-17 15:06 - 2015-01-12 02:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2015-02-17 15:06 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-17 15:06 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2015-02-17 15:06 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-02-17 15:06 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-02-17 15:06 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-02-17 15:06 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-02-17 15:06 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2015-02-17 15:06 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-17 15:06 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-17 15:06 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-02-17 15:06 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-17 15:06 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2015-02-17 15:06 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2015-02-17 15:06 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-17 15:06 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-17 15:06 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-17 15:05 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\System32\appraiser.dll
2015-02-17 15:05 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\System32\invagent.dll
2015-02-17 15:05 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\System32\generaltel.dll
2015-02-17 15:05 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\System32\devinv.dll
2015-02-17 15:05 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2015-02-17 15:05 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\System32\aepic.dll
2015-02-17 15:05 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2015-02-17 15:05 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\System32\aitstatic.exe
2015-02-17 15:05 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2015-02-17 15:05 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-02-17 15:04 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
2015-02-17 15:04 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2015-02-17 15:04 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\System32\lsasrv.dll
2015-02-17 15:04 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\System32\sspicli.dll
2015-02-17 15:04 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\System32\lsass.exe
2015-02-17 15:04 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\System32\sspisrv.dll
2015-02-17 15:04 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\System32\secur32.dll
2015-02-17 15:04 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\System32\auditpol.exe
2015-02-17 15:04 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\System32\msaudite.dll
2015-02-17 15:04 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\System32\msobjs.dll
2015-02-17 15:04 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\System32\adtschema.dll
2015-02-17 15:04 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-02-17 15:04 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-02-17 15:04 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-02-17 15:04 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-02-17 15:04 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-02-17 15:04 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-02-17 15:04 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys
2015-02-17 15:04 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2015-02-17 15:04 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\System32\srcore.dll
2015-02-17 15:04 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\System32\srclient.dll
2015-02-17 15:04 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\System32\rstrui.exe
2015-02-17 15:04 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-02-17 15:04 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-02-17 15:04 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00728064 _____ (Microsoft Corporation) C:\Windows\System32\kerberos.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00341504 _____ (Microsoft Corporation) C:\Windows\System32\schannel.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00314880 _____ (Microsoft Corporation) C:\Windows\System32\msv1_0.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00309760 _____ (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00210944 _____ (Microsoft Corporation) C:\Windows\System32\wdigest.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00086528 _____ (Microsoft Corporation) C:\Windows\System32\TSpkg.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\System32\credssp.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-02-17 15:03 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2015-02-17 15:03 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-17 15:03 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\System32\scesrv.dll
2015-02-17 15:03 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-17 15:03 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\System32\oleaut32.dll
2015-02-17 15:03 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-17 14:58 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2015-02-16 17:01 - 2015-01-14 11:28 - 03066880 _____ () C:\Windows\System32\pwNative.exe
2015-02-16 17:01 - 2013-09-30 16:26 - 00019152 ____N () C:\Windows\System32\pwdrvio.sys
2015-02-16 17:01 - 2013-09-30 16:26 - 00012504 ____N () C:\Windows\System32\pwdspio.sys
2015-02-16 17:00 - 2015-02-16 17:00 - 00000846 _____ () C:\Users\Public\Desktop\MiniTool Partition Wizard Free.lnk
2015-02-16 15:29 - 2015-02-16 15:29 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\FreeFLVConverter
2015-02-16 15:29 - 2011-09-22 11:05 - 00364544 _____ () C:\Windows\SysWOW64\PropertyGrid.ocx
2015-02-16 15:29 - 2011-09-22 11:05 - 00208500 _____ () C:\Windows\SysWOW64\ReyXpBasics.tlb
2015-02-16 15:29 - 2011-09-22 11:05 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCMCFR.DLL
2015-02-16 15:29 - 2011-09-22 11:05 - 00119568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VB6FR.DLL
2015-02-16 15:29 - 2011-09-22 11:05 - 00101888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VB6STKIT.DLL
2015-02-16 15:29 - 2011-09-22 11:05 - 00084512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PICCLP32.OCX
2015-02-16 15:29 - 2011-09-22 11:05 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CMDLGFR.DLL
2015-02-16 15:29 - 2011-09-22 11:05 - 00024576 _____ () C:\Windows\SysWOW64\ControlSubX.ocx
2015-02-16 15:29 - 2011-09-22 11:05 - 00009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PCCLPFR.DLL
2015-02-16 15:28 - 2015-02-17 01:42 - 00000000 ____D () C:\Program Files (x86)\Free FLV Converter
2015-02-15 18:15 - 2015-02-15 18:15 - 00000000 ____D () C:\ProgramData\rokapublish
2015-02-15 18:03 - 2015-02-15 18:03 - 00000000 ____D () C:\ProgramData\Solidshield
2015-02-15 15:01 - 2015-02-15 15:01 - 00034816 ___SH () C:\Users\Sherlock Holmes\Documents\Thumbs.db
2015-02-15 15:00 - 2014-12-24 18:46 - 00000326 _____ () C:\Users\Sherlock Holmes\Documents\Verknüpfung mit Recycled.lnk
2015-02-15 15:00 - 2013-10-27 09:06 - 04156350 _____ () C:\Users\Sherlock Holmes\Documents\Scannen0001.bmp
2015-02-15 15:00 - 2013-10-27 09:04 - 04157110 _____ () C:\Users\Sherlock Holmes\Documents\Scannen0001.bmp.orig
2015-02-15 14:59 - 2015-02-15 14:59 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\Bewerbung_Aktuell_2014
2015-02-15 14:59 - 2014-08-08 14:55 - 1114717902 _____ (n/a) C:\Users\Sherlock Holmes\Documents\Grim Tales - Die Vergeltung Sammleredition.exe
2015-02-14 18:56 - 2015-02-14 18:56 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\FinewayStudios
2015-02-13 20:23 - 2015-02-13 20:23 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\ERS G-Studio
2015-02-10 20:27 - 2015-02-10 20:27 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\VendelGAMES
2015-02-10 20:12 - 2015-02-10 20:12 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\EleFun Games
2015-02-10 19:13 - 2015-02-10 19:13 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\Frogwares
2015-02-10 18:42 - 2015-02-10 18:42 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\IsolatedStorage
2015-02-10 18:42 - 2015-02-10 18:42 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\DigitalVolcano
2015-02-10 18:42 - 2015-02-10 18:42 - 00000000 ____D () C:\ProgramData\IsolatedStorage
2015-02-10 12:49 - 2015-02-10 12:49 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\HP Photosmart Projects
2015-02-10 12:48 - 2015-02-10 12:48 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
2015-02-10 12:48 - 2015-02-10 12:48 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
2015-02-07 16:12 - 2015-01-09 15:11 - 00046075 _____ () C:\Users\Sherlock Holmes\Documents\Wunschserien.docx.lnk
2015-02-07 16:12 - 2014-09-14 11:37 - 00000083 _____ () C:\Users\Sherlock Holmes\Documents\dc addy.txt
2015-02-07 09:39 - 2015-02-20 15:27 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Local\FreePDF_XP
2015-02-07 09:34 - 2015-02-07 09:34 - 00000000 ____D () C:\ProgramData\FreePDF
2015-02-07 09:34 - 2015-02-07 09:34 - 00000000 ____D () C:\Program Files (x86)\FreePDF_XP
2015-02-07 09:34 - 2012-06-21 07:25 - 00113152 _____ () C:\Windows\System32\redmon64.dll
2015-02-07 09:34 - 2012-06-21 07:25 - 00044032 _____ () C:\Windows\System32\unredmon64.exe
2015-02-07 09:34 - 2012-06-21 07:25 - 00028435 _____ () C:\Windows\System32\redmon.chm
2015-02-07 09:31 - 2015-02-07 09:31 - 00000000 ____D () C:\Program Files\gs
2015-02-07 09:25 - 2015-02-07 09:25 - 00000135 _____ () C:\Windows\SysWOW64\debug.log
2015-02-07 09:23 - 2015-02-07 09:23 - 23737820 _____ () C:\Users\Sherlock Holmes\Documents\Optimal Lernen.xps
2015-02-06 20:54 - 2015-02-06 20:54 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-02-06 12:11 - 2015-02-06 12:11 - 00000000 ____H () C:\Users\Sherlock Holmes\Documents\Default.rdp
2015-02-05 19:32 - 2015-02-05 19:32 - 00003050 _____ () C:\Windows\System32\Tasks\{C368D411-8AEF-457F-BDFC-4346540C31BB}
2015-02-05 19:31 - 2015-02-05 19:31 - 00003250 _____ () C:\Windows\System32\Tasks\{69079650-C5EF-4F24-B366-0BCE7920D9A3}
2015-02-05 18:47 - 2015-02-05 18:47 - 00002019 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2015-02-03 22:18 - 2015-02-03 22:18 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Local\Adobe_Systems_Incorporate
2015-02-03 22:17 - 2015-02-03 22:24 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\My Digital Editions
2015-02-03 22:17 - 2015-02-03 22:17 - 00003090 _____ () C:\Windows\System32\Tasks\{55D0A493-F2BE-41C4-947D-119C9D648949}
2015-02-03 22:17 - 2015-02-03 22:17 - 00002178 _____ () C:\Users\Public\Desktop\Adobe Digital Editions 3.0.lnk
2015-01-30 11:02 - 2015-01-30 11:02 - 00001357 _____ () C:\Users\Sherlock Holmes\Desktop\HP Solution Center.lnk
2015-01-28 10:35 - 2015-01-28 10:35 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-27 00:23 - 2015-01-27 00:23 - 00014464 _____ (Western Digital Technologies) C:\Windows\System32\Drivers\wdcsam64.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-24 15:58 - 2014-05-11 20:43 - 01369653 _____ () C:\Windows\WindowsUpdate.log
2015-02-24 15:26 - 2014-05-11 19:57 - 00000000 ____D () C:\users\Sherlock Holmes
2015-02-24 14:54 - 2014-08-08 16:26 - 00000501 _____ () C:\Windows\System32\checkdnsid.xml
2015-02-24 13:01 - 2014-05-14 09:13 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\MBAMSwissArmy.sys
2015-02-24 02:01 - 2011-04-12 08:43 - 00699416 _____ () C:\Windows\System32\perfh007.dat
2015-02-24 02:01 - 2011-04-12 08:43 - 00149556 _____ () C:\Windows\System32\perfc007.dat
2015-02-24 02:01 - 2009-07-14 06:13 - 01620612 _____ () C:\Windows\System32\PerfStringBackup.INI
2015-02-23 19:43 - 2014-05-12 21:23 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\vlc
2015-02-23 17:47 - 2014-05-14 06:32 - 00003998 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{CAEDF7C5-6BE4-40C6-A7D7-838E0CB1CD24}
2015-02-23 15:27 - 2014-11-06 11:17 - 00000372 _____ () C:\Windows\Tasks\powersuite_monitor.job
2015-02-23 15:27 - 2014-08-14 17:23 - 00000360 _____ () C:\Windows\Tasks\dsmonitor.job
2015-02-23 06:53 - 2015-01-11 01:00 - 00008835 _____ () C:\Windows\setupact.log
2015-02-21 11:33 - 2009-07-14 05:45 - 00031984 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-21 11:33 - 2009-07-14 05:45 - 00031984 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-20 15:27 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-20 15:25 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2015-02-20 14:14 - 2015-01-14 13:16 - 00002130 _____ () C:\Windows\PFRO.log
2015-02-19 14:47 - 2015-01-01 15:28 - 00011776 _____ () C:\Users\Sherlock Holmes\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-02-19 06:51 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-02-18 22:17 - 2015-01-05 15:45 - 00002830 _____ () C:\Windows\Sandboxie.ini
2015-02-18 15:02 - 2014-05-13 13:34 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-18 15:02 - 2014-05-13 13:34 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-18 11:57 - 2014-08-13 23:00 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\DC++
2015-02-18 11:57 - 2014-08-13 23:00 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Local\DC++
2015-02-17 21:28 - 2014-11-06 11:34 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\My ISO Files
2015-02-17 16:08 - 2014-11-06 13:49 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\ProtectDISC
2015-02-17 15:41 - 2009-07-14 05:45 - 05033688 _____ () C:\Windows\System32\FNTCACHE.DAT
2015-02-17 15:37 - 2014-12-12 03:23 - 00000000 ____D () C:\Windows\System32\appraiser
2015-02-17 15:37 - 2014-05-12 00:18 - 00000000 ___SD () C:\Windows\System32\CompatTel
2015-02-17 15:37 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-02-17 15:19 - 2014-05-11 20:13 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-17 15:18 - 2014-05-15 20:08 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-17 15:18 - 2009-07-14 03:34 - 00000513 _____ () C:\Windows\win.ini
2015-02-17 15:14 - 2014-05-11 22:23 - 00000000 ____D () C:\Windows\System32\MRT
2015-02-17 15:10 - 2014-05-11 22:23 - 116773704 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2015-02-17 14:53 - 2014-08-12 17:22 - 00000000 ____D () C:\Windows\System32\Tasks\Aufgaben der Ereignisanzeige
2015-02-16 15:52 - 2014-05-11 20:27 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-02-10 16:39 - 2014-05-13 16:12 - 00000000 ____D () C:\ProgramData\Oracle
2015-02-10 15:55 - 2014-05-13 16:11 - 00000000 ____D () C:\Program Files (x86)\Java
2015-02-10 15:53 - 2014-05-13 16:11 - 00272296 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2015-02-10 15:53 - 2014-05-13 16:11 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2015-02-10 15:53 - 2014-05-13 16:11 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2015-02-10 15:53 - 2014-05-13 16:11 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-02-10 12:49 - 2014-05-11 20:31 - 00000000 ____D () C:\ProgramData\Adobe
2015-02-10 12:48 - 2014-05-11 20:31 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-02-10 12:46 - 2014-07-14 16:39 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Local\Adobe
2015-02-08 14:14 - 2014-09-01 14:44 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\DAEMON Tools Lite
2015-02-07 16:50 - 2014-05-15 15:03 - 00000486 __RSH () C:\Users\Sherlock Holmes\ntuser.pol
2015-02-07 16:17 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\System32\NDF
2015-02-07 11:14 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Public\Libraries
2015-02-07 09:25 - 2014-05-11 20:32 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\Adobe
2015-02-06 20:52 - 2014-05-12 19:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-02-06 10:22 - 2015-01-11 19:57 - 00000731 _____ () C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk
2015-02-02 16:45 - 2015-01-26 15:00 - 00000000 ____D () C:\Scans
2015-01-30 12:03 - 2015-01-26 15:05 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\Eigene Scans
2015-01-28 20:30 - 2015-01-02 13:06 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\dvdcss

Some content of TEMP:
====================
C:\Users\Sherlock Holmes\AppData\Local\Temp\A~NSISu_.exe
C:\Users\Sherlock Holmes\AppData\Local\Temp\jre-8u31-windows-au.exe
C:\Users\Sherlock Holmes\AppData\Local\Temp\proxy_vole2862650717388283353.dll
C:\Users\Sherlock Holmes\AppData\Local\Temp\_isCDDA.exe


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points  =========================

Restore point made on: 2015-02-19 06:50:23
Restore point made on: 2015-02-20 14:54:27
Restore point made on: 2015-02-24 15:24:40

==================== BCD ================================

Windows-Start-Manager
---------------------
Bezeichner              {bootmgr}
device                  partition=C:
description            Windows Boot Manager
locale                  de-DE
inherit                {globalsettings}
default                {default}
resumeobject            {4e0b9b2e-d94c-11e3-bd76-f61d6a1afe88}
displayorder            {default}
toolsdisplayorder      {bdbdbd00-6057-11e0-a7f3-ce9adfd72001}
                        {memdiag}
timeout                30

Windows-Startladeprogramm
-------------------------
Bezeichner              {default}
device                  partition=C:
path                    \Windows\system32\winload.exe
description            Windows 7
locale                  de-DE
inherit                {bootloadersettings}
recoverysequence        {4e0b9b30-d94c-11e3-bd76-f61d6a1afe88}
recoveryenabled        Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {4e0b9b2e-d94c-11e3-bd76-f61d6a1afe88}
nx                      OptIn

Windows-Startladeprogramm
-------------------------
Bezeichner              {4e0b9b30-d94c-11e3-bd76-f61d6a1afe88}
device                  ramdisk=[C:]\Recovery\4e0b9b30-d94c-11e3-bd76-f61d6a1afe88\Winre.wim,{4e0b9b31-d94c-11e3-bd76-f61d6a1afe88}
path                    \windows\system32\winload.exe
description            Windows Recovery Environment
inherit                {bootloadersettings}
osdevice                ramdisk=[C:]\Recovery\4e0b9b30-d94c-11e3-bd76-f61d6a1afe88\Winre.wim,{4e0b9b31-d94c-11e3-bd76-f61d6a1afe88}
systemroot              \windows
nx                      OptIn
winpe                  Yes

Wiederaufnahme aus dem Ruhezustand
----------------------------------
Bezeichner              {4e0b9b2e-d94c-11e3-bd76-f61d6a1afe88}
device                  partition=C:
path                    \Windows\system32\winresume.exe
description            Windows Resume Application
locale                  de-DE
inherit                {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
debugoptionenabled      No

Windows-Speichertestprogramm
----------------------------
Bezeichner              {memdiag}
device                  partition=C:
path                    \boot\memtest.exe
description            Windows-Speicherdiagnose
locale                  de-DE
inherit                {globalsettings}
badmemoryaccess        Yes

Echtmodus-Startabschnitt
------------------------
Bezeichner              {bdbdbd00-6057-11e0-a7f3-ce9adfd72001}
device                  partition=C:
path                    \bdr-ld01.mbr
description            Bitdefender Rescue Mode - Windows 7 Professional SP 1 (x64)

EMS-Einstellungen
-----------------
Bezeichner              {emssettings}
bootems                Yes

Debuggereinstellungen
---------------------
Bezeichner              {dbgsettings}
debugtype              Serial
debugport              1
baudrate                115200

RAM-Defekte
-----------
Bezeichner              {badmemory}

Globale Einstellungen
---------------------
Bezeichner              {globalsettings}
inherit                {dbgsettings}
                        {emssettings}
                        {badmemory}

Startladeprogramm-Einstellungen
-------------------------------
Bezeichner              {bootloadersettings}
inherit                {globalsettings}
                        {hypervisorsettings}

Hypervisoreinstellungen
-------------------
Bezeichner              {hypervisorsettings}
hypervisordebugtype    Serial
hypervisordebugport    1
hypervisorbaudrate      115200

Einstellungen zur Ladeprogrammfortsetzung
-----------------------------------------
Bezeichner              {resumeloadersettings}
inherit                {globalsettings}

Ger„teoptionen
--------------
Bezeichner              {4e0b9b31-d94c-11e3-bd76-f61d6a1afe88}
description            Ramdisk Options
ramdisksdidevice        partition=C:
ramdisksdipath          \Recovery\4e0b9b30-d94c-11e3-bd76-f61d6a1afe88\boot.sdi


==================== Memory info ===========================

Percentage of memory in use: 7%
Total physical RAM: 16304.71 MB
Available physical RAM: 15118.34 MB
Total Pagefile: 16302.86 MB
Available Pagefile: 15105.92 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB

==================== Drives ================================

Drive c: (Windows7) (Fixed) (Total:97.65 GB) (Free:3.07 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Frei) (Fixed) (Total:465.76 GB) (Free:459.15 GB) NTFS
Drive f: (Downloads) (Fixed) (Total:300.37 GB) (Free:140.16 GB) NTFS
Drive g: (Programme ) (Fixed) (Total:498.54 GB) (Free:481.65 GB) NTFS
Drive h: (Grafik_Fotos) (Fixed) (Total:1266.82 GB) (Free:624.86 GB) NTFS
Drive i: (Reparaturdatenträger Windows 7 6) (CDROM) (Total:0.16 GB) (Free:0 GB) UDF
Drive j: (Games) (Fixed) (Total:698.74 GB) (Free:385.89 GB) NTFS
Drive k: (Daten) (Fixed) (Total:698.52 GB) (Free:442.45 GB) NTFS
Drive p: (USB) (Removable) (Total:7.46 GB) (Free:7.45 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (Software) (Fixed) (Total:398.26 GB) (Free:255.45 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows XP) (Size: 698.6 GB) (Disk ID: A56DFF5E)
Partition 1: (Not Active) - (Size=398.3 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=300.4 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 465.8 GB) (Disk ID: E83A4318)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 472DB8E2)
Partition 1: (Active) - (Size=97.7 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=498.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=1266.8 GB) - (Type=07 NTFS)

========================================================
Disk: 3 (Size: 1397.3 GB) (Disk ID: 000CE977)
Partition 1: (Not Active) - (Size=698.7 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=698.5 GB) - (Type=OF Extended)

========================================================
Disk: 8 (Size: 7.5 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.


LastRegBack: 2015-02-23 00:09

==================== End Of Log ============================
--- --- ---

--- --- ---


ich würde es echt toll finden wenn wir hier irgendwie weiter machen.ich dachte wir kommen unserem Problem näher.leider passiert nichts mehr :-(

Aneri 26.02.2015 20:02
Hallo. Ich habe neben dem TrojanerBoard noch einen richtigen Beruf und ditze im Moment noch im Büro. Wir machen das hier alle Ehrenamtlich. Wenn du den Rechner dringend benötigst bleibt dir die möglichkeit des Fachhändlers oder in deinem Fall der Garantieanspruch.


Ich versuche mein Möglichstes innerhalb von 24h zu antworten. Alternativ kann ich dir einen kompetenteren Helfer anbieten...

Sunny-Melone 26.02.2015 20:11
[QUOTEAlternativ kann ich dir einen kompetenteren Helfer anbieten...
][/QUOTE]

ich denke nicht das das nötig ist...
sorry hab mich wohl falsch ausgedrückt. ich werde warten

schrauber 26.02.2015 20:43
hi,

ich übernehme mal. Ich hätte noch paar Fragen zum System/Aufbau und so, aber zuerst noch en schneller Schuss aus der Hüfte:

Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
BootExecute: autocheck autochk * OODBS
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.



Normal booten geht nach dem Fix? Wenn ja, geil (:D) wenn nein, nochmal nen Scan aus der Recovery.

Bitte auch mal alles externe am Rechner abklemmen. UNd bitte mal ne kurze Erklärung was da alles an Platten und Medien verbaut/angeschlossen is.

Sunny-Melone 26.02.2015 20:57
hallo schrauber,
win ist gestartet warum auch immer ,bitte sag jetzt nicht ich muß den nochmal neu booten

schrauber 26.02.2015 20:59
hast du den fix gemacht??

Zitat:
bitte sag jetzt nicht ich muß den nochmal neu booten
doch musst du, und wenn er wieder normal bootet musst du ihn grad nochmal neu starten, einfach so zum spass :)

Sunny-Melone 26.02.2015 21:02
nein der ist von allein hochgefahren,ist das jetzt dein ernst?? was wenn es danach nicht mehr geht.soll ich den fix trotzdem machen?

schrauber 26.02.2015 21:02
mach den fix von oben.

Sunny-Melone 26.02.2015 21:59
leider keine änderung

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 18-02-2015 01
Ran by SYSTEM at 2015-02-26 21:56:57 Run:3
Running from P:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
BootExecute: autocheck autochk * OODBS

*****************

HKLM\System\ControlSet001\Control\Session Manager\\BootExecute => Value was restored successfully.

==== End of Fixlog 21:56:57 ====

mir ist da gerade etwas aufgefallen,ich hoffe das hilft weiter.wenn ich vom cd Rom Laufwerk boote und nicht schnell genug irgend eine taste drücke damit von cd gestartet werden kann ,geht mein Windows auf einmal wieder

schrauber 27.02.2015 10:49
Was denn nun? Keine Änderung oder es geht wieder? :)

Also jetzt nochmal:

CD raus
alles externe abklemmen
Rechner komplett aus
Rechner neu starten.

Was passiert?

Sunny-Melone 27.02.2015 13:14
rechner fährt normal hoch :crazy:

als ich gestern dein log erstellen wollte mußte ich ja von cd booten um in den rep.modus zu kommen.ich war aber nicht schnell genug als die meldung kam:von cd booten.
also lief das system weiter und windows war auf einmal oben

soll ich mal den virenscanner durchlaufen lassen?

schrauber 27.02.2015 18:26
Nee jetzt erstmal alles im Normalen Modus:

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


Sunny-Melone 28.02.2015 00:01
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-02-2015 01
Ran by Sherlock Holmes at 2015-02-27 23:46:35
Running from E:\Sunny
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Bitdefender Virenschutz (Enabled - Up to date) {9B5F5313-CAF9-DD97-C460-E778420237B4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Bitdefender Spyware-Schutz (Enabled - Up to date) {203EB2F7-ECC3-D219-FED0-DC0A39857D09}
FW: Bitdefender Firewall (Enabled) {A364D236-8096-DCCF-EF3F-4E4DBCD170CF}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

1400 (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
1400_Help (x32 Version: 82.0.242.000 - Hewlett-Packard) Hidden
1400Trb (x32 Version: 82.0.242.000 - Hewlett-Packard) Hidden
64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
Acrobat.com (HKLM-x32\...\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.1.377 - Adobe Systems Incorporated)
Acrobat.com (x32 Version: 0.0.0 - Adobe Systems Incorporated) Hidden
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 16.0.0.245 - Adobe Systems Incorporated)
Adobe Digital Editions 3.0 (HKLM-x32\...\Adobe Digital Editions 3.0) (Version: 3.0.1 - Adobe Systems Incorporated)
Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.125 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
AIO_CDB_ProductContext (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
AIO_CDB_Software (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
AIO_Scan (x32 Version: 130.0.421.000 - Hewlett-Packard) Hidden
AMD Catalyst Install Manager (HKLM\...\{C2956908-53A3-88FC-B795-B16508296FC4}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
Ant Renamer (HKLM-x32\...\Ant Renamer 2_is1) (Version: 2.10.0 - Ant Software)
Ashampoo Burning Studio 2013 v.11.0.6 (HKLM-x32\...\{91B33C97-0FBA-74AE-E802-D782F5C8AA89}_is1) (Version: 11.0.6 - Ashampoo GmbH & Co. KG)
Ashampoo WinOptimizer 10 v.10.3.0 (HKLM-x32\...\{4209F371-88D4-AB00-ED2B-D6520C84D9D5}_is1) (Version: 10.03.00 - Ashampoo GmbH & Co. KG)
Audiobook Cutter Pro Edition (HKLM-x32\...\{E64597F4-293F-4DCB-B4FD-02D611233EA0}) (Version: 1.8.2 - Audiobook Software)
Bitdefender Total Security 2013 (HKLM\...\Bitdefender) (Version: 16.34.0.1913 - Bitdefender)
BufferChm (x32 Version: 130.0.331.000 - Hewlett-Packard) Hidden
calibre 64bit (HKLM\...\{994A15FB-0FA3-455E-8161-A558C7BC4A73}) (Version: 2.19.0 - Kovid Goyal)
CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)
Copy (x32 Version: 130.0.428.000 - Hewlett-Packard) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
DC++ 0.799 (HKLM-x32\...\DC++) (Version: 0.799 - Jacek Sieka)
Destinations (x32 Version: 130.0.0.0 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 130.0.465.000 - Hewlett-Packard) Hidden
DocProc (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
Driver Genius (HKLM-x32\...\Driver Genius_is1) (Version: 14.0 - Driver-Soft Inc.)
DX Studio Player v3.2.68 (HKLM\...\DX Studio Player v3.2.68_is1) (Version: 3.2.68 - Worldweaver Ltd.)
EaseUS Data Recovery Wizard 8.6 (HKLM\...\EaseUS Data Recovery Wizard 8.6_is1) (Version:  - EaseUS)
EaseUS Partition Master 10.1 Trial Edition (HKLM-x32\...\EaseUS Partition Master Trial Edition_is1) (Version:  - EaseUS)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
Fax (x32 Version: 130.0.418.000 - Hewlett-Packard) Hidden
File Scavenger 3.2 (de) (HKLM-x32\...\QueTek File Scavenger 3.2 (de)) (Version: 3.2.24.0 - QueTek Consulting Corporation)
Folderico 4.0 RC12 (HKLM-x32\...\Folderico) (Version: 4.0 RC12 - Shedko ( www.softq.org ))
FreePDF (Remove only) (HKLM-x32\...\FreePDF_XP) (Version:  - )
G DATA Logox4 Speechengine (HKLM-x32\...\lgx4.lgx.server) (Version:  - G DATA Software AG)
GetFoldersize 2.5.24 (HKLM-x32\...\GetFoldersize_is1) (Version: 2.5.24 - Michael Thummerer Software Design)
GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.07) (Version: 9.07 - Artifex Software Inc.)
HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)
HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP)
HP Photosmart Officejet and Deskjet All-In-One Driver Software 13.0 Rel. B (HKLM\...\{B61ED343-0B14-4241-999C-490CB1A20DA4}) (Version: 13.0 - HP)
HP Smart Web Printing 4.51 (HKLM\...\HP Smart Web Printing) (Version: 4.51 - HP)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden
HPPhotoGadget (x32 Version: 130.0.282.000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabelContent1 (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotosmartEssential (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
IsoBuster 3.4 (HKLM-x32\...\IsoBuster_is1) (Version: 3.4 - Smart Projects)
Java 8 Update 20 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418020F0}) (Version: 8.0.200 - Oracle Corporation)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
K-Lite Codec Pack 3.4.0 Full (HKLM-x32\...\KLiteCodecPack_is1) (Version: 3.40 - )
L&H TTS3000 British English (HKLM-x32\...\LHTTSENG) (Version:  - )
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Memento Mori (Patch Version 1.01) (HKLM-x32\...\Memento Mori_is1) (Version:  - dtp AG)
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{26784146-6E05-3FF9-9335-786C7C0FB5BE}) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Speech Recognition Engine 4.0 (English) (HKLM-x32\...\MSCSR) (Version:  - )
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61187 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61186 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.7523 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.7523 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{90ffcee5-8608-4e94-8c18-a4feb4f83fb8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
MiniTool Partition Wizard Free 9.0 (HKLM-x32\...\{05D996FA-ADCB-4D23-BA3C-A7C184A8FAC6}_is1) (Version:  - MiniTool Solution Ltd.)
MozBackup 1.5.1 (HKLM-x32\...\MozBackup) (Version:  - Pavel Cvrcek)
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 24.5.0 - Mozilla)
Mozilla Thunderbird 31.4.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.4.0 (x86 de)) (Version: 31.4.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
NetSpeedMonitor 2.5.4.0 x64 (HKLM\...\{88F41EE2-949B-4B52-933D-C7F8F67BC1D2}) (Version: 2.5.4.0 - Florian Gilles)
Network64 (Version: 130.0.572.000 - Hewlett-Packard) Hidden
Network64 (Version: 140.0.221.000 - Hewlett-Packard) Hidden
NVIDIA PhysX (HKLM-x32\...\{80407BA7-7763-4395-AB98-5233F1B34E65}) (Version: 9.13.1220 - NVIDIA Corporation)
O&O Defrag Professional Edition (HKLM\...\{53480360-C6AA-4E73-A4E3-1C4C915E049F}) (Version: 10.0.1634 - O&O Software GmbH)
OCR Software by I.R.I.S. 13.0 (HKLM\...\HPOCR) (Version: 13.0 - HP)
Ontrack EasyRecovery Professional (HKLM-x32\...\{668CC71A-C2AD-4D56-866D-CF300BD1D5BE}_is1) (Version: 10.0.2.3 - Kroll Ontrack Inc.)
Oracle VM VirtualBox 4.2.12 (HKLM\...\{0C1DE303-E41B-44BA-8ABA-B7F09D857001}) (Version: 4.2.12 - Oracle Corporation)
Perry Rhodan (HKLM-x32\...\Perry Rhodan_is1) (Version:  - Deep Silver)
PlexUTILITIES 1.3 (HKLM-x32\...\PlexUtil) (Version: 1.3 - Plextor)
ProtectDisc Driver, Version 11 (HKLM-x32\...\ProtectDisc Driver 11) (Version: 11.0.0.11 - ProtectDisc Software GmbH)
Q-Dir (HKLM\...\Q-Dir) (Version:  - )
Qualcomm Atheros Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.21 - Qualcomm Atheros Inc.)
Raptr (HKLM-x32\...\Raptr) (Version:  - )
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.273.37 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7076 - Realtek Semiconductor Corp.)
Recuva (HKLM\...\Recuva) (Version: 1.51 - Piriform)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version: 1.90 - Ghostgum Software Pty Ltd)
Revo Uninstaller Pro 3.1.2 (HKLM\...\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1) (Version: 3.1.2 - VS Revo Group, Ltd.)
Sandboxie 4.14 (64-bit) (HKLM\...\Sandboxie) (Version: 4.14 - Sandboxie Holdings, LLC)
Scan (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Skiller Pro Driver (HKLM-x32\...\{54C8FBB3-B992-43CB-8F0A-E26228013F88}) (Version: 1.0 - )
SlimDrivers (HKLM-x32\...\{03E312F7-8697-4BC4-A90F-33D34EECE18C}) (Version: 2.2.44488 - SlimWare Utilities, Inc.)
SmartWebPrinting (x32 Version: 130.0.457.000 - Hewlett-Packard) Hidden
SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
Status (x32 Version: 130.0.469.000 - Hewlett-Packard) Hidden
Stellar Phoenix Windows Data Recovery - Professional (HKLM-x32\...\Stellar Phoenix Windows Data Recovery - Professional_is1) (Version: 6.0.0.1 - Stellar Information Technology Pvt Ltd.)
Toolbox (x32 Version: 130.0.648.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 130.0.422.000 - Hewlett-Packard) Hidden
TuneUp Utilities 2014 (de-DE) (x32 Version: 14.0.1000.296 - TuneUp Software) Hidden
UltraISO Premium V9.62 (HKLM-x32\...\UltraISO_is1) (Version:  - )
UnloadSupport (x32 Version: 11.0.0 - Hewlett-Packard) Hidden
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
VLC media player 2.1.4 (HKLM\...\VLC media player) (Version: 2.1.4 - VideoLAN)
WebReg (x32 Version: 130.0.132.017 - Hewlett-Packard) Hidden
Winamp (HKLM-x32\...\Winamp) (Version: 5.666  - Nullsoft, Inc)
Windows Mobile Device Center Driver Update (HKLM\...\{92DBCA36-9B41-4DD1-941A-AED149DD37F0}) (Version: 6.1.6965.0 - Microsoft Corporation)
Windows Mobile-Gerätecenter (HKLM\...\{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}) (Version: 6.1.6965.0 - Microsoft Corporation)
WinRAR 5.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
Wondershare MobileTrans ( Version 5.6.0 ) (HKLM-x32\...\{18CDCEAA-A9E4-4A4C-AC0E-C15E87C30EA5}_is1) (Version: 5.6.0 - Wondershare)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-971888290-4151258157-3832144516-1000_Classes\CLSID\{677D54F0-573E-11D4-9385-005004518EC8}\InprocServer32 -> C:\Program Files\OO Software\Defrag Professional\oodpep.dll (O&O Software GmbH)
CustomCLSID: HKU\S-1-5-21-971888290-4151258157-3832144516-1000_Classes\CLSID\{8AC29A61-573D-11D4-9385-005004518EC8}\InprocServer32 -> C:\Program Files\OO Software\Defrag Professional\oodpeo.ocx (O&O Software GmbH)
CustomCLSID: HKU\S-1-5-21-971888290-4151258157-3832144516-1000_Classes\CLSID\{943AA438-0ED3-11D3-8CE7-00105AC417F9}\InprocServer32 -> C:\Program Files\OO Software\Defrag Professional\oodpeo.ocx (O&O Software GmbH)
CustomCLSID: HKU\S-1-5-21-971888290-4151258157-3832144516-1000_Classes\CLSID\{B4E83711-62D3-11D4-9396-005004518EC8}\InprocServer32 -> C:\Program Files\OO Software\Defrag Professional\oodpep.dll (O&O Software GmbH)

==================== Restore Points  =========================

27-02-2015 14:21:05 SlimDrivers Installing Drivers

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2015-01-05 17:32 - 00001162 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 hxxp://www.driver-soft.com
127.0.0.1 www.driver-soft.com
127.0.0.1 hxxp://www.driver-soft.com
127.0.0.1 www.driver-soft.com
127.0.0.1 hxxp://www.driver-soft.com
127.0.0.1 www.driver-soft.com
127.0.0.1 hxxp://www.driver-soft.com
127.0.0.1 www.driver-soft.com
127.0.0.1 lmlicenses.wip4.adobe.com
127.0.0.1 lm.licenses.adobe.com


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {10B4465B-16D9-4837-A93E-924D47C335E4} - System32\Tasks\{D5BF9942-7224-48E8-83DF-AD51EF2DF11B} => pcalua.exe -a Q:\Setup.exe -d Q:\
Task: {193A9761-FFFC-4240-9555-C176A9196FF5} - System32\Tasks\{6662A7BD-54D7-451D-82E1-0B34EBEEE697} => Z:\interface\contents\topsoftware_32593\81424\files\Fix-It_14_Utilities_DEU_WEKA.exe
Task: {1A8AA312-6F3B-4915-9324-F3C689853A58} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {2D30DC75-71C9-43FA-9780-A6F9BAB08901} - System32\Tasks\{C1AC42D5-82EB-4742-A5F2-0C0F78F77308} => pcalua.exe -a "H:\### Programme ###\## Textverarbeitung ##\DAMN NFO Viewer 2.10\DAMN NFO Viewer 2.10 RC3\DAMN_NFO_Viewer_v2.10.0031.RC3_Setup.exe" -d "H:\### Programme ###\## Textverarbeitung ##\DAMN NFO Viewer 2.10\DAMN NFO Viewer 2.10 RC3"
Task: {67657C9E-9187-44DE-A8F3-CC13BE99AA8B} - System32\Tasks\{0B211961-4591-43FC-A7E4-BC0E5D8C40D0} => Q:\Setup.exe
Task: {6CAF6DA8-14AF-4ED7-B388-D7C54793B30C} - System32\Tasks\CCleanerSkipUAC => D:\Program FilesCC_Cleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)
Task: {8116ED52-DDC2-4D49-A24A-FB2864417AAD} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {8BECD35C-BFC5-4537-B2D7-B8E51AA99335} - System32\Tasks\{C368D411-8AEF-457F-BDFC-4346540C31BB} => C:\Program Files (x86)\Adobe\Adobe Digital Editions 3.0\DigitalEditions.exe [2014-04-25] (Adobe Systems Incorporated)
Task: {9D209803-68C0-434F-A9AE-1E3EBE3221BF} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2014-12-17] (Oracle Corporation)
Task: {9F06FECF-0CBB-48D7-BD59-D68D2403666D} - System32\Tasks\SlimDrivers Startup => C:\Program Files (x86)\SlimDrivers\SlimDrivers.exe [2015-01-28] (SlimWare Utilities, Inc.)
Task: {A2D6062E-B415-49C8-ACC9-6A0CA53AFDEF} - System32\Tasks\{69079650-C5EF-4F24-B366-0BCE7920D9A3} => pcalua.exe -a C:\Windows\system32\pcwrun.exe -c "C:\Program Files (x86)\Adobe\Adobe Digital Editions 3.0\DigitalEditions.exe"
Task: {C4216BF0-D3E1-43B2-A8AF-7B83C797B937} - System32\Tasks\{1D239941-BE02-402E-89D9-A13BC01C02D4} => pcalua.exe -a "D:\Programme Files (x86)\Revo Uninstaller\Revouninstaller.exe" -d "D:\Programme Files (x86)\Revo Uninstaller"
Task: {D05D6977-899E-42D4-9629-BD2E0B2C22EC} - System32\Tasks\{55D0A493-F2BE-41C4-947D-119C9D648949} => pcalua.exe -a E:\ADE_3.0_Installer.exe -d E:\
Task: {E10A12EE-D2C5-44DB-91E3-C27B9FEE1380} - System32\Tasks\{10B45E71-1B09-4D06-9397-F5AE3F5A490F} => pcalua.exe -a "S:\## Backups  ##\## THUNDERBIRD ##\Backup E-Mail Thundersave\Backup Thunderbird 2010\08.10.2010\restore.exe" -d "S:\## Backups  ##\## THUNDERBIRD ##\Backup E-Mail Thundersave\Backup Thunderbird 2010\08.10.2010"
Task: C:\Windows\Tasks\SlimDrivers Startup.job => C:\Program Files (x86)\SlimDrivers\SlimDrivers.exe

==================== Loaded Modules (whitelisted) ==============

2014-05-12 19:06 - 2013-08-07 17:52 - 00265080 _____ () C:\Program Files\Bitdefender\Bitdefender 2013\txmlutil.dll
2014-05-12 19:06 - 2013-10-23 10:18 - 00003072 _____ () C:\Program Files\Bitdefender\Bitdefender 2013\UI\accessl.ui
2014-05-12 19:06 - 2011-11-14 19:17 - 00153680 _____ () C:\Program Files\Bitdefender\Bitdefender 2013\bdfwcore.dll
2014-05-12 19:06 - 2013-10-23 10:18 - 00005120 _____ () C:\Program Files\Bitdefender\Bitdefender 2013\UI\IMSecurityAL.ui
2015-02-06 14:12 - 2015-02-06 14:12 - 00784712 _____ () C:\Program Files\Bitdefender\Bitdefender 2013\otengines_00050_009\ashttpbr.mdl
2015-02-06 14:12 - 2015-02-06 14:12 - 00573544 _____ () C:\Program Files\Bitdefender\Bitdefender 2013\otengines_00050_009\ashttpdsp.mdl
2015-02-06 14:12 - 2015-02-06 14:12 - 02657264 _____ () C:\Program Files\Bitdefender\Bitdefender 2013\otengines_00050_009\ashttpph.mdl
2015-02-06 14:12 - 2015-02-06 14:12 - 01331648 _____ () C:\Program Files\Bitdefender\Bitdefender 2013\otengines_00050_009\ashttprbl.mdl
2013-09-04 23:17 - 2013-09-04 23:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2010-07-15 05:44 - 2010-07-15 05:44 - 00020032 _____ () d:\Program Files\Unlocker\UnlockerCOM.dll
2015-02-07 09:34 - 2012-06-21 07:25 - 00113152 _____ () C:\Windows\System32\redmon64.dll
2014-09-15 17:13 - 2014-09-15 17:13 - 00214528 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.PerformanceTuning.dll
2014-02-11 06:08 - 2014-02-11 06:08 - 00817152 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll
2014-02-11 06:08 - 2014-02-11 06:08 - 03650560 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Platform.dll
2014-05-12 19:06 - 2012-06-21 13:01 - 01117480 _____ () C:\Program Files\Bitdefender\Bitdefender SafeBox\System.Data.SQLite.dll
2014-12-29 08:16 - 2014-02-26 14:45 - 00475136 _____ () C:\Program Files (x86)\Skiller Pro\Monitor.EXE
2015-02-27 14:23 - 2014-06-26 07:44 - 00358144 _____ () C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe
2013-09-04 23:14 - 2013-09-04 23:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2014-12-29 08:16 - 2014-09-03 15:58 - 00057344 _____ () C:\Program Files (x86)\Skiller Pro\lan.dll
2014-12-29 08:16 - 2012-08-14 22:41 - 00061440 _____ () C:\Program Files (x86)\Skiller Pro\hiddriver.dll
2015-01-28 10:35 - 2015-01-28 10:35 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2015-02-27 15:11 - 2015-02-27 15:11 - 00043520 ____N () C:\Users\Sherlock Holmes\AppData\Local\Temp\proxy_vole8122898952741371965.dll
2015-01-07 19:31 - 2015-01-07 19:31 - 02593168 ____N () C:\Users\Sherlock Holmes\AppData\Local\Temp\SevenZipJBinding-N8q7X\lib7-Zip-JBinding.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Sherlock Holmes\Desktop\esetsmartinstaller_deu.exe:BDU

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-971888290-4151258157-3832144516-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Sherlock Holmes\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
MSCONFIG\startupreg: ASRock A-Tuning =>
MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: RtHDVCpl => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
MSCONFIG\startupreg: Sidebar => C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
MSCONFIG\startupreg: StartCCC => "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

==================== Accounts: =============================

Administrator (S-1-5-21-971888290-4151258157-3832144516-500 - Administrator - Disabled)
Gast (S-1-5-21-971888290-4151258157-3832144516-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-971888290-4151258157-3832144516-1007 - Limited - Enabled)
Sherlock Holmes (S-1-5-21-971888290-4151258157-3832144516-1000 - Administrator - Enabled) => C:\Users\Sherlock Holmes

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/27/2015 02:23:41 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (02/27/2015 02:23:00 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (02/27/2015 02:23:00 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (02/27/2015 02:22:50 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (02/27/2015 01:58:21 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (02/27/2015 01:49:52 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (02/26/2015 11:59:44 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (02/26/2015 11:09:55 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (02/26/2015 10:25:52 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
  Generatordaten werden gesammelt

Kontext:
  Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
  Generatorname: System Writer
  Generatorinstanz-ID: {340b2d8a-ca77-4eed-8671-451d2cac2b7d}

Error: (02/26/2015 08:50:27 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "CoCreateInstance(CLSID_VSSCoordinator)" ist ein unerwarteter Fehler aufgetreten. hr = 0x800401f0, CoInitialize wurde nicht aufgerufen.
.


System errors:
=============
Error: (02/27/2015 10:53:43 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
amdkmafd

Error: (02/26/2015 11:18:00 PM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: NT-AUTORITÄT)
Description: 0x8000002a171\??\Volume{0b426a04-d944-11e3-8567-806e6f6e6963}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{9F355421-0F1F-485B-90E9-7850DC2865A1}

Error: (02/26/2015 10:08:14 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
amdkmafd

Error: (02/26/2015 08:48:27 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
amdkmafd

Error: (02/20/2015 03:27:13 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
amdkmafd

Error: (02/20/2015 02:15:36 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
amdkmafd

Error: (02/18/2015 10:27:23 PM) (Source: Microsoft-Windows-BitLocker-Driver) (EventID: 24620) (User: NT-AUTORITÄT)
Description: Überprüfung des verschlüsselten Volumes: Die Volumeinformationen auf "\\?\Volume{6ce17563-b776-11e4-a231-bc5ff4fa0a57}" können nicht gelesen werden.

Error: (02/18/2015 10:27:18 PM) (Source: Microsoft-Windows-BitLocker-Driver) (EventID: 24620) (User: NT-AUTORITÄT)
Description: Überprüfung des verschlüsselten Volumes: Die Volumeinformationen auf "\\?\Volume{6ce1755c-b776-11e4-a231-bc5ff4fa0a57}" können nicht gelesen werden.

Error: (02/18/2015 10:24:07 PM) (Source: Microsoft-Windows-BitLocker-Driver) (EventID: 24620) (User: NT-AUTORITÄT)
Description: Überprüfung des verschlüsselten Volumes: Die Volumeinformationen auf "\\?\Volume{6ce1755c-b776-11e4-a231-bc5ff4fa0a57}" können nicht gelesen werden.

Error: (02/18/2015 10:23:57 PM) (Source: Microsoft-Windows-BitLocker-Driver) (EventID: 24620) (User: NT-AUTORITÄT)
Description: Überprüfung des verschlüsselten Volumes: Die Volumeinformationen auf "\\?\Volume{6ce17558-b776-11e4-a231-bc5ff4fa0a57}" können nicht gelesen werden.


Microsoft Office Sessions:
=========================
Error: (02/27/2015 02:23:41 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Sherlock Holmes\Desktop\esetsmartinstaller_deu.exe

Error: (02/27/2015 02:23:00 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Sherlock Holmes\Desktop\esetsmartinstaller_deu.exe

Error: (02/27/2015 02:23:00 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Sherlock Holmes\Desktop\esetsmartinstaller_deu.exe

Error: (02/27/2015 02:22:50 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Sherlock Holmes\Desktop\esetsmartinstaller_deu.exe

Error: (02/27/2015 01:58:21 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestH:\## Security ##\Sicherheitscheck_trojaboard\Eset_Online Virus Scanner\esetsmartinstaller_enu.exe

Error: (02/27/2015 01:49:52 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestE:\esetsmartinstaller_deu.exe

Error: (02/26/2015 11:59:44 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestd:\program filescc_cleaner\CCleaner.exe

Error: (02/26/2015 11:09:55 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestd:\program filescc_cleaner\CCleaner.exe

Error: (02/26/2015 10:25:52 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Zugriff verweigert


Vorgang:
  Generatordaten werden gesammelt

Kontext:
  Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
  Generatorname: System Writer
  Generatorinstanz-ID: {340b2d8a-ca77-4eed-8671-451d2cac2b7d}

Error: (02/26/2015 08:50:27 PM) (Source: VSS) (EventID: 8193) (User: )
Description: CoCreateInstance(CLSID_VSSCoordinator)0x800401f0, CoInitialize wurde nicht aufgerufen.


==================== Memory info ===========================

Processor: AMD A10-7850K APU with Radeon(TM) R7 Graphics
Percentage of memory in use: 26%
Total physical RAM: 16304.64 MB
Available physical RAM: 12014.41 MB
Total Pagefile: 34728.83 MB
Available Pagefile: 30426.68 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (Windows7) (Fixed) (Total:97.65 GB) (Free:5.71 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Programme ) (Fixed) (Total:498.54 GB) (Free:482.24 GB) NTFS
Drive e: (Downloads) (Fixed) (Total:300.37 GB) (Free:90.59 GB) NTFS
Drive f: (Grafik_Fotos) (Fixed) (Total:1266.82 GB) (Free:624.86 GB) NTFS
Drive h: (Software) (Fixed) (Total:398.26 GB) (Free:251.46 GB) NTFS
Drive i: (Frei) (Fixed) (Total:465.76 GB) (Free:365.36 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 472DB8E2)
Partition 1: (Active) - (Size=97.7 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=498.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=1266.8 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 698.6 GB) (Disk ID: A56DFF5E)
Partition 1: (Not Active) - (Size=398.3 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=300.4 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows XP) (Size: 465.8 GB) (Disk ID: E83A4318)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)

==================== End Of Log ============================
FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-02-2015 01
Ran by Sherlock Holmes (administrator) on SHERLOCK_HOLMES on 27-02-2015 23:45:49
Running from E:\Sunny
Loaded Profiles: Sherlock Holmes (Available profiles: Sherlock Holmes)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2013\vsserv.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Sandboxie Holdings, LLC) D:\Program Files\Sandboxie\SbieSvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2013\bdagent.exe
(Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\AMDUSB3DeviceDetector\nusb3mon.exe
(O&O Software GmbH) C:\Windows\System32\oodtray.exe
(Malwarebytes Corporation) D:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Sandboxie Holdings, LLC) D:\Program Files\Sandboxie\SbieCtrl.exe
(Malwarebytes Corporation) D:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(O&O Software GmbH) C:\Windows\System32\oodag.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2013\updatesrv.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender Safebox\safeboxservice.exe
(Malwarebytes Corporation) D:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
() C:\Program Files (x86)\Skiller Pro\Monitor.EXE
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(VS Revo Group) C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
(SlimWare Utilities, Inc.) C:\Program Files (x86)\SlimDrivers\SlimDrivers.exe
(ESET) C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScannerApp.exe
() C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe
(AppWork GmbH) D:\JDownloader\JDownloader2.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Bdagent] => C:\Program Files\Bitdefender\Bitdefender 2013\bdagent.exe [1575192 2013-09-27] (Bitdefender)
HKLM\...\Run: [NUSB3MON] => C:\Program Files (x86)\ATI Technologies\AMDUSB3DeviceDetector\nusb3mon.exe [97280 2012-04-11] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [] => [X]
HKLM\...\Policies\Explorer: [NoViewContextMenu] 0
HKU\S-1-5-21-971888290-4151258157-3832144516-1000\...\Run: [SandboxieControl] => d:\Program Files\Sandboxie\SbieCtrl.exe [784904 2014-10-14] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-971888290-4151258157-3832144516-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-971888290-4151258157-3832144516-1000\...\MountPoints2: {0b426a0a-d944-11e3-8567-806e6f6e6963} - Z:\run.exe
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} =>  No File
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} =>  No File
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} =>  No File
ShellIconOverlayIdentifiers: [__SafeBox1] -> {152C96EB-288E-4EDC-B7C6-D21F8250ADF3} => C:\Program Files\Bitdefender\Bitdefender SafeBox\SafeBoxShell.dll (Bitdefender)
ShellIconOverlayIdentifiers: [__SafeBox2] -> {342DAA0B-D796-460D-8566-901E08A1CCAD} => C:\Program Files\Bitdefender\Bitdefender SafeBox\SafeBoxShell.dll (Bitdefender)
ShellIconOverlayIdentifiers: [__SafeBox3] -> {57595DAE-1AE1-4D97-A49E-67CBB53B52DF} => C:\Program Files\Bitdefender\Bitdefender SafeBox\SafeBoxShell.dll (Bitdefender)
ShellIconOverlayIdentifiers: [__SafeBox4] -> {33816773-98AE-4723-ADE0-EBE54C8B5A67} => C:\Program Files\Bitdefender\Bitdefender SafeBox\SafeBoxShell.dll (Bitdefender)
BootExecute: autocheck autochk * OODBS

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-971888290-4151258157-3832144516-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKU\S-1-5-21-971888290-4151258157-3832144516-1000 -> DefaultScope {1343F391-98D5-4366-A160-D08CB4527ABF} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-971888290-4151258157-3832144516-1000 -> {1343F391-98D5-4366-A160-D08CB4527ABF} URL = https://www.google.com/search?q={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_20\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_20\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default
FF NetworkProxy: "ftp", "111.13.13.138"
FF NetworkProxy: "ftp_port", 80
FF NetworkProxy: "gopher", "111.13.13.138"
FF NetworkProxy: "gopher_port", 80
FF NetworkProxy: "http", "111.13.13.138"
FF NetworkProxy: "http_port", 80
FF NetworkProxy: "socks", "111.13.13.138"
FF NetworkProxy: "socks_port", 80
FF NetworkProxy: "socks_version", 4
FF NetworkProxy: "ssl", "111.13.13.138"
FF NetworkProxy: "ssl_port", 80
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @java.com/DTPlugin,version=11.20.2 -> C:\Program Files\Java\jre1.8.0_20\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.20.2 -> C:\Program Files\Java\jre1.8.0_20\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> d:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll No File
FF Plugin: adobe.com/AdobeAAMDetect_x86_64 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll No File
FF user.js: detected! => C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\user.js
FF Plugin ProgramFiles/Appdata: C:\Users\Sherlock Holmes\AppData\Roaming\mozilla\plugins\npDXStudioPlugin.DLL (Worldweaver Ltd.)
FF Extension: dp Launcher Plugin - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\dplauncher@digitalpublishing.de [2014-11-04]
FF Extension: FavIconReloader - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\FavIconReloader@mozilla.org [2014-05-13]
FF Extension: WOT - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-05-12]
FF Extension: Proxy-Listen.de - Proxyswitcher - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\admin@proxy-listen.de.xpi [2014-07-15]
FF Extension: AutoCopy 2 - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\autocopy2@teo.pl.xpi [2015-02-20]
FF Extension: Best Proxy Switcher - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\bestproxyswitcher@bestproxyswitcher.com.xpi [2014-07-15]
FF Extension: Classic Theme Restorer - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\ClassicThemeRestorer@ArisT2Noia4dev.xpi [2014-05-14]
FF Extension: Bookmarks Checker - check for bad links - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\firefoxbookmarkchecker@everhelper.me.xpi [2014-05-13]
FF Extension: X-Forwarded-For Header - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\jid1-vasLCl9ZsexfAQ@jetpack.xpi [2014-07-17]
FF Extension: Noia Fox options - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\NoiaFoxoption@davidvincent.tld.xpi [2014-05-14]
FF Extension: Personas Plus - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\personas@christopher.beard.xpi [2014-05-14]
FF Extension: Restartless Restart - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\restartless.restart@erikvold.com.xpi [2014-05-14]
FF Extension: Toggle Persona - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\togglepersona@davidvincent.tld.xpi [2014-05-14]
FF Extension: All-in-One Sidebar - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\{097d3191-e6fa-4728-9826-b533d755359d}.xpi [2014-05-12]
FF Extension: RSS Ticker - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\{1f91cde0-c040-11da-a94d-0800200c9a66}.xpi [2014-05-13]
FF Extension: NoScript - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-05-12]
FF Extension: Noia Fox - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\{7b90e860-5d61-11e0-80e3-0800200c9a66}.xpi [2014-05-13]
FF Extension: Adblock Plus - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-12]
FF Extension: Tab Mix Plus - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi [2014-05-13]
FF HKLM\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender 2013\bdtbext
FF Extension: bdToolbar - C:\Program Files\Bitdefender\Bitdefender 2013\bdtbext [2014-05-12]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-10-09]
FF HKLM-x32\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender 2013\bdtbext
FF HKU\S-1-5-21-971888290-4151258157-3832144516-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-09-15] (Advanced Micro Devices, Inc.) [File not signed]
S4 BdDesktopParental; C:\Program Files\Bitdefender\Bitdefender 2013\bdparentalservice.exe [69392 2013-08-07] (Bitdefender)
R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2010-10-22] (Hewlett-Packard Co.) [File not signed]
R2 MBAMScheduler; d:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; d:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R4 O&O Defrag; C:\Windows\system32\oodag.exe [1418248 2007-05-11] (O&O Software GmbH)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R4 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [239176 2013-02-19] (Realtek Semiconductor)
R2 SafeBox; C:\Program Files\Bitdefender\Bitdefender SafeBox\safeboxservice.exe [95184 2012-06-25] (Bitdefender)
R2 SbieSvc; d:\Program Files\Sandboxie\SbieSvc.exe [174600 2014-10-14] (Sandboxie Holdings, LLC)
R2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender 2013\updatesrv.exe [67320 2013-08-07] (Bitdefender)
R2 VSSERV; C:\Program Files\Bitdefender\Bitdefender 2013\vsserv.exe [1645256 2013-09-30] (Bitdefender)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S4 AHDDC2; C:\Program Files (x86)\Ashampoo\Ashampoo HDD Control 2\AHDDC2_Service.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 amdide64; C:\Windows\System32\DRIVERS\amdide64.sys [11904 2014-10-31] (Advanced Micro Devices Inc.)
S0 amdkmafd; C:\Windows\System32\DRIVERS\amdkmafd.sys [21160 2014-11-04] (Advanced Micro Devices, Inc.)
R2 AODDriver4.3; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
S3 AsrDrv101; C:\Windows\SysWOW64\Drivers\AsrDrv101.sys [22280 2014-08-16] (ASRock Incorporation)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2014-09-14] ()
R0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [727592 2013-07-19] (BitDefender)
R3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [261056 2012-11-02] (BitDefender)
R3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [601360 2013-07-19] (BitDefender)
R1 BdfNdisf; c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [93600 2013-02-22] (BitDefender LLC)
R1 bdfwfpf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [103504 2011-11-14] (BitDefender LLC)
S3 BDSandBox; C:\Windows\system32\drivers\bdsandbox.sys [82824 2013-07-23] (BitDefender SRL)
R1 BDVEDISK; C:\Windows\System32\DRIVERS\bdvedisk.sys [76944 2012-04-17] (BitDefender)
R3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-09-01] (Disc Soft Ltd)
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [17480 2013-03-07] () [File not signed]
S3 epmntdrv; C:\Windows\SysWOW64\epmntdrv.sys [14920 2013-03-07] () [File not signed]
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9800 2013-03-07] () [File not signed]
S3 EuGdiDrv; C:\Windows\SysWOW64\EuGdiDrv.sys [9160 2013-03-07] () [File not signed]
R3 FLxHCIh; C:\Windows\System32\DRIVERS\FLxHCIh.sys [77480 2014-08-16] (Fresco Logic)
R0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [150256 2013-08-23] (BitDefender LLC)
R1 ISODrive; D:\UltraISO\drivers\ISODrv64.sys [115448 2013-11-21] (EZB Systems, Inc.)
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [129224 2013-07-18] (Qualcomm Atheros Co., Ltd.)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2014-09-14] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-27] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
R0 pwdrvio; C:\Windows\System32\pwdrvio.sys [19152 2013-09-30] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [12504 2013-09-30] ()
U5 RTSPER; C:\Windows\System32\Drivers\RTSPER.sys [465624 2014-01-03] (Realsil Semiconductor Corporation)
R3 SbieDrv; d:\Program Files\Sandboxie\SbieDrv.sys [185352 2014-10-14] (Sandboxie Holdings, LLC)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [13920 2015-02-27] ()
R0 trufos; C:\Windows\System32\DRIVERS\trufos.sys [389240 2013-08-07] (BitDefender S.R.L.)
U5 UnlockerDriver5; d:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-27 14:23 - 2015-02-27 14:23 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-02-27 14:22 - 2015-02-27 13:49 - 02347384 _____ (ESET) C:\Users\Sherlock Holmes\Desktop\esetsmartinstaller_deu.exe
2015-02-27 14:21 - 2015-02-27 14:21 - 00000000 ____D () C:\ProgramData\SlimWare Utilities, Inc
2015-02-27 14:00 - 2015-02-27 14:01 - 00002876 _____ () C:\Windows\System32\Tasks\SlimDrivers Startup
2015-02-27 14:00 - 2015-02-27 14:01 - 00000430 _____ () C:\Windows\Tasks\SlimDrivers Startup.job
2015-02-27 14:00 - 2015-02-27 14:00 - 00013920 _____ () C:\Windows\system32\Drivers\SWDUMon.sys
2015-02-27 14:00 - 2015-02-27 14:00 - 00002467 _____ () C:\Users\Public\Desktop\SlimDrivers.lnk
2015-02-27 14:00 - 2015-02-27 14:00 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Local\SlimWare Utilities Inc
2015-02-27 14:00 - 2015-02-27 14:00 - 00000000 ____D () C:\Users\Public\Documents\Downloaded Installers
2015-02-24 16:45 - 2015-02-27 23:45 - 00000000 ____D () C:\FRST
2015-02-24 15:26 - 2015-02-24 15:44 - 00000000 ____D () C:\Users\Sherlock Holmes\.VirtualBox
2015-02-24 15:25 - 2015-02-24 15:25 - 00001084 _____ () C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk
2015-02-24 15:25 - 2015-02-24 15:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox
2015-02-24 15:25 - 2013-04-12 11:41 - 00237840 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys
2015-02-24 15:25 - 2013-04-12 11:40 - 00120080 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys
2015-02-24 15:24 - 2015-02-24 15:24 - 00000000 ____D () C:\Program Files\Oracle
2015-02-24 15:22 - 2015-02-24 15:37 - 00000000 ____D () C:\VirtualBox
2015-02-24 15:21 - 2015-02-24 15:21 - 00000000 ____D () C:\Austausch
2015-02-20 19:03 - 2015-02-20 19:03 - 00000861 _____ () C:\Users\Public\Desktop\EaseUS Data Recovery Wizard 8.6.lnk
2015-02-20 19:03 - 2015-02-20 19:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EaseUS Data Recovery Wizard 8.6
2015-02-20 14:54 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-02-20 14:54 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-02-20 14:54 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2015-02-20 14:54 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll
2015-02-20 14:28 - 2015-02-20 14:28 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Temp
2015-02-20 14:14 - 2015-02-27 10:53 - 00005213 _____ () C:\Windows\system32\oodbs.lor
2015-02-19 18:13 - 2015-02-19 18:13 - 00000000 ____D () C:\Users\Sherlock Holmes\Calibre Library
2015-02-19 11:04 - 2015-02-19 11:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ant Renamer
2015-02-18 20:52 - 2015-02-18 20:52 - 00000000 _____ () C:\Windows\oodcnt.INI
2015-02-18 16:35 - 2015-02-26 21:08 - 00000000 ____D () C:\Windows\system32\oodag
2015-02-18 16:23 - 2015-02-18 16:23 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\O&O
2015-02-18 16:22 - 2015-02-18 16:22 - 00002068 _____ () C:\Users\Public\Desktop\O&O Defrag.lnk
2015-02-18 16:22 - 2015-02-18 16:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\O&O Software
2015-02-18 16:22 - 2015-02-18 16:22 - 00000000 ____D () C:\Program Files\OO Software
2015-02-18 15:05 - 2015-01-23 05:42 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-02-18 15:05 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-18 15:05 - 2015-01-23 04:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-02-18 15:05 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-18 14:57 - 2015-02-18 14:58 - 00002481 ____H () C:\Windows\EPMBatch.ept
2015-02-18 11:29 - 2015-02-18 11:29 - 00000991 _____ () C:\Users\Public\Desktop\EaseUS Partition Master 10.1.lnk
2015-02-18 11:29 - 2015-02-18 11:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EaseUS Partition Master 10.1
2015-02-18 11:28 - 2014-04-04 00:42 - 03382440 _____ () C:\Windows\system32\BootMan.exe
2015-02-18 11:28 - 2014-04-04 00:25 - 02499752 _____ () C:\Windows\SysWOW64\BootMan.exe
2015-02-18 11:28 - 2013-03-07 09:49 - 00100936 _____ () C:\Windows\system32\setupempdrvx64.exe
2015-02-18 11:28 - 2013-03-07 09:49 - 00087112 _____ () C:\Windows\SysWOW64\setupempdrv03.exe
2015-02-18 11:28 - 2013-03-07 09:49 - 00019840 _____ () C:\Windows\SysWOW64\EuEpmGdi.dll
2015-02-18 11:28 - 2013-03-07 09:49 - 00017480 _____ () C:\Windows\system32\epmntdrv.sys
2015-02-18 11:28 - 2013-03-07 09:49 - 00016256 _____ () C:\Windows\system32\EuEpmGdi.dll
2015-02-18 11:28 - 2013-03-07 09:49 - 00014920 _____ () C:\Windows\SysWOW64\epmntdrv.sys
2015-02-18 11:28 - 2013-03-07 09:49 - 00009800 _____ () C:\Windows\system32\EuGdiDrv.sys
2015-02-18 11:28 - 2013-03-07 09:49 - 00009160 _____ () C:\Windows\SysWOW64\EuGdiDrv.sys
2015-02-17 21:29 - 2015-02-27 12:31 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\MEMENTO
2015-02-17 16:18 - 2015-02-17 16:18 - 00000725 _____ () C:\Users\Sherlock Holmes\Desktop\Memento Mori.lnk
2015-02-17 16:18 - 2015-02-17 16:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Memento Mori
2015-02-17 16:08 - 2015-02-17 16:08 - 00335288 _____ (Protect Software GmbH) C:\Windows\system32\Drivers\acedrv11.sys
2015-02-17 16:05 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll
2015-02-17 16:05 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll
2015-02-17 16:05 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_1.dll
2015-02-17 16:05 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2015-02-17 16:05 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_2.dll
2015-02-17 16:05 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2015-02-17 16:05 - 2008-07-12 08:18 - 04992520 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll
2015-02-17 16:05 - 2008-07-12 08:18 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2015-02-17 16:05 - 2008-07-12 08:18 - 01942552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll
2015-02-17 16:05 - 2008-07-12 08:18 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2015-02-17 16:05 - 2008-07-12 08:18 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll
2015-02-17 16:05 - 2008-07-12 08:18 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2015-02-17 16:03 - 2015-02-17 16:04 - 00017627 _____ () C:\Windows\DirectX.log
2015-02-17 15:36 - 2015-02-17 15:36 - 00002921 _____ () C:\Windows\PWCMDLST.BAK
2015-02-17 15:06 - 2015-01-14 06:47 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-17 15:06 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-17 15:06 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-17 15:06 - 2015-01-12 04:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-17 15:06 - 2015-01-12 04:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-02-17 15:06 - 2015-01-12 03:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-02-17 15:06 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-17 15:06 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-17 15:06 - 2015-01-12 03:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-02-17 15:06 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-17 15:06 - 2015-01-12 03:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-17 15:06 - 2015-01-12 03:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-02-17 15:06 - 2015-01-12 03:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-17 15:06 - 2015-01-12 03:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-17 15:06 - 2015-01-12 03:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-02-17 15:06 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-17 15:06 - 2015-01-12 03:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-02-17 15:06 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-02-17 15:06 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-17 15:06 - 2015-01-12 03:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-02-17 15:06 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-17 15:06 - 2015-01-12 03:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-02-17 15:06 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-17 15:06 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-02-17 15:06 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-02-17 15:06 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-02-17 15:06 - 2015-01-12 03:04 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-17 15:06 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-17 15:06 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-02-17 15:06 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-02-17 15:06 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-02-17 15:06 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-02-17 15:06 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-17 15:06 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-17 15:06 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-17 15:06 - 2015-01-12 02:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-02-17 15:06 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-17 15:06 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-17 15:06 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-02-17 15:06 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-02-17 15:06 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-02-17 15:06 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-02-17 15:06 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-17 15:06 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-17 15:06 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-17 15:06 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-02-17 15:06 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-17 15:06 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-17 15:06 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-17 15:06 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-17 15:06 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-17 15:06 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-17 15:05 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-02-17 15:05 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-02-17 15:05 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-02-17 15:05 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-02-17 15:05 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-02-17 15:05 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-02-17 15:05 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-02-17 15:05 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-02-17 15:05 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-02-17 15:05 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-02-17 15:04 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-17 15:04 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-17 15:04 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-17 15:04 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-02-17 15:04 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-02-17 15:04 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-02-17 15:04 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-02-17 15:04 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-02-17 15:04 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-17 15:04 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-02-17 15:04 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-17 15:04 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-02-17 15:04 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-02-17 15:04 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-02-17 15:04 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-02-17 15:04 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-02-17 15:04 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-02-17 15:04 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-17 15:04 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-17 15:04 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-02-17 15:04 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-02-17 15:04 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-02-17 15:04 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-02-17 15:04 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-02-17 15:04 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-02-17 15:03 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-17 15:03 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-17 15:03 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-17 15:03 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-17 15:03 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-17 15:03 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-17 14:58 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-16 17:01 - 2015-01-14 11:28 - 03066880 _____ () C:\Windows\system32\pwNative.exe
2015-02-16 17:01 - 2013-09-30 16:26 - 00019152 ____N () C:\Windows\system32\pwdrvio.sys
2015-02-16 17:01 - 2013-09-30 16:26 - 00012504 ____N () C:\Windows\system32\pwdspio.sys
2015-02-16 17:00 - 2015-02-16 17:00 - 00000846 _____ () C:\Users\Public\Desktop\MiniTool Partition Wizard Free.lnk
2015-02-16 17:00 - 2015-02-16 17:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MiniTool Partition Wizard Free 9.0
2015-02-16 15:31 - 2015-02-16 15:31 - 00000958 _____ () C:\Users\Sherlock Holmes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Free FLV Converter.lnk
2015-02-16 15:29 - 2011-09-22 11:05 - 00364544 _____ () C:\Windows\SysWOW64\PropertyGrid.ocx
2015-02-16 15:29 - 2011-09-22 11:05 - 00208500 _____ () C:\Windows\SysWOW64\ReyXpBasics.tlb
2015-02-16 15:29 - 2011-09-22 11:05 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCMCFR.DLL
2015-02-16 15:29 - 2011-09-22 11:05 - 00119568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VB6FR.DLL
2015-02-16 15:29 - 2011-09-22 11:05 - 00101888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VB6STKIT.DLL
2015-02-16 15:29 - 2011-09-22 11:05 - 00084512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PICCLP32.OCX
2015-02-16 15:29 - 2011-09-22 11:05 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CMDLGFR.DLL
2015-02-16 15:29 - 2011-09-22 11:05 - 00024576 _____ () C:\Windows\SysWOW64\ControlSubX.ocx
2015-02-16 15:29 - 2011-09-22 11:05 - 00009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PCCLPFR.DLL
2015-02-15 18:15 - 2015-02-15 18:15 - 00000000 ____D () C:\ProgramData\rokapublish
2015-02-15 18:03 - 2015-02-15 18:03 - 00000000 ____D () C:\ProgramData\Solidshield
2015-02-15 15:01 - 2015-02-27 12:44 - 00046592 ___SH () C:\Users\Sherlock Holmes\Documents\Thumbs.db
2015-02-15 14:59 - 2015-02-15 14:59 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\Bewerbung_Aktuell_2014
2015-02-13 20:23 - 2015-02-13 20:23 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\ERS G-Studio
2015-02-10 18:42 - 2015-02-10 18:42 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\IsolatedStorage
2015-02-10 18:42 - 2015-02-10 18:42 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\DigitalVolcano
2015-02-10 18:42 - 2015-02-10 18:42 - 00000000 ____D () C:\ProgramData\IsolatedStorage
2015-02-10 12:49 - 2015-02-10 12:49 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\HP Photosmart Projects
2015-02-10 12:48 - 2015-02-10 12:48 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
2015-02-10 12:48 - 2015-02-10 12:48 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
2015-02-07 09:39 - 2015-02-27 10:53 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Local\FreePDF_XP
2015-02-07 09:34 - 2015-02-07 09:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FreePDF
2015-02-07 09:34 - 2015-02-07 09:34 - 00000000 ____D () C:\ProgramData\FreePDF
2015-02-07 09:34 - 2015-02-07 09:34 - 00000000 ____D () C:\Program Files (x86)\FreePDF_XP
2015-02-07 09:34 - 2012-06-21 07:25 - 00113152 _____ () C:\Windows\system32\redmon64.dll
2015-02-07 09:34 - 2012-06-21 07:25 - 00044032 _____ () C:\Windows\system32\unredmon64.exe
2015-02-07 09:34 - 2012-06-21 07:25 - 00028435 _____ () C:\Windows\system32\redmon.chm
2015-02-07 09:32 - 2015-02-07 09:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ghostscript
2015-02-07 09:31 - 2015-02-07 09:31 - 00000000 ____D () C:\Program Files\gs
2015-02-07 09:25 - 2015-02-07 09:25 - 00000135 _____ () C:\Windows\SysWOW64\debug.log
2015-02-06 20:54 - 2015-02-06 20:54 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-02-06 12:11 - 2015-02-06 12:11 - 00000000 ____H () C:\Users\Sherlock Holmes\Documents\Default.rdp
2015-02-05 19:32 - 2015-02-05 19:32 - 00003050 _____ () C:\Windows\System32\Tasks\{C368D411-8AEF-457F-BDFC-4346540C31BB}
2015-02-05 19:31 - 2015-02-05 19:31 - 00003250 _____ () C:\Windows\System32\Tasks\{69079650-C5EF-4F24-B366-0BCE7920D9A3}
2015-02-05 18:47 - 2015-02-05 18:47 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-02-05 18:47 - 2015-02-05 18:47 - 00002019 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2015-02-03 22:18 - 2015-02-03 22:18 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Local\Adobe_Systems_Incorporate
2015-02-03 22:17 - 2015-02-03 22:24 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\My Digital Editions
2015-02-03 22:17 - 2015-02-03 22:17 - 00003090 _____ () C:\Windows\System32\Tasks\{55D0A493-F2BE-41C4-947D-119C9D648949}
2015-02-03 22:17 - 2015-02-03 22:17 - 00002190 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Digital Editions 3.0.lnk
2015-02-03 22:17 - 2015-02-03 22:17 - 00002178 _____ () C:\Users\Public\Desktop\Adobe Digital Editions 3.0.lnk
2015-02-03 22:17 - 2015-02-03 22:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe
2015-01-30 11:02 - 2015-01-30 11:02 - 00001357 _____ () C:\Users\Sherlock Holmes\Desktop\HP Solution Center.lnk
2015-01-28 10:35 - 2015-01-28 10:35 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-27 23:38 - 2014-08-08 16:26 - 00000501 _____ () C:\Windows\system32\checkdnsid.xml
2015-02-27 21:19 - 2014-05-14 09:13 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-27 20:51 - 2014-05-11 20:43 - 01456232 _____ () C:\Windows\WindowsUpdate.log
2015-02-27 13:06 - 2011-04-12 08:43 - 00699416 _____ () C:\Windows\system32\perfh007.dat
2015-02-27 13:06 - 2011-04-12 08:43 - 00149556 _____ () C:\Windows\system32\perfc007.dat
2015-02-27 13:06 - 2009-07-14 06:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-27 12:51 - 2015-01-01 17:41 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\Text
2015-02-27 11:11 - 2014-11-05 10:52 - 00001085 _____ () C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk
2015-02-27 11:11 - 2014-11-05 10:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro
2015-02-27 10:58 - 2009-07-14 05:45 - 00031984 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-27 10:58 - 2009-07-14 05:45 - 00031984 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-27 10:53 - 2015-01-14 13:16 - 00002434 _____ () C:\Windows\PFRO.log
2015-02-27 10:53 - 2015-01-11 01:00 - 00009003 _____ () C:\Windows\setupact.log
2015-02-27 10:53 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-27 10:05 - 2014-05-14 06:32 - 00003998 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{CAEDF7C5-6BE4-40C6-A7D7-838E0CB1CD24}
2015-02-27 10:04 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-02-26 22:38 - 2014-05-12 21:23 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\vlc
2015-02-26 22:28 - 2014-08-14 17:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue
2015-02-26 22:27 - 2014-10-30 17:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
2015-02-26 20:48 - 2015-01-05 15:45 - 00002830 _____ () C:\Windows\Sandboxie.ini
2015-02-24 15:26 - 2014-05-11 19:57 - 00000000 ____D () C:\Users\Sherlock Holmes
2015-02-20 15:25 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2015-02-19 14:47 - 2015-01-01 15:28 - 00011776 _____ () C:\Users\Sherlock Holmes\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-02-19 06:51 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-02-18 15:02 - 2014-05-13 13:34 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-18 15:02 - 2014-05-13 13:34 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-18 11:57 - 2014-08-13 23:00 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\DC++
2015-02-18 11:57 - 2014-08-13 23:00 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Local\DC++
2015-02-17 16:08 - 2014-11-06 13:49 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\ProtectDISC
2015-02-17 15:41 - 2009-07-14 05:45 - 05033688 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-17 15:37 - 2014-12-12 03:23 - 00000000 ____D () C:\Windows\system32\appraiser
2015-02-17 15:37 - 2014-05-12 00:18 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-02-17 15:37 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-02-17 15:19 - 2014-05-11 20:13 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-17 15:18 - 2014-05-15 20:08 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-17 15:18 - 2009-07-14 03:34 - 00000513 _____ () C:\Windows\win.ini
2015-02-17 15:14 - 2014-05-11 22:23 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-17 15:10 - 2014-05-11 22:23 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-17 14:53 - 2014-08-12 17:22 - 00000000 ____D () C:\Windows\System32\Tasks\Aufgaben der Ereignisanzeige
2015-02-16 16:22 - 2014-07-22 09:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
2015-02-16 15:52 - 2014-05-11 20:27 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-02-10 16:39 - 2014-05-13 16:12 - 00000000 ____D () C:\ProgramData\Oracle
2015-02-10 15:55 - 2014-05-13 16:11 - 00000000 ____D () C:\Program Files (x86)\Java
2015-02-10 15:53 - 2014-05-13 16:11 - 00272296 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2015-02-10 15:53 - 2014-05-13 16:11 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2015-02-10 15:53 - 2014-05-13 16:11 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2015-02-10 15:53 - 2014-05-13 16:11 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-02-10 12:49 - 2014-05-11 20:31 - 00000000 ____D () C:\ProgramData\Adobe
2015-02-10 12:48 - 2014-05-11 20:31 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-02-10 12:46 - 2014-07-14 16:39 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Local\Adobe
2015-02-08 14:14 - 2014-09-01 14:44 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\DAEMON Tools Lite
2015-02-08 09:43 - 2014-05-11 19:57 - 00000000 ___RD () C:\Users\Sherlock Holmes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-02-07 16:50 - 2014-05-15 15:03 - 00000486 __RSH () C:\Users\Sherlock Holmes\ntuser.pol
2015-02-07 11:14 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Public\Libraries
2015-02-07 09:25 - 2014-05-11 20:32 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\Adobe
2015-02-06 20:52 - 2014-05-12 19:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-02-06 10:22 - 2015-01-11 19:57 - 00000731 _____ () C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk
2015-02-06 10:22 - 2015-01-11 19:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre 64bit - E-book Management
2015-01-30 12:03 - 2015-01-26 15:05 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\Eigene Scans
2015-01-28 20:30 - 2015-01-02 13:06 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\dvdcss

==================== Files in the root of some directories =======

2015-01-01 15:28 - 2015-02-19 14:47 - 0011776 _____ () C:\Users\Sherlock Holmes\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-05-15 15:16 - 2014-08-12 17:26 - 0007598 _____ () C:\Users\Sherlock Holmes\AppData\Local\Resmon.ResmonCfg
2014-05-12 19:11 - 2014-05-12 19:11 - 0564843 _____ () C:\ProgramData\1399917703.bdinstall.bin
2014-10-09 14:16 - 2014-10-09 14:33 - 0001255 _____ () C:\ProgramData\hpzinstall.log

Some content of TEMP:
====================
C:\Users\Sherlock Holmes\AppData\Local\Temp\A~NSISu_.exe
C:\Users\Sherlock Holmes\AppData\Local\Temp\jre-8u31-windows-au.exe
C:\Users\Sherlock Holmes\AppData\Local\Temp\proxy_vole8122898952741371965.dll
C:\Users\Sherlock Holmes\AppData\Local\Temp\VSUSetup.exe
C:\Users\Sherlock Holmes\AppData\Local\Temp\_isCDDA.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-23 00:09

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

schrauber 28.02.2015 10:50
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
HKLM-x32\...\Run: [] => [X]
BootExecute: autocheck autochk * OODBS
Hosts:
Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.


Sunny-Melone 28.02.2015 12:23
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 25-02-2015 01
Ran by Sherlock Holmes at 2015-02-28 12:14:04 Run:4
Running from E:\Sunny
Loaded Profiles: Sherlock Holmes (Available profiles: Sherlock Holmes)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
HKLM-x32\...\Run: [] => [X]
BootExecute: autocheck autochk * OODBS
Hosts:
Emptytemp:
*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.
HKLM\System\CurrentControlSet\Control\Session Manager\\BootExecute => Value was restored successfully.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 2.8 GB temporary data.


The system needed a reboot.

==== End of Fixlog 12:14:32 ====

schrauber 28.02.2015 15:51
Ok. Sicherstellen dass keine CD drin ist.

Rechner mehrfach komplett neu starten, normal arbeiten damit, runter fahren, wieder neu starten.

BEsteht das Problem noch?

Sunny-Melone 28.02.2015 16:05
hab ihn ca 6-7 mal neu gestartet alles ok:applaus:

schrauber 28.02.2015 20:17

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Sunny-Melone 01.03.2015 11:02
Eset

Code:
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=e2eb2cc4d3aa354f88a4a7d8e66ed19c
# engine=22695
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-03-01 06:29:04
# local_time=2015-03-01 07:29:04 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Bitdefender Antivirus'
# compatibility_mode=2061 16777213 100 100 24285 129036653 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 45495 176821194 0 0
# scanned=705329
# found=16
# cleaned=0
# scan_time=24071
sh=FCF577CE410A72FFC34D688E419673B9E6C1EA54 ft=1 fh=5e7dc4dd398e10f6 vn="Variante von Win32/AdWare.SpeedingUpMyPC.S Anwendung" ac=I fn="C:\Sandbox\Sherlock_Holmes\DefaultBox\drive\C\Program Files (x86)\PC Speed Maximizer\PCSpeedMaximizer.exe"
sh=56DC854A2890C2A8971C247277486452BD80186E ft=1 fh=656b74722de352bc vn="Variante von Win32/InstallCore.UN evtl. unerwünschte Anwendung" ac=I fn="C:\Sandbox\Sherlock_Holmes\DefaultBox\drive\E\flvplayer_setup.exe.vir"
sh=647D6D9522143CA0C70258505A25D29E20845AA1 ft=1 fh=76556c3ab1a47a2a vn="Variante von Win32/WinWrapper.A evtl. unerwünschte Anwendung" ac=I fn="C:\Sandbox\Sherlock_Holmes\DefaultBox\user\current\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H56VT381\CnetInstaller[1]"
sh=B3C944A69A09DA39AE36A9FF22B5E52C26E7594A ft=1 fh=02a9130a164d7f8e vn="Variante von Win32/AdWare.SpeedingUpMyPC.S Anwendung" ac=I fn="C:\Sandbox\Sherlock_Holmes\DefaultBox\user\current\AppData\Local\Temp\is361488532\5BD75CE6_stp\pcspeedmaximizer_aqde_ppi_afd_pcsm_4tr_no_avg_bis.exe.vir"
sh=01600E6FC50EBF986CBD1AFF5041DAA171B4E28C ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="E:\$RECYCLE.BIN\S-1-5-21-971888290-4151258157-3832144516-1000\$R8MLS3X.rar"
sh=70697F12C12EED3069EFF837C89F5B982DAE7D71 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="E:\$RECYCLE.BIN\S-1-5-21-971888290-4151258157-3832144516-1000\$RDBUGQU.rar"
sh=D718984FC38898BE54FAB484429C26C3DA960238 ft=0 fh=0000000000000000 vn="Win32/RiskWare.HackAV.MQ Anwendung" ac=I fn="E:\$RECYCLE.BIN\S-1-5-21-971888290-4151258157-3832144516-1000\$RLKSMYM.rar"
sh=C8A0D0E1A073C58E3495570323F36020D15BDCE9 ft=1 fh=23cf1d267d235db1 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="H:\## DVD und Divx Proggis ##\DIVX\format-factory-2-30\format-factory-2-30.exe"
sh=EAB622CFF6A82A438196DCFEECF5445B85DF2B57 ft=1 fh=4948853c4ff8d215 vn="Variante von Win32/YourFileDownloader evtl. unerwünschte Anwendung" ac=I fn="H:\## Ebay_Biet-tools ##\Bidnapper.rar_downloader_224.exe"
sh=D63BBC7D4DABD41B6E0B09D6078AA27C2F25C9D6 ft=1 fh=bda41039d04fb9db vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="H:\## Packer und Konverter ##\7 Zip 32 Bit - CHIP-Downloader.exe"
sh=33F59F128068B14A670038A1CC20204B56AF584E ft=1 fh=f6ba6757ccba4ca4 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="H:\## Security ##\Sandboxie - CHIP-Installer.exe"
sh=F1EFF6451CED129C0E5C0A510955F234A01158A0 ft=1 fh=332b4278a72373e2 vn="Variante von Win32/Toolbar.Babylon.E evtl. unerwünschte Anwendung" ac=I fn="H:\## Security ##\Unlocker1.9.2.exe"
sh=D41B207370FE1E1CE0D4F1806269DE8E1DC9E343 ft=1 fh=5d350510cdd225b9 vn="Variante von Win32/SoftonicDownloader.F evtl. unerwünschte Anwendung" ac=I fn="H:\## Security ##\Sicherheitscheck_trojaboard\Malwarebytes_Pro\Alte Version\SoftonicDownloader_fuer_malwarebytes-anti-malware-pro.exe"
sh=D080CBE5F5D85D7B2039318B9674C7C712098805 ft=1 fh=49f5ed0be047437e vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="H:\## Security ##\Säuberungsprogramme\Adobe CS6 Cleaner Tool\Adobe CS6 Cleaner Tool - CHIP-Installer.exe"
sh=DEB9F64ABBF9425B70217747FEED6D2CF8BD9B6D ft=1 fh=a8b5d0d60197659c vn="Variante von MSIL/DownloadGuide.A evtl. unerwünschte Anwendung" ac=I fn="H:\## Treiber ##\Free Driver Scout\DLG_free-driver-scout_chip_de-DE.exe"
sh=56DC854A2890C2A8971C247277486452BD80186E ft=1 fh=656b74722de352bc vn="Variante von Win32/InstallCore.UN evtl. unerwünschte Anwendung" ac=I fn="I:\$RECYCLE.BIN\S-1-5-21-971888290-4151258157-3832144516-1000\$RN9OR23.exe"
SecurityCheck:

Code:
Results of screen317's Security Check version 0.99.96 
 Windows 7 Service Pack 1 x64 (UAC is enabled) 
 Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````
Bitdefender Virenschutz 
 Antivirus up to date! 
`````````Anti-malware/Other Utilities Check:`````````
 TuneUp Utilities 2014 (de-DE) 
 Java 8 Update 31 
 Java version 32-bit out of Date!
  Java 64-bit 8 Update 31 
 Adobe Flash Player 16.0.0.305 
 Adobe Reader XI 
 Mozilla Firefox (35.0.1)
 Mozilla Thunderbird (31.4.0)
````````Process Check: objlist.exe by Laurent```````` 
 Bitdefender Bitdefender 2013 vsserv.exe 
 Bitdefender Bitdefender 2013 bdagent.exe 
 Bitdefender Bitdefender 2013 updatesrv.exe 
 Bitdefender Bitdefender SafeBox safeboxservice.exe 
 Bitdefender Bitdefender 2013 seccenter.exe 
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-02-2015
Ran by Sherlock Holmes (administrator) on SHERLOCK_HOLMES on 01-03-2015 10:52:30
Running from E:\Sunny
Loaded Profiles: Sherlock Holmes (Available profiles: Sherlock Holmes)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2013\vsserv.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(Sandboxie Holdings, LLC) D:\Program Files\Sandboxie\SbieSvc.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2013\bdagent.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\AMDUSB3DeviceDetector\nusb3mon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2013\updatesrv.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender Safebox\safeboxservice.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2013\seccenter.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Bdagent] => C:\Program Files\Bitdefender\Bitdefender 2013\bdagent.exe [1575192 2013-09-27] (Bitdefender)
HKLM\...\Run: [NUSB3MON] => C:\Program Files (x86)\ATI Technologies\AMDUSB3DeviceDetector\nusb3mon.exe [97280 2012-04-11] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13774040 2000-01-01] (Realtek Semiconductor)
HKLM\...\Policies\Explorer: [NoViewContextMenu] 0
HKU\S-1-5-21-971888290-4151258157-3832144516-1000\...\Run: [SandboxieControl] => d:\Program Files\Sandboxie\SbieCtrl.exe [784904 2014-10-14] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-971888290-4151258157-3832144516-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-971888290-4151258157-3832144516-1000\...\MountPoints2: {0b426a0a-d944-11e3-8567-806e6f6e6963} - Z:\run.exe
HKU\S-1-5-21-971888290-4151258157-3832144516-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Bubbles.scr [899584 2010-11-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} =>  No File
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} =>  No File
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} =>  No File
ShellIconOverlayIdentifiers: [__SafeBox1] -> {152C96EB-288E-4EDC-B7C6-D21F8250ADF3} => C:\Program Files\Bitdefender\Bitdefender SafeBox\SafeBoxShell.dll (Bitdefender)
ShellIconOverlayIdentifiers: [__SafeBox2] -> {342DAA0B-D796-460D-8566-901E08A1CCAD} => C:\Program Files\Bitdefender\Bitdefender SafeBox\SafeBoxShell.dll (Bitdefender)
ShellIconOverlayIdentifiers: [__SafeBox3] -> {57595DAE-1AE1-4D97-A49E-67CBB53B52DF} => C:\Program Files\Bitdefender\Bitdefender SafeBox\SafeBoxShell.dll (Bitdefender)
ShellIconOverlayIdentifiers: [__SafeBox4] -> {33816773-98AE-4723-ADE0-EBE54C8B5A67} => C:\Program Files\Bitdefender\Bitdefender SafeBox\SafeBoxShell.dll (Bitdefender)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-971888290-4151258157-3832144516-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKU\S-1-5-21-971888290-4151258157-3832144516-1000 -> DefaultScope {1343F391-98D5-4366-A160-D08CB4527ABF} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-971888290-4151258157-3832144516-1000 -> {1343F391-98D5-4366-A160-D08CB4527ABF} URL = https://www.google.com/search?q={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_20\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_20\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default
FF NetworkProxy: "ftp", "111.13.13.138"
FF NetworkProxy: "ftp_port", 80
FF NetworkProxy: "gopher", "111.13.13.138"
FF NetworkProxy: "gopher_port", 80
FF NetworkProxy: "http", "111.13.13.138"
FF NetworkProxy: "http_port", 80
FF NetworkProxy: "socks", "111.13.13.138"
FF NetworkProxy: "socks_port", 80
FF NetworkProxy: "socks_version", 4
FF NetworkProxy: "ssl", "111.13.13.138"
FF NetworkProxy: "ssl_port", 80
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @java.com/DTPlugin,version=11.20.2 -> C:\Program Files\Java\jre1.8.0_20\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.20.2 -> C:\Program Files\Java\jre1.8.0_20\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> d:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll No File
FF Plugin: adobe.com/AdobeAAMDetect_x86_64 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll No File
FF user.js: detected! => C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\user.js
FF Plugin ProgramFiles/Appdata: C:\Users\Sherlock Holmes\AppData\Roaming\mozilla\plugins\npDXStudioPlugin.DLL (Worldweaver Ltd.)
FF Extension: dp Launcher Plugin - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\dplauncher@digitalpublishing.de [2014-11-04]
FF Extension: FavIconReloader - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\FavIconReloader@mozilla.org [2014-05-13]
FF Extension: WOT - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-05-12]
FF Extension: Proxy-Listen.de - Proxyswitcher - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\admin@proxy-listen.de.xpi [2014-07-15]
FF Extension: AutoCopy 2 - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\autocopy2@teo.pl.xpi [2015-02-20]
FF Extension: Best Proxy Switcher - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\bestproxyswitcher@bestproxyswitcher.com.xpi [2014-07-15]
FF Extension: Classic Theme Restorer - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\ClassicThemeRestorer@ArisT2Noia4dev.xpi [2014-05-14]
FF Extension: Bookmarks Checker - check for bad links - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\firefoxbookmarkchecker@everhelper.me.xpi [2014-05-13]
FF Extension: X-Forwarded-For Header - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\jid1-vasLCl9ZsexfAQ@jetpack.xpi [2014-07-17]
FF Extension: Noia Fox options - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\NoiaFoxoption@davidvincent.tld.xpi [2014-05-14]
FF Extension: Personas Plus - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\personas@christopher.beard.xpi [2014-05-14]
FF Extension: Restartless Restart - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\restartless.restart@erikvold.com.xpi [2014-05-14]
FF Extension: Toggle Persona - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\togglepersona@davidvincent.tld.xpi [2014-05-14]
FF Extension: All-in-One Sidebar - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\{097d3191-e6fa-4728-9826-b533d755359d}.xpi [2014-05-12]
FF Extension: RSS Ticker - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\{1f91cde0-c040-11da-a94d-0800200c9a66}.xpi [2014-05-13]
FF Extension: NoScript - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-05-12]
FF Extension: Noia Fox - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\{7b90e860-5d61-11e0-80e3-0800200c9a66}.xpi [2014-05-13]
FF Extension: Adblock Plus - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-12]
FF Extension: Tab Mix Plus - C:\Users\Sherlock Holmes\AppData\Roaming\Mozilla\Firefox\Profiles\mpbnzzil.default\Extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi [2014-05-13]
FF HKLM\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender 2013\bdtbext
FF Extension: bdToolbar - C:\Program Files\Bitdefender\Bitdefender 2013\bdtbext [2014-05-12]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-10-09]
FF HKLM-x32\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender 2013\bdtbext
FF HKU\S-1-5-21-971888290-4151258157-3832144516-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-09-15] (Advanced Micro Devices, Inc.) [File not signed]
S4 BdDesktopParental; C:\Program Files\Bitdefender\Bitdefender 2013\bdparentalservice.exe [69392 2013-08-07] (Bitdefender)
R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2010-10-22] (Hewlett-Packard Co.) [File not signed]
S2 MBAMScheduler; d:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
S2 MBAMService; d:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
S4 O&O Defrag; C:\Windows\system32\oodag.exe [1418248 2007-05-11] (O&O Software GmbH)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [292568 2000-01-01] (Realtek Semiconductor)
R2 SafeBox; C:\Program Files\Bitdefender\Bitdefender SafeBox\safeboxservice.exe [95184 2012-06-25] (Bitdefender)
R2 SbieSvc; d:\Program Files\Sandboxie\SbieSvc.exe [174600 2014-10-14] (Sandboxie Holdings, LLC)
R2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender 2013\updatesrv.exe [67320 2013-08-07] (Bitdefender)
R2 VSSERV; C:\Program Files\Bitdefender\Bitdefender 2013\vsserv.exe [1645256 2013-09-30] (Bitdefender)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S4 AHDDC2; C:\Program Files (x86)\Ashampoo\Ashampoo HDD Control 2\AHDDC2_Service.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 amdide64; C:\Windows\System32\DRIVERS\amdide64.sys [11944 2000-01-01] (Advanced Micro Devices Inc.)
S0 amdkmafd; C:\Windows\System32\DRIVERS\amdkmafd.sys [21160 2014-11-04] (Advanced Micro Devices, Inc.)
R2 AODDriver4.3; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
S3 AsrDrv101; C:\Windows\SysWOW64\Drivers\AsrDrv101.sys [22280 2014-08-16] (ASRock Incorporation)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2014-09-14] ()
R0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [727592 2013-07-19] (BitDefender)
R3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [261056 2012-11-02] (BitDefender)
S3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [601360 2013-07-19] (BitDefender)
R1 BdfNdisf; c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [93600 2013-02-22] (BitDefender LLC)
R1 bdfwfpf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [103504 2011-11-14] (BitDefender LLC)
S3 BDSandBox; C:\Windows\system32\drivers\bdsandbox.sys [82824 2013-07-23] (BitDefender SRL)
R1 BDVEDISK; C:\Windows\System32\DRIVERS\bdvedisk.sys [76944 2012-04-17] (BitDefender)
R3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-09-01] (Disc Soft Ltd)
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [17480 2013-03-07] () [File not signed]
S3 epmntdrv; C:\Windows\SysWOW64\epmntdrv.sys [14920 2013-03-07] () [File not signed]
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9800 2013-03-07] () [File not signed]
S3 EuGdiDrv; C:\Windows\SysWOW64\EuGdiDrv.sys [9160 2013-03-07] () [File not signed]
R3 FLxHCIh; C:\Windows\System32\DRIVERS\FLxHCIh.sys [77480 2014-08-16] (Fresco Logic)
R0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [150256 2013-08-23] (BitDefender LLC)
R1 ISODrive; D:\UltraISO\drivers\ISODrv64.sys [115448 2013-11-21] (EZB Systems, Inc.)
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [129224 2013-07-18] (Qualcomm Atheros Co., Ltd.)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2014-09-14] ()
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
R0 pwdrvio; C:\Windows\System32\pwdrvio.sys [19152 2013-09-30] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [12504 2013-09-30] ()
U5 RTSPER; C:\Windows\System32\Drivers\RTSPER.sys [788696 2000-01-01] (Realsil Semiconductor Corporation)
R3 RTSUER; C:\Windows\System32\Drivers\RtsUer.sys [377560 2000-01-01] (Realsil Semiconductor Corporation)
R3 SbieDrv; d:\Program Files\Sandboxie\SbieDrv.sys [185352 2014-10-14] (Sandboxie Holdings, LLC)
R0 trufos; C:\Windows\System32\DRIVERS\trufos.sys [389240 2013-08-07] (BitDefender S.R.L.)
U5 UnlockerDriver5; d:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
S3 RSUSBSTOR; System32\Drivers\RtsUStor.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-01 10:46 - 2015-03-01 10:46 - 00852594 _____ () C:\Users\Sherlock Holmes\Desktop\SecurityCheck.exe
2015-03-01 00:44 - 2015-03-01 00:44 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-02-28 18:53 - 2015-02-28 18:53 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\Mariaglorum
2015-02-28 15:56 - 2000-01-01 01:00 - 09890008 _____ (Realtek Semiconductor Corp.) C:\Windows\SysWOW64\RsCRIcon.dll
2015-02-28 15:56 - 2000-01-01 01:00 - 00788696 _____ (Realsil Semiconductor Corporation) C:\Windows\system32\Drivers\RtsPer.sys
2015-02-28 15:56 - 2000-01-01 01:00 - 00377560 _____ (Realsil Semiconductor Corporation) C:\Windows\system32\Drivers\RtsUer.sys
2015-02-28 15:56 - 2000-01-01 01:00 - 00359128 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RtsPStor.sys
2015-02-28 15:56 - 2000-01-01 01:00 - 00313048 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RtsBaStor.sys
2015-02-28 15:56 - 2000-01-01 01:00 - 00294104 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RtsP2Stor.sys
2015-02-28 15:35 - 2000-01-01 01:00 - 00060640 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\usbfilter.sys
2015-02-28 15:32 - 2000-01-01 01:00 - 00227648 _____ (Advanced Micro Devices, INC.) C:\Windows\system32\Drivers\amdxhc.sys
2015-02-28 15:32 - 2000-01-01 01:00 - 00106816 _____ (Advanced Micro Devices, INC.) C:\Windows\system32\Drivers\amdhub30.sys
2015-02-28 15:32 - 2000-01-01 01:00 - 00083176 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amd_sata.sys
2015-02-28 15:32 - 2000-01-01 01:00 - 00043240 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amd_xata.sys
2015-02-28 15:32 - 2000-01-01 01:00 - 00011944 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\Drivers\amdide64.sys
2015-02-28 15:08 - 2015-02-28 15:08 - 00000000 ____D () C:\Windows\SysWOW64\RTCOM
2015-02-28 15:07 - 2000-01-01 01:00 - 04263128 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHD64.sys
2015-02-28 15:07 - 2000-01-01 01:00 - 03186544 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApi64.dll
2015-02-28 15:07 - 2000-01-01 01:00 - 02860760 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtPgEx64.dll
2015-02-28 15:07 - 2000-01-01 01:00 - 02827120 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RltkAPO64.dll
2015-02-28 15:07 - 2000-01-01 01:00 - 02770976 _____ (Fortemedia Corporation) C:\Windows\system32\FMAPO64.dll
2015-02-28 15:07 - 2000-01-01 01:00 - 01959128 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSnMg64.cpl
2015-02-28 15:07 - 2000-01-01 01:00 - 01550528 _____ (Conexant Systems Inc.) C:\Windows\system32\CX64APO.dll
2015-02-28 15:07 - 2000-01-01 01:00 - 01443340 _____ () C:\Windows\system32\Drivers\RTAIODAT.DAT
2015-02-28 15:07 - 2000-01-01 01:00 - 01361336 _____ (TOSHIBA Corporation) C:\Windows\system32\tosade.dll
2015-02-28 15:07 - 2000-01-01 01:00 - 01287384 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTCOM64.dll
2015-02-28 15:07 - 2000-01-01 01:00 - 00959704 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoInstII64.dll
2015-02-28 15:07 - 2000-01-01 01:00 - 00856992 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo264.dll
2015-02-28 15:07 - 2000-01-01 01:00 - 00629464 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtDataProc64.dll
2015-02-28 15:07 - 2000-01-01 01:00 - 00560328 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAC64.dll
2015-02-28 15:07 - 2000-01-01 01:00 - 00375128 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP64A.dll
2015-02-28 15:07 - 2000-01-01 01:00 - 00331880 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtlCPAPI64.dll
2015-02-28 15:07 - 2000-01-01 01:00 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DHT64.dll
2015-02-28 15:07 - 2000-01-01 01:00 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DAA64.dll
2015-02-28 15:07 - 2000-01-01 01:00 - 00204120 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED64A.dll
2015-02-28 15:07 - 2000-01-01 01:00 - 00149608 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCfg64.dll
2015-02-28 15:07 - 2000-01-01 01:00 - 00148416 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo.dll
2015-02-28 15:07 - 2000-01-01 01:00 - 00113576 _____ (Real Sound Lab SIA) C:\Windows\system32\CONEQMSAPOGUILibrary.dll
2015-02-28 15:07 - 2000-01-01 01:00 - 00108640 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAR64.dll
2015-02-28 15:07 - 2000-01-01 01:00 - 00101208 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL64A.dll
2015-02-28 15:07 - 2000-01-01 01:00 - 00078680 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG64A.dll
2015-02-28 15:07 - 2000-01-01 01:00 - 00065944 _____ (TOSHIBA CORPORATION.) C:\Windows\system32\tepeqapo64.dll
2015-02-28 15:07 - 2000-01-01 01:00 - 00014952 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCoLDR64.dll
2015-02-28 12:25 - 2015-02-28 12:25 - 00000893 _____ () C:\Users\Sherlock Holmes\Desktop\CrystalDiskInfo.lnk
2015-02-28 12:25 - 2015-02-28 12:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CrystalDiskInfo
2015-02-28 12:21 - 2015-01-09 00:44 - 00419936 _____ () C:\Windows\SysWOW64\locale.nls
2015-02-28 12:21 - 2015-01-09 00:43 - 00419936 _____ () C:\Windows\system32\locale.nls
2015-02-27 14:22 - 2015-02-27 13:49 - 02347384 _____ (ESET) C:\Users\Sherlock Holmes\Desktop\esetsmartinstaller_deu.exe
2015-02-27 14:21 - 2015-02-27 14:21 - 00000000 ____D () C:\ProgramData\SlimWare Utilities, Inc
2015-02-27 14:00 - 2015-03-01 00:49 - 00000430 _____ () C:\Windows\Tasks\SlimDrivers Startup.job
2015-02-27 14:00 - 2015-02-28 16:02 - 00002876 _____ () C:\Windows\System32\Tasks\SlimDrivers Startup
2015-02-27 14:00 - 2015-02-27 14:00 - 00002467 _____ () C:\Users\Public\Desktop\SlimDrivers.lnk
2015-02-27 14:00 - 2015-02-27 14:00 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Local\SlimWare Utilities Inc
2015-02-27 14:00 - 2015-02-27 14:00 - 00000000 ____D () C:\Users\Public\Documents\Downloaded Installers
2015-02-24 16:45 - 2015-03-01 10:52 - 00000000 ____D () C:\FRST
2015-02-24 15:26 - 2015-03-01 00:49 - 00000000 ____D () C:\Users\Sherlock Holmes\.VirtualBox
2015-02-24 15:25 - 2015-02-24 15:25 - 00001084 _____ () C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk
2015-02-24 15:25 - 2015-02-24 15:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox
2015-02-24 15:25 - 2013-04-12 11:41 - 00237840 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys
2015-02-24 15:25 - 2013-04-12 11:40 - 00120080 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys
2015-02-24 15:24 - 2015-02-24 15:24 - 00000000 ____D () C:\Program Files\Oracle
2015-02-24 15:22 - 2015-02-24 15:37 - 00000000 ____D () C:\VirtualBox
2015-02-24 15:21 - 2015-02-28 18:48 - 00000000 ____D () C:\Austausch
2015-02-20 19:03 - 2015-02-20 19:03 - 00000861 _____ () C:\Users\Public\Desktop\EaseUS Data Recovery Wizard 8.6.lnk
2015-02-20 19:03 - 2015-02-20 19:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EaseUS Data Recovery Wizard 8.6
2015-02-20 14:54 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-02-20 14:54 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-02-20 14:54 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2015-02-20 14:54 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll
2015-02-20 14:28 - 2015-02-20 14:28 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Temp
2015-02-20 14:14 - 2015-02-27 10:53 - 00005213 _____ () C:\Windows\system32\oodbs.lor
2015-02-19 18:13 - 2015-02-19 18:13 - 00000000 ____D () C:\Users\Sherlock Holmes\Calibre Library
2015-02-19 11:04 - 2015-02-19 11:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ant Renamer
2015-02-18 20:52 - 2015-02-18 20:52 - 00000000 _____ () C:\Windows\oodcnt.INI
2015-02-18 16:35 - 2015-02-26 21:08 - 00000000 ____D () C:\Windows\system32\oodag
2015-02-18 16:23 - 2015-02-18 16:23 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\O&O
2015-02-18 16:22 - 2015-02-18 16:22 - 00002068 _____ () C:\Users\Public\Desktop\O&O Defrag.lnk
2015-02-18 16:22 - 2015-02-18 16:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\O&O Software
2015-02-18 16:22 - 2015-02-18 16:22 - 00000000 ____D () C:\Program Files\OO Software
2015-02-18 15:05 - 2015-01-23 05:42 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-02-18 15:05 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-18 15:05 - 2015-01-23 04:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-02-18 15:05 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-18 14:57 - 2015-02-18 14:58 - 00002481 ____H () C:\Windows\EPMBatch.ept
2015-02-18 11:29 - 2015-02-18 11:29 - 00000991 _____ () C:\Users\Public\Desktop\EaseUS Partition Master 10.1.lnk
2015-02-18 11:29 - 2015-02-18 11:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EaseUS Partition Master 10.1
2015-02-18 11:28 - 2014-04-04 00:42 - 03382440 _____ () C:\Windows\system32\BootMan.exe
2015-02-18 11:28 - 2014-04-04 00:25 - 02499752 _____ () C:\Windows\SysWOW64\BootMan.exe
2015-02-18 11:28 - 2013-03-07 09:49 - 00100936 _____ () C:\Windows\system32\setupempdrvx64.exe
2015-02-18 11:28 - 2013-03-07 09:49 - 00087112 _____ () C:\Windows\SysWOW64\setupempdrv03.exe
2015-02-18 11:28 - 2013-03-07 09:49 - 00019840 _____ () C:\Windows\SysWOW64\EuEpmGdi.dll
2015-02-18 11:28 - 2013-03-07 09:49 - 00017480 _____ () C:\Windows\system32\epmntdrv.sys
2015-02-18 11:28 - 2013-03-07 09:49 - 00016256 _____ () C:\Windows\system32\EuEpmGdi.dll
2015-02-18 11:28 - 2013-03-07 09:49 - 00014920 _____ () C:\Windows\SysWOW64\epmntdrv.sys
2015-02-18 11:28 - 2013-03-07 09:49 - 00009800 _____ () C:\Windows\system32\EuGdiDrv.sys
2015-02-18 11:28 - 2013-03-07 09:49 - 00009160 _____ () C:\Windows\SysWOW64\EuGdiDrv.sys
2015-02-17 21:29 - 2015-02-27 12:31 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\MEMENTO
2015-02-17 16:18 - 2015-02-17 16:18 - 00000725 _____ () C:\Users\Sherlock Holmes\Desktop\Memento Mori.lnk
2015-02-17 16:18 - 2015-02-17 16:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Memento Mori
2015-02-17 16:08 - 2015-02-17 16:08 - 00335288 _____ (Protect Software GmbH) C:\Windows\system32\Drivers\acedrv11.sys
2015-02-17 16:05 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll
2015-02-17 16:05 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll
2015-02-17 16:05 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_1.dll
2015-02-17 16:05 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2015-02-17 16:05 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_2.dll
2015-02-17 16:05 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2015-02-17 16:05 - 2008-07-12 08:18 - 04992520 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll
2015-02-17 16:05 - 2008-07-12 08:18 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2015-02-17 16:05 - 2008-07-12 08:18 - 01942552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll
2015-02-17 16:05 - 2008-07-12 08:18 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2015-02-17 16:05 - 2008-07-12 08:18 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll
2015-02-17 16:05 - 2008-07-12 08:18 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2015-02-17 16:03 - 2015-02-17 16:04 - 00017627 _____ () C:\Windows\DirectX.log
2015-02-17 15:36 - 2015-02-17 15:36 - 00002921 _____ () C:\Windows\PWCMDLST.BAK
2015-02-17 15:06 - 2015-01-14 06:47 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-17 15:06 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-17 15:06 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-17 15:06 - 2015-01-12 04:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-17 15:06 - 2015-01-12 04:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-02-17 15:06 - 2015-01-12 03:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-02-17 15:06 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-17 15:06 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-17 15:06 - 2015-01-12 03:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-02-17 15:06 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-17 15:06 - 2015-01-12 03:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-17 15:06 - 2015-01-12 03:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-02-17 15:06 - 2015-01-12 03:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-17 15:06 - 2015-01-12 03:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-17 15:06 - 2015-01-12 03:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-02-17 15:06 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-17 15:06 - 2015-01-12 03:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-02-17 15:06 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-02-17 15:06 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-17 15:06 - 2015-01-12 03:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-02-17 15:06 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-17 15:06 - 2015-01-12 03:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-02-17 15:06 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-17 15:06 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-02-17 15:06 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-02-17 15:06 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-02-17 15:06 - 2015-01-12 03:04 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-17 15:06 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-17 15:06 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-02-17 15:06 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-02-17 15:06 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-02-17 15:06 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-02-17 15:06 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-17 15:06 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-17 15:06 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-17 15:06 - 2015-01-12 02:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-02-17 15:06 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-17 15:06 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-17 15:06 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-02-17 15:06 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-02-17 15:06 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-02-17 15:06 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-02-17 15:06 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-17 15:06 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-17 15:06 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-17 15:06 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-02-17 15:06 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-17 15:06 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-17 15:06 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-17 15:06 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-17 15:06 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-17 15:06 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-17 15:05 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-02-17 15:05 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-02-17 15:05 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-02-17 15:05 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-02-17 15:05 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-02-17 15:05 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-02-17 15:05 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-02-17 15:05 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-02-17 15:05 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-02-17 15:05 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-02-17 15:04 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-17 15:04 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-17 15:04 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-17 15:04 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-02-17 15:04 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-02-17 15:04 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-02-17 15:04 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-02-17 15:04 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-02-17 15:04 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-17 15:04 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-02-17 15:04 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-17 15:04 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-02-17 15:04 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-02-17 15:04 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-02-17 15:04 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-02-17 15:04 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-02-17 15:04 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-02-17 15:04 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-17 15:04 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-17 15:04 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-02-17 15:04 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-02-17 15:04 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-02-17 15:04 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-02-17 15:04 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-02-17 15:04 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-02-17 15:04 - 2015-01-10 07:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-02-17 15:04 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-02-17 15:03 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-17 15:03 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-17 15:03 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-17 15:03 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-17 15:03 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-17 15:03 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-17 14:58 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-16 17:01 - 2015-01-14 11:28 - 03066880 _____ () C:\Windows\system32\pwNative.exe
2015-02-16 17:01 - 2013-09-30 16:26 - 00019152 ____N () C:\Windows\system32\pwdrvio.sys
2015-02-16 17:01 - 2013-09-30 16:26 - 00012504 ____N () C:\Windows\system32\pwdspio.sys
2015-02-16 17:00 - 2015-02-16 17:00 - 00000846 _____ () C:\Users\Public\Desktop\MiniTool Partition Wizard Free.lnk
2015-02-16 17:00 - 2015-02-16 17:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MiniTool Partition Wizard Free 9.0
2015-02-16 15:31 - 2015-02-16 15:31 - 00000958 _____ () C:\Users\Sherlock Holmes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Free FLV Converter.lnk
2015-02-16 15:29 - 2011-09-22 11:05 - 00364544 _____ () C:\Windows\SysWOW64\PropertyGrid.ocx
2015-02-16 15:29 - 2011-09-22 11:05 - 00208500 _____ () C:\Windows\SysWOW64\ReyXpBasics.tlb
2015-02-16 15:29 - 2011-09-22 11:05 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCMCFR.DLL
2015-02-16 15:29 - 2011-09-22 11:05 - 00119568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VB6FR.DLL
2015-02-16 15:29 - 2011-09-22 11:05 - 00101888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VB6STKIT.DLL
2015-02-16 15:29 - 2011-09-22 11:05 - 00084512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PICCLP32.OCX
2015-02-16 15:29 - 2011-09-22 11:05 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CMDLGFR.DLL
2015-02-16 15:29 - 2011-09-22 11:05 - 00024576 _____ () C:\Windows\SysWOW64\ControlSubX.ocx
2015-02-16 15:29 - 2011-09-22 11:05 - 00009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PCCLPFR.DLL
2015-02-15 18:15 - 2015-02-15 18:15 - 00000000 ____D () C:\ProgramData\rokapublish
2015-02-15 18:03 - 2015-02-15 18:03 - 00000000 ____D () C:\ProgramData\Solidshield
2015-02-15 15:01 - 2015-02-27 12:44 - 00046592 ___SH () C:\Users\Sherlock Holmes\Documents\Thumbs.db
2015-02-15 14:59 - 2015-02-15 14:59 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\Bewerbung_Aktuell_2014
2015-02-13 20:23 - 2015-02-13 20:23 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\ERS G-Studio
2015-02-10 18:42 - 2015-02-10 18:42 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\IsolatedStorage
2015-02-10 18:42 - 2015-02-10 18:42 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\DigitalVolcano
2015-02-10 18:42 - 2015-02-10 18:42 - 00000000 ____D () C:\ProgramData\IsolatedStorage
2015-02-10 12:49 - 2015-02-10 12:49 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\HP Photosmart Projects
2015-02-10 12:48 - 2015-02-10 12:48 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
2015-02-10 12:48 - 2015-02-10 12:48 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
2015-02-07 09:39 - 2015-02-27 10:53 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Local\FreePDF_XP
2015-02-07 09:34 - 2015-02-07 09:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FreePDF
2015-02-07 09:34 - 2015-02-07 09:34 - 00000000 ____D () C:\ProgramData\FreePDF
2015-02-07 09:34 - 2015-02-07 09:34 - 00000000 ____D () C:\Program Files (x86)\FreePDF_XP
2015-02-07 09:34 - 2012-06-21 07:25 - 00113152 _____ () C:\Windows\system32\redmon64.dll
2015-02-07 09:34 - 2012-06-21 07:25 - 00044032 _____ () C:\Windows\system32\unredmon64.exe
2015-02-07 09:34 - 2012-06-21 07:25 - 00028435 _____ () C:\Windows\system32\redmon.chm
2015-02-07 09:32 - 2015-02-07 09:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ghostscript
2015-02-07 09:31 - 2015-02-07 09:31 - 00000000 ____D () C:\Program Files\gs
2015-02-07 09:25 - 2015-02-07 09:25 - 00000135 _____ () C:\Windows\SysWOW64\debug.log
2015-02-06 20:54 - 2015-02-06 20:54 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-02-06 12:11 - 2015-02-06 12:11 - 00000000 ____H () C:\Users\Sherlock Holmes\Documents\Default.rdp
2015-02-05 19:32 - 2015-02-05 19:32 - 00003050 _____ () C:\Windows\System32\Tasks\{C368D411-8AEF-457F-BDFC-4346540C31BB}
2015-02-05 19:31 - 2015-02-05 19:31 - 00003250 _____ () C:\Windows\System32\Tasks\{69079650-C5EF-4F24-B366-0BCE7920D9A3}
2015-02-05 18:47 - 2015-02-05 18:47 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-02-05 18:47 - 2015-02-05 18:47 - 00002019 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2015-02-03 22:18 - 2015-02-03 22:18 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Local\Adobe_Systems_Incorporate
2015-02-03 22:17 - 2015-02-03 22:24 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\My Digital Editions
2015-02-03 22:17 - 2015-02-03 22:17 - 00003090 _____ () C:\Windows\System32\Tasks\{55D0A493-F2BE-41C4-947D-119C9D648949}
2015-02-03 22:17 - 2015-02-03 22:17 - 00002190 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Digital Editions 3.0.lnk
2015-02-03 22:17 - 2015-02-03 22:17 - 00002178 _____ () C:\Users\Public\Desktop\Adobe Digital Editions 3.0.lnk
2015-02-03 22:17 - 2015-02-03 22:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe
2015-01-30 11:02 - 2015-01-30 11:02 - 00001357 _____ () C:\Users\Sherlock Holmes\Desktop\HP Solution Center.lnk

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-01 10:26 - 2014-08-08 16:26 - 00000501 _____ () C:\Windows\system32\checkdnsid.xml
2015-03-01 10:13 - 2014-05-11 20:43 - 01621572 _____ () C:\Windows\WindowsUpdate.log
2015-02-28 23:20 - 2014-05-14 09:13 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-28 16:15 - 2011-04-12 08:43 - 00699416 _____ () C:\Windows\system32\perfh007.dat
2015-02-28 16:15 - 2011-04-12 08:43 - 00149556 _____ () C:\Windows\system32\perfc007.dat
2015-02-28 16:15 - 2009-07-14 06:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-28 16:07 - 2009-07-14 05:45 - 00031984 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-28 16:07 - 2009-07-14 05:45 - 00031984 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-28 16:01 - 2015-01-11 01:00 - 00011563 _____ () C:\Windows\setupact.log
2015-02-28 16:01 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-28 15:56 - 2014-05-11 20:27 - 00000000 ____D () C:\Program Files (x86)\Realtek
2015-02-28 15:55 - 2014-11-04 17:06 - 00000000 ____D () C:\Windows\SysWOW64\sda
2015-02-28 15:32 - 2014-05-11 20:13 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-28 15:16 - 2014-05-11 20:27 - 00000000 ___HD () C:\Program Files (x86)\Temp
2015-02-28 15:06 - 2014-05-11 20:27 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-02-28 15:00 - 2015-01-14 13:16 - 00015700 _____ () C:\Windows\PFRO.log
2015-02-28 10:46 - 2014-05-14 06:32 - 00003998 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{CAEDF7C5-6BE4-40C6-A7D7-838E0CB1CD24}
2015-02-27 12:51 - 2015-01-01 17:41 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\Text
2015-02-27 11:11 - 2014-11-05 10:52 - 00001085 _____ () C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk
2015-02-27 11:11 - 2014-11-05 10:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro
2015-02-27 10:04 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-02-26 22:38 - 2014-05-12 21:23 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\vlc
2015-02-26 22:28 - 2014-08-14 17:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue
2015-02-26 22:27 - 2014-10-30 17:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
2015-02-26 20:48 - 2015-01-05 15:45 - 00002830 _____ () C:\Windows\Sandboxie.ini
2015-02-24 15:26 - 2014-05-11 19:57 - 00000000 ____D () C:\Users\Sherlock Holmes
2015-02-20 15:25 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2015-02-19 14:47 - 2015-01-01 15:28 - 00011776 _____ () C:\Users\Sherlock Holmes\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-02-19 06:51 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-02-18 15:02 - 2014-05-13 13:34 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-18 15:02 - 2014-05-13 13:34 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-18 11:57 - 2014-08-13 23:00 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\DC++
2015-02-18 11:57 - 2014-08-13 23:00 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Local\DC++
2015-02-17 16:08 - 2014-11-06 13:49 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\ProtectDISC
2015-02-17 15:41 - 2009-07-14 05:45 - 05033688 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-17 15:37 - 2014-12-12 03:23 - 00000000 ____D () C:\Windows\system32\appraiser
2015-02-17 15:37 - 2014-05-12 00:18 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-02-17 15:37 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-02-17 15:18 - 2014-05-15 20:08 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-17 15:18 - 2009-07-14 03:34 - 00000513 _____ () C:\Windows\win.ini
2015-02-17 15:14 - 2014-05-11 22:23 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-17 15:10 - 2014-05-11 22:23 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-17 14:53 - 2014-08-12 17:22 - 00000000 ____D () C:\Windows\System32\Tasks\Aufgaben der Ereignisanzeige
2015-02-16 16:22 - 2014-07-22 09:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
2015-02-10 16:39 - 2014-05-13 16:12 - 00000000 ____D () C:\ProgramData\Oracle
2015-02-10 15:55 - 2014-05-13 16:11 - 00000000 ____D () C:\Program Files (x86)\Java
2015-02-10 15:53 - 2014-05-13 16:11 - 00272296 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2015-02-10 15:53 - 2014-05-13 16:11 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2015-02-10 15:53 - 2014-05-13 16:11 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2015-02-10 15:53 - 2014-05-13 16:11 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-02-10 12:49 - 2014-05-11 20:31 - 00000000 ____D () C:\ProgramData\Adobe
2015-02-10 12:48 - 2014-05-11 20:31 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-02-10 12:46 - 2014-07-14 16:39 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Local\Adobe
2015-02-08 14:14 - 2014-09-01 14:44 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\DAEMON Tools Lite
2015-02-08 09:43 - 2014-05-11 19:57 - 00000000 ___RD () C:\Users\Sherlock Holmes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-02-07 16:50 - 2014-05-15 15:03 - 00000486 __RSH () C:\Users\Sherlock Holmes\ntuser.pol
2015-02-07 11:14 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Public\Libraries
2015-02-07 09:25 - 2014-05-11 20:32 - 00000000 ____D () C:\Users\Sherlock Holmes\AppData\Roaming\Adobe
2015-02-06 20:52 - 2014-05-12 19:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-02-06 10:22 - 2015-01-11 19:57 - 00000731 _____ () C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk
2015-02-06 10:22 - 2015-01-11 19:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre 64bit - E-book Management
2015-01-30 12:03 - 2015-01-26 15:05 - 00000000 ____D () C:\Users\Sherlock Holmes\Documents\Eigene Scans

==================== Files in the root of some directories =======

2015-01-01 15:28 - 2015-02-19 14:47 - 0011776 _____ () C:\Users\Sherlock Holmes\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-05-15 15:16 - 2014-08-12 17:26 - 0007598 _____ () C:\Users\Sherlock Holmes\AppData\Local\Resmon.ResmonCfg
2014-05-12 19:11 - 2014-05-12 19:11 - 0564843 _____ () C:\ProgramData\1399917703.bdinstall.bin
2014-10-09 14:16 - 2014-10-09 14:33 - 0001255 _____ () C:\ProgramData\hpzinstall.log

Some content of TEMP:
====================
C:\Users\Sherlock Holmes\AppData\Local\Temp\proxy_vole746263734687455927.dll
C:\Users\Sherlock Holmes\AppData\Local\Temp\Uninstall.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-23 00:09

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

keine weiteren probleme im moment würde nur noch gerne den pc säubern,was war nun eigentlich der auslöser für diese komische zeichenkette ?

schrauber 01.03.2015 16:15
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
C:\Sandbox\Sherlock_Holmes\DefaultBox\drive\C\Program Files (x86)\PC Speed Maximizer\PCSpeedMaximizer.exe

C:\Sandbox\Sherlock_Holmes\DefaultBox\drive\E\flvplayer_setup.exe.vir

C:\Sandbox\Sherlock_Holmes\DefaultBox\user\current\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H56VT381\CnetInstaller[1]

C:\Sandbox\Sherlock_Holmes\DefaultBox\user\current\AppData\Local\Temp\is361488532\5BD75CE6_stp\pcspeedmaximizer_aqde_ppi_afd_pcsm_4tr_no_avg_bis.exe.vir

E:\$RECYCLE.BIN\S-1-5-21-971888290-4151258157-3832144516-1000\$R8MLS3X.rar

E:\$RECYCLE.BIN\S-1-5-21-971888290-4151258157-3832144516-1000\$RDBUGQU.rar

E:\$RECYCLE.BIN\S-1-5-21-971888290-4151258157-3832144516-1000\$RLKSMYM.rar

H:\## DVD und Divx Proggis ##\DIVX\format-factory-2-30\format-factory-2-30.exe

H:\## Ebay_Biet-tools ##\Bidnapper.rar_downloader_224.exe

H:\## Packer und Konverter ##\7 Zip 32 Bit - CHIP-Downloader.exe

H:\## Security ##\Sandboxie - CHIP-Installer.exe

H:\## Security ##\Unlocker1.9.2.exe

H:\## Security ##\Sicherheitscheck_trojaboard\Malwarebytes_Pro\Alte Version\SoftonicDownloader_fuer_malwarebytes-anti-malware-pro.exe

H:\## Security ##\Säuberungsprogramme\Adobe CS6 Cleaner Tool\Adobe CS6 Cleaner Tool - CHIP-Installer.exe

H:\## Treiber ##\Free Driver Scout\DLG_free-driver-scout_chip_de-DE.exe

I:\$RECYCLE.BIN\S-1-5-21-971888290-4151258157-3832144516-1000\$RN9OR23.exe
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
FF NetworkProxy: "ftp", "111.13.13.138"
FF NetworkProxy: "ftp_port", 80
FF NetworkProxy: "gopher", "111.13.13.138"
FF NetworkProxy: "gopher_port", 80
FF NetworkProxy: "http", "111.13.13.138"
FF NetworkProxy: "http_port", 80
FF NetworkProxy: "socks", "111.13.13.138"
FF NetworkProxy: "socks_port", 80
FF NetworkProxy: "socks_version", 4
FF NetworkProxy: "ssl", "111.13.13.138"
FF NetworkProxy: "ssl_port", 80
FF NetworkProxy: "type", 0
Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.






Woher das kam ist nicht nachvollziehbar.


Noch eine Kontrolle:
Lade dir bitte Emsisoft MBR Master herunter und speichere es auf den Desktop.
  • Führe die mbrmastr.exe aus.
  • Drücke auf Backup MBR und speichere es als emsi auf den Desktop.
  • Schliesse dann das Programm wieder.
  • Packe die erstellte emsi.mbr in ein zip-Archiv (Rechtsklick -> Senden an -> Zip-komprimierten Ordner) und hänge die Datei hier an.
  • Auf dem Desktop wird ebenfalls eine Textdatei MBRMastr_<date>_<time>.txt erstellt. Poste deren Inhalt bitte hier.

Sunny-Melone 01.03.2015 19:18
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 29-02-2015
Ran by Sherlock Holmes at 2015-03-01 19:11:53 Run:5
Running from E:\Sunny
Loaded Profiles: Sherlock Holmes (Available profiles: Sherlock Holmes)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\Sandbox\Sherlock_Holmes\DefaultBox\drive\C\Program Files (x86)\PC Speed Maximizer\PCSpeedMaximizer.exe

C:\Sandbox\Sherlock_Holmes\DefaultBox\drive\E\flvplayer_setup.exe.vir

C:\Sandbox\Sherlock_Holmes\DefaultBox\user\current\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H56VT381\CnetInstaller[1]

C:\Sandbox\Sherlock_Holmes\DefaultBox\user\current\AppData\Local\Temp\is361488532\5BD75CE6_stp\pcspeedmaximizer_aqde_ppi_afd_pcsm_4tr_no_avg_bis.exe.vir

E:\$RECYCLE.BIN\S-1-5-21-971888290-4151258157-3832144516-1000\$R8MLS3X.rar

E:\$RECYCLE.BIN\S-1-5-21-971888290-4151258157-3832144516-1000\$RDBUGQU.rar

E:\$RECYCLE.BIN\S-1-5-21-971888290-4151258157-3832144516-1000\$RLKSMYM.rar

H:\## DVD und Divx Proggis ##\DIVX\format-factory-2-30\format-factory-2-30.exe

H:\## Ebay_Biet-tools ##\Bidnapper.rar_downloader_224.exe

H:\## Packer und Konverter ##\7 Zip 32 Bit - CHIP-Downloader.exe

H:\## Security ##\Sandboxie - CHIP-Installer.exe

H:\## Security ##\Unlocker1.9.2.exe

H:\## Security ##\Sicherheitscheck_trojaboard\Malwarebytes_Pro\Alte Version\SoftonicDownloader_fuer_malwarebytes-anti-malware-pro.exe

H:\## Security ##\Säuberungsprogramme\Adobe CS6 Cleaner Tool\Adobe CS6 Cleaner Tool - CHIP-Installer.exe

H:\## Treiber ##\Free Driver Scout\DLG_free-driver-scout_chip_de-DE.exe

I:\$RECYCLE.BIN\S-1-5-21-971888290-4151258157-3832144516-1000\$RN9OR23.exe
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
FF NetworkProxy: "ftp", "111.13.13.138"
FF NetworkProxy: "ftp_port", 80
FF NetworkProxy: "gopher", "111.13.13.138"
FF NetworkProxy: "gopher_port", 80
FF NetworkProxy: "http", "111.13.13.138"
FF NetworkProxy: "http_port", 80
FF NetworkProxy: "socks", "111.13.13.138"
FF NetworkProxy: "socks_port", 80
FF NetworkProxy: "socks_version", 4
FF NetworkProxy: "ssl", "111.13.13.138"
FF NetworkProxy: "ssl_port", 80
FF NetworkProxy: "type", 0
Emptytemp:
       


*****************

C:\Sandbox\Sherlock_Holmes\DefaultBox\drive\C\Program Files (x86)\PC Speed Maximizer\PCSpeedMaximizer.exe => Moved successfully.
C:\Sandbox\Sherlock_Holmes\DefaultBox\drive\E\flvplayer_setup.exe.vir => Moved successfully.
C:\Sandbox\Sherlock_Holmes\DefaultBox\user\current\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H56VT381\CnetInstaller[1] => Moved successfully.
C:\Sandbox\Sherlock_Holmes\DefaultBox\user\current\AppData\Local\Temp\is361488532\5BD75CE6_stp\pcspeedmaximizer_aqde_ppi_afd_pcsm_4tr_no_avg_bis.exe.vir => Moved successfully.
E:\$RECYCLE.BIN\S-1-5-21-971888290-4151258157-3832144516-1000\$R8MLS3X.rar => Moved successfully.
E:\$RECYCLE.BIN\S-1-5-21-971888290-4151258157-3832144516-1000\$RDBUGQU.rar => Moved successfully.
E:\$RECYCLE.BIN\S-1-5-21-971888290-4151258157-3832144516-1000\$RLKSMYM.rar => Moved successfully.
H:\## DVD und Divx Proggis ##\DIVX\format-factory-2-30\format-factory-2-30.exe => Moved successfully.
H:\## Ebay_Biet-tools ##\Bidnapper.rar_downloader_224.exe => Moved successfully.
H:\## Packer und Konverter ##\7 Zip 32 Bit - CHIP-Downloader.exe => Moved successfully.
H:\## Security ##\Sandboxie - CHIP-Installer.exe => Moved successfully.
H:\## Security ##\Unlocker1.9.2.exe => Moved successfully.
H:\## Security ##\Sicherheitscheck_trojaboard\Malwarebytes_Pro\Alte Version\SoftonicDownloader_fuer_malwarebytes-anti-malware-pro.exe => Moved successfully.
H:\## Security ##\Säuberungsprogramme\Adobe CS6 Cleaner Tool\Adobe CS6 Cleaner Tool - CHIP-Installer.exe => Moved successfully.
H:\## Treiber ##\Free Driver Scout\DLG_free-driver-scout_chip_de-DE.exe => Moved successfully.
I:\$RECYCLE.BIN\S-1-5-21-971888290-4151258157-3832144516-1000\$RN9OR23.exe => Moved successfully.
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
Firefox Proxy settings were reset.
Firefox Proxy settings were reset.
Firefox Proxy settings were reset.
Firefox Proxy settings were reset.
Firefox Proxy settings were reset.
Firefox Proxy settings were reset.
Firefox Proxy settings were reset.
Firefox Proxy settings were reset.
Firefox Proxy settings were reset.
Firefox Proxy settings were reset.
Firefox Proxy settings were reset.
Firefox Proxy settings were reset.
EmptyTemp: => Removed 699.2 MB temporary data.


The system needed a reboot.

==== End of Fixlog 19:12:21 ====

Sunny-Melone 01.03.2015 19:23
Code:
Detected Windows version: 6.1 Build 7601 Service Pack 1
Installing direct disk access driver ...
Driver connection handle: 0x00000114
3 valid drive(s) found.

Details for Disk 0 - WDC WD20 EARX-00PASB0 Rev 51.0:
  Device name              : \\.\PhysicalDrive0
  Geometry (C/H/S)        : 243201/255/63
  Boot loader reputation  : Known Good (Windows 7)
  Cross view comparison    : Passed
  Partition table integrity: Passed

  Boot loader hashes
    SHA-1                  : 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79
    MD5                    : A36C5E4F47E84449FF07ED3517B43A31


Details for Disk 1 - SAMSUNG HD753LJ Rev 1AA0:
  Device name              : \\.\PhysicalDrive1
  Geometry (C/H/S)        : 91201/255/63
  Boot loader reputation  : Known Good (Windows XP)
  Cross view comparison    : Passed
  Partition table integrity: Passed

  Boot loader hashes
    SHA-1                  : DA38B874B7713D1B51CBC449F4EF809B0DEC644A
    MD5                    : 8F558EB6672622401DA993E1E865C861


Details for Disk 2 - SAMSUNG HD502IJ Rev 1AA0:
  Device name              : \\.\PhysicalDrive2
  Geometry (C/H/S)        : 60801/255/63
  Boot loader reputation  : Known Good (Windows XP)
  Cross view comparison    : Passed
  Partition table integrity: Passed

  Boot loader hashes
    SHA-1                  : DA38B874B7713D1B51CBC449F4EF809B0DEC644A
    MD5                    : 8F558EB6672622401DA993E1E865C861

Sunny-Melone 01.03.2015 19:26
ich glaub ich habe den auslöser gefunden,ich habe noch 2 externe festplatten. als ich diese ebend wieder angeschlossen hatte hab ich wieder diese zeichenkette bekommen.
das problem scheint wohl auf einen der externen zu liegen.als ich den rechner das 2 mal startete ohne externa war alles ok

schrauber 02.03.2015 08:30
Stell das BIOS um sodass zuerst nicht von USB gebootet wird. Und scanne beide Platten mit Malwarebytes.

Sunny-Melone 02.03.2015 18:30
das mit dem bios war eine gute idee und hat auch geklappt rechner fährt normal hoch.
Leider hab ich mit Malewarebytes nichts gefunden...

schrauber 03.03.2015 07:18
Da muss auch nicht zwingend Malware drauf sein auf den Platte. Wenn der versucht von denen zu booten passiert sowas einfach mal :)

Sunny-Melone 03.03.2015 10:17
ok,somit wären wir eigentlich durch,soll ich noch andere reinigungs tools durchlaufen lassen?

schrauber 03.03.2015 16:27
fertig :)

http://deeprybka.trojaner-board.de/b...cleanupneu.png
Cleanup:
(Die Reihenfolge ist hier entscheidend)

Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken.

Falls Combofix verwendet wurde:
http://deeprybka.trojaner-board.de/b.../combofix2.pngCombofix deinstallieren
  • Wichtig: Bitte Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.
  • Drücke bitte die http://deeprybka.trojaner-board.de/b...ne/revo/w7.png + R Taste und schreibe Combofix /Uninstall in das Ausführen-Fenster.
  • Klicke auf OK.
    Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert.
  • Nun die eben deaktivierten Programme wieder aktivieren.

Alle Logs gepostet? Dann lade Dir bitte http://filepony.de/icon/tiny/delfix.pngDelFix herunter.
  • Schließe alle offenen Programme.
  • Starte die delfix.exe mit einem Doppelklick.
  • Setze vor jede Funktion ein Häkchen.
  • Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...:dankeschoen:und/oder das Forum mit einer kleinen Spende http://www.trojaner-board.de/extra/spende.png unterstützen. :applaus:

http://deeprybka.trojaner-board.de/b...ast/schild.png
Absicherung:
Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:

Browser
Java
 Flash-Player
PDF-Reader

Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.
Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.

Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.

Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank.
Meine Empfehlung:
http://filepony.de/icon/emsisoft_anti_malware.png
Emsisoft

Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen.

Optional:
http://filepony.de/icon/noscript.png NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.
http://filepony.de/icon/malwarebytes_anti_exploit.pngMalwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.


Lade Software von einem sauberen Portal wie http://filepony.de/images/microbanner.gif.
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner .


Abschließend noch ein paar grundsätzliche Bemerkungen:
Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.

Sunny-Melone 05.03.2015 14:05
Hab vielen dank für alles
lg sunny

schrauber 05.03.2015 19:03
Gern Geschehen :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 05:50 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131