| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: svchost belastet CPU, Malware-Funde was nun?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
01.09.2015, 10:33
| #1 |
 |  svchost belastet CPU, Malware-Funde was nun? Hallo, ich habe folgendes Problem: Seit Tagen/Wochen läuft mein Laptop immer langsamer, was daran lag, dass 2 svchost.exe Anwendungen meinen CPU fast durchgehend mit 90% in Beschlag nahmen. Heute war es mir zu viel und ich habe im Internet nach Lösungen gesucht. Darauf bin ich auf die Software Malwarebytes Anti-Malware gestoßen, um nach möglichen Schädlingen zu suchen. Ein Suchdurchlauf hat mit gerade 145 Funde angezeigt....  Wie soll ich da jetzt weiter mit vorgehen? Auswahl löschen? Aber ist damit alles behoben? Danke schon mal im Voraus! Anbei die Diagnose: Malwarebytes Anti-Malware www.malwarebytes.org Suchlaufdatum: 01.09.2015 Suchlaufzeit: 10:42:29 Protokolldatei: Administrator: Ja Version: 2.1.8.1057 Malware-Datenbank: v2015.09.01.01 Rootkit-Datenbank: v2015.08.16.01 Lizenz: Testversion Malware-Schutz: Aktiviert Schutz vor bösartigen Websites: Aktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows Vista Service Pack 2 CPU: x86 Dateisystem: NTFS Benutzer: Jan Suchlauftyp: Bedrohungssuchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 332905 Abgelaufene Zeit: 42 Min., 2 Sek. Speicher: Aktiviert Start: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (keine bösartigen Elemente erkannt) Module: 0 (keine bösartigen Elemente erkannt) Registrierungsschlüssel: 16 PUP.Optional.Delta.ShrtCln, HKLM\SOFTWARE\CLASSES\APPID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}, , [07ae85a55e2d989e604b29a772905fa1], PUP.Optional.Babylon, HKU\S-1-5-21-5983412-2541121911-1157762278-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}, , [13a234f65a3180b68a17359f738f31cf], PUP.Optional.Iminent, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{68B81CCD-A80C-4060-8947-5AE69ED01199}, , [6d48da508efdf04689a314c3a55d1be5], PUP.Optional.Iminent, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{E6B969FB-6D33-48d2-9061-8BBD4899EB08}, , [1f968b9fa9e2db5bb180bf1870927b85], PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\CLASSES\CLSID\{3c471948-f874-49f5-b338-4f214a2ee0b1}, , [cde8121893f8e74f3e1194f019eba858], PUP.Optional.DataMangr, HKLM\SOFTWARE\DataMngr, , [dfd6e446fc8f61d579df93f64aba55ab], PUP.Optional.Iminent, HKLM\SOFTWARE\Iminent, , [c8ed63c7f79493a312483165f410a858], PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\CLASSES\Toolbar.CT2851647, , [5a5b9e8c1f6ce650295d650a956fb848], PUP.Optional.Babylon, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\dhkplhfnhceodhffomolpfigojocbpcb, , [cde8eb3f7d0e7cbac53b74080afa669a], PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\LEOCDEIGFNKAOJCAPIKDJCDBEDCJMFFC, , [0aab9a901a7138feb888d9480300da26], PUP.Optional.DataMngr, HKU\S-1-5-21-5983412-2541121911-1157762278-1000\SOFTWARE\DataMngr, , [7b3ae644d3b8df57204137524db7a45c], PUP.Optional.DataMngr, HKU\S-1-5-21-5983412-2541121911-1157762278-1000\SOFTWARE\DataMngr_Toolbar, , [85305cce2863ab8b3e24a8e150b4738d], PUP.Optional.Iminent, HKU\S-1-5-21-5983412-2541121911-1157762278-1000\SOFTWARE\Iminent, , [cce9d258ff8c082e9eadfe98c4406b95], PUP.Optional.Babylon, HKU\S-1-5-21-5983412-2541121911-1157762278-1000\SOFTWARE\BABSOLUTION\Updater, , [e1d47fab315a082e24d70e6d5ca8d42c], PUP.Optional.Conduit, HKU\S-1-5-21-5983412-2541121911-1157762278-1000\SOFTWARE\CONDUIT\FF, , [9c19c06a4e3d63d39f921c6863a1857b], PUP.Optional.ConduitTB.Gen, HKU\S-1-5-21-5983412-2541121911-1157762278-1000\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\LEOCDEIGFNKAOJCAPIKDJCDBEDCJMFFC, , [10a577b3b8d3082ef9487ba6986b39c7], Registrierungswerte: 4 PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\leocdeigfnkaojcapikdjcdbedcjmffc|path, C:\Users\Jan\AppData\Local\CRE\leocdeigfnkaojcapikdjcdbedcjmffc.crx, , [0aab9a901a7138feb888d9480300da26] PUP.Optional.ConduitTB.Gen, HKU\S-1-5-21-5983412-2541121911-1157762278-1000\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\leocdeigfnkaojcapikdjcdbedcjmffc|path, C:\Users\Jan\AppData\Local\CRE\leocdeigfnkaojcapikdjcdbedcjmffc.crx, , [10a577b3b8d3082ef9487ba6986b39c7] PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-5983412-2541121911-1157762278-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}|URL, hxxp://www2.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=240E0016EA56B080&affID=121565&tsp=4996, , [c3f27caeb1dac96db066660634d0837d] PUP.Optional.Babylon, HKU\S-1-5-21-5983412-2541121911-1157762278-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}|FaviconURL, search.babylon.com/favicon.ico, , [f9bcab7f4645ce6805f880fb0bf952ae] Registrierungsdaten: 1 PUP.Optional.StartPage, HKU\S-1-5-21-5983412-2541121911-1157762278-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www2.delta-search.com/?babsrc=HP_ss&mntrId=240E0016EA56B080&affID=121565&tsp=4996, Gut: (www.google.com), Schlecht: (hxxp://www2.delta-search.com/?babsrc=HP_ss&mntrId=240E0016EA56B080&affID=121565&tsp=4996),,[6a4b86a4008bb482224d5507a164fc04] Ordner: 30 PUP.Optional.ConduitTB.Gen, C:\Users\Jan\AppData\Local\CRE, , [a510e9416d1e112543fca9787f84f50b], PUP.Optional.ConduitTB.Gen, C:\Program Files\Conduit\Community Alerts, , [cde8121893f8e74f3e1194f019eba858], PUP.Optional.ConduitTB.Gen, C:\Program Files\Conduit, , [cde8121893f8e74f3e1194f019eba858], PUP.Optional.OpenCandy, C:\Users\Jan\AppData\Roaming\OpenCandy, , [09ac9f8b404bc2745509ffed798920e0], PUP.Optional.OpenCandy, C:\Users\Jan\AppData\Roaming\OpenCandy\0A0151A452DC4C27B2F79CE83762DC57, , [09ac9f8b404bc2745509ffed798920e0], PUP.Optional.OpenCandy, C:\Users\Jan\AppData\Roaming\OpenCandy\E02147E6E4104AE49D9A6F00218A3855, , [09ac9f8b404bc2745509ffed798920e0], PUP.Optional.ConduitTB.Gen, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\conduit, , [a51051d9602be5516e17777daf5349b7], PUP.Optional.ConduitTB.Gen, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\conduit\cachedIcons, , [a51051d9602be5516e17777daf5349b7], PUP.Optional.Babylon, C:\Users\Jan\AppData\LocalLow\BabylonToolbar, , [c5f046e46823a6900b845d9a778b8c74], PUP.Optional.Babylon, C:\Users\Jan\AppData\LocalLow\BabylonToolbar\BabylonToolbar, , [c5f046e46823a6900b845d9a778b8c74], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\chrome, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\components, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\defaults, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\DualPackage, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\lib, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\META-INF, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\searchplugin, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\BG, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\CZ, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\DE, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\EN, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\ES, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\FR, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\HE, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\RU, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\SK, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\TR, , [7342210982093006117c030859aafa06], Dateien: 94 PUP.Optional.Babylon, C:\Users\Jan\AppData\Roaming\OpenCandy\0A0151A452DC4C27B2F79CE83762DC57\DeltaTB.exe, , [0ea770ba008bf343ce587d5216ebd62a], PUP.Optional.OpenCandy, C:\Users\Jan\Downloads\veetle-0.9.19.exe, , [c5f0df4b840788aee9b26b198f76da26], PUP.Optional.ConduitTB.Gen, C:\Users\Jan\AppData\Local\CRE\leocdeigfnkaojcapikdjcdbedcjmffc.crx, , [a510e9416d1e112543fca9787f84f50b], PUP.Optional.BProtector, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\bProtector_extensions.rdf, , [496c1812f19a04326be6fd8158ac7e82], PUP.Optional.ConduitTB.Gen, C:\Program Files\Conduit\Community Alerts\Alert.dll, , [cde8121893f8e74f3e1194f019eba858], PUP.Optional.DVDVideoSoft, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi, , [9f1689a1cebd90a6c785f993a65e0df3], PUP.Optional.ICQPlugin, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\searchplugins\icqplugin-1.xml, , [7c3944e64f3cb581abd8fe975ca8926e], PUP.Optional.ICQPlugin, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\searchplugins\icqplugin-2.xml, , [f0c5171308830432a4df167f8e76ea16], PUP.Optional.ICQPlugin, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\searchplugins\icqplugin-3.xml, , [14a12ffb711ab482a1e2306555afb64a], PUP.Optional.ICQPlugin, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\searchplugins\icqplugin-4.xml, , [ae07200a602b74c2e59ed1c44cb8e41c], PUP.Optional.ICQPlugin, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\searchplugins\icqplugin-5.xml, , [5a5b69c112790333681b2c692fd5f907], PUP.Optional.ICQPlugin, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\searchplugins\icqplugin-6.xml, , [694c16145338ab8b681b7421de265aa6], PUP.Optional.ICQPlugin, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\searchplugins\icqplugin-7.xml, , [8f26032768239f9710735d3813f16997], PUP.Optional.ICQPlugin, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\searchplugins\icqplugin.xml, , [3085220856350630eb984a4bc44018e8], PUP.Optional.OpenCandy, C:\Users\Jan\AppData\Roaming\OpenCandy\E02147E6E4104AE49D9A6F00218A3855\driverscannerDE.exe, , [09ac9f8b404bc2745509ffed798920e0], PUP.Optional.ConduitTB.Gen, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\conduit\alertDB.sqlite, , [a51051d9602be5516e17777daf5349b7], PUP.Optional.ConduitTB.Gen, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\conduit\cachedIcons\http___storage_conduit_com_BankImages_RadioSkins_StarFleet_ equalizer_dead.gif, , [a51051d9602be5516e17777daf5349b7], PUP.Optional.ConduitTB.Gen, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\conduit\cachedIcons\http___storage_conduit_com_BankImages_RadioSkins_StarFleet_ maxi.gif, , [a51051d9602be5516e17777daf5349b7], PUP.Optional.ConduitTB.Gen, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\conduit\cachedIcons\http___storage_conduit_com_BankImages_RadioSkins_StarFleet_ minimize.gif, , [a51051d9602be5516e17777daf5349b7], PUP.Optional.ConduitTB.Gen, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\conduit\cachedIcons\http___storage_conduit_com_BankImages_RadioSkins_StarFleet_ play.gif, , [a51051d9602be5516e17777daf5349b7], PUP.Optional.ConduitTB.Gen, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\conduit\cachedIcons\http___storage_conduit_com_BankImages_RadioSkins_StarFleet_ play_mini.gif, , [a51051d9602be5516e17777daf5349b7], PUP.Optional.ConduitTB.Gen, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\conduit\cachedIcons\http___storage_conduit_com_BankImages_RadioSkins_StarFleet_ stop.gif, , [a51051d9602be5516e17777daf5349b7], PUP.Optional.ConduitTB.Gen, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\conduit\cachedIcons\http___storage_conduit_com_BankImages_RadioSkins_StarFleet_ vol.gif, , [a51051d9602be5516e17777daf5349b7], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\chrome.manifest, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\install.rdf, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\version.txt, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\chrome\conduitengine.jar, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\components\ConduitAutoCompleteSearch.js, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\components\ConduitAutoCompleteSearch.xpt, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\components\ConduitToolbar.idl, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\components\ConduitToolbar.js, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\components\ConduitToolbar.xpt, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\components\RadioWMPCore.dll, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\components\RadioWMPCore.xpt, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\components\RadioWMPCoreGecko19.dll, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\defaults\alertSettingsComponent.xml, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\defaults\appContextMenu.xml, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\defaults\engineContextMenu.xml, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\defaults\engineSettings.json, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\defaults\fbAlert.js, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\defaults\getAppsContextMenu.xml, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\defaults\postAppsContextMenu.xml, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\defaults\toolbarContextMenu.xml, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\defaults\unsharedAppsContextMenu.xml, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\DualPackage\install.rdf, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\lib\xpcom.js, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\META-INF\manifest.mf, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\META-INF\zigbert.rsa, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\META-INF\zigbert.sf, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\searchplugin\conduit.gif, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\searchplugin\conduit.ico, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\searchplugin\conduit.PNG, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\searchplugin\conduit.src, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.Conduit, C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\extensions\engine@conduit.com\searchplugin\conduit.xml, , [c4f13befff8c181eb6f7d32803ff31cf], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\Configuration.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\OptionDlg.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\RegionalSettings.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\UserInterface.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\BG\Configuration.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\BG\OptionDlg.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\BG\RegionalSettings.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\BG\UserInterface.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\CZ\Configuration.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\CZ\OptionDlg.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\CZ\RegionalSettings.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\CZ\UserInterface.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\EN\Configuration.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\EN\OptionDlg.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\EN\RegionalSettings.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\EN\UserInterface.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\ES\Configuration.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\ES\OptionDlg.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\ES\RegionalSettings.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\ES\UserInterface.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\FR\Configuration.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\FR\OptionDlg.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\FR\RegionalSettings.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\FR\UserInterface.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\HE\Configuration.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\HE\OptionDlg.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\HE\RegionalSettings.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\HE\UserInterface.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\RU\Configuration.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\RU\OptionDlg.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\RU\RegionalSettings.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\RU\UserInterface.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\SK\Configuration.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\SK\OptionDlg.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\SK\RegionalSettings.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\SK\UserInterface.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\TR\Configuration.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\TR\OptionDlg.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\TR\RegionalSettings.xml, , [7342210982093006117c030859aafa06], PUP.Optional.ICQToolbar, C:\ProgramData\ICQ\ICQToolbar\XML\TR\UserInterface.xml, , [7342210982093006117c030859aafa06], Physische Sektoren: 0 (keine bösartigen Elemente erkannt) (end) |
|
01.09.2015, 11:45
| #2 |
| /// the machine /// TB-Ausbilder    | svchost belastet CPU, Malware-Funde was nun? hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
01.09.2015, 12:24
| #3 |
| | svchost belastet CPU, Malware-Funde was nun?Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x86) Version:31-08-2015 durchgeführt von Jan (Administrator) auf JAN-PC (01-09-2015 13:15:22) Gestartet von C:\Users\Jan\Downloads Geladene Profile: Jan (Verfügbare Profile: Jan) Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) Sprache: Deutsch (Deutschland) Internet Explorer Version 9 (Standard-Browser: FF) Start-Modus: Normal Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Prozesse (Nicht auf der Ausnahmeliste) ================= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.) (Microsoft Corporation) C:\Windows\System32\SLsvc.exe (Arachnoid Biometrics Identification Group Corp.) C:\Program Files\Acer\Acer Bio Protection\CompPtcVUI.exe (Agere Systems) C:\Windows\System32\agrsmsvc.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe () C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe (Cisco Systems, Inc.) D:\webvpn\cvpnd.exe (Egis Incorporated) C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe () C:\Program Files\Acer\Empowering Technology\Service\ETService.exe () C:\Program Files\Acer\Acer Bio Protection\BASVC.exe (Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe () C:\Acer\Mobility Center\MobilityService.exe (Nero AG) C:\Program Files\Nero\Update\NASvc.exe (NewTech InfoSystems, Inc.) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe () C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe (pdfforge GmbH) C:\Program Files\PDF Architect 2\creator-ws.exe () C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe (Acer Incorporated) C:\Program Files\Acer\Acer VCM\RS_Service.exe (TuneUp Software) C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Launcher\Avira.ServiceHost.exe (TuneUp Software) C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe (Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Realtek Semiconductor) C:\Windows\RtHDVCpl.exe () C:\Windows\PLFSetI.exe (Arachnoid Biometrics Identification Group Corp.) C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe (Realtek Semiconductor Corp.) C:\Users\Jan\AppData\Local\Temp\RtkBtMnt.exe (Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe (Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe (Acer Incorporated) C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe (Acer Inc.) C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe (Spotify Ltd) C:\Users\Jan\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Launcher\Avira.Systray.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Microsoft Corporation) C:\Windows\winsxs\x86_microsoft-windows-taskmgr_31bf3856ad364e35_6.0.6001.18000_none_14622f2da933f0c7\taskmgr.exe (Microsoft Corporation) C:\Windows\System32\wuauclt.exe (Microsoft Corporation) C:\Windows\System32\conime.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe () C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe () C:\Program Files\Mozilla Firefox\updated\firefox.exe (Microsoft Corporation) C:\Windows\System32\UI0Detect.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe (Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exe (Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exe (Malwarebytes Corporation) D:\ Malwarebytes Anti-Malware \mbamservice.exe (Malwarebytes Corporation) D:\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) D:\ Malwarebytes Anti-Malware \mbam.exe ==================== Registry (Nicht auf der Ausnahmeliste) =========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1037608 2008-02-22] (Synaptics, Inc.) HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup HKLM\...\Run: [NvMediaCenter] => RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [6111232 2008-04-25] (Realtek Semiconductor) HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1826816 2007-11-21] (Realtek Semiconductor Corp.) HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2007-10-23] () HKLM\...\Run: [ZPdtWzdVitaKey MC3000] => C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe [3667968 2008-07-24] (Arachnoid Biometrics Identification Group Corp.) HKLM\...\Run: [LManager] => C:\Program Files\Launch Manager\LManager.exe [793096 2008-04-01] (Dritek System Inc.) HKLM\...\Run: [eAudio] => C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe [544768 2008-03-07] (Acer Incorporated) HKLM\...\Run: [ePower_DMC] => C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe [397312 2008-04-30] (Acer Inc.) HKLM\...\Run: [ControlCenter3] => C:\Program Files\Brother\ControlCenter3\brctrcen.exe [86016 2007-12-21] (Brother Industries, Ltd.) HKLM\...\Run: [] => [X] HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [782008 2015-08-29] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\Launcher\Avira.Systray.exe [134368 2015-07-02] (Avira Operations GmbH & Co. KG) Winlogon\Notify\AWinNotifyVitaKey MC3000: C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll [2008-07-24] (Arachnoid Biometrics Identification Group Corp.) HKU\S-1-5-21-5983412-2541121911-1157762278-1000\...\Run: [Spotify Web Helper] => C:\Users\Jan\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-05-19] (Spotify Ltd) HKU\S-1-5-21-5983412-2541121911-1157762278-1000\...\Run: [Dropbox Update] => C:\Users\Jan\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-12] (Dropbox, Inc.) Lsa: [Notification Packages] scecli C:\Program Files\Acer\Acer Bio Protection\PwdFilter ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jan\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jan\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jan\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll [2008-03-04] (Egis Incorporated) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VPN Client.lnk [2015-04-05] ShortcutTarget: VPN Client.lnk -> C:\Windows\Installer\{51FB15F4-AD27-43BC-AD4B-DD0354FB6BBD}\Icon3E5562ED7.ico () ==================== Internet (Nicht auf der Ausnahmeliste) ==================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt..) Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704 2011-08-31] (Apple Inc.) Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2012-11-07] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2012-11-07] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2012-11-07] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2012-11-07] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2012-11-07] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2012-11-07] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2012-11-07] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2012-11-07] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 40 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2012-11-07] (Avira Operations GmbH & Co. KG) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 Tcpip\..\Interfaces\{A6E9DDEE-0B07-4CB5-9542-49665845B74B}: [DhcpNameServer] 192.168.178.1 Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.intl.acer.yahoo.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.intl.acer.yahoo.com HKU\S-1-5-21-5983412-2541121911-1157762278-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www2.delta-search.com/?babsrc=HP_ss&mntrId=240E0016EA56B080&affID=121565&tsp=4996 HKU\S-1-5-21-5983412-2541121911-1157762278-1000\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://global.acer.com/ SearchScopes: HKU\S-1-5-21-5983412-2541121911-1157762278-1000 -> DefaultScope {DECA3892-BA8F-44b8-A993-A466AD694AE4} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-acer SearchScopes: HKU\S-1-5-21-5983412-2541121911-1157762278-1000 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www2.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=240E0016EA56B080&affID=121565&tsp=4996 SearchScopes: HKU\S-1-5-21-5983412-2541121911-1157762278-1000 -> {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = SearchScopes: HKU\S-1-5-21-5983412-2541121911-1157762278-1000 -> {DECA3892-BA8F-44b8-A993-A466AD694AE4} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-acer BHO: PDF Architect 3 Helper -> {06E08260-0695-4EC1-A74B-1310D8899D93} -> C:\Program Files\PDF Architect 3\creator-ie-helper.dll [2015-04-24] (pdfforge GmbH) BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2013-04-16] (RealDownloader) BHO: PDF Architect Helper -> {691B33B0-B86E-47F3-81C7-56E4FE3B929C} -> C:\Program Files\PDF Architect 2\creator-ie-helper.dll [2014-10-10] (pdfforge GmbH) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-06-15] (Oracle Corporation) BHO: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22] (Microsoft Corporation) BHO: Avira SearchFree Toolbar plus Web Protection -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> C:\Program Files\Ask.com\GenericAskToolbar.dll [2012-01-04] (Ask) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-06-15] (Oracle Corporation) BHO: DVDVideoSoft WebPageAdjuster Class -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll Keine Datei Toolbar: HKLM - Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll [2008-03-04] (Egis Incorporated.) Toolbar: HKLM - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll [2012-01-04] (Ask) Toolbar: HKLM - PDF Architect Toolbar - {DEEB13D7-CEA9-45FB-B77C-E039BEC85221} - C:\Program Files\PDF Architect 2\creator-ie-plugin.dll [2014-10-10] (pdfforge GmbH) Toolbar: HKLM - PDF Architect 3 Toolbar - {2DFF3579-5AA7-45B9-9328-1D38EA230861} - C:\Program Files\PDF Architect 3\creator-ie-plugin.dll [2015-04-24] (pdfforge GmbH) Toolbar: HKU\S-1-5-21-5983412-2541121911-1157762278-1000 -> Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll [2012-01-04] (Ask) DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_51-windows-i586.cab DPF: {CAFEEFAC-0017-0000-0051-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_51-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_51-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2001-06-21] (Microsoft Corporation) FireFox: ======== FF ProfilePath: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default FF Homepage: hxxp://google.de/ FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-13] () FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2013-04-08] () FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google) FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-06-15] (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-06-15] (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.) FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2010-04-17] (Microsoft Corporation) FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-30] (Microsoft Corporation) FF Plugin: @real.com/nppl3260;version=16.0.2.32 -> d:\realplayer\Netscape6\nppl3260.dll [2013-07-27] (RealNetworks, Inc.) FF Plugin: @real.com/nprndlchromebrowserrecordext;version=1.3.2 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll [2013-04-16] (RealNetworks, Inc.) FF Plugin: @real.com/nprndlhtml5videoshim;version=1.3.2 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll [2013-04-16] (RealNetworks, Inc.) FF Plugin: @real.com/nprndlpepperflashvideoshim;version=1.3.2 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll [2013-04-16] (RealNetworks, Inc.) FF Plugin: @real.com/nprpplugin;version=16.0.2.32 -> d:\realplayer\Netscape6\nprpplugin.dll [2013-07-27] (RealPlayer) FF Plugin: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll [2013-04-16] (RealDownloader) FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-09-01] (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-09-01] (Google Inc.) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-06-27] (Adobe Systems Inc.) FF user.js: detected! => C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\user.js [2013-09-05] FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFFICE.DLL [2007-03-22] (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2015-06-27] (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppl3260.dll [2013-07-27] (RealNetworks, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2013-06-29] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2013-06-29] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2013-06-29] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2013-06-29] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2013-06-29] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nprpplugin.dll [2013-07-27] (RealPlayer) FF SearchPlugin: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\searchplugins\icqplugin-1.xml [2015-08-29] FF SearchPlugin: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\searchplugins\icqplugin-2.xml [2009-05-04] FF SearchPlugin: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\searchplugins\icqplugin-3.xml [2009-06-14] FF SearchPlugin: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\searchplugins\icqplugin-4.xml [2009-09-28] FF SearchPlugin: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\searchplugins\icqplugin-5.xml [2009-10-29] FF SearchPlugin: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\searchplugins\icqplugin-6.xml [2009-12-18] FF SearchPlugin: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\searchplugins\icqplugin-7.xml [2010-01-12] FF SearchPlugin: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\searchplugins\icqplugin.xml [2009-04-20] FF Extension: Avira Browser Safety - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\Extensions\abs@avira.com [2015-08-12] FF Extension: Conduit Engine - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\Extensions\engine@conduit.com [2010-12-21] FF Extension: vShare Plugin - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\Extensions\vshare@toolbar [2010-10-02] FF Extension: Microsoft .NET Framework Assistant - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-10-09] FF Extension: Yahoo! Toolbar - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2015-03-03] FF Extension: PsicoTSI - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\Extensions\{7E77F5DF-8022-40e3-9122-F03DEBEFC43B} [2010-02-04] FF Extension: FoxTrick - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\Extensions\{9d1f059c-cada-4111-9696-41a62d64e3ba} [2015-05-29] FF Extension: Gmail S/MIME - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\Extensions\{4c197c8f-a50f-4b49-a2d2-ed922c95612f}.xpi [2012-08-22] FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012-11-21] FF Extension: Adblock Plus - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-12-15] FF Extension: ICQ Toolbar - C:\Program Files\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2015-08-29] FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-03-17] FF HKLM\...\Firefox\Extensions: [{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext FF HKLM\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff FF HKLM\...\Firefox\Extensions: [{FCE04E1F-9378-4f39-96F6-5689A9159E45}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013-07-27] FF HKLM\...\Firefox\Extensions: [pdf_architect_2_conv@pdfarchitect.org] - C:\Program Files\PDF Architect 2\resources\pdfarchitect2firefoxextension FF Extension: PDF Architect 2 Creator - C:\Program Files\PDF Architect 2\resources\pdfarchitect2firefoxextension [2014-12-27] FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext FF HKLM\...\Firefox\Extensions: [pdf_architect_3_conv@pdfarchitect.org] - C:\Program Files\PDF Architect 3\resources\pdfarchitect3firefoxextension FF Extension: PDF Architect 3 Creator - C:\Program Files\PDF Architect 3\resources\pdfarchitect3firefoxextension [2015-06-29] FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\itms.js [2015-08-29] Chrome: ======= CHR HKLM\...\Chrome\Extension: [dhkplhfnhceodhffomolpfigojocbpcb] - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbar.crx <nicht gefunden> CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx CHR HKLM\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-04-16] CHR HKLM\...\Chrome\Extension: [leocdeigfnkaojcapikdjcdbedcjmffc] - C:\Users\Jan\AppData\Local\CRE\leocdeigfnkaojcapikdjcdbedcjmffc.crx [2013-01-31] CHR HKU\S-1-5-21-5983412-2541121911-1157762278-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [leocdeigfnkaojcapikdjcdbedcjmffc] - C:\Users\Jan\AppData\Local\CRE\leocdeigfnkaojcapikdjcdbedcjmffc.crx [2013-01-31] CHR HKU\S-1-5-21-5983412-2541121911-1157762278-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx <nicht gefunden> ==================== Dienste (Nicht auf der Ausnahmeliste) ======================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) S2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc.exe [887128 2015-07-30] (Avira Operations GmbH & Co. KG) R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [461672 2015-08-29] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [461672 2015-08-29] (Avira Operations GmbH & Co. KG) R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1212048 2015-08-29] (Avira Operations GmbH & Co. KG) R2 Avira.ServiceHost; C:\Program Files\Avira\Launcher\Avira.ServiceHost.exe [218816 2015-07-02] (Avira Operations GmbH & Co. KG) R2 BUNAgentSvc; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [16384 2008-03-03] (NewTech Infosystems, Inc.) [Datei ist nicht signiert] R2 CLHNService; C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [81504 2008-01-16] () [Datei ist nicht signiert] R2 CVPND; D:\webvpn\cvpnd.exe [1528608 2008-08-29] (Cisco Systems, Inc.) R2 ETService; C:\Program Files\Acer\Empowering Technology\Service\ETService.exe [24576 2008-03-21] () [Datei ist nicht signiert] R2 IGBASVC; C:\Program Files\Acer\Acer Bio Protection\BASVC.exe [3517440 2008-07-24] () [Datei ist nicht signiert] R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [61440 2007-01-17] (Hewlett-Packard Company) [Datei ist nicht signiert] R2 MBAMScheduler; D:\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation) R2 MBAMService; D:\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation) R2 MobilityService; C:\Acer\Mobility Center\MobilityService.exe [110592 2007-12-06] () [Datei ist nicht signiert] R2 NAUpdate; C:\Program Files\Nero\Update\NASvc.exe [503080 2010-05-04] (Nero AG) R2 NTISchedulerSvc; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [131072 2008-04-04] () [Datei ist nicht signiert] S3 PDF Architect 2; C:\Program Files\PDF Architect 2\ws.exe [1771560 2014-10-10] (pdfforge GmbH) R2 PDF Architect 2 Creator; C:\Program Files\PDF Architect 2\creator-ws.exe [738856 2014-10-10] (pdfforge GmbH) S3 PDF Architect 3; C:\Program Files\PDF Architect 3\ws.exe [2244312 2015-04-24] (pdfforge GmbH) S3 PDF Architect 3 CrashHandler; C:\Program Files\PDF Architect 3\crash-handler-ws.exe [901336 2015-04-24] (pdfforge GmbH) S3 pdfforge CrashHandler; C:\Program Files\PDF Architect 2\crash-handler-ws.exe [861736 2014-10-10] (pdfforge GmbH) R2 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-04-16] () R2 RS_Service; C:\Program Files\Acer\Acer VCM\RS_Service.exe [233472 2008-01-10] (Acer Incorporated) [Datei ist nicht signiert] S2 SkypeUpdate; D:\Skype\Updater\Updater.exe [327296 2015-07-09] (Skype Technologies) R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-21] (Microsoft Corporation) ===================== Treiber (Nicht auf der Ausnahmeliste) ========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) R0 AlfaFF; C:\Windows\System32\Drivers\AlfaFF.sys [43184 2008-07-24] (Alfa Corporation) R3 ATSWPDRV; C:\Windows\System32\DRIVERS\ATSwpDrv.sys [146944 2008-05-30] (AuthenTec, Inc.) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108448 2015-07-30] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136728 2015-07-30] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37896 2015-06-15] (Avira Operations GmbH & Co. KG) S3 CVirtA; C:\Windows\System32\DRIVERS\CVirtA.sys [5275 2007-01-18] (Cisco Systems, Inc.) R2 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306299 2008-08-29] (Cisco Systems, Inc.) [Datei ist nicht signiert] R3 DNE; C:\Windows\System32\DRIVERS\dne2000.sys [125328 2008-03-29] (Deterministic Networks, Inc.) R2 int15; C:\Windows\system32\drivers\int15.sys [69632 2007-01-26] () [Datei ist nicht signiert] R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-06-18] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [98520 2015-09-01] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-06-18] (Malwarebytes Corporation) R2 NTIPPKernel; C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys [122368 2008-01-16] (Cyberlink Corp.) [Datei ist nicht signiert] R0 sptd; C:\Windows\System32\Drivers\sptd.sys [721904 2009-12-23] () [Datei ist nicht signiert] R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [31848 2015-07-14] (Avira Operations GmbH & Co. KG) R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl [61424 2008-04-18] (Cyberlink Corp.) U3 aid24gzp; C:\Windows\system32\Drivers\aid24gzp.sys [0 ] (Microsoft Corporation) <==== ACHTUNG (Null Byte Datei/Ordner) S2 adfs; kein ImagePath S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] ==================== NetSvcs (Nicht auf der Ausnahmeliste) =================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) ==================== Ein Monat: Erstellte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2015-09-01 13:15 - 2015-09-01 13:16 - 00029212 _____ C:\Users\Jan\Downloads\FRST.txt 2015-09-01 13:14 - 2015-09-01 13:15 - 00000000 ____D C:\FRST 2015-09-01 13:13 - 2015-09-01 13:13 - 01690624 _____ (Farbar) C:\Users\Jan\Downloads\FRST.exe 2015-09-01 10:39 - 2015-09-01 13:14 - 00098520 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-09-01 10:38 - 2015-09-01 10:38 - 00000000 ____D C:\ProgramData\Malwarebytes 2015-09-01 10:38 - 2015-06-18 08:41 - 00094936 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-09-01 10:38 - 2015-06-18 08:41 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-09-01 10:38 - 2015-06-18 08:41 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-09-01 10:34 - 2015-09-01 10:37 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Jan\Downloads\mbam-setup-2.1.8.1057.exe 2015-08-29 19:24 - 2015-08-29 19:24 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2015-08-29 13:36 - 2015-08-29 19:23 - 00000000 ____D C:\Program Files\Mozilla Firefox 2015-08-29 13:05 - 2015-08-29 13:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2015-08-29 13:05 - 2015-08-29 13:05 - 00000000 ____D C:\Program Files\Skype 2015-08-29 13:05 - 2015-08-29 13:05 - 00000000 ____D C:\Program Files\Common Files\Skype ==================== Ein Monat: Geänderte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2015-09-01 13:12 - 2008-07-24 04:00 - 00042369 _____ C:\ProgramData\nvModes.001 2015-09-01 13:12 - 2006-11-02 14:47 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2015-09-01 13:12 - 2006-11-02 14:47 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2015-09-01 13:09 - 2015-06-12 20:57 - 00001216 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-5983412-2541121911-1157762278-1000UA.job 2015-09-01 12:50 - 2008-07-24 03:54 - 01392615 _____ C:\Windows\WindowsUpdate.log 2015-09-01 12:19 - 2009-10-17 14:29 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-09-01 10:19 - 2009-10-17 14:29 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-09-01 10:18 - 2015-06-12 20:57 - 00001164 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-5983412-2541121911-1157762278-1000Core.job 2015-09-01 10:09 - 2010-03-15 14:25 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Skype 2015-08-29 19:24 - 2012-09-03 16:49 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Dropbox 2015-08-29 19:23 - 2012-05-04 09:01 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service 2015-08-29 13:11 - 2015-02-20 14:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2015-08-29 13:06 - 2010-03-15 14:24 - 00000000 ____D C:\ProgramData\Skype 2015-08-18 12:46 - 2008-07-24 04:12 - 00000000 _____ C:\Windows\system32\LogConfigTemp.xml 2015-08-18 12:43 - 2008-05-07 20:04 - 00000147 _____ C:\Windows\system32\agent.log 2015-08-18 12:43 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2015-08-18 12:42 - 2014-03-01 13:49 - 03845186 _____ C:\Windows\PFRO.log 2015-08-18 12:41 - 2006-11-02 15:01 - 00032614 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2015-08-15 10:27 - 2006-11-02 12:33 - 00006658 _____ C:\Windows\system32\PerfStringBackup.INI 2015-08-13 15:26 - 2012-04-03 11:27 - 00778440 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2015-08-13 15:26 - 2011-05-17 22:14 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2015-08-13 15:15 - 2013-02-13 01:46 - 00002425 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk ==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ======= 2009-05-28 18:45 - 2011-01-23 11:44 - 0002299 _____ () C:\Users\Jan\AppData\Roaming\acervcmtmp.ini 2009-05-29 15:24 - 2015-06-15 18:54 - 0000680 _____ () C:\Users\Jan\AppData\Local\d3d9caps.dat 2009-03-21 13:58 - 2015-03-08 11:19 - 0039424 _____ () C:\Users\Jan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2012-03-04 20:13 - 2014-06-15 16:56 - 0004096 ____H () C:\Users\Jan\AppData\Local\keyfile3.drm 2015-07-16 14:10 - 2015-07-16 14:10 - 0000873 _____ () C:\Users\Jan\AppData\Local\recently-used.xbel 2008-07-24 04:00 - 2015-09-01 13:12 - 0042369 _____ () C:\ProgramData\nvModes.001 2008-07-24 04:00 - 2010-10-01 13:14 - 0042369 _____ () C:\ProgramData\nvModes.dat Einige Dateien in TEMP: ==================== C:\Users\Jan\AppData\Local\Temp\avgnt.exe C:\Users\Jan\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpmdis9i.dll C:\Users\Jan\AppData\Local\Temp\RtkBtMnt.exe C:\Users\Jan\AppData\Local\Temp\SkypeSetup.exe ==================== Bamital & volsnap ================= (Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.) C:\Windows\explorer.exe => Datei ist digital signiert C:\Windows\system32\winlogon.exe => Datei ist digital signiert C:\Windows\system32\wininit.exe => Datei ist digital signiert C:\Windows\system32\svchost.exe => Datei ist digital signiert C:\Windows\system32\services.exe => Datei ist digital signiert C:\Windows\system32\User32.dll => Datei ist digital signiert C:\Windows\system32\userinit.exe => Datei ist digital signiert C:\Windows\system32\rpcss.dll => Datei ist digital signiert C:\Windows\system32\dnsapi.dll => Datei ist digital signiert C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert LastRegBack: 2015-08-18 12:52 ==================== Ende vom FRST.txt ============================ Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x86) Version:31-08-2015
durchgeführt von Jan (2015-09-01 13:17:18)
Gestartet von C:\Users\Jan\Downloads
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-5983412-2541121911-1157762278-500 - Administrator - Disabled)
Gast (S-1-5-21-5983412-2541121911-1157762278-501 - Limited - Enabled)
Jan (S-1-5-21-5983412-2541121911-1157762278-1000 - Administrator - Enabled) => C:\Users\Jan
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
AAA 6.0.00.15 (HKLM\...\Acer Acer Bio Protection 6.0.00.15) (Version: - )
Acer Arcade Deluxe (HKLM\...\InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}) (Version: 2.0.5225 - CyberLink Corp.)
Acer Arcade Deluxe (Version: 2.0.5225 - CyberLink Corp.) Hidden
Acer Bio Protection
Acer Crystal Eye Webcam 3.0.3.1 (HKLM\...\{A77255C4-AFCB-44A3-BF0F-2091A71FFD9E}) (Version: 3.0.3.1 - SuYin)
Acer Crystal Eye Webcam 3.0.3.1 (Version: 3.0.3.1 - SuYin) Hidden
Acer eAudio Management (HKLM\...\{57265292-228A-41FA-9AEC-4620CBCC2739}) (Version: 3.0.3007 - CyberLink Corp.)
Acer eDataSecurity Management (HKLM\...\{A5633652-3795-4829-BB0B-644F0279E279}) (Version: 3.0.3060 - Egis Inc.)
Acer Empowering Technology (HKLM\...\{8F1B6239-FEA0-450A-A950-B05276CE177C}) (Version: 3.0.3006 - Acer Incorporated)
Acer ePower Management (HKLM\...\{58E5844B-7CE2-413D-83D1-99294BF6C74F}) (Version: 3.0.3009 - Acer Incorporated)
Acer eRecovery Management (HKLM\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 3.0.3010 - Acer Incorporated)
Acer eSettings Management (HKLM\...\{13D85C14-2B85-419F-AC41-C7F21E68B25D}) (Version: 3.0.3006 - Acer Incorporated)
Acer GridVista (HKLM\...\GridVista) (Version: 2.72.317 - )
Acer Mobility Center Plug-In (HKLM\...\{11316260-6666-467B-AC34-183FCB5D4335}) (Version: 3.0.3000 - Acer Inc.)
Acer ScreenSaver (HKLM\...\{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}) (Version: 1.11.0506 - Acer Incorporated)
Acer VCM (HKLM\...\{047F790A-7A2A-4B6A-AD02-38092BA63DAC}) (Version: 3.1.3000 - Acer Incorporated)
Activation Assistant for the 2007 Microsoft Office suites (HKLM\...\Activation Assistant for the 2007 Microsoft Office suites) (Version: - Microsoft Corporation)
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
Adobe Flash Player 10 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 10.0.42.34 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 18.0.0.232 - Adobe Systems Incorporated)
Adobe Reader X (10.1.15) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.15 - Adobe Systems Incorporated)
Agere Systems HDA Modem (HKLM\...\Agere Systems Soft Modem) (Version: - Agere Systems)
alphacombixx (HKLM\...\alphacombixx) (Version: - )
Apple Application Support (HKLM\...\{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}) (Version: 2.3.4 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{E14ADE0E-75F3-4A46-87E5-26692DD626EC}) (Version: 6.1.0.13 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Ask Toolbar (HKLM\...\{86D4B82A-ABED-442A-BE86-96357B70F4FE}) (Version: 1.14.1.0 - Ask.com) <==== ACHTUNG
AuthenTec Fingerprint Sensor Minimum Install (HKLM\...\{31A5ED9F-E07B-4F6E-8179-27325BAAC502}) (Version: 7.10.0.1129 - AuthenTec)
Avira (HKLM\...\{a5e00a72-db4a-4f77-8874-d1265b8fcd7e}) (Version: 1.1.42.10415 - Avira Operations GmbH & Co. KG)
Avira (Version: 1.1.42.10415 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM\...\Avira Antivirus) (Version: 15.0.12.420 - Avira Operations GmbH & Co. KG)
Avira SearchFree Toolbar plus Web Protection Updater (HKU\S-1-5-21-5983412-2541121911-1157762278-1000\...\{79A765E1-C399-405B-85AF-466F52E918B0}) (Version: 1.2.0.20064 - Ask.com) <==== ACHTUNG
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
Brother MFL-Pro Suite DCP-165C (HKLM\...\{3A08B59E-A9F0-4F4D-B7E5-6875D7F13327}) (Version: 1.1.8.0 - Brother Industries, Ltd.)
Call of Duty(R) 4 - Modern Warfare(TM) (HKLM\...\InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}) (Version: 1.00.0000 - Activision)
Call of Duty(R) 4 - Modern Warfare(TM) (Version: 1.00.0000 - Activision) Hidden
Cisco Systems VPN Client 5.0.04.0300 (HKLM\...\{51FB15F4-AD27-43BC-AD4B-DD0354FB6BBD}) (Version: 5.0.4 - Cisco Systems, Inc.)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Designer 2.0 (HKLM\...\Designer 2.0_is1) (Version: 7.9.5 - Fomanu AG)
Dropbox (HKU\S-1-5-21-5983412-2541121911-1157762278-1000\...\Dropbox) (Version: 3.8.8 - Dropbox, Inc.)
Free YouTube to MP3 Converter version 3.12.12.827 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.12.827 - DVDVideoSoft Ltd.)
FUSSBALL MANAGER 10 (HKLM\...\FUSSBALL MANAGER 10) (Version: 2.0.0.6 - Electronic Arts)
GIMP 2.8.0 (HKLM\...\GIMP-2_is1) (Version: 2.8.0 - The GIMP Team)
Google Earth (HKLM\...\{817750FA-EC6A-485D-9901-0683AE6FFDF1}) (Version: 7.1.5.1557 - Google)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.28.13 - Google Inc.) Hidden
iCloud (HKLM\...\{FDB5E0F3-86EA-4379-8A2F-1BC2436543E9}) (Version: 1.0.2.17 - Apple Inc.)
Interaktive Sprachreise - Vokabeltrainer English (HKLM\...\VTE_17_689501) (Version: - digital publishing AG)
iTunes (HKLM\...\{91FD46D2-4FB7-4A51-8637-556E1BE1DB7C}) (Version: 11.0.4.4 - Apple Inc.)
Java 8 Update 45 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
JMicron JMB38X Flash Media Controller (HKLM\...\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.00.11.02 - JMicron Technology Corp.)
Launch Manager (HKLM\...\LManager) (Version: - )
LECTURNITY Player (HKLM\...\{8624888C-A959-45A5-98F4-292E956325EA}) (Version: 4.0.0000 - imc AG)
LightScribe 1.4.142.1 (Version: 1.4.142.1 - hxxp://www.lightscribe.com) Hidden
Malwarebytes Anti-Malware Version 2.1.8.1057 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Marvell Miniport Driver (HKLM\...\Marvell Miniport Driver) (Version: 10.55.3.3 - Marvell)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM\...\{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}) (Version: 08.05.0822 - Microsoft Corporation)
Mozilla Firefox 40.0.3 (x86 de) (HKLM\...\Mozilla Firefox 40.0.3 (x86 de)) (Version: 40.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 40.0.3.5716 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
NBA 2K9 (HKLM\...\Steam App 7740) (Version: - Visual Concepts)
Nero BurnLite 10 (HKLM\...\{842BEE12-CCCB-43F4-ABAF-CBA6DFE2583D}) (Version: 10.0.10500 - Nero AG)
Nero BurnLite 10 (HKLM\...\{AB627AF2-9C7E-4DBD-816B-3B2646B81E89}) (Version: 10.0.10100.1.100 - Nero AG)
Nero Update (HKLM\...\{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}) (Version: 1.0.0018 - Nero AG)
NTI Backup Now 5 (HKLM\...\InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}) (Version: 5.1.2.503 - NewTech Infosystems)
NTI Backup Now Standard (Version: 5.1.2.503 - NewTech Infosystems) Hidden
NTI Media Maker 8 (HKLM\...\InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}) (Version: 8.0.2.6322 - NewTech Infosystems)
NTI Media Maker 8 (Version: 8.0.2.6322 - NewTech Infosystems) Hidden
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: - )
OpenOffice.org 3.2 (HKLM\...\{192A107E-C6B9-41B9-BDBF-38E3AA226054}) (Version: 3.2.9483 - OpenOffice.org)
Origin (HKLM\...\Origin) (Version: 8.2.2.2413 - Electronic Arts, Inc.)
PaperPort Image Printer (HKLM\...\{2BC2781A-F7F6-452E-95EB-018A522F1B2C}) (Version: 1.00.0000 - Nuance Communications, Inc.)
PDF Architect 2 (HKLM\...\PDF Architect 2) (Version: 2.0.51.17865 - pdfforge GmbH)
PDF Architect 2 Create Module (Version: 2.1.6.19758 - pdfforge GmbH) Hidden
PDF Architect 2 Edit Module (Version: 2.1.6.19758 - pdfforge GmbH) Hidden
PDF Architect 2 View Module (Version: 2.1.6.19758 - pdfforge GmbH) Hidden
PDF Architect 3 (HKLM\...\PDF Architect 3) (Version: 3.0.45.22485 - pdfforge GmbH)
PDF Architect 3 Create Module (Version: 3.0.13.22993 - pdfforge GmbH) Hidden
PDF Architect 3 Edit Module (Version: 3.0.13.22993 - pdfforge GmbH) Hidden
PDF Architect 3 View Module (Version: 3.0.13.22993 - pdfforge GmbH) Hidden
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 2.1.2 - pdfforge)
PHOTOfunSTUDIO 6.1 HD Lite Edition (HKLM\...\{7E653036-DE31-4BFD-96BB-421CC72E06FC}) (Version: 6.01.015 - Panasonic Corporation)
PhotoNow! (HKLM\...\{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.1.4619 - CyberLink Corp.)
Project64 1.6 (HKLM\...\{9559F7CA-5E34-4237-A2D9-D856464AD727}) (Version: 1.6 - Project64)
QuickTime (HKLM\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
RealDownloader (Version: 1.3.2 - RealNetworks, Inc.) Hidden
RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0 - RealNetworks, Inc) Hidden
RealPlayer (HKLM\...\RealPlayer 16.0) (Version: 16.0.2 - RealNetworks)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5610 - Realtek Semiconductor Corp.)
RealUpgrade 1.1 (Version: 1.1.0 - RealNetworks, Inc.) Hidden
ScanSoft PaperPort 11 (HKLM\...\{7A8FF745-BBC5-482B-88E4-18D3178249A9}) (Version: 11.1.0000 - Nuance Communications, Inc.)
Skype™ 7.8 (HKLM\...\{6A0549A9-1B96-498C-ACBC-3943001FEB19}) (Version: 7.8.102 - Skype Technologies S.A.)
Spotify (HKU\S-1-5-21-5983412-2541121911-1157762278-1000\...\Spotify) (Version: 0.9.8.296.g91f68827 - Spotify AB)
Steam (HKLM\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve)
Super LoiLoScope WebShortcut (HKLM\...\{AC589470-884E-4E15-96D8-437780F8185D}) (Version: 1.0.0 - LoiLo)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 11.0.2.0 - Synaptics)
System Requirements Lab (HKLM\...\SystemRequirementsLab) (Version: - )
TuneUp Utilities 2011 (HKLM\...\TuneUp Utilities 2011) (Version: 10.0.4600.4 - TuneUp Software)
TuneUp Utilities 2011 (Version: 10.0.4600.4 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (Version: 10.0.4600.4 - TuneUp Software) Hidden
VLC media player 1.1.10 (HKLM\...\VLC media player) (Version: 1.1.10 - VideoLAN)
WildTangent Updater (HKLM\...\wcmdmgr.exe) (Version: - )
WildTangent Web Driver (HKLM\...\wtwebdriver) (Version: - )
Winamp (HKLM\...\Winamp) (Version: 5.551 - Nullsoft, Inc)
Windows Live Anmelde-Assistent (HKLM\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8117.0416 - Microsoft Corporation)
Windows Live Sync (HKLM\...\{586509F0-350D-48B5-B763-9CC2F8D96C4C}) (Version: 14.0.8117.416 - Microsoft Corporation)
Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WinRAR 4.20 (32-bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Jan\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{087B3AE3-E237-4467-B8DB-5A38AB959AC9}\InprocServer32 -> C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll (OpenOffice.org)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{0A368B9B-3566-4730-B40E-EAF6858A53AF}\InprocServer32 -> C:\Users\Jan\AppData\Local\Dropbox\Update\1.3.27.33\psuser.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{3059C9E6-9EDC-4C89-933E-C65623F8FD60}\localserver32 -> C:\Users\Jan\AppData\Local\Dropbox\Update\DropboxUpdate.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{30A2652A-DDF7-45e7-ACA6-3EAB26FC8A4E}\localserver32 -> C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{3B092F0C-7696-40E3-A80F-68D74DA84210}\InprocServer32 -> C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll (OpenOffice.org)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{41662FC2-0D57-4aff-AB27-AD2E12E7C273}\localserver32 -> C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{448BB771-CFE2-47C4-BCDF-1FBF378E202C}\localserver32 -> C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{63542C48-9552-494A-84F7-73AA6A7C99C1}\InprocServer32 -> C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll (OpenOffice.org)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{67F2A879-82D5-4A6D-8CC5-FFB3C114B69D}\InprocServer32 -> C:\Program Files\OpenOffice.org 3\program\so_activex.dll ()
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{7B342DC4-139A-4a46-8A93-DB0827CCEE9C}\localserver32 -> C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{7BC0E710-5703-45BE-A29D-5D46D8B39262}\InprocServer32 -> C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\ooofiltproxy.dll (OpenOffice.org)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{7F902AD4-FC6A-4B2F-8B8D-B6DD4E329B76}\InprocServer32 -> C:\Users\Jan\AppData\Local\AskToolbar\Downloaded Program Files\AviraWidget.dll (Ask.com)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{7FA8AE11-B3E3-4D88-AABF-255526CD1CE8}\localserver32 -> C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{82154420-0FBF-11d4-8313-005004526AB4}\localserver32 -> C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{87DC457B-B35D-48AC-BD42-BDF35EF623CE}\localserver32 -> C:\Users\Jan\AppData\Local\Dropbox\Update\1.3.27.33\DropboxUpdateOnDemand.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{9FAA38ED-5635-44F7-9BE0-8CAFE29B3783}\localserver32 -> C:\Users\Jan\AppData\Local\Dropbox\Update\1.3.27.33\DropboxUpdateOnDemand.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{BDD611C3-7BAB-460F-8711-5B9AC9EF6020}\InprocServer32 -> C:\Program Files\OpenOffice.org 3\Basis\program\xmergesync.dll Keine Datei
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{C0DD324D-A74F-4533-84AD-030F76771C77}\localserver32 -> C:\Users\Jan\AppData\Local\Dropbox\Update\1.3.27.33\DropboxUpdateOnDemand.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{C32E3EEC-3C10-426E-95F3-38C7F139FADD}\localserver32 -> C:\Users\Jan\AppData\Local\Dropbox\Update\1.3.27.33\DropboxUpdateOnDemand.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\InprocServer32 -> C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll (OpenOffice.org)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{C6AB3E74-9F4F-4370-8120-A8A6FABB7A7C}\InprocServer32 -> C:\Program Files\OpenOffice.org 3\Basis\program\xmergesync.dll Keine Datei
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{D0484DE6-AAEE-468a-991F-8D4B0737B57A}\localserver32 -> C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{D2D59CD1-0A6A-4D36-AE20-47817077D57C}\localserver32 -> C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{DF846759-BE0F-4451-B9D3-4BEFF765A1FD}\InprocServer32 -> C:\Users\Jan\AppData\Local\AskToolbar\Downloaded Program Files\AviraTrans.dll (Ask.com)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{E5A0B632-DFBA-4549-9346-E414DA06E6F8}\localserver32 -> C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Jan\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{EE5D1EA4-D445-4289-B2FC-55FC93693917}\localserver32 -> C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{F616B81F-7BB8-4F22-B8A5-47428D59F8AD}\localserver32 -> C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jan\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jan\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jan\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jan\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jan\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jan\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jan\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jan\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\Jan\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-5983412-2541121911-1157762278-1000_Classes\CLSID\{FE819BE5-BADF-4370-9913-6FB84ABA6FB1}\InprocServer32 -> C:\Users\Jan\AppData\Local\Dropbox\Update\1.3.27.33\psuser.dll (Dropbox, Inc.)
==================== Wiederherstellungspunkte =========================
02-07-2015 11:04:54 Geplanter Prüfpunkt
07-07-2015 12:36:44 Windows Update
13-07-2015 20:15:35 Windows Update
18-07-2015 16:01:43 Windows Update
25-07-2015 11:04:28 Windows Update
26-07-2015 03:00:20 Windows Update
29-07-2015 08:40:53 Windows Update
04-08-2015 11:11:22 Windows Update
07-08-2015 14:54:44 Windows Update
11-08-2015 12:52:12 Windows Update
18-08-2015 17:59:02 Windows Update
29-08-2015 19:51:16 Windows Update
==================== Hosts Inhalt: ==========================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {114ED8C7-A306-44C7-90CA-A9AC0FBF28CF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {16C3AC44-DB9A-40E7-89F0-680B36A3923F} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)
Task: {24E7E831-DAD3-4639-BF54-4CF71EE994A7} - System32\Tasks\Real Player-Online-Aktualisierungsprogramm => D:\Realplayer\update\RealOneMessageCenter.exe [2013-07-27] (RealNetworks, Inc.)
Task: {38B5D05D-9EC4-47F3-A9D1-6795BA0E6E43} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2015-04-30] (Oracle Corporation)
Task: {412A2C28-91DD-4533-A8A0-7D45B9C078EA} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-5983412-2541121911-1157762278-1000Core => C:\Users\Jan\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-12] (Dropbox, Inc.)
Task: {57F5D1B8-8528-449A-84C7-24EC557C51E7} - System32\Tasks\ScanSoft Background Update => C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2006-10-25] (Nuance Communications, Inc.)
Task: {61636394-007C-430A-94D2-4B40714B356F} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-5983412-2541121911-1157762278-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2013-04-16] (RealNetworks, Inc.)
Task: {63C7A30D-751A-4AE1-9821-51FEB8B494EC} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-5983412-2541121911-1157762278-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2013-04-16] (RealNetworks, Inc.)
Task: {89430610-1839-4253-BAF1-6C5B840F8C3C} - System32\Tasks\Wild Tangent-Online-Aktualisierungsprogramm => C:\Windows\wt\updater\wcmdmgrl.exe [2001-07-20] (WildTangent, Inc.)
Task: {8AD22319-8925-4308-8CF7-10965989265B} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-5983412-2541121911-1157762278-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2013-04-16] (RealNetworks, Inc.)
Task: {8B212FBA-BFBC-4E44-A1CF-FBC9993700E6} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {8D06A182-952D-4BAF-BDF0-B2E7623F7B36} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2011 => C:\Program Files\TuneUp Utilities 2011\OneClick.exe [2011-12-13] (TuneUp Software)
Task: {9C5C4F7E-0EFF-4C8E-85B0-51BF5184A92E} - System32\Tasks\{FC26A34B-EEC8-4D70-9017-FD220A18AE52} => pcalua.exe -a G:\aoesetup.exe -d G:\ -c /autorun
Task: {9CF1E533-9661-4D5E-A463-6E69551263FA} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)
Task: {A932CF6D-C1C1-4219-BA05-5AE35BD4D7B2} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-5983412-2541121911-1157762278-1000UA => C:\Users\Jan\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-12] (Dropbox, Inc.)
Task: {DC28AA3F-61D4-4C45-90CE-8D9B0044F943} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {FD93A8E5-0AA4-4B9D-9374-CA416715461E} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)
Task: {FE188D56-BBBF-4D0C-B628-0535E6914D19} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-5983412-2541121911-1157762278-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2013-04-16] (RealNetworks, Inc.)
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-5983412-2541121911-1157762278-1000Core.job => C:\Users\Jan\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-5983412-2541121911-1157762278-1000UA.job => C:\Users\Jan\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2008-07-24 04:09 - 2008-07-24 04:09 - 00080896 _____ () C:\Program Files\Acer\Acer Bio Protection\PwdFilter.dll
2011-11-02 00:26 - 2011-11-02 00:26 - 00087912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2011-11-02 00:26 - 2011-11-02 00:26 - 01242472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2008-02-28 22:44 - 2008-02-28 22:44 - 01024000 _____ () C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\ACE.dll
2008-02-28 22:44 - 2008-02-28 22:44 - 00098304 _____ () C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\ACEXML.dll
2008-02-28 22:44 - 2008-02-28 22:44 - 00061440 _____ () C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\ACEXML_Parser.dll
2008-07-24 04:26 - 2008-01-16 18:35 - 00081504 _____ () C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
2008-08-29 13:58 - 2008-08-29 13:58 - 00197408 _____ () C:\Windows\system32\vpnapi.dll
2008-05-07 20:06 - 2008-03-21 13:22 - 00024576 _____ () C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
2008-05-07 20:06 - 2008-05-07 20:06 - 00032768 _____ () C:\Windows\assembly\GAC_MSIL\Framework.Model.Controller\3.0.3006.0__14bcaafdb44b5951\Framework.Model.Controller.dll
2008-05-07 20:06 - 2008-05-07 20:06 - 00020480 _____ () C:\Windows\assembly\GAC_MSIL\Framework.Model.ControllerInterface\3.0.3006.0__d842b71b4d6ed079\Framework.Model.ControllerInterface.dll
2008-05-07 20:06 - 2008-05-07 20:06 - 00061440 _____ () C:\Windows\assembly\GAC_MSIL\Framework.Library\3.0.3006.0__3036420f80dd6947\Framework.Library.dll
2008-05-07 20:06 - 2008-05-07 20:06 - 00028672 _____ () C:\Windows\assembly\GAC_MSIL\Framework.Host\3.0.3006.0__672b450de5a7e94a\Framework.Host.dll
2008-05-07 20:06 - 2008-05-07 20:06 - 00016384 _____ () C:\Windows\assembly\GAC_MSIL\Framework.PluginInterface\3.0.3006.0__9ecdf03bb2054f94\Framework.PluginInterface.dll
2008-07-24 04:10 - 2008-03-07 03:35 - 00016384 ____N () C:\Program Files\Acer\Empowering Technology\eAudio\eAudioSrvPlugin.dll
2008-05-07 20:06 - 2008-05-07 20:06 - 00036864 _____ () C:\Windows\assembly\GAC_MSIL\Framework.Utility\3.0.3006.0__4df5dcab8860d239\Framework.Utility.dll
2008-07-24 04:13 - 2008-04-23 10:57 - 00016384 _____ () C:\Program Files\Acer\Empowering Technology\eSettings\eSettings.ServicePlugin.dll
2008-07-24 04:13 - 2008-04-23 10:54 - 00016384 _____ () C:\Program Files\Acer\Empowering Technology\eSettings\eSettings.Logger.dll
2008-07-24 04:13 - 2008-04-23 10:56 - 00143360 _____ () C:\Program Files\Acer\Empowering Technology\eSettings\eSettings.Model.Computer.dll
2008-07-24 04:13 - 2008-04-23 10:54 - 00036864 _____ () C:\Program Files\Acer\Empowering Technology\Service\eSettings.Model.ComputerInterface.dll
2008-07-24 04:09 - 2008-07-24 04:09 - 03517440 _____ () C:\Program Files\Acer\Acer Bio Protection\BASVC.exe
2008-07-24 04:27 - 2007-12-06 16:15 - 00110592 _____ () C:\Acer\Mobility Center\MobilityService.exe
2008-07-24 04:27 - 2007-11-27 15:08 - 00032768 _____ () C:\Acer\Mobility Center\MobilityInterface.dll
2008-04-04 03:03 - 2008-04-04 03:03 - 00131072 _____ () C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
2013-04-16 03:07 - 2013-04-16 03:07 - 00039056 _____ () C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
2008-07-24 04:11 - 2008-04-30 16:00 - 00204800 _____ () C:\Windows\System32\SysHook.dll
2008-07-24 04:08 - 2007-10-23 10:56 - 00200704 _____ () C:\Windows\PLFSetI.exe
2008-07-24 13:48 - 2003-06-07 23:30 - 00057344 _____ () C:\Program Files\Launch Manager\PowerUtl.dll
2008-05-07 20:06 - 2008-03-21 13:22 - 00319488 _____ () C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe
2008-05-07 20:06 - 2008-03-21 13:22 - 01527808 _____ () C:\Program Files\Acer\Empowering Technology\Framework.AppBar.dll
2008-05-07 20:06 - 2008-03-21 13:22 - 00024576 _____ () C:\Program Files\Acer\Empowering Technology\Framework.Presenter.dll
2008-05-07 20:06 - 2008-03-21 13:22 - 00005120 _____ () C:\Program Files\Acer\Empowering Technology\de\Framework.AppBar.resources.dll
2008-07-24 04:10 - 2008-03-07 03:36 - 00028672 ____N () C:\Program Files\Acer\Empowering Technology\eAudio\eAudioMenuPlugin.dll
2008-07-24 04:13 - 2008-04-23 10:56 - 00020480 _____ () C:\Program Files\Acer\Empowering Technology\eSettings\eSettings.QuickMenu.dll
2015-08-13 15:26 - 2015-08-13 15:26 - 17482952 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_18_0_0_232.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
AlternateDataStreams: C:\ProgramData\TEMP:C95B63DA
AlternateDataStreams: C:\Users\Jan\Downloads\Andes_Online_-_Emision_de_reserva_web_P6ETX.eml:OECustomProperty
AlternateDataStreams: C:\Users\Jan\Downloads\Sicherheitsmangel_Netzger_t_Speedport_W_700V_eml.eml:OECustomProperty
AlternateDataStreams: C:\Users\Jan\Documents\Referenznr_19045789_Ihre_Bestell_ung_von_TuneUp_Utilities_2011.eml:OECustomProperty
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-5983412-2541121911-1157762278-1000\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Acer01.jpg
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 2) (ConsentPromptBehaviorUser: 1) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: ApnUpdater => "C:\Program Files\Ask.com\Updater\Updater.exe"
MSCONFIG\startupreg: CLMLServer => "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe"
MSCONFIG\startupreg: eDataSecurity Loader => C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: PlayMovie => "C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe"
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: TkBellExe => "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
MSCONFIG\startupreg: wcmdmgr => C:\Windows\wt\updater\wcmdmgrl.exe -launch
MSCONFIG\startupreg: WinampAgent => "C:\Program Files\Winamp\winampa.exe"
MSCONFIG\startupreg: Windows Defender => %ProgramFiles%\Windows Defender\MSASCui.exe -hide
==================== FirewallRules (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [WinCollab-Out-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-In-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-Out-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-In-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-DFSR-Out-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [WinCollab-DFSR-In-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [{5AD711F2-CD42-429E-818E-E2A72FAD3FF2}] => (Allow) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
FirewallRules: [{2DB9864A-7249-4E0B-9B05-84DF35F6E304}] => (Allow) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
FirewallRules: [{1078D01E-5551-4BBA-B6D4-0A4CB6DB4C87}] => (Allow) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
FirewallRules: [{0515AB49-D391-4A91-8DAF-53C4D3C2F355}] => (Allow) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
FirewallRules: [{663E24DB-746F-4613-A025-711B5352DF9A}] => (Allow) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
FirewallRules: [{31A2002C-2D07-4788-A180-D1FB7DF92E6E}] => (Allow) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
FirewallRules: [{CD04A254-A2E8-4ADB-96D2-91074CD83499}] => (Allow) c:\Program Files\Cyberlink\PowerDirector\PDR.EXE
FirewallRules: [{64996EE9-8CCD-48F6-A98B-9347A48D6ECA}] => (Allow) C:\Program Files\Acer\Acer VCM\VC.exe
FirewallRules: [{531ED096-CABD-4EAA-BC28-6B8792D5C079}] => (Allow) C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe
FirewallRules: [{8D2C4E88-26BF-4CAA-9198-D08A3AE0EE41}] => (Allow) C:\Program Files\Acer Arcade Deluxe\PlayMovie\PlayMovie.exe
FirewallRules: [{16FF4909-2D11-4BC7-834A-2EFF94E8C44E}] => (Allow) C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
FirewallRules: [{F0EF1C88-D8E3-462B-BCC3-B5E00668845A}] => (Allow) C:\Program Files\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe
FirewallRules: [{67E8D579-3983-4062-9B0E-E3D051D7E0CB}] => (Allow) D:\Program Files\Steam\steamapps\common\nba 2k9\nba2k9.exe
FirewallRules: [{A903B174-A913-4AE3-9664-7267C1D821DC}] => (Allow) D:\Program Files\Steam\steamapps\common\nba 2k9\nba2k9.exe
FirewallRules: [TCP Query User{721E91D1-BD1F-4BF4-AC65-031DD00A6512}C:\program files\java\jre6\bin\java.exe] => (Allow) C:\program files\java\jre6\bin\java.exe
FirewallRules: [UDP Query User{A49D5E08-8857-49E3-9B02-D5261D1694DF}C:\program files\java\jre6\bin\java.exe] => (Allow) C:\program files\java\jre6\bin\java.exe
FirewallRules: [{D7637C83-BEA5-4AA9-8E72-475A74E496A5}] => (Allow) C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe
FirewallRules: [{515E83A7-88CF-4A8B-98F8-53C92EC6F0B5}] => (Allow) C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe
FirewallRules: [TCP Query User{917DD749-3716-4924-B0E8-4C15681D01B8}D:\electronic arts\eadm\core.exe] => (Allow) D:\electronic arts\eadm\core.exe
FirewallRules: [UDP Query User{864DC017-5841-4DC1-8EBE-3F22189D7A4B}D:\electronic arts\eadm\core.exe] => (Allow) D:\electronic arts\eadm\core.exe
FirewallRules: [TCP Query User{50B40492-D62F-4FAB-B35B-898641DE9C2E}D:\ea sports\fussball manager 10\manager10.exe] => (Allow) D:\ea sports\fussball manager 10\manager10.exe
FirewallRules: [UDP Query User{BF82F7F3-280C-4CDD-9C51-F5DA034E511A}D:\ea sports\fussball manager 10\manager10.exe] => (Allow) D:\ea sports\fussball manager 10\manager10.exe
FirewallRules: [{E3CFEF7B-A6C5-4206-AD3A-641B911E165E}] => (Allow) D:\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{E3B6151A-0811-435B-867E-E9C8D0EBA4D0}C:\program files\google\google earth\client\googleearth.exe] => (Block) C:\program files\google\google earth\client\googleearth.exe
FirewallRules: [UDP Query User{4E8357DF-5C60-423B-99FD-95D507AB3C01}C:\program files\google\google earth\client\googleearth.exe] => (Block) C:\program files\google\google earth\client\googleearth.exe
FirewallRules: [TCP Query User{E5BEC192-91BB-4F23-8F60-5600FBF08634}C:\program files\mozilla firefox\firefox.exe] => (Allow) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{65FE3C49-7ECE-4A94-B7A3-5ED6B8D49955}C:\program files\mozilla firefox\firefox.exe] => (Allow) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [TCP Query User{A036CD7B-A7A8-473C-AECD-C978DB772849}D:\realplayer\realplay.exe] => (Block) D:\realplayer\realplay.exe
FirewallRules: [UDP Query User{9A6951A4-FA95-4AAB-B61D-4372CC10E351}D:\realplayer\realplay.exe] => (Block) D:\realplayer\realplay.exe
FirewallRules: [TCP Query User{402A112A-6AFE-4BF8-BE8C-EF8DDBAC39C3}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{F506BF63-F21D-4E4D-A045-ECD0F7971623}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [TCP Query User{29514EC1-F6E9-4070-B34B-65803D4BCE30}C:\program files\google\google earth\client\googleearth.exe] => (Allow) C:\program files\google\google earth\client\googleearth.exe
FirewallRules: [UDP Query User{05491484-6DB9-4424-8EC8-375088601E0F}C:\program files\google\google earth\client\googleearth.exe] => (Allow) C:\program files\google\google earth\client\googleearth.exe
FirewallRules: [{74F73F8A-6725-43B0-B639-E8815372F15C}] => (Allow) LPort=80
FirewallRules: [{35BDDA50-E213-4458-A29E-427B204D2ABF}] => (Allow) LPort=80
FirewallRules: [{8BF0E37F-1099-4C94-B0D2-D823BE973963}] => (Allow) LPort=80
FirewallRules: [TCP Query User{FB700B29-AEDE-4103-8102-8736D94D5CEB}D:\sopcast\sopcast.exe] => (Block) D:\sopcast\sopcast.exe
FirewallRules: [UDP Query User{166F42B4-F078-4FDC-BC04-94C7C6DAB41C}D:\sopcast\sopcast.exe] => (Block) D:\sopcast\sopcast.exe
FirewallRules: [TCP Query User{55830950-4A11-4ED4-944F-B17B417329F2}D:\sopcast\adv\sopadver.exe] => (Block) D:\sopcast\adv\sopadver.exe
FirewallRules: [UDP Query User{70685464-C994-4E27-9D72-B2520951FC3F}D:\sopcast\adv\sopadver.exe] => (Block) D:\sopcast\adv\sopadver.exe
FirewallRules: [TCP Query User{E1A111D7-831B-482C-A691-B68DAAB9F836}D:\sopcast\sopcast.exe] => (Block) D:\sopcast\sopcast.exe
FirewallRules: [UDP Query User{7657A3FA-906D-4958-893C-18787052B64C}D:\sopcast\sopcast.exe] => (Block) D:\sopcast\sopcast.exe
FirewallRules: [TCP Query User{B59BE22E-8813-420E-8BA1-6370FD364E9C}D:\sopcast\adv\sopadver.exe] => (Block) D:\sopcast\adv\sopadver.exe
FirewallRules: [UDP Query User{A40EE330-DF4C-485F-9BCD-B73F1C029F4A}D:\sopcast\adv\sopadver.exe] => (Block) D:\sopcast\adv\sopadver.exe
FirewallRules: [{9455596D-3748-4649-816F-5140F1FDF892}] => (Allow) C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe
FirewallRules: [{C73CD511-A929-4AFD-B065-ADF835D02672}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{15785AEE-963B-4D83-9308-E27FF1EA6860}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{42371E47-DA22-450D-895E-C786823870A0}] => (Allow) C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe
FirewallRules: [TCP Query User{C3C628CB-DAD8-4FB6-B6A1-6496399A4314}C:\program files\mozilla firefox\plugin-container.exe] => (Allow) C:\program files\mozilla firefox\plugin-container.exe
FirewallRules: [UDP Query User{B96F6800-D395-4793-A7EF-D5DA64A8C2AB}C:\program files\mozilla firefox\plugin-container.exe] => (Allow) C:\program files\mozilla firefox\plugin-container.exe
FirewallRules: [TCP Query User{AE5DDCBF-EBC8-452C-9A40-4146351DA83A}C:\program files\mozilla firefox\plugin-container.exe] => (Block) C:\program files\mozilla firefox\plugin-container.exe
FirewallRules: [UDP Query User{1042A3A5-2312-4DF7-BC75-039D9B18A59A}C:\program files\mozilla firefox\plugin-container.exe] => (Block) C:\program files\mozilla firefox\plugin-container.exe
FirewallRules: [TCP Query User{4090197D-998F-42DB-B354-18E8BA4C16B7}C:\program files\internet explorer\iexplore.exe] => (Allow) C:\program files\internet explorer\iexplore.exe
FirewallRules: [UDP Query User{1309AFE7-5206-4B73-A4E9-14ED976E0CF1}C:\program files\internet explorer\iexplore.exe] => (Allow) C:\program files\internet explorer\iexplore.exe
FirewallRules: [{1CCB5108-2728-4110-BC97-D7602B88A368}] => (Allow) C:\Users\Jan\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{925DB77B-AFF3-46CC-B6ED-73CA178E9A47}] => (Allow) C:\Users\Jan\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [TCP Query User{EBBD8B4F-CD4F-43C4-86E0-A7C10334A495}C:\users\jan\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\jan\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{4F8B6803-2E9E-47C6-89D8-3FE12CFC16F7}C:\users\jan\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\jan\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{A61F0DA8-B84B-4F28-8287-F302FD0A78C4}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [TCP Query User{2C1E87B2-2BF0-4A35-BB42-9216A4B41D32}C:\users\jan\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\jan\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{30EB792E-1C5D-4960-A996-485B113BD49C}C:\users\jan\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\jan\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{18186DED-F240-46C5-B0DB-DE2070170684}C:\users\jan\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\jan\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{804B4F16-314F-4ECF-BCE5-31DA5CA5C58F}C:\users\jan\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\jan\appdata\roaming\spotify\spotify.exe
FirewallRules: [{B49967BE-5540-4A49-96D0-7495848EA4F4}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [TCP Query User{E2A84380-7EB5-4A52-A507-2ACBC7FA1393}D:\lecturnity\jre5\bin\javaw.exe] => (Allow) D:\lecturnity\jre5\bin\javaw.exe
FirewallRules: [UDP Query User{8614AE04-6CCF-4ECD-BD1F-789E58DADE86}D:\lecturnity\jre5\bin\javaw.exe] => (Allow) D:\lecturnity\jre5\bin\javaw.exe
FirewallRules: [TCP Query User{E9EB353F-E2BE-4BF6-89C1-2C46849A62E6}D:\lecturnity\jre5\bin\javaw.exe] => (Allow) D:\lecturnity\jre5\bin\javaw.exe
FirewallRules: [UDP Query User{E3DE3BEE-2D9A-470A-9642-993BC3E7F083}D:\lecturnity\jre5\bin\javaw.exe] => (Allow) D:\lecturnity\jre5\bin\javaw.exe
FirewallRules: [{8F8A2B29-80A5-48B4-B1B6-64202898D0F8}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{ADE16CDC-1DBB-4901-B85D-D361257BB69D}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
StandardProfile\AuthorizedApplications: [D:\fotobuch.de\Designer 2.0\Designer.exe] => Designer.exe
==================== Fehlerhafte Geräte im Gerätemanager =============
Name: Cisco Systems VPN Adapter
Description: Cisco Systems VPN Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (08/29/2015 11:25:29 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 10983
Error: (08/29/2015 11:25:29 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 10983
Error: (08/29/2015 11:25:29 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (08/29/2015 11:25:28 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9953
Error: (08/29/2015 11:25:28 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 9953
Error: (08/29/2015 11:25:28 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (08/29/2015 11:25:27 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 8783
Error: (08/29/2015 11:25:27 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 8783
Error: (08/29/2015 11:25:27 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (08/29/2015 11:25:26 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 7660
Systemfehler:
=============
Error: (08/22/2015 06:02:57 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: 30000AntiVirSchedulerService
Error: (08/21/2015 10:25:55 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: 30000TuneUp.UtilitiesSvc
Error: (08/20/2015 11:41:25 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: 30000TuneUp.UtilitiesSvc
Error: (08/19/2015 02:32:58 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: 30000Wlansvc
Error: (08/18/2015 05:02:06 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: 30000ShellHWDetection
Error: (08/18/2015 12:44:53 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: adfs%%2
Error: (08/18/2015 12:44:53 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058
Error: (08/15/2015 09:12:54 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: adfs%%2
Error: (08/15/2015 09:12:54 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058
Error: (08/15/2015 06:14:39 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: 30000TuneUp.UtilitiesSvc
Microsoft Office:
=========================
Error: (08/29/2015 11:25:29 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 10983
Error: (08/29/2015 11:25:29 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 10983
Error: (08/29/2015 11:25:29 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (08/29/2015 11:25:28 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9953
Error: (08/29/2015 11:25:28 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 9953
Error: (08/29/2015 11:25:28 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (08/29/2015 11:25:27 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 8783
Error: (08/29/2015 11:25:27 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 8783
Error: (08/29/2015 11:25:27 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (08/29/2015 11:25:26 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 7660
CodeIntegrity:
===================================
Date: 2015-09-01 13:16:54.182
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-09-01 13:16:53.173
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-09-01 13:16:52.049
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-09-01 13:16:50.960
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-09-01 13:15:47.439
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-09-01 13:15:46.295
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-09-01 13:15:45.048
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-09-01 13:15:44.034
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-09-01 13:02:57.870
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-09-01 13:02:56.807
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 Duo CPU P7350 @ 2.00GHz
Prozentuale Nutzung des RAM: 65%
Installierter physikalischer RAM: 3065.95 MB
Verfügbarer physikalischer RAM: 1063.08 MB
Summe virtueller Speicher: 6336.93 MB
Verfügbarer virtueller Speicher: 3531.1 MB
==================== Laufwerke ================================
Drive c: (ACER) (Fixed) (Total:142.65 GB) (Free:5.24 GB) NTFS ==>[Laufwerk mit Startkomponenten (eingeholt von BCD)]
Drive d: (DATA) (Fixed) (Total:142.67 GB) (Free:49.13 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (Size: 298.1 GB) (Disk ID: 4622FDBB)
Partition 1: (Not Active) - (Size=9.8 GB) - (Type=27)
Partition 2: (Active) - (Size=142.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=142.7 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=3 GB) - (Type=12)
==================== Ende vom Addition.txt ============================
|
|
01.09.2015, 17:49
| #4 |
| /// the machine /// TB-Ausbilder | svchost belastet CPU, Malware-Funde was nun? Lade Dir bitte von hier  Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Deinstallier am Besten gleich den kompletten Avira scheiss. Scan mit Combofix
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
01.09.2015, 21:33
| #5 |
| | svchost belastet CPU, Malware-Funde was nun? Ich habe ein Problem, ich habe alles so verfolgt wie du gesagt hast, aber seit Neustart durch Combofix macht der Laptop nichts mehr, außer dass ein Fenster mit Bitte warten vor schwarzem Bildschirm seit einer Stunde läuft. Ich glaube, dass ist nicht normal oder? Was kann ich jetzt machen? Ich habe irgendwie Angst wenn ich manuell ausschalte Daten zu verlieren.. Ich habe jetzt auf das Kreuzchen geklickt, und siehe da ich War auf dem Startbildschirm, nur öffnen und schließen sich jetzt dauernd Fenster, einmal C:/combofix/cf21440.3xe C:/combofix/pev.3xe und das normale combofix Fenster. Nach Neustart ändert sich auch nichts, andere Vorgänge kann man durch das ständige auf und zumachen der Fenster leider nicjt. |
|
02.09.2015, 18:00
| #6 |
| /// the machine /// TB-Ausbilder | svchost belastet CPU, Malware-Funde was nun? Boote mal in den abgesicherten Modus und lass dort FRST scannen.
__________________ --> svchost belastet CPU, Malware-Funde was nun? |
|
02.09.2015, 18:19
| #7 |
| | svchost belastet CPU, Malware-Funde was nun?Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x86) Version:31-08-2015
durchgeführt von Jan (Administrator) auf JAN-PC (02-09-2015 19:16:16)
Gestartet von C:\Users\Jan\Downloads
Geladene Profile: Jan (Verfügbare Profile: Jan)
Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) Sprache: Deutsch (Deutschland)
Internet Explorer Version 9 (Standard-Browser: FF)
Start-Modus: Safe Mode (with Networking)
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(Microsoft Corporation) C:\Windows\HelpPane.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1037608 2008-02-22] (Synaptics, Inc.)
HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [NvMediaCenter] => RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [6111232 2008-04-25] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1826816 2007-11-21] (Realtek Semiconductor Corp.)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2007-10-23] ()
HKLM\...\Run: [ZPdtWzdVitaKey MC3000] => C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe [3667968 2008-07-24] (Arachnoid Biometrics Identification Group Corp.)
HKLM\...\Run: [LManager] => C:\Program Files\Launch Manager\LManager.exe [793096 2008-04-01] (Dritek System Inc.)
HKLM\...\Run: [eAudio] => C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe [544768 2008-03-07] (Acer Incorporated)
HKLM\...\Run: [ePower_DMC] => C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe [397312 2008-04-30] (Acer Inc.)
HKLM\...\Run: [ControlCenter3] => C:\Program Files\Brother\ControlCenter3\brctrcen.exe [86016 2007-12-21] (Brother Industries, Ltd.)
HKLM\...\Run: [AvgUi] => D:\AVG\Framework\Common\avguix.exe [1139624 2015-08-20] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [AVG_UI] => C:\Program Files\AVG\AVG2015\avgui.exe [3775912 2015-08-24] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [combofix] => C:\ComboFix\Combobatch.bat [8272 2015-09-01] ()
Winlogon\Notify\AWinNotifyVitaKey MC3000: C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll [2008-07-24] (Arachnoid Biometrics Identification Group Corp.)
HKU\S-1-5-21-5983412-2541121911-1157762278-1000\...\Run: [Spotify Web Helper] => C:\Users\Jan\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-05-19] (Spotify Ltd)
HKU\S-1-5-21-5983412-2541121911-1157762278-1000\...\Run: [Dropbox Update] => C:\Users\Jan\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jan\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jan\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jan\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll [2008-03-04] (Egis Incorporated)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VPN Client.lnk [2015-04-05]
ShortcutTarget: VPN Client.lnk -> C:\Windows\Installer\{51FB15F4-AD27-43BC-AD4B-DD0354FB6BBD}\Icon3E5562ED7.ico ()
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt..)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704 2011-08-31] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{A6E9DDEE-0B07-4CB5-9542-49665845B74B}: [DhcpNameServer] 192.168.178.1
Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Richtlinienbeschränkung <======= ACHTUNG
HKU\S-1-5-21-5983412-2541121911-1157762278-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Richtlinienbeschränkung <======= ACHTUNG
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.intl.acer.yahoo.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-5983412-2541121911-1157762278-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-5983412-2541121911-1157762278-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www2.delta-search.com/?babsrc=HP_ss&mntrId=240E0016EA56B080&affID=121565&tsp=4996
SearchScopes: HKU\S-1-5-21-5983412-2541121911-1157762278-1000 -> DefaultScope {DECA3892-BA8F-44b8-A993-A466AD694AE4} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-acer
SearchScopes: HKU\S-1-5-21-5983412-2541121911-1157762278-1000 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www2.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=240E0016EA56B080&affID=121565&tsp=4996
SearchScopes: HKU\S-1-5-21-5983412-2541121911-1157762278-1000 -> {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL =
SearchScopes: HKU\S-1-5-21-5983412-2541121911-1157762278-1000 -> {DECA3892-BA8F-44b8-A993-A466AD694AE4} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-acer
BHO: PDF Architect 3 Helper -> {06E08260-0695-4EC1-A74B-1310D8899D93} -> C:\Program Files\PDF Architect 3\creator-ie-helper.dll [2015-04-24] (pdfforge GmbH)
BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2013-04-16] (RealDownloader)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-06-15] (Oracle Corporation)
BHO: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-06-15] (Oracle Corporation)
BHO: DVDVideoSoft WebPageAdjuster Class -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll Keine Datei
Toolbar: HKLM - Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll [2008-03-04] (Egis Incorporated.)
Toolbar: HKLM - PDF Architect 3 Toolbar - {2DFF3579-5AA7-45B9-9328-1D38EA230861} - C:\Program Files\PDF Architect 3\creator-ie-plugin.dll [2015-04-24] (pdfforge GmbH)
DPF: {CAFEEFAC-0017-0000-0051-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_51-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_51-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2001-06-21] (Microsoft Corporation)
FireFox:
========
FF ProfilePath: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default
FF Homepage: hxxp://google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-13] ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2013-04-08] ()
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-06-15] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-06-15] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2010-04-17] (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-30] (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=16.0.2.32 -> d:\realplayer\Netscape6\nppl3260.dll [2013-07-27] (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlchromebrowserrecordext;version=1.3.2 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll [2013-04-16] (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlhtml5videoshim;version=1.3.2 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll [2013-04-16] (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlpepperflashvideoshim;version=1.3.2 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll [2013-04-16] (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=16.0.2.32 -> d:\realplayer\Netscape6\nprpplugin.dll [2013-07-27] (RealPlayer)
FF Plugin: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll [2013-04-16] (RealDownloader)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-09-01] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-09-01] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-06-27] (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\user.js [2013-09-05]
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFFICE.DLL [2007-03-22] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2015-06-27] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppl3260.dll [2013-07-27] (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2013-06-29] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2013-06-29] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2013-06-29] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2013-06-29] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2013-06-29] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nprpplugin.dll [2013-07-27] (RealPlayer)
FF SearchPlugin: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\searchplugins\icqplugin-1.xml [2015-08-29]
FF SearchPlugin: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\searchplugins\icqplugin-2.xml [2009-05-04]
FF SearchPlugin: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\searchplugins\icqplugin-3.xml [2009-06-14]
FF SearchPlugin: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\searchplugins\icqplugin-4.xml [2009-09-28]
FF SearchPlugin: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\searchplugins\icqplugin-5.xml [2009-10-29]
FF SearchPlugin: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\searchplugins\icqplugin-6.xml [2009-12-18]
FF SearchPlugin: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\searchplugins\icqplugin-7.xml [2010-01-12]
FF SearchPlugin: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\searchplugins\icqplugin.xml [2009-04-20]
FF Extension: Avira Browser Safety - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\Extensions\abs@avira.com [2015-08-12]
FF Extension: Conduit Engine - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\Extensions\engine@conduit.com [2010-12-21]
FF Extension: vShare Plugin - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\Extensions\vshare@toolbar [2010-10-02]
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-10-09]
FF Extension: Yahoo! Toolbar - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2015-03-03]
FF Extension: PsicoTSI - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\Extensions\{7E77F5DF-8022-40e3-9122-F03DEBEFC43B} [2010-02-04]
FF Extension: FoxTrick - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\Extensions\{9d1f059c-cada-4111-9696-41a62d64e3ba} [2015-05-29]
FF Extension: Gmail S/MIME - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\Extensions\{4c197c8f-a50f-4b49-a2d2-ed922c95612f}.xpi [2012-08-22]
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012-11-21]
FF Extension: Adblock Plus - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-12-15]
FF Extension: ICQ Toolbar - C:\Program Files\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2015-08-29]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-03-17]
FF HKLM\...\Firefox\Extensions: [{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF HKLM\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff
FF HKLM\...\Firefox\Extensions: [{FCE04E1F-9378-4f39-96F6-5689A9159E45}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013-07-27]
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF HKLM\...\Firefox\Extensions: [pdf_architect_3_conv@pdfarchitect.org] - C:\Program Files\PDF Architect 3\resources\pdfarchitect3firefoxextension
FF Extension: PDF Architect 3 Creator - C:\Program Files\PDF Architect 3\resources\pdfarchitect3firefoxextension [2015-06-29]
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\itms.js [2015-08-29]
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [dhkplhfnhceodhffomolpfigojocbpcb] - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbar.crx <nicht gefunden>
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-04-16]
CHR HKLM\...\Chrome\Extension: [leocdeigfnkaojcapikdjcdbedcjmffc] - C:\Users\Jan\AppData\Local\CRE\leocdeigfnkaojcapikdjcdbedcjmffc.crx [2013-01-31]
CHR HKU\S-1-5-21-5983412-2541121911-1157762278-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [leocdeigfnkaojcapikdjcdbedcjmffc] - C:\Users\Jan\AppData\Local\CRE\leocdeigfnkaojcapikdjcdbedcjmffc.crx [2013-01-31]
CHR HKU\S-1-5-21-5983412-2541121911-1157762278-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx <nicht gefunden>
==================== Dienste (Nicht auf der Ausnahmeliste) ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
S2 AVGIDSAgent; C:\Program Files\AVG\AVG2015\avgidsagent.exe [3637160 2015-08-24] (AVG Technologies CZ, s.r.o.)
S2 avgsvc; D:\AVG\Framework\Common\avgsvcx.exe [869288 2015-08-20] (AVG Technologies CZ, s.r.o.)
S2 avgwd; C:\Program Files\AVG\AVG2015\avgwdsvc.exe [335656 2015-08-24] (AVG Technologies CZ, s.r.o.)
S2 BUNAgentSvc; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [16384 2008-03-03] (NewTech Infosystems, Inc.) [Datei ist nicht signiert]
S2 CLHNService; C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [81504 2008-01-16] () [Datei ist nicht signiert]
S2 CVPND; D:\webvpn\cvpnd.exe [1528608 2008-08-29] (Cisco Systems, Inc.)
S2 ETService; C:\Program Files\Acer\Empowering Technology\Service\ETService.exe [24576 2008-03-21] () [Datei ist nicht signiert]
S2 IGBASVC; C:\Program Files\Acer\Acer Bio Protection\BASVC.exe [3517440 2008-07-24] () [Datei ist nicht signiert]
S2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [61440 2007-01-17] (Hewlett-Packard Company) [Datei ist nicht signiert]
S2 MobilityService; C:\Acer\Mobility Center\MobilityService.exe [110592 2007-12-06] () [Datei ist nicht signiert]
S2 NAUpdate; C:\Program Files\Nero\Update\NASvc.exe [503080 2010-05-04] (Nero AG)
S2 NTISchedulerSvc; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [131072 2008-04-04] () [Datei ist nicht signiert]
S3 PDF Architect 3; C:\Program Files\PDF Architect 3\ws.exe [2244312 2015-04-24] (pdfforge GmbH)
S3 PDF Architect 3 CrashHandler; C:\Program Files\PDF Architect 3\crash-handler-ws.exe [901336 2015-04-24] (pdfforge GmbH)
S2 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-04-16] ()
S2 RS_Service; C:\Program Files\Acer\Acer VCM\RS_Service.exe [233472 2008-01-10] (Acer Incorporated) [Datei ist nicht signiert]
S2 SkypeUpdate; D:\Skype\Updater\Updater.exe [327296 2015-07-09] (Skype Technologies)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-21] (Microsoft Corporation)
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R0 AlfaFF; C:\Windows\System32\Drivers\AlfaFF.sys [43184 2008-07-24] (Alfa Corporation)
S3 ATSWPDRV; C:\Windows\System32\DRIVERS\ATSwpDrv.sys [146944 2008-05-30] (AuthenTec, Inc.)
S1 Avgdiskx; C:\Windows\System32\DRIVERS\avgdiskx.sys [132576 2015-03-11] (AVG Technologies CZ, s.r.o.)
S1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [250800 2015-08-19] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [222640 2015-08-19] (AVG Technologies CZ, s.r.o.)
S1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [31664 2015-07-23] (AVG Technologies CZ, s.r.o.)
S1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [207328 2015-06-16] (AVG Technologies CZ, s.r.o.)
S0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [290272 2015-05-07] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [189872 2015-08-04] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [35808 2015-03-20] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [230832 2015-08-04] (AVG Technologies CZ, s.r.o.)
S3 CVirtA; C:\Windows\System32\DRIVERS\CVirtA.sys [5275 2007-01-18] (Cisco Systems, Inc.)
S2 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306299 2008-08-29] (Cisco Systems, Inc.) [Datei ist nicht signiert]
R3 DNE; C:\Windows\System32\DRIVERS\dne2000.sys [125328 2008-03-29] (Deterministic Networks, Inc.)
S2 int15; C:\Windows\system32\drivers\int15.sys [69632 2007-01-26] () [Datei ist nicht signiert]
S2 NTIPPKernel; C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys [122368 2008-01-16] (Cyberlink Corp.) [Datei ist nicht signiert]
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [721904 2009-12-23] () [Datei ist nicht signiert]
S2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl [61424 2008-04-18] (Cyberlink Corp.)
U3 alx6cm63; C:\Windows\system32\Drivers\alx6cm63.sys [0 ] (Microsoft Corporation) <==== ACHTUNG (Null Byte Datei/Ordner)
S2 adfs; kein ImagePath
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Jan\AppData\Local\Temp\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-09-02 17:15 - 2015-07-21 22:55 - 01206192 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-09-02 17:15 - 2015-07-21 18:07 - 03605440 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-09-02 17:15 - 2015-07-21 18:07 - 03553216 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-09-02 17:15 - 2015-07-21 18:07 - 00140224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ecache.sys
2015-09-02 17:15 - 2015-07-21 18:07 - 00056256 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-09-02 17:15 - 2015-07-21 18:03 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\emdmgmt.dll
2015-09-02 17:15 - 2015-07-21 18:03 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-09-02 17:15 - 2015-07-21 18:03 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-09-02 17:10 - 2015-07-31 21:27 - 00103120 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-09-02 17:09 - 2015-07-09 16:20 - 00304640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2015-09-02 17:08 - 2015-07-10 21:37 - 02067968 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-09-02 17:07 - 2015-07-11 17:56 - 11587584 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-09-02 17:02 - 2015-07-18 18:03 - 00068608 _____ (Microsoft Corporation) C:\Windows\system32\basesrv.dll
2015-09-02 17:01 - 2015-07-10 21:37 - 01402368 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2015-09-02 17:01 - 2015-07-10 21:37 - 01253376 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-09-02 16:59 - 2015-08-01 00:08 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-09-02 16:59 - 2015-07-31 23:46 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2015-09-02 16:59 - 2015-07-31 23:46 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2015-09-02 16:59 - 2015-07-31 23:46 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2015-09-02 16:59 - 2015-07-31 23:46 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2015-09-02 16:59 - 2015-07-31 22:41 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2015-09-02 16:59 - 2015-07-31 22:40 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2015-09-02 16:59 - 2015-07-31 22:35 - 00682496 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2015-09-02 16:59 - 2015-07-31 22:33 - 02066944 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-09-02 16:59 - 2015-07-31 22:33 - 01072640 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-09-02 16:59 - 2015-07-31 22:33 - 00802304 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-09-02 16:59 - 2015-07-31 22:33 - 00297472 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-09-02 16:56 - 2015-07-01 17:57 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2015-09-02 16:55 - 2015-07-09 16:25 - 00151040 _____ (Microsoft Corporation) C:\Windows\system32\notepad.exe
2015-09-02 16:55 - 2015-07-09 16:25 - 00151040 _____ (Microsoft Corporation) C:\Windows\notepad.exe
2015-09-01 20:17 - 2015-09-01 21:49 - 00000000 ___SD C:\ComboFix
2015-09-01 20:17 - 2015-09-01 20:17 - 00000000 ____D C:\Qoobox
2015-09-01 20:17 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2015-09-01 20:17 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2015-09-01 20:17 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-09-01 20:17 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-09-01 20:17 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-09-01 20:17 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2015-09-01 20:17 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2015-09-01 20:17 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2015-09-01 20:16 - 2015-09-01 20:46 - 00000000 ____D C:\Windows\erdnt
2015-09-01 20:16 - 2015-09-01 20:17 - 00000000 ___SD C:\32788R22FWJFW
2015-09-01 20:11 - 2015-09-01 20:11 - 05635829 ____R (Swearware) C:\Users\Jan\Downloads\ComboFix.exe
2015-09-01 20:08 - 2015-09-01 20:08 - 00000561 _____ C:\Users\Jan\Desktop\Revo Uninstaller.lnk
2015-09-01 20:06 - 2015-09-01 20:07 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Jan\Downloads\revosetup95.exe
2015-09-01 19:54 - 2015-09-01 19:54 - 00000000 ____D C:\Users\Jan\AppData\Roaming\AVG2015
2015-09-01 19:53 - 2015-09-01 19:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-09-01 19:52 - 2015-09-01 19:54 - 00000000 ____D C:\ProgramData\AVG2015
2015-09-01 19:52 - 2015-09-01 19:52 - 00000000 ___HD C:\$AVG
2015-09-01 19:51 - 2015-09-01 19:51 - 00000000 ____D C:\Program Files\AVG
2015-09-01 19:47 - 2015-09-02 19:06 - 00000000 ____D C:\ProgramData\MFAData
2015-09-01 19:47 - 2015-09-01 22:14 - 00000000 ____D C:\Users\Jan\AppData\Local\Avg2015
2015-09-01 19:47 - 2015-09-01 19:47 - 00000000 ____D C:\Users\Jan\AppData\Local\MFAData
2015-09-01 19:46 - 2015-09-01 19:46 - 00000551 _____ C:\Users\Public\Desktop\AVG.lnk
2015-09-01 19:44 - 2015-09-01 19:46 - 00000000 ____D C:\ProgramData\Avg
2015-09-01 19:42 - 2015-09-01 19:54 - 00000000 ____D C:\Users\Jan\AppData\Local\AvgSetupLog
2015-09-01 19:42 - 2015-09-01 19:42 - 00000000 ____D C:\Users\Jan\AppData\Local\Avg
2015-09-01 19:41 - 2015-09-01 19:42 - 16902256 _____ (AVG Technologies) C:\Users\Jan\Downloads\avg_gsr_stb_all_ltst_94.exe
2015-09-01 13:17 - 2015-09-01 13:19 - 00056090 _____ C:\Users\Jan\Downloads\Addition.txt
2015-09-01 13:15 - 2015-09-02 19:16 - 00000000 _____ C:\Users\Jan\Downloads\FRST.txt
2015-09-01 13:14 - 2015-09-02 19:16 - 00000000 ____D C:\FRST
2015-09-01 13:13 - 2015-09-01 13:13 - 01690624 _____ (Farbar) C:\Users\Jan\Downloads\FRST.exe
2015-09-01 10:38 - 2015-09-01 10:38 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-09-01 10:34 - 2015-09-01 10:37 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Jan\Downloads\mbam-setup-2.1.8.1057.exe
2015-08-29 19:24 - 2015-08-29 19:24 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-08-29 13:36 - 2015-09-01 16:14 - 00000000 ____D C:\Program Files\Mozilla Firefox
2015-08-29 13:05 - 2015-08-29 13:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-08-29 13:05 - 2015-08-29 13:05 - 00000000 ____D C:\Program Files\Skype
2015-08-29 13:05 - 2015-08-29 13:05 - 00000000 ____D C:\Program Files\Common Files\Skype
2015-08-19 11:52 - 2015-08-19 11:52 - 00250800 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdriverx.sys
2015-08-19 11:52 - 2015-08-19 11:52 - 00222640 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidshx.sys
2015-08-12 12:36 - 2015-07-22 22:54 - 12386816 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-08-12 12:36 - 2015-07-22 22:54 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-08-12 12:36 - 2015-07-22 22:51 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-08-12 12:36 - 2015-07-22 22:47 - 09751040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-08-12 12:36 - 2015-07-22 22:46 - 01139712 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-08-12 12:36 - 2015-07-22 22:46 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-08-12 12:36 - 2015-07-22 22:45 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-08-12 12:36 - 2015-07-22 22:45 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-08-12 12:36 - 2015-07-22 22:45 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-08-12 12:36 - 2015-07-22 22:44 - 01804288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-08-12 12:36 - 2015-07-22 22:44 - 00718336 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-08-12 12:36 - 2015-07-22 22:44 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-08-12 12:36 - 2015-07-22 22:44 - 00421888 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-08-12 12:36 - 2015-07-22 22:44 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-08-12 12:36 - 2015-07-22 22:43 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-08-12 12:36 - 2015-07-22 22:43 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-08-12 12:36 - 2015-07-22 22:43 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-08-12 12:36 - 2015-07-22 22:43 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-08-12 12:36 - 2015-07-22 22:43 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-08-12 12:36 - 2015-07-22 22:43 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-08-12 12:36 - 2015-07-22 22:43 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-08-12 12:36 - 2015-07-22 22:42 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-08-05 00:03 - 2015-08-05 00:03 - 00877152 _____ (Microsoft Corporation) C:\Windows\system32\msvcr120_clr0400.dll
2015-08-05 00:03 - 2015-08-05 00:03 - 00538208 _____ (Microsoft Corporation) C:\Windows\system32\msvcp120_clr0400.dll
2015-08-04 11:33 - 2015-08-04 11:33 - 00230832 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgtdix.sys
2015-08-04 11:32 - 2015-08-04 11:32 - 00189872 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgmfx86.sys
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-09-02 19:10 - 2014-03-01 13:49 - 03915676 _____ C:\Windows\PFRO.log
2015-09-02 19:09 - 2015-06-12 20:57 - 00001216 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-5983412-2541121911-1157762278-1000UA.job
2015-09-02 19:09 - 2008-07-24 04:00 - 00042369 _____ C:\ProgramData\nvModes.001
2015-09-02 19:08 - 2009-10-17 14:29 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-09-02 19:08 - 2008-07-24 04:12 - 00000000 _____ C:\Windows\system32\LogConfigTemp.xml
2015-09-02 19:08 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Microsoft.NET
2015-09-02 19:06 - 2009-10-17 14:29 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-09-02 19:06 - 2008-05-07 20:04 - 00000147 _____ C:\Windows\system32\agent.log
2015-09-02 19:06 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-09-02 19:06 - 2006-11-02 14:47 - 02310784 _____ C:\Windows\system32\FNTCACHE.DAT
2015-09-02 19:06 - 2006-11-02 14:47 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-09-02 19:06 - 2006-11-02 14:47 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-09-02 19:02 - 2010-08-20 17:04 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-09-02 17:19 - 2006-11-02 15:01 - 00032614 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-09-02 17:18 - 2008-07-24 03:54 - 01649642 _____ C:\Windows\WindowsUpdate.log
2015-09-02 17:18 - 2006-11-02 14:37 - 00000000 ____D C:\Windows\system32\XPSViewer
2015-09-02 17:15 - 2010-08-20 17:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-09-01 22:34 - 2006-11-02 12:33 - 00006658 _____ C:\Windows\system32\PerfStringBackup.INI
2015-09-01 20:47 - 2006-11-02 12:22 - 56360960 _____ C:\Windows\system32\config\software.bak
2015-09-01 20:47 - 2006-11-02 12:22 - 47710208 _____ C:\Windows\system32\config\COMPON~3.bak
2015-09-01 20:47 - 2006-11-02 12:22 - 27000832 _____ C:\Windows\system32\config\system.bak
2015-09-01 20:47 - 2006-11-02 12:22 - 00786432 _____ C:\Windows\system32\config\default.bak
2015-09-01 20:47 - 2006-11-02 12:22 - 00262144 _____ C:\Windows\system32\config\security.bak
2015-09-01 20:47 - 2006-11-02 12:22 - 00262144 _____ C:\Windows\system32\config\sam.bak
2015-09-01 20:09 - 2015-06-12 20:57 - 00001164 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-5983412-2541121911-1157762278-1000Core.job
2015-09-01 19:53 - 2010-12-20 18:23 - 00000000 ____D C:\Users\Jan\AppData\Roaming\TuneUp Software
2015-09-01 19:26 - 2012-01-13 11:54 - 00000000 ____D C:\ProgramData\Avira
2015-09-01 19:25 - 2010-03-16 17:04 - 00000000 ____D C:\Program Files\OpenOffice.org 3
2015-09-01 19:08 - 2009-04-10 14:27 - 00000000 ____D C:\Windows\wt
2015-09-01 19:03 - 2009-05-29 15:24 - 00001356 _____ C:\Users\Jan\AppData\Local\d3d9caps.dat
2015-09-01 10:09 - 2010-03-15 14:25 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Skype
2015-08-29 19:24 - 2012-09-03 16:49 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Dropbox
2015-08-29 19:23 - 2012-05-04 09:01 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2015-08-29 13:06 - 2010-03-15 14:24 - 00000000 ____D C:\ProgramData\Skype
2015-08-13 15:26 - 2012-04-03 11:27 - 00778440 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-08-13 15:26 - 2011-05-17 22:14 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-08-13 15:15 - 2013-02-13 01:46 - 00002425 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2009-05-28 18:45 - 2011-01-23 11:44 - 0002299 _____ () C:\Users\Jan\AppData\Roaming\acervcmtmp.ini
2009-05-29 15:24 - 2015-09-01 19:03 - 0001356 _____ () C:\Users\Jan\AppData\Local\d3d9caps.dat
2009-03-21 13:58 - 2015-03-08 11:19 - 0039424 _____ () C:\Users\Jan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-03-04 20:13 - 2014-06-15 16:56 - 0004096 ____H () C:\Users\Jan\AppData\Local\keyfile3.drm
2015-07-16 14:10 - 2015-07-16 14:10 - 0000873 _____ () C:\Users\Jan\AppData\Local\recently-used.xbel
2008-07-24 04:00 - 2015-09-02 19:09 - 0042369 _____ () C:\ProgramData\nvModes.001
2008-07-24 04:00 - 2010-10-01 13:14 - 0042369 _____ () C:\ProgramData\nvModes.dat
Einige Dateien in TEMP:
====================
C:\Users\Jan\AppData\Local\temp\GUR5031.exe
C:\Users\Jan\AppData\Local\temp\RtkBtMnt.exe
==================== Bamital & volsnap =================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2015-09-02 16:56
==================== Ende vom FRST.txt ============================
|
|
03.09.2015, 17:55
| #8 |
| /// the machine /// TB-Ausbilder | svchost belastet CPU, Malware-Funde was nun? Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKLM\...\Run: [combofix] => C:\ComboFix\Combobatch.bat [8272 2015-09-01] ()
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Rechner normal starten.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
03.09.2015, 19:06
| #9 |
| | svchost belastet CPU, Malware-Funde was nun?Code:
ATTFilter Entferungsergebnis von Farbar Recovery Scan Tool (x86) Version:31-08-2015
durchgeführt von Jan (2015-09-03 20:04:27) Run:2
Gestartet von C:\Users\Jan\Downloads
Geladene Profile: Jan (Verfügbare Profile: Jan)
Start-Modus: Safe Mode (with Networking)
==============================================
fixlist Inhalt:
*****************
HKLM\...\Run: [combofix] => C:\ComboFix\Combobatch.bat [8272 2015-09-01] ()
Emptytemp:
*****************
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\combofix => Wert nicht gefunden.
EmptyTemp: => 1.7 GB temporäre Dateien entfernt.
Das System musste neu gestartet werden.
==== Ende vom Fixlog 20:04:49 ====
|
|
04.09.2015, 17:36
| #10 |
| /// the machine /// TB-Ausbilder | svchost belastet CPU, Malware-Funde was nun? Kannste jetzt normal booten?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
05.09.2015, 00:34
| #11 |
| | svchost belastet CPU, Malware-Funde was nun? Ja, tut wieder ganz normal booten  |
|
05.09.2015, 15:10
| #12 |
| /// the machine /// TB-Ausbilder | svchost belastet CPU, Malware-Funde was nun? Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
05.09.2015, 18:29
| #13 |
| | svchost belastet CPU, Malware-Funde was nun? Ich hab den Mbam durchlaufen lassen, 144 Funde wurden in Quarantäne gesetzt, aber nach dem geforderten Neustart (habe mehrere Male versucht hochzufahren), bleibt der Bildschirm nach der Anmeldung schwarz und nur die Maus ist zu sehen... und auf das Programm kann ich ja im abgesicherten nicht zugreifen, bzgl. Protokol, bzw. ich finde die Anwendung nicht. |
|
06.09.2015, 07:14
| #14 |
| /// the machine /// TB-Ausbilder | svchost belastet CPU, Malware-Funde was nun? Das muss aber im Safe Mode gehen. Bitte mal ein FRST log im angesicherten Modus mit Netzwerk erstellen und posten.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
06.09.2015, 20:32
| #15 |
| | svchost belastet CPU, Malware-Funde was nun? jetzt hab ichs hinbekommen, aber komisch, dass da alle Werte bei 0 stehen, obwohl es 144 Funde gab.... mbam: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlaufdatum: 05.09.2015 Suchlaufzeit: 17:54:52 Protokolldatei: mbam.txt Administrator: Ja Version: 0.0.0.0000 Malware-Datenbank: v2015.09.05.04 Rootkit-Datenbank: v2015.08.16.01 Lizenz: Testversion Malware-Schutz: Aktiviert Schutz vor bösartigen Websites: Aktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows Vista Service Pack 2 CPU: x86 Dateisystem: NTFS Benutzer: Jan Suchlauftyp: Bedrohungssuchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 332446 Abgelaufene Zeit: 51 Min., 2 Sek. Speicher: Aktiviert Start: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (keine bösartigen Elemente erkannt) Module: 0 (keine bösartigen Elemente erkannt) Registrierungsschlüssel: 0 (keine bösartigen Elemente erkannt) Registrierungswerte: 0 (keine bösartigen Elemente erkannt) Registrierungsdaten: 0 (keine bösartigen Elemente erkannt) Ordner: 0 (keine bösartigen Elemente erkannt) Dateien: 0 (keine bösartigen Elemente erkannt) Physische Sektoren: 0 (keine bösartigen Elemente erkannt) (end) Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x86) Version:06-09-2015 01 durchgeführt von Jan (Administrator) auf JAN-PC (06-09-2015 21:28:29) Gestartet von C:\Users\Jan\Downloads Geladene Profile: Jan (Verfügbare Profile: Jan) Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) Sprache: Deutsch (Deutschland) Internet Explorer Version 9 (Standard-Browser: FF) Start-Modus: Safe Mode (with Networking) Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Prozesse (Nicht auf der Ausnahmeliste) ================= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.) (Microsoft Corporation) C:\Windows\HelpPane.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (Malwarebytes Corporation) D:\ Malwarebytes Anti-Malware \mbam.exe ==================== Registry (Nicht auf der Ausnahmeliste) =========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1037608 2008-02-22] (Synaptics, Inc.) HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup HKLM\...\Run: [NvMediaCenter] => RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [6111232 2008-04-25] (Realtek Semiconductor) HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1826816 2007-11-21] (Realtek Semiconductor Corp.) HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2007-10-23] () HKLM\...\Run: [ZPdtWzdVitaKey MC3000] => C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe [3667968 2008-07-24] (Arachnoid Biometrics Identification Group Corp.) HKLM\...\Run: [LManager] => C:\Program Files\Launch Manager\LManager.exe [793096 2008-04-01] (Dritek System Inc.) HKLM\...\Run: [eAudio] => C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe [544768 2008-03-07] (Acer Incorporated) HKLM\...\Run: [ePower_DMC] => C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe [397312 2008-04-30] (Acer Inc.) HKLM\...\Run: [ControlCenter3] => C:\Program Files\Brother\ControlCenter3\brctrcen.exe [86016 2007-12-21] (Brother Industries, Ltd.) HKLM\...\Run: [AvgUi] => D:\AVG\Framework\Common\avguix.exe [1139624 2015-08-20] (AVG Technologies CZ, s.r.o.) HKLM\...\Run: [AVG_UI] => C:\Program Files\AVG\AVG2015\avgui.exe [3775912 2015-08-24] (AVG Technologies CZ, s.r.o.) HKLM\...\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] => C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \mbamdor.exe [54072 2015-06-18] (Malwarebytes Corporation) Winlogon\Notify\AWinNotifyVitaKey MC3000: C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll [2008-07-24] (Arachnoid Biometrics Identification Group Corp.) HKU\S-1-5-21-5983412-2541121911-1157762278-1000\...\Run: [Spotify Web Helper] => C:\Users\Jan\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-05-19] (Spotify Ltd) HKU\S-1-5-21-5983412-2541121911-1157762278-1000\...\Run: [Dropbox Update] => C:\Users\Jan\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jan\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jan\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jan\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll [2008-03-04] (Egis Incorporated) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VPN Client.lnk [2015-04-05] ShortcutTarget: VPN Client.lnk -> C:\Windows\Installer\{51FB15F4-AD27-43BC-AD4B-DD0354FB6BBD}\Icon3E5562ED7.ico () ==================== Internet (Nicht auf der Ausnahmeliste) ==================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt..) Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704 2011-08-31] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 Tcpip\..\Interfaces\{A6E9DDEE-0B07-4CB5-9542-49665845B74B}: [DhcpNameServer] 192.168.178.1 Internet Explorer: ================== HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Richtlinienbeschränkung <======= ACHTUNG HKU\S-1-5-21-5983412-2541121911-1157762278-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Richtlinienbeschränkung <======= ACHTUNG HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.intl.acer.yahoo.com HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome HKU\S-1-5-21-5983412-2541121911-1157762278-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch SearchScopes: HKU\S-1-5-21-5983412-2541121911-1157762278-1000 -> DefaultScope {DECA3892-BA8F-44b8-A993-A466AD694AE4} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-acer SearchScopes: HKU\S-1-5-21-5983412-2541121911-1157762278-1000 -> {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = SearchScopes: HKU\S-1-5-21-5983412-2541121911-1157762278-1000 -> {DECA3892-BA8F-44b8-A993-A466AD694AE4} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-acer BHO: PDF Architect 3 Helper -> {06E08260-0695-4EC1-A74B-1310D8899D93} -> C:\Program Files\PDF Architect 3\creator-ie-helper.dll [2015-04-24] (pdfforge GmbH) BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2013-04-16] (RealDownloader) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-06-15] (Oracle Corporation) BHO: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22] (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-06-15] (Oracle Corporation) BHO: DVDVideoSoft WebPageAdjuster Class -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll Keine Datei Toolbar: HKLM - Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll [2008-03-04] (Egis Incorporated.) Toolbar: HKLM - PDF Architect 3 Toolbar - {2DFF3579-5AA7-45B9-9328-1D38EA230861} - C:\Program Files\PDF Architect 3\creator-ie-plugin.dll [2015-04-24] (pdfforge GmbH) DPF: {CAFEEFAC-0017-0000-0051-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_51-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_51-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2001-06-21] (Microsoft Corporation) FireFox: ======== FF ProfilePath: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default FF Homepage: hxxp://google.de/ FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-13] () FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2013-04-08] () FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google) FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-06-15] (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-06-15] (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.) FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2010-04-17] (Microsoft Corporation) FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-30] (Microsoft Corporation) FF Plugin: @real.com/nppl3260;version=16.0.2.32 -> d:\realplayer\Netscape6\nppl3260.dll [2013-07-27] (RealNetworks, Inc.) FF Plugin: @real.com/nprndlchromebrowserrecordext;version=1.3.2 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll [2013-04-16] (RealNetworks, Inc.) FF Plugin: @real.com/nprndlhtml5videoshim;version=1.3.2 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll [2013-04-16] (RealNetworks, Inc.) FF Plugin: @real.com/nprndlpepperflashvideoshim;version=1.3.2 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll [2013-04-16] (RealNetworks, Inc.) FF Plugin: @real.com/nprpplugin;version=16.0.2.32 -> d:\realplayer\Netscape6\nprpplugin.dll [2013-07-27] (RealPlayer) FF Plugin: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll [2013-04-16] (RealDownloader) FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-09-01] (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-09-01] (Google Inc.) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-06-27] (Adobe Systems Inc.) FF user.js: detected! => C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\user.js [2013-09-05] FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFFICE.DLL [2007-03-22] (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2015-06-27] (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppl3260.dll [2013-07-27] (RealNetworks, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2013-06-29] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2013-06-29] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2013-06-29] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2013-06-29] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2013-06-29] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nprpplugin.dll [2013-07-27] (RealPlayer) FF Extension: Avira Browser Safety - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\Extensions\abs@avira.com [2015-08-12] FF Extension: vShare Plugin - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\Extensions\vshare@toolbar [2010-10-02] FF Extension: Microsoft .NET Framework Assistant - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-10-09] FF Extension: Yahoo! Toolbar - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2015-03-03] FF Extension: PsicoTSI - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\Extensions\{7E77F5DF-8022-40e3-9122-F03DEBEFC43B} [2010-02-04] FF Extension: FoxTrick - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\Extensions\{9d1f059c-cada-4111-9696-41a62d64e3ba} [2015-05-29] FF Extension: Gmail S/MIME - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\Extensions\{4c197c8f-a50f-4b49-a2d2-ed922c95612f}.xpi [2012-08-22] FF Extension: Adblock Plus - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\hq7edut1.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-12-15] FF Extension: ICQ Toolbar - C:\Program Files\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2015-08-29] FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-03-17] FF HKLM\...\Firefox\Extensions: [{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext FF HKLM\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff FF HKLM\...\Firefox\Extensions: [{FCE04E1F-9378-4f39-96F6-5689A9159E45}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013-07-27] FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext FF HKLM\...\Firefox\Extensions: [pdf_architect_3_conv@pdfarchitect.org] - C:\Program Files\PDF Architect 3\resources\pdfarchitect3firefoxextension FF Extension: PDF Architect 3 Creator - C:\Program Files\PDF Architect 3\resources\pdfarchitect3firefoxextension [2015-06-29] FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\itms.js [2015-08-29] Chrome: ======= CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx CHR HKLM\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-04-16] CHR HKLM\...\Chrome\Extension: [leocdeigfnkaojcapikdjcdbedcjmffc] - <kein Path\update_url> CHR HKU\S-1-5-21-5983412-2541121911-1157762278-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx <nicht gefunden> ==================== Dienste (Nicht auf der Ausnahmeliste) ======================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) S2 AVGIDSAgent; C:\Program Files\AVG\AVG2015\avgidsagent.exe [3637160 2015-08-24] (AVG Technologies CZ, s.r.o.) S2 avgsvc; D:\AVG\Framework\Common\avgsvcx.exe [869288 2015-08-20] (AVG Technologies CZ, s.r.o.) S2 avgwd; C:\Program Files\AVG\AVG2015\avgwdsvc.exe [335656 2015-08-24] (AVG Technologies CZ, s.r.o.) S2 BUNAgentSvc; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [16384 2008-03-03] (NewTech Infosystems, Inc.) [Datei ist nicht signiert] S2 CLHNService; C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [81504 2008-01-16] () [Datei ist nicht signiert] S2 CVPND; D:\webvpn\cvpnd.exe [1528608 2008-08-29] (Cisco Systems, Inc.) S2 ETService; C:\Program Files\Acer\Empowering Technology\Service\ETService.exe [24576 2008-03-21] () [Datei ist nicht signiert] S2 IGBASVC; C:\Program Files\Acer\Acer Bio Protection\BASVC.exe [3517440 2008-07-24] () [Datei ist nicht signiert] S2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [61440 2007-01-17] (Hewlett-Packard Company) [Datei ist nicht signiert] S2 MBAMScheduler; D:\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation) S2 MBAMService; D:\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation) S2 MobilityService; C:\Acer\Mobility Center\MobilityService.exe [110592 2007-12-06] () [Datei ist nicht signiert] S2 NAUpdate; C:\Program Files\Nero\Update\NASvc.exe [503080 2010-05-04] (Nero AG) S2 NTISchedulerSvc; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [131072 2008-04-04] () [Datei ist nicht signiert] S3 PDF Architect 3; C:\Program Files\PDF Architect 3\ws.exe [2244312 2015-04-24] (pdfforge GmbH) S3 PDF Architect 3 CrashHandler; C:\Program Files\PDF Architect 3\crash-handler-ws.exe [901336 2015-04-24] (pdfforge GmbH) S2 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-04-16] () S2 RS_Service; C:\Program Files\Acer\Acer VCM\RS_Service.exe [233472 2008-01-10] (Acer Incorporated) [Datei ist nicht signiert] S2 SkypeUpdate; D:\Skype\Updater\Updater.exe [327296 2015-07-09] (Skype Technologies) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-21] (Microsoft Corporation) ===================== Treiber (Nicht auf der Ausnahmeliste) ========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) R0 AlfaFF; C:\Windows\System32\Drivers\AlfaFF.sys [43184 2008-07-24] (Alfa Corporation) S3 ATSWPDRV; C:\Windows\System32\DRIVERS\ATSwpDrv.sys [146944 2008-05-30] (AuthenTec, Inc.) S1 Avgdiskx; C:\Windows\System32\DRIVERS\avgdiskx.sys [132576 2015-03-11] (AVG Technologies CZ, s.r.o.) S1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [250800 2015-08-19] (AVG Technologies CZ, s.r.o.) R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [222640 2015-08-19] (AVG Technologies CZ, s.r.o.) S1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [31664 2015-07-23] (AVG Technologies CZ, s.r.o.) S1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [207328 2015-06-16] (AVG Technologies CZ, s.r.o.) S0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [290272 2015-05-07] (AVG Technologies CZ, s.r.o.) R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [189872 2015-08-04] (AVG Technologies CZ, s.r.o.) R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [35808 2015-03-20] (AVG Technologies CZ, s.r.o.) R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [230832 2015-08-04] (AVG Technologies CZ, s.r.o.) S3 CVirtA; C:\Windows\System32\DRIVERS\CVirtA.sys [5275 2007-01-18] (Cisco Systems, Inc.) S2 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306299 2008-08-29] (Cisco Systems, Inc.) [Datei ist nicht signiert] R3 DNE; C:\Windows\System32\DRIVERS\dne2000.sys [125328 2008-03-29] (Deterministic Networks, Inc.) S2 int15; C:\Windows\system32\drivers\int15.sys [69632 2007-01-26] () [Datei ist nicht signiert] S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-06-18] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [98520 2015-09-06] (Malwarebytes Corporation) S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-06-18] (Malwarebytes Corporation) S2 NTIPPKernel; C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys [122368 2008-01-16] (Cyberlink Corp.) [Datei ist nicht signiert] R0 sptd; C:\Windows\System32\Drivers\sptd.sys [721904 2009-12-23] () [Datei ist nicht signiert] S2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl [61424 2008-04-18] (Cyberlink Corp.) U3 as0tzvr8; C:\Windows\system32\Drivers\as0tzvr8.sys [0 ] (Microsoft Corporation) <==== ACHTUNG (Null Byte Datei/Ordner) S2 adfs; kein ImagePath U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation) S3 catchme; \??\C:\Users\Jan\AppData\Local\Temp\catchme.sys [X] S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] ==================== NetSvcs (Nicht auf der Ausnahmeliste) =================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) ==================== Ein Monat: Erstellte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2015-09-06 21:28 - 2015-09-06 21:28 - 00000000 ____D C:\Users\Jan\Downloads\FRST-OlderVersion 2015-09-06 21:27 - 2015-09-06 21:27 - 00001203 _____ C:\Users\Jan\Desktop\mbam.txt 2015-09-06 21:23 - 2015-09-06 21:23 - 00000569 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-09-06 21:23 - 2015-09-06 21:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-09-06 20:54 - 2015-09-06 20:54 - 00000326 _____ C:\Windows\Tasks\0615pizUpdateInfo.job 2015-09-06 20:54 - 2015-09-06 20:54 - 00000000 ____D C:\ProgramData\Avg_Update_0615piz 2015-09-05 16:40 - 2015-09-06 21:24 - 00098520 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-09-05 16:39 - 2015-06-18 08:41 - 00094936 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-09-05 16:39 - 2015-06-18 08:41 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-09-05 16:39 - 2015-06-18 08:41 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-09-05 16:35 - 2015-09-05 16:36 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Jan\Downloads\mbam-setup-2.1.8.1057(1).exe 2015-09-02 17:15 - 2015-07-21 22:55 - 01206192 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2015-09-02 17:15 - 2015-07-21 18:07 - 03605440 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe 2015-09-02 17:15 - 2015-07-21 18:07 - 03553216 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-09-02 17:15 - 2015-07-21 18:07 - 00140224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ecache.sys 2015-09-02 17:15 - 2015-07-21 18:07 - 00056256 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys 2015-09-02 17:15 - 2015-07-21 18:03 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\emdmgmt.dll 2015-09-02 17:15 - 2015-07-21 18:03 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll 2015-09-02 17:15 - 2015-07-21 18:03 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll 2015-09-02 17:10 - 2015-07-31 21:27 - 00103120 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll 2015-09-02 17:09 - 2015-07-09 16:20 - 00304640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys 2015-09-02 17:08 - 2015-07-10 21:37 - 02067968 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll 2015-09-02 17:07 - 2015-07-11 17:56 - 11587584 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2015-09-02 17:02 - 2015-07-18 18:03 - 00068608 _____ (Microsoft Corporation) C:\Windows\system32\basesrv.dll 2015-09-02 17:01 - 2015-07-10 21:37 - 01402368 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll 2015-09-02 17:01 - 2015-07-10 21:37 - 01253376 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2015-09-02 16:59 - 2015-08-01 00:08 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll 2015-09-02 16:59 - 2015-07-31 23:46 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll 2015-09-02 16:59 - 2015-07-31 23:46 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll 2015-09-02 16:59 - 2015-07-31 23:46 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll 2015-09-02 16:59 - 2015-07-31 23:46 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll 2015-09-02 16:59 - 2015-07-31 22:41 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2015-09-02 16:59 - 2015-07-31 22:40 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll 2015-09-02 16:59 - 2015-07-31 22:35 - 00682496 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll 2015-09-02 16:59 - 2015-07-31 22:33 - 02066944 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-09-02 16:59 - 2015-07-31 22:33 - 01072640 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll 2015-09-02 16:59 - 2015-07-31 22:33 - 00802304 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll 2015-09-02 16:59 - 2015-07-31 22:33 - 00297472 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll 2015-09-02 16:56 - 2015-07-01 17:57 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll 2015-09-02 16:55 - 2015-07-09 16:25 - 00151040 _____ (Microsoft Corporation) C:\Windows\system32\notepad.exe 2015-09-02 16:55 - 2015-07-09 16:25 - 00151040 _____ (Microsoft Corporation) C:\Windows\notepad.exe 2015-09-01 20:17 - 2015-09-01 21:49 - 00000000 ___SD C:\ComboFix 2015-09-01 20:17 - 2015-09-01 20:17 - 00000000 ____D C:\Qoobox 2015-09-01 20:17 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe 2015-09-01 20:17 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe 2015-09-01 20:17 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2015-09-01 20:17 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2015-09-01 20:17 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2015-09-01 20:17 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe 2015-09-01 20:17 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe 2015-09-01 20:17 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe 2015-09-01 20:16 - 2015-09-01 20:46 - 00000000 ____D C:\Windows\erdnt 2015-09-01 20:16 - 2015-09-01 20:17 - 00000000 ___SD C:\32788R22FWJFW 2015-09-01 20:11 - 2015-09-01 20:11 - 05635829 ____R (Swearware) C:\Users\Jan\Downloads\ComboFix.exe 2015-09-01 20:08 - 2015-09-01 20:08 - 00000561 _____ C:\Users\Jan\Desktop\Revo Uninstaller.lnk 2015-09-01 20:06 - 2015-09-01 20:07 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Jan\Downloads\revosetup95.exe 2015-09-01 19:54 - 2015-09-01 19:54 - 00000000 ____D C:\Users\Jan\AppData\Roaming\AVG2015 2015-09-01 19:53 - 2015-09-01 19:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2015-09-01 19:52 - 2015-09-01 19:54 - 00000000 ____D C:\ProgramData\AVG2015 2015-09-01 19:52 - 2015-09-01 19:52 - 00000000 ___HD C:\$AVG 2015-09-01 19:51 - 2015-09-01 19:51 - 00000000 ____D C:\Program Files\AVG 2015-09-01 19:47 - 2015-09-06 20:54 - 00000000 ____D C:\ProgramData\MFAData 2015-09-01 19:47 - 2015-09-01 22:14 - 00000000 ____D C:\Users\Jan\AppData\Local\Avg2015 2015-09-01 19:47 - 2015-09-01 19:47 - 00000000 ____D C:\Users\Jan\AppData\Local\MFAData 2015-09-01 19:46 - 2015-09-01 19:46 - 00000551 _____ C:\Users\Public\Desktop\AVG.lnk 2015-09-01 19:44 - 2015-09-01 19:46 - 00000000 ____D C:\ProgramData\Avg 2015-09-01 19:42 - 2015-09-01 19:54 - 00000000 ____D C:\Users\Jan\AppData\Local\AvgSetupLog 2015-09-01 19:42 - 2015-09-01 19:42 - 00000000 ____D C:\Users\Jan\AppData\Local\Avg 2015-09-01 19:41 - 2015-09-01 19:42 - 16902256 _____ (AVG Technologies) C:\Users\Jan\Downloads\avg_gsr_stb_all_ltst_94.exe 2015-09-01 13:17 - 2015-09-01 13:19 - 00056090 _____ C:\Users\Jan\Downloads\Addition.txt 2015-09-01 13:15 - 2015-09-06 21:28 - 00000000 _____ C:\Users\Jan\Downloads\FRST.txt 2015-09-01 13:14 - 2015-09-06 21:28 - 00000000 ____D C:\FRST 2015-09-01 13:13 - 2015-09-06 21:28 - 01692160 _____ (Farbar) C:\Users\Jan\Downloads\FRST.exe 2015-09-01 10:38 - 2015-09-01 10:38 - 00000000 ____D C:\ProgramData\Malwarebytes 2015-09-01 10:34 - 2015-09-01 10:37 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Jan\Downloads\mbam-setup-2.1.8.1057.exe 2015-08-29 19:24 - 2015-08-29 19:24 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2015-08-29 13:36 - 2015-09-01 16:14 - 00000000 ____D C:\Program Files\Mozilla Firefox 2015-08-29 13:05 - 2015-08-29 13:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2015-08-29 13:05 - 2015-08-29 13:05 - 00000000 ____D C:\Program Files\Skype 2015-08-29 13:05 - 2015-08-29 13:05 - 00000000 ____D C:\Program Files\Common Files\Skype 2015-08-19 11:52 - 2015-08-19 11:52 - 00250800 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdriverx.sys 2015-08-19 11:52 - 2015-08-19 11:52 - 00222640 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidshx.sys 2015-08-12 12:36 - 2015-07-22 22:54 - 12386816 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-08-12 12:36 - 2015-07-22 22:54 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2015-08-12 12:36 - 2015-07-22 22:51 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-08-12 12:36 - 2015-07-22 22:47 - 09751040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-08-12 12:36 - 2015-07-22 22:46 - 01139712 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-08-12 12:36 - 2015-07-22 22:46 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-08-12 12:36 - 2015-07-22 22:45 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-08-12 12:36 - 2015-07-22 22:45 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2015-08-12 12:36 - 2015-07-22 22:45 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2015-08-12 12:36 - 2015-07-22 22:44 - 01804288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-08-12 12:36 - 2015-07-22 22:44 - 00718336 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2015-08-12 12:36 - 2015-07-22 22:44 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-08-12 12:36 - 2015-07-22 22:44 - 00421888 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-08-12 12:36 - 2015-07-22 22:44 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2015-08-12 12:36 - 2015-07-22 22:43 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2015-08-12 12:36 - 2015-07-22 22:43 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-08-12 12:36 - 2015-07-22 22:43 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2015-08-12 12:36 - 2015-07-22 22:43 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-08-12 12:36 - 2015-07-22 22:43 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2015-08-12 12:36 - 2015-07-22 22:43 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2015-08-12 12:36 - 2015-07-22 22:43 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2015-08-12 12:36 - 2015-07-22 22:42 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll ==================== Ein Monat: Geänderte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2015-09-06 21:18 - 2014-03-01 13:49 - 03962984 _____ C:\Windows\PFRO.log 2015-09-06 21:16 - 2015-06-12 20:57 - 00001216 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-5983412-2541121911-1157762278-1000UA.job 2015-09-06 20:53 - 2008-05-07 20:04 - 00000147 _____ C:\Windows\system32\agent.log 2015-09-06 20:52 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2015-09-06 20:52 - 2006-11-02 14:47 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2015-09-06 20:52 - 2006-11-02 14:47 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2015-09-05 19:32 - 2010-03-15 14:25 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Skype 2015-09-05 19:31 - 2009-05-29 15:24 - 00001356 _____ C:\Users\Jan\AppData\Local\d3d9caps.dat 2015-09-05 19:19 - 2009-10-17 14:29 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-09-05 19:18 - 2009-10-17 14:29 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-09-05 18:59 - 2008-07-24 03:54 - 01706302 _____ C:\Windows\WindowsUpdate.log 2015-09-05 18:56 - 2008-07-24 04:12 - 00000000 _____ C:\Windows\system32\LogConfigTemp.xml 2015-09-05 18:50 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\nap 2015-09-05 18:49 - 2006-11-02 15:01 - 00032614 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2015-09-05 18:46 - 2009-03-18 17:29 - 00000000 ____D C:\ProgramData\ICQ 2015-09-05 16:31 - 2008-07-24 04:00 - 00042369 _____ C:\ProgramData\nvModes.001 2015-09-03 20:24 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Microsoft.NET 2015-09-02 19:06 - 2006-11-02 14:47 - 02310784 _____ C:\Windows\system32\FNTCACHE.DAT 2015-09-02 19:02 - 2010-08-20 17:04 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2015-09-02 17:18 - 2006-11-02 14:37 - 00000000 ____D C:\Windows\system32\XPSViewer 2015-09-02 17:15 - 2010-08-20 17:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2015-09-01 22:34 - 2006-11-02 12:33 - 00006658 _____ C:\Windows\system32\PerfStringBackup.INI 2015-09-01 20:47 - 2006-11-02 12:22 - 56360960 _____ C:\Windows\system32\config\software.bak 2015-09-01 20:47 - 2006-11-02 12:22 - 47710208 _____ C:\Windows\system32\config\COMPON~3.bak 2015-09-01 20:47 - 2006-11-02 12:22 - 27000832 _____ C:\Windows\system32\config\system.bak 2015-09-01 20:47 - 2006-11-02 12:22 - 00786432 _____ C:\Windows\system32\config\default.bak 2015-09-01 20:47 - 2006-11-02 12:22 - 00262144 _____ C:\Windows\system32\config\security.bak 2015-09-01 20:47 - 2006-11-02 12:22 - 00262144 _____ C:\Windows\system32\config\sam.bak 2015-09-01 20:09 - 2015-06-12 20:57 - 00001164 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-5983412-2541121911-1157762278-1000Core.job 2015-09-01 19:53 - 2010-12-20 18:23 - 00000000 ____D C:\Users\Jan\AppData\Roaming\TuneUp Software 2015-09-01 19:26 - 2012-01-13 11:54 - 00000000 ____D C:\ProgramData\Avira 2015-09-01 19:25 - 2010-03-16 17:04 - 00000000 ____D C:\Program Files\OpenOffice.org 3 2015-09-01 19:08 - 2009-04-10 14:27 - 00000000 ____D C:\Windows\wt 2015-08-29 19:24 - 2012-09-03 16:49 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Dropbox 2015-08-29 19:23 - 2012-05-04 09:01 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service 2015-08-29 13:06 - 2010-03-15 14:24 - 00000000 ____D C:\ProgramData\Skype 2015-08-13 15:26 - 2012-04-03 11:27 - 00778440 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2015-08-13 15:26 - 2011-05-17 22:14 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2015-08-13 15:15 - 2013-02-13 01:46 - 00002425 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk ==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ======= 2009-05-28 18:45 - 2011-01-23 11:44 - 0002299 _____ () C:\Users\Jan\AppData\Roaming\acervcmtmp.ini 2009-05-29 15:24 - 2015-09-05 19:31 - 0001356 _____ () C:\Users\Jan\AppData\Local\d3d9caps.dat 2009-03-21 13:58 - 2015-03-08 11:19 - 0039424 _____ () C:\Users\Jan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2012-03-04 20:13 - 2014-06-15 16:56 - 0004096 ____H () C:\Users\Jan\AppData\Local\keyfile3.drm 2015-07-16 14:10 - 2015-07-16 14:10 - 0000873 _____ () C:\Users\Jan\AppData\Local\recently-used.xbel 2008-07-24 04:00 - 2015-09-05 16:31 - 0042369 _____ () C:\ProgramData\nvModes.001 2008-07-24 04:00 - 2010-10-01 13:14 - 0042369 _____ () C:\ProgramData\nvModes.dat Einige Dateien in TEMP: ==================== C:\Users\Jan\AppData\Local\temp\RtkBtMnt.exe ==================== Bamital & volsnap ================= (Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.) C:\Windows\explorer.exe => Datei ist digital signiert C:\Windows\system32\winlogon.exe => Datei ist digital signiert C:\Windows\system32\wininit.exe => Datei ist digital signiert C:\Windows\system32\svchost.exe => Datei ist digital signiert C:\Windows\system32\services.exe => Datei ist digital signiert C:\Windows\system32\User32.dll => Datei ist digital signiert C:\Windows\system32\userinit.exe => Datei ist digital signiert C:\Windows\system32\rpcss.dll => Datei ist digital signiert C:\Windows\system32\dnsapi.dll => Datei ist digital signiert C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert LastRegBack: 2015-09-06 21:15 ==================== Ende vom FRST.txt ============================ |
|
dann auf 
und dann auf 
. 
WARNUNG an die MITLESER: 
Linear-Darstellung
